8931acd76f2f61c5b4a94b45f5fb30b646d979dddc11c1b1e1ea0ccd96a39be4

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 08:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_178664e537370661665f103cd7510dc6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 4.2MB
Sample260804-j4w6ksvcpg
SHA256 8931acd76f2f61c5b4a94b45f5fb30b646d979dddc11c1b1e1ea0ccd96a39be4
MD5 178664e537370661665f103cd7510dc6
SHA1 493f2df84ed2146ec419575e9efeb9ea44262856
SHA512 876bc40cc823e140627b6ca847c31fe9d01c8c78121946fbb5c400c39e6279167aa1a3268253fc1d49bd6a0f7ec1670f690654aef9d6505ce9b234bfd8e3e4bb
SSDEEP 49152:skh6fN1NMW4C1Cmm17DZrXkgs+9qPTGSrE+QjhlPWM2ODcLVz3R3/ThSNJgFIDRs:yNnwuTZQjCOWTUf
TLSH
T117167B07E6B940E5C0BBD1398A56960BFAB1780A8731A7CB4791475B5F237F0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2472	elevation_service.exe
5040	elevation_service.exe
5280	maintenanceservice.exe
2848	OSE.EXE
5048	PerceptionSimulationService.exe
2320	perfhost.exe
4968	ReFsDedupSvc.exe
5680	SensorDataService.exe
4540	ssh-agent.exe
2228	AgentService.exe
3728	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-04_178664e537370661665f103cd7510dc6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-04_178664e537370661665f103cd7510dc6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_178664e537370661665f103cd7510dc6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_178664e537370661665f103cd7510dc6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_178664e537370661665f103cd7510dc6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_178664e537370661665f103cd7510dc6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d5193458238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_178664e537370661665f103cd7510dc6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002338c581e923dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f1c6c81e923dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006711ad81e923dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2472	elevation_service.exe
2472	elevation_service.exe
2472	elevation_service.exe
2472	elevation_service.exe
2472	elevation_service.exe
2472	elevation_service.exe
2472	elevation_service.exe
5040	elevation_service.exe
5040	elevation_service.exe
5040	elevation_service.exe
5040	elevation_service.exe
5040	elevation_service.exe
5040	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4128	2026-08-04_178664e537370661665f103cd7510dc6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	2472	elevation_service.exe
Token: SeBackupPrivilege	4968	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4968	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4968	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4968	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4968	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4968	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4968	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4968	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4968	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4968	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2228	AgentService.exe
Token: 33	3728	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3728	SearchIndexer.exe
Token: SeDebugPrivilege	2472	elevation_service.exe
Token: SeDebugPrivilege	5040	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 6132	4128	2026-08-04_178664e537370661665f103cd7510dc6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe	90
PID 3728 wrote to memory of 4200	3728	SearchIndexer.exe	102
PID 3728 wrote to memory of 1108	3728	SearchIndexer.exe	103
PID 3728 wrote to memory of 4712	3728	SearchIndexer.exe	104
PID 3728 wrote to memory of 124	3728	SearchIndexer.exe	105
PID 3728 wrote to memory of 3604	3728	SearchIndexer.exe	107
PID 3728 wrote to memory of 4320	3728	SearchIndexer.exe	108
PID 3728 wrote to memory of 2052	3728	SearchIndexer.exe	109

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-08-04_178664e537370661665f103cd7510dc6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_178664e537370661665f103cd7510dc6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_178664e537370661665f103cd7510dc6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4128
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4128" "1444" "1316" "1432" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:6132

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2472

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5040

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5280

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2848

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5048

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2320

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4968

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5680

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4540

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2228

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4200
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2328 1784 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4712
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1752 1716 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:124
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3604
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2328 1784 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4320
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1752 1716 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 841064a2acdb44a8a3357046d11d6cb8383b3e21a11564a5f6280b138ddfa022
MD5 39e4ba49ef87150539e5d28b314f2c9e
SHA1 8e46867c48b883a95c418cccb7dab6af6131f765
SHA512 eaa70fa7069ded55b58b6c1f239cc9e95bf2e60249f9c5ecb83623383c2740298964d7b67cfbd3fa45dd5eea6315924a05649fcb749b743c23d3521bdcb66ff9
SSDEEP 49152:sb+632BuPkFKRrdE6ohvstBhuXjfS4LWxntgFIDRRAubt5M:W3q6sjBNUf
TLSH
T1C7D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 ba562410f8e2092f696fa12b0e3ba66b087b2c1295ef094db6f53f51c114f495
MD5 a67e0ee8f4e88a183554b4bb7065db2c
SHA1 54b910cfab401b896be42d9baf8831f10ae6683a
SHA512 6ec35784c6652330cdb6703dc053e03d76e859d219c738f7f006a37cb3cc061b6b6f2bb64e51deb6f4f2b22fc8f583f113ad5d0789e1f755fd822be5bb69d84f
SSDEEP 24576:pXYfDtczAzVg9N9JMlDlfjRiVuVsWt5MJMs:MtcegFIDRRAubt5M
TLSH
T1AF85F12873D509F9EC678279C9B28501DB33785547A0E78B03F089665F732D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 efd02816cb921b59d98c0886f6c5e8a465f678ea0463e7a70fd6530636cfc31e
MD5 03cf3654cacf454ff451daa4a6cb60d9
SHA1 1685935c76668be28798e3714d66e6445097c8bb
SHA512 be32ca0f82da53f487796cbaf9ea655d05dcf92b7b6c6eb90c23b0bb078518e0d8afd27c8cab2abdbdc0151b0282babdbaf87a9f527c09e499317d081dcf373b
SSDEEP 24576:m0Le5ji0hmx7rM0Vg9N9JMlDlfjRiVuVsWt5MJMs:mPji0A53gFIDRRAubt5M
TLSH
T19A959E26F6748375D073C0B9C5D2A68EEE72308617308ACB4296C77C7E676E6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 26c1e27c082510f4d913dbce0f8cab13ad5747651c5e802462599ef37228a898
MD5 3f97cb17324791e4a65ffbe1103a0731
SHA1 46a19010aec25fafdbc693548659fab28fe3dbec
SHA512 2854df399d0a0bfce7d219f6e1d65b887e00096ac14e2619f1df370027e60cacf29c368f6b151a724bcfb493cf14ccdaa10f1f98fe983244303485a35b741d85
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWn6q8wyuCVg9N9JMlDlfjRiVuVsWt5MJMs:o/ezSC6vUzPveHjyDgFIDRRAubt5M
TLSH
T118755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 fa73baf55c3d05593516261947299c87a84b9dac04a805c512df934110d809d3
MD5 d1f1b5fee188d121a9d1b2d1517eab1b
SHA1 369ee21e2fbd69a85f4677922565fc8e44dab0f3
SHA512 705a95a6d8e8085a569b6f500f9a71dad98ad7a586d68b82d1b169a74fbc9ebf3db86dcc1cd50cee6d651e442e91d064367d95db9768f2918f027413e318d378
SSDEEP 24576:jVbqPb88hv/l+YHVg9N9JMlDlfjRiVuVsWt5MJMs:jVO88hXl+WgFIDRRAubt5M
TLSH
T1B4559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 30355c384642fa14d01d5012146e0bb06cf176178feab16276bff442bef7bca5
MD5 eb58f18b73fe8a348eead5c46d6ac9a4
SHA1 565f255160bbd25d2e6fd0c422251cca5f972cde
SHA512 82c1cfab57e8c5c79fade4ced348b9fad9bbcd8ebd63a10c2c9aa4ab7f486f36672ae6c86167ead095c6133995028a9e9608c4ed1d0dcc59184865c758a9498e
SSDEEP 12288:D9EV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:D94Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1E96523AA7645A5F6C65B82B1CA735389CF235E5836C58547C2B01AD1C9FC1A2EC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 c04038220bbd8b66034e6c6c59bd9028349feea1b8c29c53be03da45269335d0
MD5 71d79ada1836e714b9adea1fcd3faa02
SHA1 f9c4e642664e53b15edea503ed154057d79e8a9f
SHA512 de6bcf501080bfcf705cdea89c4f85f5552ba41588675ab95b4b3e3db07d21805aa3e8208a3ff356a0a8d69082c872dcec9452a0f44be5b4dad421653b852e23
SSDEEP 12288:MeBNUbTVO86UNV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:MJIU/Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T19885CF7BAE28FCE2C27E8DB99A918340D77278304B5293CBD174824EDE235E15D7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a99ee174f82bd60ae4e185104410654be0fcafff57fbe3e32de1fd2849c1bce7
MD5 a7a56776078dfaa834cf68c4ae65e47d
SHA1 2e872708e225e079b46fd8e1dc0c1430867bedab
SHA512 33c42c75f6b32fdf626e80aa596fd085d4d5836bbf810500e6852fbfecbedf1d4bcfc8d3b3702c0e165922060a72b9f5edb59ac9e3a8e586f76f8dad5d0e1138
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THq:TQvGAdlCEL8c/DRNw5C/Uf
TLSH
T1A8267C656BF880F5E0A7E174C97A86B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 5137da1cdda0d436189ea05e8160e580d8f9583c84e4ac26348be06155d0a760
MD5 43dee26877220f99b204f2553bcdcb8d
SHA1 56532126395e10b4ec7c5f836e313565348efba2
SHA512 1709995847c01bd4917a71638a786c2c04bd4d9da9a6e8383086210042b26a3d02f54dc6a361fee86fdef500f72549ed75d3de8900b3a76be1d4a5bae7be8a14
SSDEEP 24576:YSewsAjtVg9N9JMlDlfjRiVuVsWt5MJMs:vljHgFIDRRAubt5M
TLSH
T1F585E031FA74E036C27B0DB25B36C706583D7A204B911AC3E3B84E9E99742D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 262a3b81e89a7f9cd69907adb219cf966fcda52423fafcb3d0944e6255fd28b9
MD5 169f0a445a65b28337114f4cb164a8db
SHA1 17b209c7a3f156ce68bc4bebda0c9c3c0611c3a2
SHA512 1d065d967a5461889eaa2701a8ecf02feed64dc437d2e7ce58b37f129aba717b1247a5ae94593d7a19d448b227030c13be23b064fe467be24f319b5708105ddc
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHoUf:MUEtQevvqc2W1cpV2tI32oUf
TLSH
T102474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 bb3f3339b6ea3d1f6a00ba224a96523ea4251495639f431888c502042e0e0eb5
MD5 a29a9902a56275ce4f51254a38603ad4
SHA1 ef0a7f9006b0287c167e332ebdd85676611aff1f
SHA512 879c27563e333dfe9a62f20d013f512d8a824a8930e92352d81da0a97a6ee77160fa0b146661ae41d40f1a4d36d3a7f99ba6352456f74ab76a1c6ba56b7d9adc
SSDEEP 49152:8CbRquA/m2yL5zQfFiV+XenmE3/zngFIDRRAubt5M:1oqtVjnmDUf
TLSH
T1C9D58D1976B8C2E4D1F6C37886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 16312cdd6ac417ac0a176b5784cfb96cbb03584f87139ab75f7d2096c1538298
MD5 ff6bf82e28dfad0c0ae66739965cf59f
SHA1 c9de584eae5748bb0c59b0c9877d928235bc4d36
SHA512 f943d9f4799cced2e1f44f447f2c832f1b3fdc08e74ba847ad9e6ef1e22e6b8692570f4527f6135742f4dd6b88728f035d4af2cbaaac6424df4d0dcbd3ed69dc
SSDEEP 24576:OAhGL3IFoiwtA5l7S53eVg9N9JMlDlfjRiVuVsWt5MJMs:OAMUFoiq5KgFIDRRAubt5M
TLSH
T1F835AE81E7F955D4F5B3AAB899B68171EA76BCA95E31C20F2160C11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 b08f9b6e949d48f912660db7d42c9081fd1158c9959ab3d02080b1a10ae390fd
MD5 3c79e17e32b3659d5f80415f524ff2d0
SHA1 c558ab297fa573c3ad78f803fa2211506ce96eff
SHA512 cea722cc9f8cb97af6c1f7b9bbef4c011452bbf07de8d6a44f08e3d9c806248fa965d3a4f3f8ff6c6b1f129696ffdecc225d9ed63e23468cbfd20988c39fd18a
SSDEEP 24576:HwuWOWZVg9N9JMlDlfjRiVuVsWt5MJMs:HwZOGgFIDRRAubt5M
TLSH
T15D85F14A32A40CF9E9678239C553C136EBB3B8013A61C71F43B0C65B5F77261AD2EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 c4833a824fb476862439ee4a8cdcab34445abd5bb301b67e3be3ba0dce389c7c
MD5 5e5a6599137ca93290a1c0573ffb8735
SHA1 c25b060cfafef3033b00cc6c1ce630c7c4379b3d
SHA512 627b082e2364dbfd341db92c8bb7efa754eb974bca38fde00677f860ce9620643b1730d3af16c343844dd679914186ab1d0df233f1e29bd2515c6d4867faf7cf
SSDEEP 12288:z0Z1IyPV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:IZusVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1FF7512AA33D460F6D1A78278C9F24345CB72785633B283CF427006A65FB66D25D3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 adffdbdf28e1b5a490ed4b57500a5b5de45e5f7604cbfc318d6ea45b3e865a50
MD5 8337f00504bf6ac2daad6daf4d593611
SHA1 a7a13cc7990275fecb35337a6afb4a125626882c
SHA512 a298a511685e5ddaa2db1e12aad45d92a5e4aa9b506a089cdd6cd045d06b37d9f6e4a6ace57a38414c85692789982a7e76f429dd83c54fde4c74bb61fdc102f8
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U+:oQRQyi36YOcPbLvw2gAf+PN3+Uf
TLSH
T186667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fb7313366f6d0a56193be7ae83ec5e28780238dcc6f96e6367d697168bece734
MD5 2c71a9d9fc1c73de1ceeef36be69396d
SHA1 cb21375f94f95e0efa01dbee9c8e54c4dd25a7e5
SHA512 09136fc6012e5f53ad75ce8d8696a1744064ff41c1532f688e0c87469c763730e32ccefd9cae002e740efe5fb6c941614bccaf71b35ac1510d09e00d2e919585
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U+:fQRQyi36YOcPbLvw2gAf+PN3+Uf
TLSH
T180667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a85e9ec3dc52af0f4f860a8ed303048062cd4a2f785f4b8c2c412e24e7791d77
MD5 e6eba9188b68056e92ae53677e0092dd
SHA1 0ca531fc70c2a0304469d7f196d4ae58027a5da0
SHA512 ae867a05a542569dd1f5a1b96bc2db1f48368e0df3347cbb2e2c21fd92122d8537bcffb09b5b484ce3ea066cbf37c49fdd3fa64be09ee56c67f7c87dda6d75e8
SSDEEP 49152:z68Qg55nhceWu7PNU3/3gFIDRRAubt5M:tthLRc/QUf
TLSH
T12FB54933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ddc83f452d58e9091c036297ba5f60d550aab0b18e1be4f528a34c9c3fb0ef2b
MD5 584ce9cfed2f348d416408d53e67ca04
SHA1 f753dc170b8be467a239fc92278e49e24533bb01
SHA512 610e6cb3b2a3148098c5f4895f2f8e4584f169948a2de77a966bcd104a329d72256e45f514d44965465858071e2a0824ca9723f231e96ad0bf76037699082004
SSDEEP 49152:r3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk998:uy5112gYy5azzVvt69nLKnhZVUf
TLSH
T184167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a3a509a406ccdce9f50ab1cafaaeee811e68d2872fde6a4fed583401c8373a12
MD5 a77228382600265af2c14a8dc185b97c
SHA1 3a05e89ad78902058a4adf89ba244a380b5721b1
SHA512 42842b854efc071e20620502247752a3897ff8fad372c3836bf186d20cf61da0da76991dfae439b24613fa6fbf5aa4c85674254e9e27bbc4d0f69bd261291325
SSDEEP 49152:PB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glsgFIDRRAubt5M:xu6Jmdxd2dhUf
TLSH
T1E9D5AD13F1DA01E8D06ED078974A9233EA62BC490B35B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fde372641aff61d205545f5763b5f9798a94c12774dbd100fec68630f95ee3ae
MD5 60a1fb6c9b2560dcb09b6e1387169b14
SHA1 03e5e2fdee850cc53241c80878261abe9a8475a9
SHA512 2ac9d6a715a1734d27ba0f03942555553c0cbc94a2e1bb923b78078e02f560fb4b39b59bbc032e3b300dabbc685c619b132610ee05f4c2e856d59c740c1f6d98
SSDEEP 49152:b1hpsNoJpF1A63U44CwH7R4xNgFIDRRAubt5M:bmifPWRDUf
TLSH
T136B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BAE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a0a9953c59252f158d948b0f857fa123e3fc8f6d29ec0d00678429191773e71b
MD5 be3f6bf109ffc1d8c058b970c5c16c8c
SHA1 4396dadb2ed525265125a39f36f18ccba6403f2b
SHA512 4aba041be1659d604a4f81872e87700a24ed1ad56b9f657c86078a3ea9fa96e795bdd659ca73d4bf50e9f3c5f77cbc72979c5c500dc7c73241f7b2b3eb700fdc
SSDEEP 49152:0SuZQIY0Be2KcRVtOnks6NMHqMgFIDRRAubt5M:m5dKii61BUf
TLSH
T199C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77EE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 dc041706289146a8aa33d5dd391c6b91d8becda4447c834d1e9b96eea24a3b31
MD5 0d3c1e1e1b1b841e52b44b2c1827b153
SHA1 05380bcfd861e737826aeed2bd5426af5901b9ca
SHA512 bdec1cc9b34c5ba80d8aece671cc4405c488e6e276ec22b2253d8654b97bc7637a1f0e028dfa8cac755929a681a1255f3cd1d4e42954908a2938c927af316655
SSDEEP 49152:ehtSn8EApI0fig3giDn0AP5whgFIDRRAubt5M:/X2imphHUf
TLSH
T1CC95BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 7792f613125f5ef7172306677aae4989b9813f06339d2ef721f81144f9b23fe3
MD5 df70c8c0ce930ff2ae4572aea93a38c2
SHA1 e46621ce8b93100aebdc6aa97553dc6e88ef485a
SHA512 0da1acbf164775cde8b3f86108aefe8c4eada30e30372a3c82648908ca85c95d474bcb80d8cd8abb79c1ac9801d3694f70094c9f0ee40e438bacbfbf95b71a4e
SSDEEP 12288:WMV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:WwVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T17F6523AE758695F7C507C2B1C9735389CF262B5E72D64147D2B00591DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 fe91cb7f49e6045991232d1705207c5a57e60d5bd96c9903f4c752f0fc451034
MD5 6bafa65f536bb1f0fddabdbdf2b8978a
SHA1 000c7bb5775eb9d39a37f80bd814cfa5251dced8
SHA512 ac0e9cd0ca8069168e05a219facb7b232edb684502057b8a8d8a00433962c7b55fe38c0db0b8c624bfcac3be48258be5c510eb52715d52fd022efda121d571c0
SSDEEP 12288:SLV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:SBVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T19F6523AA758655F7C50BC2B1CA735389CF262B5E72D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 2d3b4ea81a6cda37cd488d1ff139a04627a45705558cd967bf3387f6400dc16e
MD5 55d476b8a8dcd12d6cba00948cf4e50a
SHA1 364b574f738faee32353adbc51f0a297451c56ce
SHA512 1d031bae1ea3decc72e44070c115c92e571e59f8d27acb3cfaa5c72f01faf56c3eb8d17b0f36ecd092e53ac5018ccc4676f7a92bf507aa5b28206905ed06628d
SSDEEP 12288:L1V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:L3Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1F56523AE758695F7C50BC2B1CA735389CF221B5E76D68147D2B00491DAF81A1AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 976df494b255dda8c60cb8ef25b2c3565fc4d0c24d34c2558b8058b3fe6b17ca
MD5 683ab4876f37c7cd46bdba068607ccc6
SHA1 1154a10897e8029350a3c965f8f0aae4a56d6159
SHA512 0ad991d2a4cbcf7318fa21a1dd85b3378333e2a84a6ccc9de0abc75931eeb36e2f11b2b9ff179910ff82779992399b6d2596a30d5954f8ecfab00aa0372ca140
SSDEEP 12288:9V+V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:WVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T18065236A369651F7C457C2B1C9734345CB727E9973A2828FD27009958EF43A1AC2AFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 adee82e224c8d9320386e382c09e674f48101e40aa8c9a1070b7ab5c820847de
MD5 cb18d37d48f356256849ef22e7f97a1b
SHA1 2dc68c42954ac984cafe622790c04aec36de7e4d
SHA512 e2b3b8dec1e277656b5abc984dee659f3730a325bd11b72e01ea0b5176924d19fff334be59269db15dd9598a98c3e6ebe189f624de61c8dff87ba33b6d8b855f
SSDEEP 12288:f2V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:fmVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1F06523AA758695F7C50BC2B1CA735389CF261B5E76D68147D2B00491DAF81A1AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 4fb5f4d8215205460dd2b36aab0770ea80473a986b254c8e4ea39c40622dd8f0
MD5 179f56e4529f0e1d62976fb570e7a777
SHA1 21980f9d4790f71bb6201610dd97e9fb44daf092
SHA512 383cc5a149ec89af2c26acf6455c51218d1dbb2921ee4c8f2e7414af22eb3b5fcd94b914794300fc9b42bf29d358b198b1e522fc8962a2383296b404539697b2
SSDEEP 12288:iHV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:ilVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1B86523AA758655F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 638abb81011208a0e1caa1d99160198bec49c633460f5bc4a7f0bb58e0912156
MD5 76a92b9a8f781a9ee20afaa7cea4123f
SHA1 fec6ea84cd6ed82a071d4d44f5bdbb427d1c0f4b
SHA512 4c831bb1e86cbeab67a1a0675103e63c16db6308f5865a12b56ddc663d0ca54dbe4f47407deffeef978e4dd90c86c3d31c02eb97216b6d04fac170c7d240c19a
SSDEEP 12288:2jV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:2JVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1366523AE758659F7C50BC2B1CA725389CF262B5E76D68147D2B00491DAF81A1AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 334c98a7ca0d46770faa15149228321aa3c5dc740dd5212734b12d2fc942e6b7
MD5 f15e7c0f10a90cd776898167df0690c8
SHA1 5bfc2b2d81edfc826202f932113db2382ad13a36
SHA512 e6b6377858a6ce397dade338e9f85920cdf2767966bb8dc8c522afffcf2c3195c96c7dd18eebfe7e20d479d097b7a94fa61637ad29854796fc2454b209092483
SSDEEP 24576:XZMrzFVSOhVg9N9JMlDlfjRiVuVsWt5MJMs:XZMrzfPgFIDRRAubt5M
TLSH
T1FC8501A9739018F9DC67823EC9228906C6B27C5A17A0C60F03F436675F773A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 c20fca734c729a07705c5892e3aa145d2326d88f27f4b1b3d7ea40f9b61be41d
MD5 31d344741f7364ca93ab3d3b73edaa78
SHA1 7c5a557f4ab84bdfc62edf2b4031c79db1cea4c3
SHA512 0ab67bca5cb1bcbe7dae421362b3ed46b3bf58a632a1448005ea8b180430d0d7162f689ecaf11b70669dfe007a6add58e11419fd6d3e8991b99fa76c8aa8abde
SSDEEP 12288:lwV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:l8Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1506523AE758655F7C50B82B1CA735389CF262B5E72D68147D2B00591DAFC1A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 887a75fc152ea02d51d553a98fc89596bf768f928035fd9cc55bc0ee1ca737b3
MD5 a4a493ad039f39a0bed634baee535d84
SHA1 8203ff786d74e8604a494816e38483e3db178ab1
SHA512 8b8ede4098d308c87e43d117ed0dd4357c1353798c3548846d0561541fa4f449cc4299ea55456b3969f81fc9f05aa8828211741a8b796bbf5b4a80884a7e53bf
SSDEEP 12288:v0V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:vIVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1DF6523AE758655F7C50BC2B1CA735389CF262B5E72C68147D2B00591DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 d5343bc4c4032349c95400cc45838e19e382a6191a3cd34edf41950c158c9422
MD5 b1bd6cd5b50a197298bbb726867b378c
SHA1 5f84601e4bf2c73d8a8064f295b276e792775f29
SHA512 f92a8514dc95211d6ce249ee0870cf0b1ecde8bb1f6912521104ac89e187df10ab617a99400d8b130294b204720c02e55b2a8e5627ff1b8acf5c88339765b1c6
SSDEEP 12288:8yPz5L8PV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:lzy9Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1EF75125B73A130F9C1278275C9621A02E772783617608A9F53B007B65F772E1AD3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 3fbff28c9a25c7181c1fcf28041c78e4ea37b0c406b8fe1bcd0649994c8bf971
MD5 bd22145852eae4075d784c07646b65d1
SHA1 ecf173d5bceb0f5ae130e82f6a347ab5b2fa0434
SHA512 c4272b1f6113f4e18227408b42c35f26beff8d95d92bece802576149a65bab3e167e059376105d288f5cf409e22c15035e66563039c26ffb398c0e80759ce340
SSDEEP 12288:cwV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:c8Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1266523AE754655F7C50B82B1CA735389CF262B5E72D68147D2B00991DAFC1A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 00058c8c07e36ddf284ab3e7e8792d7765ac46681961191afd91a7cdcd679fcc
MD5 8dd68cb857f092fa5a2d1f6034c1d807
SHA1 88fda15917c175be7efd6790f3ac70f3d4122257
SHA512 3d5fef65b452d619ccb5c56434ebe04dcccce1d3773a549768caf608b9fd72589f345ee9fdf4c9439b5fe7f134241859b7d179d93f860018169ef4452a761a1c
SSDEEP 12288:rwV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:r8Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1AF6523AE758655F7C50B82B1CA735389CF262B5E72D68147D2B00591DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 36095e4c516b34011f458cda165f55e11ebca11062a4a5dcb88bd345525a269d
MD5 f297f9cf18b9c7252c0436c3b96629b9
SHA1 d608688c49290139e1f984c1db82746f8fe06898
SHA512 74f70338f071ca3aa81ea6a2aa3c30300f269576a3fb95d1b7e4e49d40c45b6e6f252f176dc54921668be4dd58577eac15a5d4bd642591430e9320dec03a2f36
SSDEEP 12288:gyPz5L8PV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:Rzy9Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T10E75125B73A130F9C1278275C9621A02E772783617608A9F53B007B65F772E1AD3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 0c831c97516f52f29f97c8ee6eddf18dcd19179d0f35a286303960c96960a9b9
MD5 d8c558d1ad5d6e778e8ba6ea7d021429
SHA1 69f427dc4bd39b3f1222cbdd0387f8a8d5e2fccd
SHA512 101d6109bb0b187869c35f42866e5e8bf7527a5243f03da4d6da039fa212273fd3fad0d044e34fefaefa3ca743bb36885912304d6a1357d564109016358c4ae2
SSDEEP 24576:KTxaLl3z0zDnVg9N9JMlDlfjRiVuVsWt5MJMs:KTsLljugFIDRRAubt5M
TLSH
T1F88501A9B35018F9DC67823ACD628906C7B27C5A17A0C61F03F436665F733A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 35c1b1a0bb1b76f22f06011a7e0f790acfe412968b988551da8e62c9d6dd76c9
MD5 7ca67f125aac7a50ca2c672520edef35
SHA1 10e5ac28bfe878e479cef43ade011bde9d1fab5c
SHA512 4f82d5af12b660630485e8e76c4a7d38770e10bcde0c6d791391618aeaf85a15ca4a995598b0a1c117b1d5d3bba6f4ece883f18a6525c9f6035d5cda6b6fb9f5
SSDEEP 24576:U3Zd9CHKy7GZrVg9N9JMlDlfjRiVuVsWt5MJMs:eZd9CHKyaPgFIDRRAubt5M
TLSH
T10695CF90F3E414E9F0B7DA35C9725602CA767C9A1B71DA8F03A4265A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 2cf088fd67ecd3c293b192781d8e58d73147b3f800f5d0cf4dd45e2c27580c18
MD5 2de8c549e5ae0befc9c8c94fec31bc78
SHA1 bc20e11dc0d4dd2038ed303420d35e69501b6953
SHA512 e5ba530eb9d3852ecb89d5cc2fb835b70bbf31c6c32dc3c54da535bb722e0f56564ee2337a1c65a882a831f02c9e001b7e3fad64ef86c1c8f9e7642efed958f0
SSDEEP 12288:yVV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:yXVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1166523AA758695F7C50BC2B1CA735389CF261B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 dd07d49ec79b8ef959701b7b5a2ca9afc1258a181ab00aac1893391129a2b4ab
MD5 3b9442b02ab41a4d3d18ec8c84f0f98f
SHA1 dbf6dc53e91a690ee8112d1c7c2d3b8ecfb40ce4
SHA512 227b366637bd68ab819e409da1724787568ed2cd54839865823d7c77597f04e76c26bad49637dad3b0f1393c9ea77ff0b70302997481322d9bb2f33c99e064a5
SSDEEP 12288:SvV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:SdVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1816523AE759655F7C51BC2B1CA734385CF262B5E72D68147D2B008919AFC1A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 057d0e40df4789fec45c30b0c0cebea0aff0a581c88e0b553c17aa5b18126c8a
MD5 ab6f4f4882b473b2f7900698e52a40d8
SHA1 f101a55835eed746c59f0962b09e647dba302488
SHA512 a7623507bea0645c7b6a34685b7d207873c90fcb2ff02421ed6a374f035e0e7ceb4d0aa7fa42eed136da5d7ec61eaef05dbdcc67eecb1384712f7cc2553ed003
SSDEEP 12288:GyV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:GqVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1326523AA754655F7C50BC2B1CA735389CF262B5E72D68147D2B00991DAFC1A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 c0403352223ad1c0d5190dd9807f620485a765fc859e448457565808a5e277bc
MD5 f14e1d4de3aef9e286fc23d4da4deaee
SHA1 a6e689bb65ba592e9c46016c3616363f2030fcc5
SHA512 d19f85718c926339b3a9d51c1d995da7e2cf5a7fe033faa37da7c811864234047b31362b08a2cc3c9f3f997b71b530c9c80a56d25a979b580960ddfae496f5df
SSDEEP 12288:hwV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:h8Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1DD6523AE758655F7C50BC2B1CA735389CF262B5E72D68147D2B00591DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 5a910761867cf5750cef231356fa66f7e4bf3320f58ac3adb247a4067f918489
MD5 0727fe927dbd57ac6d562e3e800b206d
SHA1 0928fc2011723fd4f3fe7ca66ce71ecfa6ad4834
SHA512 1e332d9c159660df30523fa7d98dd4873acaf3a775039dd77c3be70b8c44637e089829d99c5617c7a9feaed4d4f053ffaea0b94d81b957ec51deef0edcb74a2c
SSDEEP 12288:zVV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:zXVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1EE6523AA754695F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 d8e70f6a007c395aeed9510257d80e9dd90d19e60ff726fc21c37e0be9c807ab
MD5 8fd5c70f671d88c7e98ba1034969f198
SHA1 c1629c54045a5d3d342e5d082a2b4ac427a9ceb3
SHA512 31b3688d9d5f92b3af0bbca8cdf98be5f4933a96ada7979fd2a45bccbcb4bafc48c150b680bfe899c505ef2522ca330aef776c826d835d6141ef22e0280a5577
SSDEEP 12288:DIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:DkVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1496523AE754655F7C50BC2B1CA735385CF262B5E72D68147D2B00591DAF81A2A80FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 cfbd0194e71f74ccd6f1188820fc3a3dfd34a28e343bf4ec00cd0207f1e3ae84
MD5 fd0d7d3e348764ba2275bfeb316a1eb8
SHA1 d50bcea52846a628953cfba84f2597dec4c35a0a
SHA512 92df7cb5bb0bbe4519022a804347d61f213100e67abfb7734ef1239a602f2cd25bcd0c8304374d44c9ae4e654b68c1a9e2b4d40cd632b6f2a01aaf94175b40a6
SSDEEP 12288:d2V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:dmVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1F46523AA758695F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAFC1A1AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 36ed6755e563b2dc5603fe54ba58e30c382aa4f6cc3193f8fdcbc7186b534cb5
MD5 83cc1dd99ab8610255fcddee20f972c3
SHA1 793bc0da9d4aa0aedd40e3aadb142ec45cfadb89
SHA512 a6d477f82c739562b4b26b9a2f1403aa259ab91f59008477d6137dbae5d8290964e8f8273afc23313e82a74018918de42613429dc8ff21f1a29e6568ab74ed73
SSDEEP 24576:ufwv2k9RX6wkyAIYVg9N9JMlDlfjRiVuVsWt5MJMs:UMnYIogFIDRRAubt5M
TLSH
T17895DF29EBD844E5E177923CC9B3460AF6B178591B71C2CF02AA53AD0E37ED06D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 013432d560ca1c5d705a9c11397c01d169116662df956cb57390ad55576c6dc8
MD5 b179b9688d95c678233c9c0c6771cdf4
SHA1 6f2ad6939c023e45ed8c6ea3bc5dbc5cae5200c6
SHA512 0b88c114f70fc3742f7e6d414c725fa672a209078c4de621d87b0454fb1f299596f67fec8b2bd4ad9fae4aa8bba46cac9ce4cc4a100909614d775f52791a4804
SSDEEP 49152:MYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0BgFIDRRAubt5M:rySzPeUf
TLSH
T156066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7b41c88e180ec6c20e15b4255a1502109a61291cab1e17a2dd2b9b4f04187a8a
MD5 1dd83b0784a8587f4a86f8e729a1c1a7
SHA1 f5cc89869dbb55f5901a51f36c529a90b92a112c
SHA512 6800416c7ff46427daddb67564cb343df788741dd3369faed1c75dd992289d129851b18334f30719fec56ca672baf2110a57f31f37c7901a0a31c2593f577060
SSDEEP 24576:U47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYxVg9N9JMlDlfjRiVuVsWt5MJMs:U47JUQjTirIhCnDHUPfF/RgFIDRRAubE
TLSH
T16965AE1EA3EC01E5E1BAC27885154A5AEA71742E2B31CACF1270437D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 2542e840a37a07c738c19c4be94c209e004186e4bfd1e38f368bf63ef5fa4534
MD5 7e7c9ba8875f454b024167c7314805f5
SHA1 2683a5f1f1145716b67404cbbfffee5392d5cf99
SHA512 2e263c45711e95e1809fbc334e6adcfc06344660dc53bc6cf43d903c90c1d8c36acc121f48605a33f36e048877ba97bff0f983a7eda9cb9278e0fe09200560c9
SSDEEP 12288:tVsfAV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:WsVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T15275F15AE29402E9C06E9275C7624641F7333C2593E1D3CB92E0F57E1FB92909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 2955b9089cf842f9e3cdda20b95b84cd620296e61172adc26ade771183ef02fa
MD5 2f434ca41b8dbae77edeb2ef8fd99ae7
SHA1 eabbc402cd13ce1cd3307e665d3ce54c8b175a6e
SHA512 ae9b807a63f462e186e8f08d761ddc0ad0ca34114e96c7c76c9edb7e62d725567f82109c8b3c0c9e03beb1807d57b817c7ab29874768c1b7f350294098cd0c7e
SSDEEP 12288:52jqUay5tP/iaFYyQeE84Tq0QGQudaRbiA2JJ8dW3fdP:52XakYwEMfhCaRbxq6WPdP
TLSH
T1F6552940762BC75FC6A980365E32D1CCAB707D45EE056F0773C8873F9576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 8aefa7d7c6a04e59c2d63e1cc4a573797f4e0995d04a2318568f0b02304dd7b6
MD5 5e59bea30a99030e0c98cea1acc8671c
SHA1 65c0f3db4f48232fe196d6e945a08884d10f646a
SHA512 2f0e5e8cd86f4c8d5027322b6749cac681b451f2868bc2db53a25704c46d027f824f87d473cfa3a4ecfc957d698c29e1b0aee0278933ba6ed8c164cad39fbdbb
SSDEEP 24576:ObxyvNo+2KcWtBFO4dXHIss/Us9x6x3MB7yAv6lje+6DWIp+6P8:di+6Dd5E
TLSH
T18375E881A137A39FD1FB50320339AB4DA764EC06B7096F16B7C8053AD87AB55B0B93C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 00ecb13bdee17327beb01e6329aabf845215d5ba54b109c76bd8d26c31dcf43a
MD5 5cbdc6a6da85cbfbe73fe3a0d1314fcb
SHA1 302e041eb7867d562b0701cb446098c4603dbd5a
SHA512 7a0119fdf6ac32cb77d03ed243b04f0ebb49cc7d31a704532243719cc2915be991a9b5becba661fcfdb8fcac4985456618981f6b17796f9e2d262902c0156743
SSDEEP 12288:L+7YV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:OUVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T19965237A768999E7D46B92B0C97383058B2B7B693B8181C7E17005D199F81D1AC3BBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1e1fc63e69f74e5d3566262c10cc0b3fb50694a280f58dda0e05a66472a2d70c
MD5 b123ef94dd14e838e9ce141162012d78
SHA1 dafcc61fad2c608fd58a8c214c767d2e427c24dc
SHA512 4fd6e5b8dc71cd29275246b23c49efc0b34e337884500a300f0b6b87040d6e783b25d1c4f95ac01f2a9f1d0ec75b5aeb4855a4469e717018c4d55ac7c0a97c89
SSDEEP 24576:kgb6bmBIi49WNNFpg1rSvFv7bYCVg9N9JMlDlfjRiVuVsWt5MJMs:kgb4mBIBhGF7gFIDRRAubt5M
TLSH
T17265AE1E22EC02F5E0FAD2B8CDA64417D6B278161732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 f5f7e37afa1edd47a86e10332d2565d64995b5427f2a244b78615da00cab9d95
MD5 99f19239070a8cd5d43b063cd9da04c3
SHA1 9d0568e1eece5024e0829728756e8a4c1f5f88eb
SHA512 1b8e7b45fe26f1cfc7dab3547dcb5022ac95017d4ad04679debf9c30b4f1daa67f9478620c9e5c3088fb846e06c503d3984aaadd34e4088e46f0ec54ec2ad00b
SSDEEP 24576:ZG88u8FpJqH19zria7/mhVg9N9JMlDlfjRiVuVsWt5MJMs:M7ZFPqVka7/WgFIDRRAubt5M
TLSH
T16595F16576E101F1D47BD138CA924663F6B2B8251364EBDF07A88A511F23AE14B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 9639d56eca6434eb2644f75271b187c4a1abb44202485fdbe44b38634c3313b2
MD5 100feaf569415d38f02e951e4d4f4bc9
SHA1 8b9de47d17a6b52cbe0e861cf77c5a655b3fe92a
SHA512 c67e81a7b39f406e51f6b042f5f4e8c7ea80780744a6f57f8290f6b6d2f1013a6383846ee98da1684ce1080875d71bbdaa1008833499eee09983095ca209986a
SSDEEP 24576:EPUr+NQ1Vg9N9JMlDlfjRiVuVsWt5MJMs:EJQPgFIDRRAubt5M
TLSH
T15185F12F32A918E5E676E17DC9824709E77274621352D2CF02E0417E4F67AE8BC3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f6934e36396a55341f26bdc6580e6792e69db14dd927faee47ba75ae420e3636
MD5 45e36c65a7221917fafca50c792e3a4a
SHA1 d142eb16769365b75be6f932c6fa8dffc90f86d0
SHA512 9a484106bd64bbe53b60ecb854ba02d04557439aa372b948b8c310ae4f05a0c0a237fde2b48e0eb0918ed5ecde845f856eceb24cfa3767646c5a9caa85be94fc
SSDEEP 49152:pBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/gFIDRRAubt5M:KG05lO43bdUf
TLSH
T18AD5CF6E62EC11F9D1BBD17CCAC6460BEBB23415033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 559663987040452c5302ada7a104352a65f5a4bfe8037d4b8c464a279877d72e
MD5 d5c6c64adf3be7f1bf8aabef3213fbe0
SHA1 20f5b62c598f2366e9ac10c50b136e89afad019a
SHA512 24f6bc8440cbca86399eb9c6690efbe45b35b66354732a8e911139a18cb8db48b7f72f61a55c35c21e3c616b1c08959f06e247d8317639782b4e3bfeb7725483
SSDEEP 24576:ffa5POZ3dpuWVM50JicR2hG0lasx2+47eidnTVg9N9JMlDlfjRiVuVsWt5MJMs:na5POZ3BJt2pasx2+m3gFIDRRAubt5M
TLSH
T16565BF5EA6FC01D5D5B9D17DC583460AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4603758b329ed0c49725bfb45120b00ec30ea540ebc6e0904b8ffc4996331f72
MD5 2cf62b384762e2dc2307bc8f2a4dee18
SHA1 b6ebe22be2f691d0068a44bdd61a9166dba37d77
SHA512 6b80e08882521348170278520352b2907389edc27409d9d153a9b720afb010dba38d81c45feeed631f982c37c309e928e59f40d78bced0b9cfa504e6c8292b29
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7Fk5Vg9N9JMlDlfjRiVuVsWt5MJMs:ENc/zEOVHF2gFIDRRAubt5M
TLSH
T1AA858C2623E901E4F5BBE1BE89779546FA717869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 49e3ad0bc0bd86a7afee4e1ea10f843b872610156b629ada1d980ef88ab07ab6
MD5 6a170d16ba3be7597b0e9f552f525e8a
SHA1 4a8a2b5b3a0d44f32f4f1452e84004bc685dfae2
SHA512 3abf2fb3703b242749b1bd3c147e16e081a9a8b7e5023da0c2465a9db36f003c6c02a2d4dc3c4a82f0e6b92c4b6ce7256c541e9be523240619e2cd6a5ebdeb1d
SSDEEP 24576:QTkNvNnaFeYhJNtmZBmoVg9N9JMlDlfjRiVuVsWt5MJMs:QTMwBtOm4gFIDRRAubt5M
TLSH
T16C55AF6EB6B806E4D1FEC6B4CD238512EA727461173293CB5290C13F4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 f91a1876ec1b2869fb5d6af72b83a0cf5f40d6df2bb8f8201ffc38be56123d72
MD5 7967c12b65eed41cfb9f4cb9f45067d1
SHA1 b71aacfae974892d7b07861979d58c6e8bb5230a
SHA512 2bd82fa4746f70de16983ae2d6d4f41221d7042e9ff49899639d408d48aa685c248a29f10b75863623cf86b95aa1c29ae06ab1ac769946074cae149fdff201f6
SSDEEP 24576:6D3FHshBIYQgAQVg9N9JMlDlfjRiVuVsWt5MJMs:6DVHeBIAAAgFIDRRAubt5M
TLSH
T1CD95E17EE69C04E5D57BC1BCCA638606E77138A9032256CB02D081B65F6BEE46D3EF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2228-133-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2228-139-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2228-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2228-141-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2228-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2320-85-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2320-86-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/2320-316-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2320-91-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/2472-119-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2472-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2472-15-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2472-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2848-63-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2848-69-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2848-62-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2848-219-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3728-149-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3728-156-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3728-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3728-324-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4128-0-0x0000000140000000-0x0000000140432000-memory.dmp

Download

memory/4128-9-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4128-2-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4128-31-0x0000000140000000-0x0000000140432000-memory.dmp

Download

memory/4128-32-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4540-320-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4540-128-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4540-122-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4540-120-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4968-101-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4968-335-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4968-318-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4968-337-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4968-105-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4968-95-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5040-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5040-148-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5040-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5040-52-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5048-73-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5048-81-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5048-75-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5048-302-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5280-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5280-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5280-60-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5280-58-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5280-39-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5680-321-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5680-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5680-323-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5680-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5680-108-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5680-114-0x0000000000790000-0x00000000007F0000-memory.dmp

Download