022c108bc279e0d7b336b859f8f1139bb09486139b429ebb9e2fed5af462d82d

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_18c7b003b36b4fa2544ccc74fb5cb8d9_cobalt-strike_icedid_njrat_stealc_vidar.exe
Size 1.2MB
Sample260804-p6d1nsbc27
SHA256 022c108bc279e0d7b336b859f8f1139bb09486139b429ebb9e2fed5af462d82d
MD5 18c7b003b36b4fa2544ccc74fb5cb8d9
SHA1 79fb48ce4e7ddf6e276b91da55aaef56bf697fc3
SHA512 e19a57d525830cc009f62e2560cf0bebd65bae3d7e198259c6e40eab0e53fb4cb011b89f5b5b1eb98985faaec03db55a91062973809f7ba9e0948f04990b669d
SSDEEP 24576:93WpRwENzlNhc+mVpKdwqr2Vg9N9JMlDlfjRiVuVsWt5MJMs:aDmV06rgFIDRRAubt5M
TLSH
T134459D4663E842E4F1F3A738D972454ADB72BC515B39C6CF0264565E0E73AD08E3AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4904	elevation_service.exe
3276	elevation_service.exe
2608	maintenanceservice.exe
2964	OSE.EXE
2756	PerceptionSimulationService.exe
4864	perfhost.exe
4212	ReFsDedupSvc.exe
4168	SensorDataService.exe
1920	ssh-agent.exe
5032	AgentService.exe
2376	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_18c7b003b36b4fa2544ccc74fb5cb8d9_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8ea51ce2e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_18c7b003b36b4fa2544ccc74fb5cb8d9_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_18c7b003b36b4fa2544ccc74fb5cb8d9_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_18c7b003b36b4fa2544ccc74fb5cb8d9_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_18c7b003b36b4fa2544ccc74fb5cb8d9_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000004fea2eba1024dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000046e6d5fa1024dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000deb9fdfa1024dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000454527b91024dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001477e4bb1024dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000690b5bb91024dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4904	elevation_service.exe
4904	elevation_service.exe
4904	elevation_service.exe
4904	elevation_service.exe
4904	elevation_service.exe
4904	elevation_service.exe
4904	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5528	2026-08-03_18c7b003b36b4fa2544ccc74fb5cb8d9_cobalt-strike_icedid_njrat_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	4904	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5032	AgentService.exe
Token: SeBackupPrivilege	4212	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4212	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4212	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4212	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4212	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4212	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4212	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4212	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4212	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4212	ReFsDedupSvc.exe
Token: 33	2376	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2376	SearchIndexer.exe
Token: SeDebugPrivilege	4904	elevation_service.exe
Token: SeDebugPrivilege	3276	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5528	2026-08-03_18c7b003b36b4fa2544ccc74fb5cb8d9_cobalt-strike_icedid_njrat_stealc_vidar.exe
5528	2026-08-03_18c7b003b36b4fa2544ccc74fb5cb8d9_cobalt-strike_icedid_njrat_stealc_vidar.exe
5528	2026-08-03_18c7b003b36b4fa2544ccc74fb5cb8d9_cobalt-strike_icedid_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 4312	2376	SearchIndexer.exe	101
PID 2376 wrote to memory of 1092	2376	SearchIndexer.exe	102
PID 2376 wrote to memory of 1272	2376	SearchIndexer.exe	103
PID 2376 wrote to memory of 5340	2376	SearchIndexer.exe	104
PID 2376 wrote to memory of 3256	2376	SearchIndexer.exe	106
PID 2376 wrote to memory of 3748	2376	SearchIndexer.exe	107
PID 2376 wrote to memory of 1104	2376	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-03_18c7b003b36b4fa2544ccc74fb5cb8d9_cobalt-strike_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_18c7b003b36b4fa2544ccc74fb5cb8d9_cobalt-strike_icedid_njrat_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5528

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3276

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2608

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2964

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2756

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4864

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4212

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4168

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1920

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5032

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4312
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1092
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1576 1036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1272
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1756 1760 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5340
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1756 1760 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3748
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1576 1036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b79dfd4c6aab6ca9e3a53f763823cdc1fd1165277a1039fd42837563c11d9b03
MD5 0745d4d78ddaf4bbb04e20ac2c303096
SHA1 13a834f9d44a32aa6855fa83c42aff687f75748b
SHA512 4322c67424ad2092118c0e9b3e2be99a8fcdc4160cac2680cbf37cc4bc397606604e0628688f3cb88f366fa953f937fb9004ee4bcc9003d59ab1cfabab8778b9
SSDEEP 49152:ub+632BuPkFKRrdE6ohvstBhuXjfS4LWxnbgFIDRRAubt5M:w3q6sjBzUf
TLSH
T12FD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 ca2df0f30d914d7b93c9ee6022621a296de38c1136b25c33da322feb989abab7
MD5 1b9a1156fd2075a9feeb8b0da5b6eeec
SHA1 26c2601eda16c08d19aa67157efaa346a9b4f0ef
SHA512 fc998aa2055b07c6657a10a952ac4ec4f81edad277007cf128353328b9ab84c75355b5ea826329d3d0b4acb64465fbfe77603f01b7d51f5513ec1d295cb9948a
SSDEEP 24576:4XYfDtczASVg9N9JMlDlfjRiVuVsWt5MJMs:vtcRgFIDRRAubt5M
TLSH
T15D85F12873D508F9EC678279C9B28502DB33785547A0E78B03F489665F732D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 144c7dc55a77ab36908bdc117a67d9d3f40afd0aa94821f478a2128f374d9f48
MD5 d5fa2788f00aeb21d9da6c9aa88d8ae2
SHA1 329573364a37d9f6c11dbe2299b003315d4b93ce
SHA512 a4074ce34edcf692dcdfe919ff0ea5d0bb5d1a464de92995293c4b12790437c2580ce17f02fec79b208e4ac7fd5a2c1a98bc06f2c6ffc9787470435190ba084b
SSDEEP 24576:C0Le5ji0hmx7rM5Vg9N9JMlDlfjRiVuVsWt5MJMs:CPji0A5ogFIDRRAubt5M
TLSH
T196959E26F6748375D073C0B9C5D2A68EEE72308617308ACB4296C77C7E676E6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c2c5fe957c43ea0f367c636cfe7adacfb2be710e5de2f495a1a3aab14fa2059a
MD5 afcd3af0da893efd81b560e76e8fb1af
SHA1 78374ee45dd7f5acf89f61e6eb311cfeadad686c
SHA512 986d8f91e71ce1231d78aa43a8bcf7b6e3a7f6cdaf2baf4d9807db87db9082cbc12157c66ae3f832972cea2114956ba8eb398845856748b9e8ffd10c79c45ee4
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWn6q8wyuzVg9N9JMlDlfjRiVuVsWt5MJMs:V/ezSC6vUzPveHjysgFIDRRAubt5M
TLSH
T1FE755C25F5788323D0B2D0BAC5D6BA99FE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 dd53961f186ef2fb977cea543a5c91f4b7c8b5db7b8065814eab81a505c83f7b
MD5 64f18b0274e9d3604ed3fd225f2dc4ac
SHA1 83e243fb418273392475e85684fe1400edc45ed2
SHA512 e268d552d21afa71bb3c5b0d0b9444b9c307ecf0bc371bc0e6f3bdae33e77556a2488ee1351b3edbb1b80d9a58992115073dcedcbb4245fa8608e0dca7c52310
SSDEEP 24576:bVbqPb88hv/l+YeVg9N9JMlDlfjRiVuVsWt5MJMs:bVO88hXl+5gFIDRRAubt5M
TLSH
T17F559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 efc6e5cecf08ed539d491a40a104bee5fb75452ce9104d63130ce7a6d21ab549
MD5 4e58be28a81fe540946f495e1c18f1e7
SHA1 eb2c9c5b2666e500ab4be06ceea0dce5ae71e74a
SHA512 568d45e9c326eeb78fd3780cd77817415390186e7cf33cc3c8f74cafdfcf996620a8b5feda03fff80978d2f57dbac2d462970b945a10dd91a6f0ba89401a10c8
SSDEEP 12288:29nV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:29FVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1706523AA7645A5F6C65B82B1CA735389CF236F5835C58547C2B01AD189FC1A2EC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 d256dc9449852fbb403c1768e676013506792a0dbed872ac4c7b3f9663d9fd5e
MD5 8565000a15f7b37a3e9672e373067aa2
SHA1 451481a20ec7cadcf24b2a8780206f1a526482d7
SHA512 caf230d4b85f48a21444d848b87ed9a2c7c6af68674f176aa88189353fd9fa2af53291ce66b52a22b2eec3006dab9b0e1498b3b3c9b00580a0fa3fea8f315185
SSDEEP 12288:IeBNUbTVO86U2V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:IJIUmVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T14785CF7BAE28FCE2C27E8DB89A918340D77278304B5293CBD174824EDE235E15D7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c8710d45d09b8f4b954f35553189441f2cde0883d3f6cae2d8fbe62ca61053d1
MD5 e19287d05bf9c3bd6d61a3737eca2cab
SHA1 9fa91ea4f03a26965f66c6a675ce14711a77ecfa
SHA512 8e19aece943525ec45f87ecf4b1723f6e7fe58e5fa4436eafc8a2545af6f2e39ec7fd578da0f123022d179863c1a4eae4e8599aefede952460e7de5f0fa211da
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THp:mQvGAdlCEL8c/DRNw5CWUf
TLSH
T102267C656BF880F5E0A7E174C97A86B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 896cafbe1f4e56bf79911bc6c4d5bd9dfdae5fa84e0d915f7933f4a4e455afb1
MD5 8efad087549639a96c7c6e4090ff71cd
SHA1 0d742cd0ada9fe5d27f52176e52db255425d0d2b
SHA512 31533ee13fd5551681b69ce630d05b369421df10e6a2899fba68d3405953bebf572bcbc08b2b25ea7b6dc350e64fdad44c167936e16fcc648f41bb5c0ce22b09
SSDEEP 24576:8SewsAjoVg9N9JMlDlfjRiVuVsWt5MJMs:Llj4gFIDRRAubt5M
TLSH
T11385E031FA74E036C27B0DB25B36C706583D7A204B911AC3E3B84E9E99742D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 63d38df5ccfa85f94c57b232c1aafeb30e3ba84ce0d7d22de07bb21a8234dee1
MD5 1e12a1df6ee7d8c2b725137217f9aad3
SHA1 8304e2569262fc156ad4043cc64b4a2d9a6d325b
SHA512 baafbeba153f9c0a92c23df90d202548b0b9632919e7a297cb60eb4f0d2f13c9ad074f1d6cb8a9406ac5e510dfdc98eaced3fa8b03139b80f3707a21a7a6606f
SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHdUf:cUEtQevvqc2W1cpV2tI32dUf
TLSH
T1A6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 24b8baaadaff3514d8c9ef788b1a6ed91db7a426f74c0ccbdf0e2dff0fe6d457
MD5 4262a8362e91e4653956410f50f7ca90
SHA1 0d020dfd3a4d6b0f74fc9ea9727d71ba16daa00d
SHA512 782de684bf19feecaa0e6b6c318fc027360b34c58496a8c0051d16dcdf5ed31024340b6e1c6fe5d3f02aba72b61e41bf0d8624a14c3b8b81f93bc76923afbea0
SSDEEP 49152:GCbRquA/m2yL5zQfFiV+XenmE3/zYgFIDRRAubt5M:roqtVjnmCUf
TLSH
T10ED58D1976B8C2E4D1F6C37886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ddb0ddc924a49e6f4c9f5d9c8c896c83e86580ce6664251b51b5bebf29567a1b
MD5 e59a5d2b91e38faf4c4269df545ed0a4
SHA1 427b23143b6ce48158c0fdf9bdc806289f8c7528
SHA512 bd668cc167cf83033a823e488f8101fed61bf5caf3edd8a57f06c4b04d471afcfe2188cb3294766e58ba84dc2ec4832b58f1fdfb21d70f8c8999cbcb07a493eb
SSDEEP 24576:1AhGL3IFoiwtA5l7S533Vg9N9JMlDlfjRiVuVsWt5MJMs:1AMUFoiq5VgFIDRRAubt5M
TLSH
T13D35AE81E7F955D4F5B3AAB899B68171EA76BCA95E31C20F2160C11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 5638a0a12c22dcb59b9d3ed47aab67c378c68b61aa694e61948549bde74c65f2
MD5 91e45b93f01bea3a035a2ac398cef35a
SHA1 713a0fded0f71d2a376466ff1535066d2be69e20
SHA512 2ffc37310fac15c1b97b0252469f20b19290c7aefa3ed3777f0597fcc633afb0d7b55964685556a6fb6b9419133e5e5f01b3af4ffa787d0d6216408971d0d47b
SSDEEP 24576:5wuWOWsVg9N9JMlDlfjRiVuVsWt5MJMs:5wZOpgFIDRRAubt5M
TLSH
T1E685F14A32A40CF9E9678239C653C136EBB3B8053A61C71F4370C65B5F77261AD2EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 2ef526cc89496b6e45cd2519f0a75e39a57db7236d3903c8dad9011fc2d23bd5
MD5 389e6fcc33619f0d1341f7dc0b0c417f
SHA1 87c66b25fd6d893e0c0e58b7ec7568b28c28db6b
SHA512 d00fa3b0d768c4181f28e2191c4b7c86120666c9bc69ab07b3092c857a9898e779bc7c73623b50df7115fd5c4574b93e14367a3e67c40e5c914c75075834dd74
SSDEEP 12288:V0Z1IyEV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:aZuhVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1A875129A32D460FAD1A78278C9F24345CB72785633B243CF427006A65FB66D25D3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 64c0cc5122d056f9ba37362eda29bea83c0ea3b8627213a815c28f9cf855a76b
MD5 961473fe6f16f92db98d6c78b41306eb
SHA1 4a0ba647e417bd5d5f16937ea0390905e6751090
SHA512 626662d67f050c5f913fd8117f78ce3697a43ff3ba55e3c6da084a4f93b9be13e244000474cf2d363f8b90fb664b2d9f40a1671559bd50d8271fa0b692728f37
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UF:5QRQyi36YOcPbLvw2gAf+PN3HUf
TLSH
T177667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6c3daab4576321f766d46d7a17d9525663c97d0f375afe18b68ab6d7def3ae36
MD5 1825e6204b486a89304a9003ffeb756d
SHA1 3768eaf99c876401a0503a7bf1038fc8a9fc67fe
SHA512 377904d82e34f8b8aea74fc85b70668915a109c8bbfc43dbdc6a8b72188f514c5a0b1cd5a5bb51b934cfe08ce02b6ab2af8b7dd00e590f7f5c6f41afd33c13ea
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UF:UQRQyi36YOcPbLvw2gAf+PN3HUf
TLSH
T14E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f7c8a42cc5fc009ebe8be5db075192a0b265685157822b4800feb5c7d325c286
MD5 fe5a1ce1391120bcae2adddfd088bcd5
SHA1 78858887684a46244f31d82f2141bdf67b6f57fd
SHA512 a1239414fe3635728533a52568225786852543c706019246d0114bfda830b028a21720c4ef6b943e10ea37aee42b7514ace2919d3e6679733b276ac18de4adf9
SSDEEP 49152:b68Qg55nhceWu7PNU3/ogFIDRRAubt5M:lthLRc/1Uf
TLSH
T1E6B54933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 949e4775e42de668b86d125f2ad150763b3699a51aa3ad683e7f372bba9197ab
MD5 5ecb1301fa36bc00ec1a736d5eb6ed9a
SHA1 28e2b06bd59f49027d99675128b9f6ab1d762d23
SHA512 7fdef474e9ee7bd40962ab5c1ad1deee91282587bbc08bd63e285e599309ba499ee8ace0a056617cf1e93619faeeb86a116de849e95089aaf92c5863040c0b15
SSDEEP 49152:M3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99P:py5112gYy5azzVvt69nLKnhZ4Uf
TLSH
T146167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5060e82ec54041d24fb79bc187e2494bd9dd5164adfcef7cf7062c2c9a0dd392
MD5 18ff6d157915eb3a140af572f11e93d3
SHA1 86322e6d61904ae1d761b608f714ae241d382392
SHA512 3b2cd6c5ceacf870bb620b6fed403b9e3b09eb5b2152245a1ff0558407f1ca71d857aa28fafb19296a09772653a200624dbcfdb2700e4681d888f7b3397defe7
SSDEEP 49152:OB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glRgFIDRRAubt5M:cu6Jmdxd2d2Uf
TLSH
T141D5AD13F1DA01E8D06ED078974A9233EA62BC490B35B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ded15a06f506cd19082d4ede91440345a3e1abf74b57ba9a8b9134d5cdfd3627
MD5 307361a245befcd6c28b82475861e71a
SHA1 c56546cfa7d7874dd74379704c9124c8c13fa436
SHA512 b0f20300acb6728c871e49c6b773d8b0dc2c02e414fd5cb43dd071bd6797a3e1ddceaa625a0460d0a99f1b2372380c56c750be2329af5ad61e9a92adebc3daf6
SSDEEP 49152:z1hpsNoJpF1A63U44CwH7R4xCgFIDRRAubt5M:zmifPWRCUf
TLSH
T113B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BAE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ea9cc40381484447d69f49dbf6c6f0995a2d972bd51f21debb52757cb160ae9c
MD5 bcb662833a315a7d83f82654e7b0ce77
SHA1 b4ebcbd6766e138e280dfaa0ca0c623fc65ec642
SHA512 7a37dfd2eb42cbbee5eebdfadd3d1b7bce886588dce2abe4313fdf94a0ea115cce8b0302b5fd5cc3790db168a3c32554b3887c4b2dd3d6dfcf6e093c5de6b099
SSDEEP 49152:1SuZQIY0Be2KcRVtOnks6NMHqrgFIDRRAubt5M:b5dKii61cUf
TLSH
T1D7C5BE13F2E940E8E0BED674C7669232EA72BC464B34A6DF064072551E77EE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 690d92cfba2da97981ff37de9c9c7239654aaaeceb85e141053801edf56711d6
MD5 ff427641b7df53ce221bd20c3075cd35
SHA1 e97c25ed6490664c5bb3dbd107889974943fa109
SHA512 195f4e3796541edd0be53ee04cc78e2b550acee78d221e4b3ff63221a679bd0e1c9b4603760fdc5a0a39043094c65f044e107848f941a8fb7b6ed375e79e7a55
SSDEEP 49152:+htSn8EApI0fig3giDn0AP5w+gFIDRRAubt5M:fX2imphuUf
TLSH
T18395BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 543efc197ec9afa59e9ec783c1abb31fee91e7c13da0aefd84768e62a2d1ccb2
MD5 409cd04ea114111fc8eb45330aedbadd
SHA1 fd81f4dfb35aac08c5957ba5e17f1b12d596edec
SHA512 175ccc3e1e16d752cb7531c9bd6c9a46d9f16fae9f0fe54e44f7adfa7ec94d100f546963d7d6becf35a17996bc42fcf676b58b3b6835dd351b0eea301f977ae4
SSDEEP 12288:nfV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:ntVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1186523AE758695F7C50BC2B1CA735389CF262B5E76D64147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 523ab4e51f3ddb9db5f80c76a6c349f471d8d1fb94837f9e9eda0f4acf3bb947
MD5 de03b769e8d3ed30862b9853683d3e99
SHA1 835b48e40caac40f20434e9a0f84767bd0dddb63
SHA512 9af72eb3586c2067e888d7d28a68b39a0d5b93587f4ce9edc2a6ca8a970bd2afbb1f441ddb6d171e025ae4f11d090b4237d6f9532c0f9fd157a60cb8d369b875
SSDEEP 12288:noV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:nEVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1216523AA758655F7C50BC2B1CA735389CF226B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 51e826a848f5d7c556f453ead42d447674cd337d2fee3eab8c5389b2fa2d82c3
MD5 47891cfd5a7b32ccc5c5586dab77ab16
SHA1 f8b768580589de3f8065e482c63966e3be7475ec
SHA512 edc677d7025d1a709bf928eeca7708303931f2e9619640c0926c80fbd01a155368bd746910e701f06504ffa016b9192981adec6b9bf0016f050f942e37c621fd
SSDEEP 12288:UuV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:UOVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1F66523AA758695F7C50BC2B1CA735389CF221B5E76D68147D2B00491DAF81A1AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 d54c3e081f39c79907122f8514d2b352c737220c3eecc60c8a3779fbb0010c62
MD5 22f7b6b694b0af6ed517576a7d8ad5d8
SHA1 70d964115e8a181dba2e5c62f0bec821c8082394
SHA512 b575d7c2ca2a6521edb411bff56b48b6549f1bc15f47cc1f6fc921236047eb51b266f32808faed13c46d98ee856ae70350c6a7c976608a15ee1e904cdae88ee0
SSDEEP 12288:BVVV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:DVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T12765236A369645F7C457C2B1C9734345CB727E5973A2828FD27009968EF42A1AC2EFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 4b422973a0fda2eac1507354c0a9b9c72afeb0d1ce0bc786707ce32fcf5723ef
MD5 920678088ca47a97f6e1184f8fc90963
SHA1 8036468df546412a92724c64361a4ce28ca06094
SHA512 c32529c9b4ec567ca02164acd289b0060be691bcb5760a1927e1094b4e9e5f95ab7da2c5bf5235a0e492a7728375ad5e0104b5ef2acbbfff9ca11c6908222b5b
SSDEEP 12288:LdV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:LvVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1006523AA758695F7C50BC2B1CA735389CF222B5E76D68147D2B004919AF81A1AC1FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 2c590ceaa30c93b66467c62bb3c0c5b0380e406c25e2b13926444575c379d208
MD5 66e895fde5ae0a40d2a9ee73703a48f2
SHA1 71fd0e46bd0a0d67a8f32137ff7644887611dbeb
SHA512 6897beb93322835ed774ae2ac3982fcdd03e7cec05c4aefdefb0b5af3db25081a980025ce29f248d38131d939cbaf6fa77f0df6419fcf65f75b6aab605039c90
SSDEEP 12288:osV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:oQVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1486523AA758655F7C51BC2B1CA735389CF222B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 a24ae7bd921683a9a445f2a980859c2d5ecd7af4039c8127c46e279e76faf3ef
MD5 db4a16280fa687de335362a0440f2106
SHA1 0365c279a798f5fb775e08e762a3f8c3c4005660
SHA512 d8219e1ec84182a41aaa9a435b1d08cfbe51498fd723e7b3ffaed4eb044a506576bbd0834e10e7c838b8f0323c3662a8555c76d2b0875dac939baa497572aa6e
SSDEEP 12288:+QV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:+cVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T14C6523AE758655F7C51BC2B1CA725389CF222B5E76D68147D2B00491DAF81A1AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 922eda0e75aa1012e49f9d30a78de160d3cc9298139202cfc28842f7a4911d46
MD5 7a08b1e912f0cb68b7044fd31321bfa0
SHA1 bbbcf30a8b54da11e77e9439505e196613fb17cb
SHA512 5758b4f862681e1d68c8d7bacfc557acc2e54d7eebbfccccb5d551ce6e4b168b3b8e3b0bc901fcabe9ff402533a3b286d58d9e628930d4c3439fbc5cb84af890
SSDEEP 24576:4ZMrzFVSOkVg9N9JMlDlfjRiVuVsWt5MJMs:4ZMrzfQgFIDRRAubt5M
TLSH
T1B98501A9739018F9DC67823EC9628906C7B27C5A17A0C61F03B436675F733A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 af806ebd28d210383c6ea3eb9847e247365697dbf256d9fdf974d56da5bbc10f
MD5 66380d15ef52eff702c71d590ef00a6b
SHA1 2df507ede230340f3814adba77cee9d63543d2b4
SHA512 f064c04e70b4d2fe9a39cfcb8e9caa89688ccc9c5a28da0c9fcda10791d8a6f920fa4b9ff08651affcfadc5ef590a4f89b0aaed59879f00e4989496a50172094
SSDEEP 12288:KbV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:KxVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T15E6523AE754655F7C51B82B1CA735389CF262B5E76C68147D2B00891DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 ce71edd1173d90896b564ca6e7e76a47322aae0203146ad84e4469ffda1d8ef9
MD5 3324fc54e0a6edba342a86982a7bbe2f
SHA1 f9b3a2a55f35677cdd0b26e7e7a0da8c4d5e21c9
SHA512 f4edf5e20ff7e3001a95c0aee299896187b8225051c3e865b5da8f33edf0b27ec6515ba08d2e06c909e7fc0265105cbcb9fc04c56e2d06413737b54a1efb28b4
SSDEEP 12288:5XV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:5VVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1BB6523AE758655F7C51BC2B1CA735389CF266B5E72C68147D2B008919AF81A1AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 1e2cc119cd52766264f7d0f13c8105064abb69543774451f58438da81876f756
MD5 417396be9cc36a279eab8c9d21f44b87
SHA1 32c93d3beadee56358f393c3411fec345b998af6
SHA512 117ebdd42790f76cfac8fc665fdc0c4075250e2dd460b98a6aae5b25ceebdbebb6637efc0221a2b66f2d06a7f93646c288d94bdd7435c6e68849e53214c89715
SSDEEP 12288:dyPz5L8EV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:Uzy4Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T14475125B73A130F9D1378274C9621A02E772783617608A9F53B006B65F772E1AD3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 879d605fe1887df685932d7cefb462cc90592708a98f4a92b5341b1b506ec8ad
MD5 a8bbfe4530f7df6078fcfc2a1c6b71cf
SHA1 833414467c80c0212f66393f0c3406c7630b915f
SHA512 4ab64e2ae2027bbcc6722fc64d2177e270f6aff2e5adf9a6cd60d2fdd723b45b5cc5ba53f48308cf4d1580f4b58629c937e45beeb4c6c71e04367cc5c176eb53
SSDEEP 12288:zbV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:zxVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1E86523AE758655F7C50B82B1CA735389CF266B5E72C68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 a29be56a08f39c24733b00ca6717dd7c53aeb7da96930d031b9033889449d1c4
MD5 cc26e21d7d70d416dfa466d7e69a07c2
SHA1 3acd3b4bbd3d141d8e703f89abf23fe21b602f4b
SHA512 13a165958f05d2d217aabc3350203c6a6638d7fcab1235124f61e0f0eb570f501c8741e6a63a6cf3aa577f8894ef22eb86c4e488ed456513895bf2dbcc355627
SSDEEP 12288:KbV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:KxVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1766523AE754655F7C50B82B1CA735389CF262B5E72C68147D2B00891DAF81A1AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 2fe30a2a959b7965638671034170ed2d754c24cd34b67575698234b9d8de9f0d
MD5 c7aae930ea9164ba93484d6b746508a5
SHA1 90c9932e782612b63ef03fbf26eb2157e0b9c5de
SHA512 493d3819f56d852e09bf0ad2a2a8b285f9581d5572226cce9910a56dcfaf00c8573ddd54bd97cc12262e1a42870274207d949842b9293dae14d5f04e66a53cb7
SSDEEP 12288:QyPz5L8EV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:hzy4Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T19C75125B73A130F9D1378274C9621A02E772783617608A9F53B006B65F772E1AD3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 974934ff084c38ecc8bb3b5a3fe63d2d87933d1a3642740c34da021ce56cd6db
MD5 d844f6128de51636918dbe13e1fda31e
SHA1 e9ed975ac2d54833942adbb1a623c89501a27098
SHA512 09f8f5c5fb2fd50def2b0b44e75f73ed1f80dfd3d38d667c92f36ae51829a504a37e4d89972cee704fb6ee9337ffa8308a4ec0f0d9d289447e65390f04564388
SSDEEP 24576:oTxaLl3z0zD+Vg9N9JMlDlfjRiVuVsWt5MJMs:oTsLljhgFIDRRAubt5M
TLSH
T1A48501A9B39018F9DC67813ACD628906C7B27C5A17A0C61F03B436675F733A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 10c392f4d747f9f08b4ecf5fc4a190095867c6b11f1a58e0f86f21ec867dc02a
MD5 011ed9a04a432c90d9ff0691a1ec04a8
SHA1 f7a357b005c4e7c6f1bf45f2bf7c438a720a9229
SHA512 a0f14b91edabbbfef50a765ba25cc961cddc252b0207db0a774d11f8fdf40eac4f52b0f3ab9b694ed1d251523cda9ea564d4440b59a8cf349a420a44cff3ecc3
SSDEEP 24576:X3Zd9CHKy7GZ6Vg9N9JMlDlfjRiVuVsWt5MJMs:nZd9CHKyaQgFIDRRAubt5M
TLSH
T10D95CF90F3E414E9F0B7DA35C9725602CA767C9A1B71DA8F03A4265A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 154d33a3fcfa9c97749d6221d7a35a34beca0b2c9416bc06681cd66b8bbb4798
MD5 a75eba9e4ba61cbb0a33af030cb9ff20
SHA1 82cdd7c24830f375b8b3e1b3201a79fb151bf0b8
SHA512 be8ff54153b4f0fb5f2ab559bffaad5ceb1dabecf01f48870e004a04b83807ef3a13e081773a2d78520e5561d79ea51639fe8b54cd97e849ad30b37097b352f2
SSDEEP 12288:VOV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:VuVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1016523AA758695F7C50BC2B1CA735389CF222B5E76D68147D2B00491DAF81A1AC1FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 6c362555d409b880b67f89178d5dda923c4666febd136f7a95c410b8d15acb37
MD5 2243d0ecb64d88677451adb30b2b7ca3
SHA1 64891cd3db21a2485400d1a588d504251b5f035b
SHA512 105989b7cff0f0f1bfe814fd581b7ee4fb6ffa33ff22692dda671611531673fad97f0d790f12b435e92016ee2c21f6131ba4cf493680ef1a26a35fd983ae398d
SSDEEP 12288:UkV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:UYVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1896523AD758655F7C51BC2B1CA734385CF262B5D76D68147D2B008919AFC1A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 a78210ff48ab263797f01fe6de0355e04af00572f14dda0ee8ab2ed26e2ed458
MD5 fb0a3eb60d3786aec8f7ce96fc38c795
SHA1 041e248417f4d886ffcb38e29f38e71aead42557
SHA512 a47c695c1cabe5898b3226f3482ec2994710078fe031957e63420f631403b3bd080f3e37f8526a6cda888d210c7e9146ab776ffbbedb12169f38ebebd108ee96
SSDEEP 12288:ERV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:ErVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1806523AA758655F7C51BC2B1CA735389CF262B5E72C68147D2B009919EF81A1AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 193eb98f7ae221fc9bb8f743656bd0a5f8a806e686387999de4b262496a7ebd7
MD5 12826363828817805a25d453a39244e1
SHA1 da594be62428831b9c6e6fcc79380b1b7a3706cd
SHA512 074717258a6c8cd3cbf6cd5cb555bfda95aea283fb1a99277b32813d27a68f44fc8676ebe12ee928ff959711a629d1a5809f4c1ee79e37130fd7d5a086370b20
SSDEEP 12288:lbV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:lxVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T18D6523AE754655F7C50B82B1CA735389CF262B5E76C68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 84e9814cb5380bd4dd60c9fbae60595e7728ccbb20c740cd529bd5bdad0c55b7
MD5 dd5f438228e8e7009067fe72e5bb3a24
SHA1 5f607db10effd989deb181f3314fa000df7bc45d
SHA512 aecfa1cb3a127d08698c32b3b06815bafa60227b16f01eb38eb59604d5429f8317b763a9e26feecb239c4445b9b4122d4eb4762614056c1182a73a63c220579a
SSDEEP 12288:WOV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:WuVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1F06523AA758695F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A1AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 1fb861a9cab5bddc551a5d8ea7a301e313ee3014fb01048969db3dd0b3603aa3
MD5 2c9c0e303df5e6bd68d5454e85249c31
SHA1 22a3b2176bfceadc2be96ae3a8baa42ee21b9ce9
SHA512 e80798a342e6b6be4347a72e375e79ad5cffb46dd80f8272618b39249aaf55b3f531f5c8cbfc89437c4e57b28540efe649caaed88ea8d6f06d76fe62cf52e1ac
SSDEEP 12288:GDV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:GpVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T11C6523AE758655F7C50BC2B1CA735385CF262B5E72C68147D2B00991DAF81A2A80FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 b59e418892b3b937c8c43209d1e7c540876cd82a4d4ecd2ca2a4a383bdaa8634
MD5 7805a37862011e0058fb7078c74705c9
SHA1 c0cff2c35d1ccd7140ac9b280da4d860ec07b55a
SHA512 acbf7d6bce31851def4c01db23bdfb395392b79c56fb325390a89a8616f55b0211c3c8782438584aa0c57019d3575bdddfba23d7e9328c41c76197c2191f6825
SSDEEP 12288:8dV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:8vVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1576523AA758695F7C50BC2B1CA735389CF222B5E76D68147D2B004919EF81A1AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 13f62250311cef3b2f5607558e31276361693f22bffaa3e8d12875d024610156
MD5 13fbe4193eea059404ead6df365a476d
SHA1 031ebfa781b04b02a46addc6737d31a43b799e7c
SHA512 0426e33f02ab4ec4256755d63fa4de43e33ad3580d09d8d88c429ce2e517a93a9733b84f3ca7ec14d9f0607986e65fa815735b27b489043bf1f8476c741713ca
SSDEEP 24576:qfwv2k9RX6wkyAIlVg9N9JMlDlfjRiVuVsWt5MJMs:IMnYI/gFIDRRAubt5M
TLSH
T16995DF29EBD844E5E177923CC9B3460AF6B178591B71C2CF02AA53AD0E37ED06D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 740094e86ad42e1a3a9ad10270cc959ec7c1fd4daa21eac5a7780257ce66b558
MD5 ce519205f24d7c3ca6f4a635ab354008
SHA1 9c8aefee78d9d77b26b1c3b3bb0def7844cd7040
SHA512 b49a5993be90b0860b8ce65b046597ec1ca2193632ffdc69ac31c5ca9d7114558a9402ab1ed3922b7184a1391d769b003fdce0b9b51f8210fdfab180dc71eabd
SSDEEP 49152:nYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0egFIDRRAubt5M:CySzPnUf
TLSH
T1CB066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b271817e23a45e15f89440f56681b53bb176116aedf12c219493c1afb1c5bdef
MD5 d4d2e0ccd9de4e9e3b06906c7a5554e7
SHA1 3eb55239f48496268827ba5f7138d029f24e75d2
SHA512 50d926d9648015bfc979a244788ec0ae02a69ca8b41ca8f43eed40cdeaa361bebf87c7bb08b811ffb8d4b802aba345bec4f229011ad54342e312da7f817eac8f
SSDEEP 24576:d47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY0Vg9N9JMlDlfjRiVuVsWt5MJMs:d47JUQjTirIhCnDHUPfF/ugFIDRRAubE
TLSH
T1B065AE1EA3EC01E5E1BAC27885154A5AEA71742E2B31CACF1270437D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 c997cc2cdda79578ffba4129bb4fbb50de0e5107b452c979ef7e0f24640daa2d
MD5 7a862ad05866cc2654903e543153b852
SHA1 5b07dff7c63a9adc8f894868cc9554f621839636
SHA512 d3024261f3343a12c736740ec9df4aed28cea1734425fa6fb77291a4bf75e8056a799045aa3a1b1c38ad8c0b911cf54149f8cc5dc5afba87d5891226f5637acf
SSDEEP 12288:IVsfrV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:hhVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1BF75F15AE29402E9C06E9275C7624641F7333C2593E1D3CB92E0F57E1FB92909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 4c9a10172b28d2d3468af21af9ded7afa1ce32e13f96e87bb7e2f184432f01e1
MD5 d562aa13b89fcaeada53e1b3eb177b02
SHA1 4ad36f9d3e9d8d56711913490e87d66e048a8d45
SHA512 285d57000c5d49a0c28a8037a058369cfc507be0d1255476b1279bb3eb7274b8d128191c1667b734a2d145d67e25f0073c3dd2882540d2d5b59faa600245222d
SSDEEP 12288:7rfdhU3fx54u/nPIuaIgWoapWBX2+EXC3bFV62lWb/N22f4OxcNPkNpQzaOXpE+C:7rf7UPRn5VGLFI5t48cNPapQzaAE+C
TLSH
T16B553841762AD79FC6A940325E36D6CCAB707C01FE055E0773C8873F9476669BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 fba283f2a5b4a43ffbe5a2036f39462bba086070f9097da7fdaf043a50f197a8
MD5 323d40d157bdf9e8c21d4b3912951b50
SHA1 85be7a3f8a1e58ba4f38681fdc2494a3bdb5451c
SHA512 168584f4a1a9f75443c9fcefac3a02a7a8d458903b402415e0b8a03a0c7a891ddf109b20082ee54f0dbe65b66e74eecfaf886a7f77ac9d274b5a68102a537fee
SSDEEP 12288:6i/bmsvkIuaIgWoi8X1fbTLrZM+58GqA8k5PjOlCvNyc3X4Kx6bs:6i/bmsbHGwdfV5VNf3X1x6bs
TLSH
T1C8653D41A9A7E35FC8FE50774632C68DBB786C02BB452B0173444A3C987767EB5F2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 d938c6b4ce26f80ed332ca6cd95728624d36d94c920d86fa47bdd4a849c82eac
MD5 80912fd60a62f24c7028361607eb373b
SHA1 953fdbea9304071ed52f7efccace7a8cf061feeb
SHA512 a52a5997e9f686b4dd3a40aab1a985412c335ffebeaf19f2b6044609075564bcabcb59fbb2e83d7c31012429ab3937652989eb50da3b332573fd7b42dc5a61d9
SSDEEP 12288:B+7TV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:0ZVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1DF65237A768999E7D46B92B0C97383058B277B693BC181C7E17005D199F81D1AC3BF83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e90df10693b98ff24d1db77106706bbf59069c2c44fc6b20ca2d013fdeabe87f
MD5 c48315394602676fd137262bac05e1cf
SHA1 672e689018142af34f114f1baa024555e2420904
SHA512 336ce7d66d594b06cbc56393fe1c897aa9b915a7a7eceb327216c41d847e37996343ce61c27ad77d84e25203a393ce678ca1cde201747697e89ed2b90ad16d5e
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bYzVg9N9JMlDlfjRiVuVsWt5MJMs:ngb4mBIBhGF0gFIDRRAubt5M
TLSH
T13465AE1E22EC02F5E0FAD2B8CDA64417D6B278161732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 fb7ba9ea97d22dd27bfb21ca5a654cec4e4722b247feacbb6f94bfd50d2593dc
MD5 163b5aa727efca32dde438a213ff318f
SHA1 b21799d8e041dd994912d09ec9b1dd5221d70259
SHA512 e2ccc41916e64f8e83b91af79178b1103fe268076125761d8ff28f05e52396de099d67e30b73c6b99789ea5c5b14cf279bf73ae25b37b9ae0b5ff80d83abbb15
SSDEEP 24576:vG88u8FpJqH19zria7/mkVg9N9JMlDlfjRiVuVsWt5MJMs:e7ZFPqVka7/5gFIDRRAubt5M
TLSH
T14D95F16576E101F1D47BD138CA924663F6B2B8251364EBDF07A88A511F23AE14B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 3b30d555b00bd72f38a3a4c3d876ea00e5c80bd0d6354f20ee9197bbb3f924f1
MD5 a478f2643110dba4bbfb8b62dcc8c48b
SHA1 9508cb1752588d6205e0d7d4af343820ae424995
SHA512 39d9822e306ee3f23504b57a2963df729e57a71a4e037f9e940688daef021ac4f6e3ca5ebaaed1ce49ea858121d755ead42ec262b7d5073b450add3590b8895c
SSDEEP 24576:APUr+NQgVg9N9JMlDlfjRiVuVsWt5MJMs:AJQQgFIDRRAubt5M
TLSH
T12B85F12F32A918E5E676E17DC9924709E77274621352D2CF02E0417E4F67AE8BC3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7fd916405504599621842843bd055816b9219d5cbf0d050c5eec400faca5a49c
MD5 f95eea464d0da4843b93d172ff26ac3b
SHA1 b92822e6cd249f86d956fb6dd38ea3c09fec665a
SHA512 f9fde33d650d54d29db436d44fe1bc787e1a8abe0a22a8837c5dcb20731dfb0c62de528a3c9c75fb5909e7c03bdd3aa06d4ec803d6d59ba4a32d2a020ce43010
SSDEEP 49152:KBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjAgFIDRRAubt5M:1G05lO43bwUf
TLSH
T183D5CF6E62EC11F9D1BBD17CCAC6460BEBB23415033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 96e9dbca5913eae74000b0a2484d8f3f484bd96f2af4fca869bdf5b346eee34d
MD5 871551620230dd6f5d1428af5b8cf5ab
SHA1 51ca51f9e71ff927f3ae8df3e9ea846e131f5ee3
SHA512 5bbc415a7518652248b31c6b07059135710aa4487a3e07a6d19d4502c755461aa279784da6aa000fa556119b05e7e5d5422834c6507bf1c736458effaf52624c
SSDEEP 24576:afa5POZ3dpuWVM50JicR2hG0lasx2+47eidnyVg9N9JMlDlfjRiVuVsWt5MJMs:ya5POZ3BJt2pasx2+mogFIDRRAubt5M
TLSH
T16865BF5EA6FC01D5D5B9D17DC583460AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 91fa1cbeb8c8bdd78fb78d04ce23ccfc9470f496aa2d3ddfdcfaab08971651f7
MD5 acb61010795b2382c83140903f58cfa2
SHA1 057b83e9cbf5fcdd163e39e2754cfa1bc8e9b2e3
SHA512 59966a575d302fcb15dabaafe539eef73d51d24ebf6849d38762233c632f566956f7fd4f07ed1d1787e1c69df4a02bfd11e9db8bff0c96a00db3e6997bfb6e42
SSDEEP 24576:9NcwHdjbyQ4nLC18lb/EOjowL7FkMVg9N9JMlDlfjRiVuVsWt5MJMs:9Nc/zEOVHFZgFIDRRAubt5M
TLSH
T14B858C2623E901E4F5BBE1BE89779546FA717869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 41a4438496f25740f5e4de7acc1a5bba301a46966c9e2b5ab0d55e072132dfee
MD5 b48fe5fb5db60c469072fe5fd653836d
SHA1 6e680be315294206f2566a6936cbb51f47aaf416
SHA512 0a9932d94289022ed7a0bf996c02d3d51484b99ef996baa2ac3ece8a72b2ab7c613cb1247ef01eda53d349bb730596f98299b9ce34aff4236f717b75ba82afa6
SSDEEP 24576:8TkNvNnaFeYhJNtmZBmvVg9N9JMlDlfjRiVuVsWt5MJMs:8TMwBtOmdgFIDRRAubt5M
TLSH
T16D55AF6EB6B806E4D1FEC6B4CD238512EA727461173293CB5290C13F4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 a1f8946555f9b1f48fc35d5acbd745b808f1f8a7f5acbff161d1cbb72bf8b1c2
MD5 5ef5d31c5087a92d2d16dcee736340fa
SHA1 54cf9108902c15c8ce91262cdbebe26733f8088f
SHA512 1e6a4949f77582e04f6388e24cf722a880f89c62cb825e263cbbf8730f779d02ce689eee322b5c124513ad4e755c1d26212fb925e6199733e27dd6470a37c2a5
SSDEEP 24576:sD3FHshBIYQgANVg9N9JMlDlfjRiVuVsWt5MJMs:sDVHeBIAAngFIDRRAubt5M
TLSH
T11A95E17EE69C04E5D57BC1BCCA638606E77138A9032256CB02D081B65F6BEE46D3EF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1272-332-0x0000020B741E0000-0x0000020B743BB000-memory.dmp

Download

memory/1920-316-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/1920-116-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/1920-124-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1920-118-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2376-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2376-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2376-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2376-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2608-43-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2608-54-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/2608-56-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2608-44-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/2608-50-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/2756-69-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2756-290-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2756-71-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2756-77-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2964-65-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2964-272-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2964-58-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2964-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3276-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3276-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3276-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3276-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3276-144-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3748-409-0x00000278C5E80000-0x00000278C60AD000-memory.dmp

Download

memory/4168-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4168-319-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/4168-317-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/4168-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4168-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4168-104-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/4168-110-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/4212-92-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4212-336-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4212-334-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4212-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4212-98-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4212-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4864-305-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4864-81-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4864-87-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/4864-82-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/4904-26-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4904-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4904-115-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4904-18-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5032-138-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5032-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5032-135-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5032-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5032-129-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5528-0-0x0000000140000000-0x0000000140132000-memory.dmp

Download

memory/5528-15-0x0000000140000000-0x0000000140132000-memory.dmp

Download

memory/5528-13-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/5528-8-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/5528-7-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/5528-1-0x0000000002180000-0x00000000021E0000-memory.dmp

Download