c0db90d1a84e1da298cd940a1c3c18a9aade088a8f90894add33e8cb313ae4ab

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_243549a53f5115281509e3ce5b6f81de_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.7MB
Sample260819-265vlsbl81
SHA256 c0db90d1a84e1da298cd940a1c3c18a9aade088a8f90894add33e8cb313ae4ab
MD5 243549a53f5115281509e3ce5b6f81de
SHA1 37aab59189d10cb791ba83117034a31ca5478826
SHA512 9bbe1104959f15f8dd79538369374ea67ef430d900fa05e559c55df10c946a396d127887296ebaf601e0f4b4eae9f786f8fa351f2b44866984bf791d98600f75
SSDEEP 12288:l23Jh2kPCcnWZ9bv8XsFS4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxQ:l2LvQvk94yxknw4FYnshx8OfVe247
TLSH
T1CA85CF0167E505A8F9F7A63899F29122EB737C955B38C64F0398415E1FB3E90CD39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1712	elevation_service.exe
2460	elevation_service.exe
3756	maintenanceservice.exe
4948	OSE.EXE
880	PerceptionSimulationService.exe
4420	perfhost.exe
5280	ReFsDedupSvc.exe
4192	SensorDataService.exe
5236	ssh-agent.exe
1792	AgentService.exe
6132	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-19_243549a53f5115281509e3ce5b6f81de_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-19_243549a53f5115281509e3ce5b6f81de_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\755509c0b05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-19_243549a53f5115281509e3ce5b6f81de_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-19_243549a53f5115281509e3ce5b6f81de_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-19_243549a53f5115281509e3ce5b6f81de_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-19_243549a53f5115281509e3ce5b6f81de_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000064a41d883030dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a23327883030dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd914b883030dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c527a5473030dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007144e8493030dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000817241463030dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d3ce3873030dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000cbc077473030dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1712	elevation_service.exe
1712	elevation_service.exe
1712	elevation_service.exe
1712	elevation_service.exe
1712	elevation_service.exe
1712	elevation_service.exe
1712	elevation_service.exe
2460	elevation_service.exe
2460	elevation_service.exe
2460	elevation_service.exe
2460	elevation_service.exe
2460	elevation_service.exe
2460	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5164	2026-08-19_243549a53f5115281509e3ce5b6f81de_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	1712	elevation_service.exe
Token: SeBackupPrivilege	5280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5280	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5280	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5280	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5280	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5280	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1792	AgentService.exe
Token: 33	6132	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6132	SearchIndexer.exe
Token: SeDebugPrivilege	1712	elevation_service.exe
Token: SeDebugPrivilege	2460	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5164 wrote to memory of 1264	5164	2026-08-19_243549a53f5115281509e3ce5b6f81de_cobalt-strike_icedid_njrat_satacom_vidar.exe	90
PID 6132 wrote to memory of 4692	6132	SearchIndexer.exe	103
PID 6132 wrote to memory of 2904	6132	SearchIndexer.exe	104
PID 6132 wrote to memory of 3388	6132	SearchIndexer.exe	105
PID 6132 wrote to memory of 3268	6132	SearchIndexer.exe	106
PID 6132 wrote to memory of 4152	6132	SearchIndexer.exe	108
PID 6132 wrote to memory of 5616	6132	SearchIndexer.exe	109
PID 6132 wrote to memory of 2004	6132	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-19_243549a53f5115281509e3ce5b6f81de_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_243549a53f5115281509e3ce5b6f81de_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5164
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_243549a53f5115281509e3ce5b6f81de_cobalt-strike_icedid_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-19_243549a53f5115281509e3ce5b6f81de_cobalt-strike_icedid_njrat_satacom_vidar.exe" uninstall
  2⤵
  PID:1264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2460

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3756

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4948

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:880

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4420

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5280

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4192

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5236

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6132
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4692
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2904
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3388
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3268
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4152
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5616
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bc11eef509e54b3f2b8e9e770f6f3304c4f5ee0dc9acf0596af28c9d0c2960e6
MD5 3ae3354a49bb1f61902a2ce63c49e2dd
SHA1 888401aecb932cd4f7527b2b668c5f826c151efc
SHA512 191da2fbbbb53bae3d4f3add35627adcd700e3156617926807efbcd4ae198dc43bbdc12644ab51d5a92eac95ad4c515ce244e508629e98a91bf04a781777d538
SSDEEP 49152:zb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnox4x8EVep:R3q6HjBvix8EVy
TLSH
T164D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 9e592591ae5e9afd72e6346b44ca7b22d76706f0b93d308bc6b2ae921a00284d
MD5 f7885abc76b0d1561bbd0cc113ab5ccc
SHA1 0882b942bd05b7baf6b41b3448c46bcaa1271624
SHA512 40a2bae56e02eaca194cb6c641262e20d53281e6e99e2c59b14ada52330f051fac9e9d3c4b82c2dbe4483ff157c5140d06333c667e65ee5e256f97e4ffd0b6ce
SSDEEP 12288:e1XLsswWkxy2lRq2czA4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:sXYfDtczA4yxknw4FYnshx8OfVe247
TLSH
T14A75F12877D508F9EC6B8139CDB28512E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 85406ee549e257edf24ebd24ce90b698e0a3a12450760b2c3624f4be05710901
MD5 3a9b3bddef2fe0e025bb21e1f079ec9b
SHA1 ac64a6847b2a08c6a82a4df9c10809447aaf048b
SHA512 2117294e1179a5e1c8772150d0d061dbd798a0b21bd7c297c7509dacb0b4b6d6a5eb5fe1d23f549ef891aa9370263e9b3a5f8b8da3809c4a5d0b85702d4b57f8
SSDEEP 24576:50Le5ji0hmx1rMlyxknw4FYnshx8OfVe247:5Pji0A75x4x8EVep
TLSH
T12995AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 669f8782cb7e4591de0d0a555d425d081701bd032d59041bc04c368871eefc86
MD5 93488578727ad46f163ccbd79315855e
SHA1 a05b2a599a415b5a86b029810b028278734bf4f1
SHA512 ffbf498dacd7401bb8542abecc107163d1a3f7ca9320e3a3893ba86716cdf47dc27a9df4c4ed2647b63a0c599a605758a88be77290226e69e1d566c459a07086
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWE6q8wyuXyxknw4FYnshx8OfVe247:R/ezSC6vUzPvxHjylx4x8EVep
TLSH
T1C1756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4b75ff5e3fd921c35bd6a771357bf4efe6b1cbec86398f9b1c390c98faaae1ec
MD5 3708c574b1dfed192c5fb3f235bc703d
SHA1 6d430c43e97159cce75991f70afb8f20287a8b0a
SHA512 a8807dc814d0675ca497158427bc081628a8178a03ea55f8b26f0b45f38d867317ef660bee59683c078fce43c8a85be4781838869b7e187a177fd186d0832841
SSDEEP 24576:TVbqPb88hv/l+6Eyxknw4FYnshx8OfVe247:TVO88hXl+cx4x8EVep
TLSH
T1CD559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 bcb28b8fd75f536f3ea814f1818bc2909a8c845547a7a3cb8ab2323473ac9c4c
MD5 d4c57ad20519e65d6df7ff7efbd6a8a0
SHA1 85280c847434f59908e0bd7c16148f0060c67cc4
SHA512 0a94acf41c1716288c975e0e77567e42d12975d5263181c2f13fbd4adc81ac8ebb2e3c13d1f4f3a644dd1b1dbce5d904278f7629fd3be6a4e940b98d6be5739f
SSDEEP 12288:rNR+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:rNRyxknw4FYnshx8OfVe247
TLSH
T16465237CA7DDA4E1FA5E15331B7572622616BDA0DA74C11BC778B14EE0F0CA0E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 25c3a2a86a0b04dd6e5cafe7b3ed6eefc86910feaec10925f3bae0fc09a46aba
MD5 e1cc018c0a89466a42d6114d590baafc
SHA1 3d8cf442decf8702957ccba687d66d067c66bcaf
SHA512 bb0003d7d6f3c391083613fa2c96ed5b0667ca0c6ee8325c834480f282f1511e4e8f9e21d02d22f52a99f7a38579be5d715f661a4339886534ebdec4594e27fd
SSDEEP 12288:MeBNUbTVO86Us+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:MJIUsyxknw4FYnshx8OfVe247
TLSH
T17C75CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d68356a71c5061262f1fd498ec53fb33ccfdceee1ab614e3cffda8da63ba1f70
MD5 55b6c337efccfaabe369872ec35d808d
SHA1 8bc265e7fca07c70c6a14ad9d0778553b15d810a
SHA512 c3756f82c08300f1115dd48085251451197efa2fdb7cd2682926bafff2269693864e5508b0c437f4bfb85595c1c8085b559c4e6eab057b02d9f4dbe2364bbbfb
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THX:SQvGAdlCEL8c/yRNw5CSix8EVy
TLSH
T1CC267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 0f11f98dc15cd0692245dee88bfef7cfd8bf10e9ba025e2773335f1d26affd80
MD5 a1e1c2f0ad2505123252801e1f9a6120
SHA1 b256c1b8e57589ec690ddca299aa90ef167ce963
SHA512 22c7bb1d6dd3c73af467dc60e8f858c96adfaca08d3f4f7ce0a2bc75635519b245869c28a9a45f9f3ebad00c1054cb4700f357104e80102002ad1d266f2d3c2b
SSDEEP 12288:AAwSfxL/2Dc3LDLLmt0LDQewsAj2+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:V6ewsAj2yxknw4FYnshx8OfVe247
TLSH
T1ED85E030FE74E032C6BF0DB21B36D716142DB9604F611AC3E3E89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9cf61845374fe2decea75de383814fb544051a6e84b338d27b55d6d01dc8738e
MD5 934fda472a20332dac55c45bcdfb3873
SHA1 49b8c0248892fd68d420cc82fd1aee54b1229faa
SHA512 af42308035e88406622d8a3f9ddb03df753a0138b8c8ca5dc6ca71ab1655c5a182f9d6b61dc15412f516db941ba13e21cd1d7c252b10f807b4d2de59421f9f03
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHM:YUEtQevvqc2W1cpV2EI32
TLSH
T136474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a354daea8f15910bc18fd63c29ed60674e4a98576e22c2c0d7ed9613b3462743
MD5 42a8ebf3d316e410459e80bb068baf71
SHA1 46a198d99a5d26c62ba49ab7764076b3e822713d
SHA512 715234321e64272bba1f5345a43d602283294ef0e8039ec0137ae6901b85532c2f099ea81f482f2fb061615500376f4ccb8e7357381b44e11ff7635f61aa388b
SSDEEP 49152:LCbRquA/m2yL5zQfFiV+XenmE3/zJx4x8EVep:UoqtVjnm+ix8EVy
TLSH
T17BD58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 546625aba3cd6e7429a77a9e7b2d19a057b33275874e2bdadadbca48e1a7b339
MD5 96700ec1ff2fbee708855dda5d573201
SHA1 769ee7e2ce9d183c16f83a0eb14e2e68a002a3ee
SHA512 3d6f27ef8fc9610b9693ed29b49e95bec141fc5c70f46b713970a75c9101a34821f4b3f5109ba001e740ba9f3cd009a32e12ca90528b5e93e43f7b6cc0af1c9b
SSDEEP 24576:sAhGLJIFoiwtA5l7S537yxknw4FYnshx8OfVe247:sAMyFoiq5ux4x8EVep
TLSH
T10435AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 4bc9e0d8f4e8d6b4fbe0b92fa2ae5b414dcc268919b528ff0a0a733c30b5088d
MD5 3739dfb8bba697f12e781116504df17a
SHA1 516632a59e06da3ef6a5ef9308a854fb82760ab7
SHA512 5189a589e9ac07a6284c28254450b5edb3941970db19d49eddc699bea183370dc36c5648938f93ababe1d8d0c94dbd8b42c9b39f1cb3d35b0a9dfd51b899f037
SSDEEP 12288:Rmw5HEjsChN4BFgl0WDm+C3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:MwuVOWqyxknw4FYnshx8OfVe247
TLSH
T11175F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 c7d99b21eced479f7807001791d43b7a3dc50bc47bb7f8ae4c9eb6fa75587965
MD5 11fbf4d43574bdc25df980acd0b936b3
SHA1 78dd76f3e04689fddd9a9aaae0e46e1f3a74bdaf
SHA512 71c95c9cc23dc569bfeed9e5562de9f2a51ed7fdb92cad0816f745f52b9c6503e9789246741d3e0c7c165976e94ed812b19369f93835b471ff9a8b715665b855
SSDEEP 12288:bFZ1Iym+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:RZutyxknw4FYnshx8OfVe247
TLSH
T1F86512AC33E860F1E1A7113A89F15205E76274A2677183CF4764A25EAF72DD09D3D723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 43c08d7fbacb81d3109f8b8bdea2016d23e3863367808af562afb0e6cf2fc0fd
MD5 be9fc649c5c22074e37729968c3943c8
SHA1 369a2d03bbf79b54013b24e4e4ab35a14daf465f
SHA512 8d7479543e70de6b07da33ee8509b8d8eba4e3c23b6e5a45a381d8340ada8a9eb313a300dc7f6c7541fb5762ec11718b25f53d88191bb2ccfbcf2f10ef3e8f7f
SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ub:gQRQyi36YOcPQLvw2gAf+PN3Dix8EVy
TLSH
T15F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bb3c2d91f7f9a59cb943036edb52007ae85448dac7373dd3b31b8c38cf8d9f34
MD5 6df2c7caa823992d9cd7fe0f95b977ad
SHA1 e5c6c7690da411bc7beed1a6ff432f2c8f974b8b
SHA512 7e644f7103f03a1b7950a5a7b064a9df19e4f12d7f79495dc1cbd34bea96985d7dfc0e9a75a1bbb1ae229f089a561d59a5a1a47fffb5f8e4ee048fb5a7d79581
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ub:JQRQyi36YOcPQLvw2gAf+PN3Dix8EVy
TLSH
T1D7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5a7dc565ae72c3ff9b9524e7cf7d2821472cca6415eb35ebc66a86781abbfd4f
MD5 7c6049852f8703219f61f043f18fdab0
SHA1 5d47d48df5476c8b48fe44d5588fdae5832f7794
SHA512 2a768dc12bfc1a73730d0b7c752f3329cee47233cd8007440f330fecec5cbe814c6e89093bb746c3d7a3e241a15f1babe76a58b7feae85feb0c702f0e2f7b300
SSDEEP 24576:kwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL09yxknw4FYnshx8Z:K68Qg55nhheWu7PNU3/5x4x8EVep
TLSH
T196B55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 743ac644963b6210a24e386a4cd5377aa62c1c279c60ec83a672e7871d7cf60c
MD5 e229500a42149c456d964c4546601830
SHA1 2838369c1ef6ee22d73704fd5ddcb56a1b50d683
SHA512 d7239be8fee2501c69bd01fa2644f6884957c9d8c2e43d1db1e3b49a2f81d582c8398493947daae079d1d08092c71aab08f91742dcd9ffda15400485e312c9bb
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99p:Iy5112gYy5azzVvL69nLKnhZUix8EVy
TLSH
T1D2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d5f42a4ec6ba00bdfcc019051ec9196655b9a7ccc2c77256f9db6f414c42e50c
MD5 fb0648df90b295fe2b0e08b09cd34b4e
SHA1 346f322498c74b301fb52ce278f635304582ad69
SHA512 fb695233c4d86fe5004fbdc7ab7457804d010c35356b541d1602fe09b14c8b80a65f862d088257331c2b9ea6d4a13da25fd33ccaeb20a4bd9f39cb1cf53c30ee
SSDEEP 49152:MB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gljx4x8EVep:Gu6JmVxd2djix8EVy
TLSH
T1A4D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7a29073547301dbb61142798862044be7eaadbafe1dd4f3706b84114bf5c6e1b
MD5 ec778c5d671f819da754b9a16e394fed
SHA1 2be5b55224eff3f0cbfd7d6fcab9a8e0946cfee0
SHA512 70729eaed0a598adfc78c6a69e515a059925c834fe179ba88c4a957e7ac9664383430c8e7f83560c6eba7645dba5b2b93c2199542e7f05394d7e095b5c1f433e
SSDEEP 49152:61hpsNoJpF1A6UU44CwH7R4xnx4x8EVep:6mifPbR+ix8EVy
TLSH
T154B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0aa33f9d638f54d46877c32485138136ce4e2b4abe65608eab0a60793118701a
MD5 f7d8c41195e18a0a8f86d3cb703b96d3
SHA1 37eec221bae7e34d55e1050acccd66f2f52f0cb4
SHA512 f787f6bbd247f585d4628c8b65b9266739cce4261f69f6f2dae89f9dc76ef229fd855743e4bda0a40c3f8afbcd1a99be750758f723530f3e3ab6562b935f89fb
SSDEEP 49152:eSuZQIY0Be2KRRVtOnks6NMHqYx4x8EVep:w5dKTi61Yix8EVy
TLSH
T1C5C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8abedb442dd1315d9a0ba923f4f7c3934e37f43b56bbe58c183d95ea6f8e84fb
MD5 4917375d0c35a368ed8ac8b02986373a
SHA1 26e0ff2001cf8ab194a1876c6a9f8295fc9c17ae
SHA512 5f44aeb5b9ac8b8e16611021ca092e8402f9d64c80f48968841de1eac4c92eaeb36f3c396a39b85527368bf738cceb229fc018aea9a814011f7f6eb92013ebf8
SSDEEP 49152:ZhtSn8EApI0figngiDn0AP5wbx4x8EVep:oX2iyphqix8EVy
TLSH
T15E95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 03bb650e88afae1b5c9ba3452ade9795855d084d944eb55172f575a432cbaed3
MD5 166da4e3cac85c7c719608b49cd6112a
SHA1 e6138fec558b85d643763c386011e2e58ae13e7e
SHA512 342559f870df5e61e0ed469ac22e7bc831be433a0d2011ed865b7b3e1a3b0bd38f3e8b2e0cd0a42b60f38f5d7e65a9997d734c6b460a09ef22e0265965f4b420
SSDEEP 12288:gZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:gZyxknw4FYnshx8OfVe247
TLSH
T1726523BCBBDE95E2F50D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 ed78a3e051666240fedf73cb5a15da30cd927140822e0e15bcd61470b36bf1a9
MD5 4cc01e068e6635e71fdcde4402b056ad
SHA1 9517793ddc7a5d068d35cdce0e11770b447cc713
SHA512 b1239ec8605b4bc426e9f8284822945fcfef36f8985cacbe9ba255d2bf5cab600a80ede4f3813506af0ac18fa37d7865c447af0d152e1f97692d712650f2becc
SSDEEP 12288:CC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:CCyxknw4FYnshx8OfVe247
TLSH
T15B65237CBBDE95E2E50D11734B7173626609B5A5EA71811BCB7DB00EF1F0CA0A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 5c99169865bb9021e06762b8dac2406acadae36f21c29c06b6661ef02abd7cd2
MD5 13c93f913e2c6db63bfd59611d3c2a09
SHA1 a9580477bf4a1cfb3379ed4c5588913e006be90c
SHA512 0bf6f9bd17c4f3574e7d408e9aa8a9efff70b246e75ca52006bc239ffb0a5f10412ba209b707da2cc4f17b7bd10e2fdec83ce86ad851f05ab14e6e360426b190
SSDEEP 12288:FU+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:FUyxknw4FYnshx8OfVe247
TLSH
T1B06523BCBBDE95D2F54D10734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 a57425f33a837ded1e55ccf54de3f649541b6d40a1f6851054606e8508f6b0ee
MD5 341c1d44502ccea66acfdde722f43d2e
SHA1 696c39899903928a798cac222237112d4b18ed85
SHA512 b9863327947b31ab3e28f199bf2035c24266fbaf1b740f89e695d8d7864e2f5c12604e27ac4ea7a173066d224e8ebd937551b219fbbf60bffd524a55e1cacf5c
SSDEEP 12288:jVb+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lyxknw4FYnshx8OfVe247
TLSH
T1A565237C77EE50D1E85A51738A716222B365B8E5EB31835FCB24710EE9B0890E43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 2752ca58e9481f38e66f244361c4631f271889ab8f8f4d1e911e529634ece245
MD5 a9352c56cc8548175eaf3bbcc5351ed3
SHA1 3071b9a0d26d8fd777f52c1fc629fc45179916d5
SHA512 f6406b14887c8e4d533a163aa61552dc7c4f05ca551886fa3a21f2b2977054b81ece6c0d3ea8f215062489f5429b3250b93ec44712b2ed56bec841d73e8504b4
SSDEEP 12288:HT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:HTyxknw4FYnshx8OfVe247
TLSH
T1A76523BCBBDE95D2F50D11734B7163627609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 5466ad3b79acdf6ca6df5eb59bf3bac48772ac699ff8cba5b4a892465aefc270
MD5 4c6df7c912412928e5dc3a35d7d264a1
SHA1 a5add3d7c22ad9ebf65707c4ed12ce303cece457
SHA512 641ae7628262017e70f0b5ab2a93b81cd9def5699e1d12e758e3349319c36d64c89cde886d43783a605c8e5112e104dbf2cf5f76f7b0f391dc55f289903ca8cf
SSDEEP 12288:M++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:M+yxknw4FYnshx8OfVe247
TLSH
T15765237CBBDE95E2F50D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 d9782a5dd707cd87d1b57cfc78403d5c98409efc837534b40f077402ea8e59f0
MD5 abefe843d0c33246bcbfa097498a7581
SHA1 87cfa2930553910e707071f167dad8b6a98a1f68
SHA512 68d788dceee19bfad1732a08344e9dd8ce0455a87bb8d2563e8e6fc1f6e8cc4c3119acfc53c0567f14bcae34e26df8eb9aeaeffd41b4f911386c073de5f355dd
SSDEEP 12288:w6+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:w6yxknw4FYnshx8OfVe247
TLSH
T13865237CBBDA95D2F50D11734B7173626609B5A5EA71811BCB7DB00EF1F0C60A01E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 4c44959f0067a1096d9ca1a11a0d4c34b9577822129de812b1b2c64eab4c4426
MD5 97b1c7aeb7fcf3f68c17d72a4e674a8f
SHA1 6df6000de9e416d69cb471135a6b0db8fe7fe6e4
SHA512 9e384beb36a0605e9b565bf0ca1cc7736143370940b35d54cc40e7d84c33ba7bab7a30b65ca7d2e971c6da58f1375d044d622867d3407b80e73ca2f190139f14
SSDEEP 12288:AiZwbZzzFEoS2cPvyi+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:DZMdzFVSOiyxknw4FYnshx8OfVe247
TLSH
T12B7501A8B39018F4EC67413FC9259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 fed744e4ba1bb5fa4d9a94fa0a577eab7a440474ed38b43e1cc89fee725afec9
MD5 0cbc3e0d64add67cac4137df7af7b158
SHA1 cf7becb516849411df1a98ead741c3cc8073d415
SHA512 7b7d756ced0408e991751c5a70baf57e55323a120007becc057422d28fba5993a448c3e2d937562ff1a547cd8bd3665b2e404a330c907a0aa675380f4be77ff1
SSDEEP 12288:jd+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:jdyxknw4FYnshx8OfVe247
TLSH
T1036523BCBBDEA5D2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 814cd76332313888f1aa7b9bc902ad186b68285d67d2dcc84e1b720de864f3a0
MD5 fff070df42a71b3535832d811b32a18e
SHA1 c444ec83d8fc6a40503a0c5dc5b26b15c8c8e09c
SHA512 5408854ba3e5b4650f875319456213de919ce82cb8594819823658968ee5781089873d3ca8c5928debdf268f30d21d38ed6df02fcd8dd65cc834002c80dc197b
SSDEEP 12288:iB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:iByxknw4FYnshx8OfVe247
TLSH
T1D96523BCBBDE95E2F50D11734B7163626609B6A5EA71811BCB7DB00EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 99ca4c3bc0aa343b20462b7db29c20c05e79f9b0d4198fffc6c9344553d930f6
MD5 bab9a734fd1f2cad8d4585f8ce48e73c
SHA1 afb621c517583dbdde9907088dbdcf2f515c2479
SHA512 17c35c2c7c1c884e2dede644a225f6d8ba6e841eea370c71a1cb2be01af5887295c04a215e49ff9d53d55e1731c76fe10ce61c357e722796ca6133d587417a28
SSDEEP 12288:HyPz5L8m+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qzymyxknw4FYnshx8OfVe247
TLSH
T1EB75125B73E530F5D13A4236C9621612F372B8724B3086AF87A4537A6E725E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 430dd9384cfe95110eaf64173a0d36d4888822f2ef842193ced6d98a0db41333
MD5 d32fffd7be059a7892fc8b1bddea4642
SHA1 bc5498462c488e7ac188133a298789d8940ec585
SHA512 a7811594bc0921974c141a609180db03667d8066b9f268aa8e8214a354b5b6d3529454610bb92eedc0fa371934da2848e531385495d8f60e64e27014730d47b3
SSDEEP 12288:od+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:odyxknw4FYnshx8OfVe247
TLSH
T1FA6523BCBBDEA5D2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 b20f216dffdbf70facdb312412b3c1e16cf5650f1b8cdc89a63b11b568fb197f
MD5 9df1472f976c2de156187d69602a6756
SHA1 d6748e2c814d3cde5c5cc2181635c12eb5cd0342
SHA512 55fc05075258f08bfd48c0dd41b0d27a9627bc345503a24b368dc4095c5c3bfc70392aba7b5c52bcd77cbc686f6fab450cb854347ab93319bfc859db761ba386
SSDEEP 12288:Rd+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Rdyxknw4FYnshx8OfVe247
TLSH
T1E76523BCBBDEA5D2F50D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 2b262760bad488ba416fe417b25f6e7c43628b7e9e1899f68f0a7d27b47a1c92
MD5 7487c6a276369aecba153980c9e8ae6f
SHA1 dfa4e42b7d94b8f629e6792ecdcdb0f79a277979
SHA512 681491cffd54da1ebe0345e3e691ec264a986a8b8aafa5f079c7f8d879139144994bb5301a91a1afa956a775f9bd8332fee9d1e74d672915165a95bed702c427
SSDEEP 12288:tyPz5L8m+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ezymyxknw4FYnshx8OfVe247
TLSH
T1F475125B73E530F5D13A4236C9621612F372B8724B3086AF87A4537A6E725E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 4d183dbd3be5e597f345078019ab784cd1e6f98bc39c456a028fdb04ee54b0a2
MD5 3dc9db7e2a11c797f182c0e2be1a3528
SHA1 20f40686a7a4f802c897bfe9937b94cf5145733f
SHA512 569464b223c25cf91bb9231539b619fb603481e24c0aedd9bc7a6ab057afe55cb88121e1305d47f1effbfbb9bed48c692723d6647b6e2a70529e0de679068635
SSDEEP 24576:5TGaLl3z0zDkyxknw4FYnshx8OfVe247:5TFLljix4x8EVep
TLSH
T1A87502A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B9F736A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 4dd361b463645bc0edd3555b3b63946f93228b70a2f46c5a0fa42e7cf2c9580d
MD5 ca37a6988695eceb604d102ddac5d301
SHA1 e216b9d607ee568cbb5438c7672d677dbc641dd1
SHA512 ef55a51f79ae6074ac7a36f459f87c3adbc0efd4c4ddebd5e2cc2a5d2fad319ceedc298c90e2460ef97685bae41280cf69ddc7def089e77654460a206851c410
SSDEEP 24576:F3Xd9CHKy7GZgyxknw4FYnshx8OfVe247:lXd9CHKyahx4x8EVep
TLSH
T10B95CF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 7377cb4f98617074024184513cbebbd3df0f7dc2f5cebcfb5de597fddb6164a8
MD5 61af2f89b33965e939c7633098116a0d
SHA1 8d09c7b75f18f4e386643af417d8f7dd51f4747d
SHA512 a8fe4c06407227b2542cf5777ef46c500c5f7678e5feec8a7ff679f75b7706107746904f9f46d4af978e0305b2dc4fc2548cd7d25f3bfdef6b18dd47736964c1
SSDEEP 12288:Y0+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Y0yxknw4FYnshx8OfVe247
TLSH
T1036523BCBBDE95E2F50D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 4e6bed491b5632238e68a0f91fe0255e35c359d8dfd27fc95c8c66e403809bf0
MD5 2eb61c3b6b390363b64cc6a99f02d9f1
SHA1 026c9b83a697e54d789d9b35754873a6f72b12de
SHA512 2713f9491b5b41419bb3b2031c2b3a1ee0f14cd981dc7504014aff55b2fe4f189569ddbf1dafb26dd49651d20043103ba06d2f209fbd17490d13bbcc8e9dc22b
SSDEEP 12288:fG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fGyxknw4FYnshx8OfVe247
TLSH
T1076523BCBBDA95E2F50D11734B7163626609B6A5EA71811BCB7DB00EF1F0C60A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 74127ec6d4128132b9c6d00e98d069c52708f0fc35632920e052bf365538b13f
MD5 9cc46e9e7eec69f1f0b6ad8fc83dea8e
SHA1 d4112f2fa085cf9f98aaf5156306638d6dc75f03
SHA512 2cb693f3ec962af7ea51629e18757ee60f4145dc654de269cd1c2c3e31440783ee72dbae68b0738efbc86479cbbe33966d8a19907970f524c1939c12485b30d9
SSDEEP 12288:7v+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7vyxknw4FYnshx8OfVe247
TLSH
T1D66523BCBBDE95D2F50D11734B7163626609B5E5EAB1811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 927c0165b2526a709ecd25f70530c4d632d9b1c5a1d160e6470e095ca3f4c44a
MD5 dd8179fe08c174b4369d423738da4243
SHA1 a5db77dbb78f13412065c8f92e897fae728b9ffb
SHA512 16cc790405773606dfdfa9152524db9eeb53e53465b3f1e9ea99d130ae8d4114dd3bdf5093e9279464740983a998807c669a12dc78cc25b52edc27c36b744ca2
SSDEEP 12288:id+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:idyxknw4FYnshx8OfVe247
TLSH
T17D6523BCBBDEA5D2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 4b38c92e8017b2ed4eca6885b67ab40036d872281b9545042f5d5fcafbbc0675
MD5 cdceab4b464d0cdeba6d1b4caa5ea906
SHA1 ab3bd3f87a911aa6408ace345451df0bf2a37b26
SHA512 072f5cead2220dbbaf3917b9d30f4a415130c5d902eaca43c8468cd3e420cfdf42c29366d47ca0ba25aa6a97ca3d6021985ad494abf44c2bfc332e1e0637163e
SSDEEP 12288:N0+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7T:N0yxknw4FYnshx8OfVe247T
TLSH
T1CD6523BCBBDEA5D2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 445ca5875bdf81b31e4170b74b329edbe07b3cfc3e17a4909950ae0eb3406d1f
MD5 ad85eceb6930708e15bab3952477659f
SHA1 12140f3989ece565c14fb8578fa4129959b8a659
SHA512 c30ebe1fb7fe07193b9307565e64fbf8ec32cf725a185203021ba8a529bd211a1eaa9d8c0be57e9e17f431b1aaac8d3ef2a06d5ed06b0100c381f5cae04ac761
SSDEEP 12288:R1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7T:R1yxknw4FYnshx8OfVe247T
TLSH
T1E06523BCBBDE95D2E50D11734B7163626609B6E5EA72811BCB7DB00EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 cc82d3e80c409be6186dda815e086050b706dc5fd6dd046ac0a7eecc74690c02
MD5 f2b6a8448db25cd7c7a98e2bd3a4ca62
SHA1 c4c973950ad0a8bcf844208a52797cc38a0690e0
SHA512 dad11762db19cc8997e0f142e34806dc2d9c2d5496921ba6bf82600bfea31f7bfcbb3e481dbf4805f9d8d890daea3577862a437bc9574b2acddb918698b4c311
SSDEEP 24576:gfwvJk9RX6wkyAIxyxknw4FYnshx8OfVe247:JMnYI0x4x8EVep
TLSH
T1A395CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 788cb7a9a2c3746f6d163b71449e03afa37b488036ec1ce63af78b9acfd93b6f
MD5 63c849fb165a23ac31e937fa3e968a85
SHA1 fd31875b7e5c619fdcb8a30237b9f14a2a87f987
SHA512 67424219737224d4d504f0cdfd1f74f9d776d41c8c0b6225e00c6dc6bd0f34b119f10d2e70466305be54833ca96dbacfc7fa30320410b1e2583b0498f9505c2d
SSDEEP 49152:AYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK07x4x8EVep:uySzPjix8EVy
TLSH
T1CC066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 05d38afb762f2b96e9befec640ea495090da71cdfba7b2eb0b0f6ed4c273f4ca
MD5 918c0133a7aff30fc68b5f6e66f9432e
SHA1 c2239287f2b4dd24a125657cb8e3f74fa0fbcfcf
SHA512 b818eace2244a7230d389371547c00cc4b64aa0f817104b440b491773134d3745b60dd42404429573605e8d74055d768248ea0ed8421a3e0d0bb990f36e99010
SSDEEP 24576:L47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYSyxknw4FYnshx8OfVe247:L47JUQj1irIhCnDHUPfF/rx4x8EVep
TLSH
T16B65AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 f8ef361cc7e0ecbd209181503663471fd9a630b2f9c383a118528e8e44606a7b
MD5 0593bd396897fe521130116f8de8be59
SHA1 f44f54744afcd55f52ecde54e6c52d12c1364ca6
SHA512 8a0c68d48d261199a3e0589572a864dcd1fa1e99b79f0581a4ea084f943a66e1612bc565d37f947aeca1e5ea1c1d0996bf815397dce87c50e5e503a410969e1f
SSDEEP 12288:2+sft+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Otyxknw4FYnshx8OfVe247
TLSH
T12075F028E29802E4D06E2276CB625641B3237C6597F1D3CB97D0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 4713b7480a36b53957d1d20e4c5b6731f39d5f8851116964c960942e246e7405
MD5 fb5e90a7f2b23c6f51c52077f514c736
SHA1 14cc2ff7b4b6ef574144bfaa3ec57ccc67277b66
SHA512 676e72c7d557081ada0f2cbcc63b926a3100f2f29a356053938c8f9d4309b7ee93ebcb3fceeb4a7dbcc9940dae620cc7d87b918fde098899a9d5ad8156dcd83a
SSDEEP 12288:AAF+j6KrU3fQJWd6BcWj1evysKLUkgEcE9UEUwd8:A8I6QUPQmWIv+QbEb9UY
TLSH
T11D452850762AD75FC6A940321E32D2CCA7707C11EE45AF0373C98B3F9576669BAF2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 de13055fdc50c5da741b1ce74029691427f2809aaf606c1e3c6a4b757e438911
MD5 8d4dd7379989b8723feb4347a0a1e771
SHA1 ff44be7863b3579c1a7951ae38a9e479a09cf512
SHA512 70bb5a9d60c94624e9c43dafc49762fbeca9cd89d9515da3aa7f0147abbbe16b1caea9611333f183d97ea0dc32f9e5f645d4fe1c4245de2a8de9bca26c172f03
SSDEEP 12288:kpTN0Sqhd7rzWYXWtM9pMZ68m6pETvX/v:kpTN0dlrzWSWtM/MZ6B66vv
TLSH
T13465D8819137A2CFC1F7603207265F8CA774EC56B7456F2673C8443AD86AB25B4BA3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

755509c0b05c2f27.bin

Path C:\Users\Admin\AppData\Roaming\755509c0b05c2f27.bin
Size 12KB
SHA256 608e0e8e2b8ab9b7aedf935a673effa8dcc0e380c302b74f1099299cc38e51db
MD5 3e1c6d2aae99701e1113cde8eb8a53c8
SHA1 21f7d96ec7be2f1965b2ab4f3c0c624792db6c04
SHA512 2d25a54003c7bac4984ef6be3ea92b766e891a2b0ca51572014254cae7e11c2121c9fa5a181fbcaffdcf86c57616378ab267dac288b4c4c67d120225126c21ff
SSDEEP 192:zKI1fowYwpbcVLKhEBOXBP984M4hXuXsPH9zcnBiAOEDbdd3ohtQJXy:ztoXDOhAO5G4M4hXuXU9zUDbzstQI
TLSH
T1A142CF6067C5764CE3396B99E9F49C18DC3E40EA9623E94E070ACC0ABD44596DEC1507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 e828ee5efeba0d65f79190fc8e5cb9eaa7d05fe70411ff7b0c7ddddfa60c2e18
MD5 ca0083d729709c1dd1366b8d937c0709
SHA1 fdbb5a23e97ebc2035e8eee31f47949def273664
SHA512 6efef6a684761162724dade3c0c6047c91103f10547bd3c47001676d5b44e4874d03a134db33600dc2fe2ca3a755930f49f146c9d26c9e99c52daaab4f9eb360
SSDEEP 12288:l47F+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6Fyxknw4FYnshx8OfVe247
TLSH
T1EA65237CA7DEA992F86D11730676A231320AB5B49B70C1DBD728B14EE0B0CD0D97E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 24bf6ee18a5b5f8a1cd00e8142cd72f283cedbed85313df7b94e8b9a0ba5c199
MD5 93fc06820b9c0b325ca1261bb4bb7878
SHA1 3269f4cd6fa2c7e267ac72ec96edbf04b9247a02
SHA512 dd6978302c66c2e7f13f5e7ad02449aa572a9d1825e18c87bd93e58f3799b92bcbd4bf7df32a1bf001b366635662d6c0bbf3ac58770a95027d1529c8c850ad97
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bYXyxknw4FYnshx8OfVe247:xgb4mBIBhGFNx4x8EVep
TLSH
T1CB65AE1E22EC02F5E0F9D2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 990e273fc64c5904d95e2d8b317d923f1dda1e9a91745b863da72f039f0c9a50
MD5 cf2ff5a0af86ea417b2aa84942340536
SHA1 c95e98ad8a717abec5af39aa2e15d630eaa01de8
SHA512 d7e06789468fd9cbc346b2625ca2e725052a4070de0d8e1f25dc48d07f522a568c1df42ddc72133f84c705dd5a6bcca8d3201c05a3e09a74cd3b60cf5872bfa3
SSDEEP 24576:RG88u8FpJqH1azria7/miyxknw4FYnshx8OfVe247:07ZFPqVla7/6x4x8EVep
TLSH
T18995F16877E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 180b78df2dea9f958c551afb04d520892f1a5f072a824aab731da8872d105a80
MD5 17750e91c52e7c47c2a8253e87b9f0f1
SHA1 bbe657c3b1e31d970b265fa14e3bc6235c35b10d
SHA512 4900279ebc7a3ce0ef498de1996cedca7b254d9b00f19088c47741167f22276e3c5186e4163078d20b78a010fdf48babfa43e0ee178aecd5a056a49941d34848
SSDEEP 49152:fBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxx4x8EVep:QG05lO43bMix8EVy
TLSH
T131D5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3e2c2083cc80b8a631f78abbbc3095dbcdf80c0afeb8b5544eecb3d04e3b2de4
MD5 5d467d89446b3228887aae1d0d104c4d
SHA1 d6743271c06cfd4617578d5ef99e9dc90cf015a4
SHA512 3cb0cf467e1cc9bcd02cb65bf647d145bac5f083d54b03323a4c40d35ff47d2d64f7f3ea4e8f54090469c400c8e5fbaa77c805052443e5058c6787e29dd1064b
SSDEEP 24576:Jfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnYyxknw4FYnshx8OfVe247:Za5POZ3+Jt2pasx2+m5x4x8EVep
TLSH
T1A765AF5DA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6d9620dbc2297145c1e7e78ed8756149cedec05f304a4087157a26ebdc854632
MD5 3e8c1baa93a25f9fde4555e95dca9539
SHA1 a61655ce3fde1a4f38f7caa5594af6867a5631a0
SHA512 e28c5b495f1d9242a973fb8d1f09901a675b97997a6b92a4ea1f30318ef8c6c274e2be0a268a4bbb245f9d877b127393706ba6064ed81aaba3c3a12e82056eae
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7FkKyxknw4FYnshx8OfVe247:TNc/zEOVHFax4x8EVep
TLSH
T1DC857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6e322c2db183006158f532257c8c94558a2713434371056540a430091f0722a6
MD5 6a2df821a0d0f39e532ede2768f41c05
SHA1 8db95a93ad5bcb59c250804b8fa28adb7d732e10
SHA512 576015f1638520089f97e1a17ecf72da61c435eadd6a52dd0764a851aedddaf868b2f37f41a5abd1bace47cde6ae0ffd95ef60cdec5d75dbacad742036b7c9bb
SSDEEP 24576:w8kNvNnaFeYhJNtmZBm8yxknw4FYnshx8OfVe247:w8MwBtOmXx4x8EVep
TLSH
T14555AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 38a78a3bfd29b2b2fee3435b41ccf36876b2b87dbec0914241e03a111ba5ca96
MD5 7c870b0a710355dac041f2fbd4718d88
SHA1 f4d9610c373d7e7eef5a86e73e0cf686af90ee5f
SHA512 96481b0c386f52d6db7faa4e9556894582a7cd011ddbe8048c781122d29bc9aa065cbbab2fd580fdbc1d5048c7a08c902161c94afe7fbd0d5673dd6e1e6afb45
SSDEEP 12288:SHvUrBFrEjwaQu+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:SPUr+NQuyxknw4FYnshx8OfVe247
TLSH
T1AA75F12E22ED18E5E67AA17D89928319F771B4621711D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 c67afc837e014209857698d87725a12874ca0bc7d1e68796e14ac33d034668fa
MD5 d3b26d42b5ffa30cd1d29d7e26966c9e
SHA1 53c50f39e4d445b52733b5beb6fbca43d4b34540
SHA512 0814e4f2b8c40fc28863095ba04c37e50acacf86b42ab9869762300da1ef6c3e6b0c0049f38b0d5c3b759adc6c6920794fe944ca8768e10e5b2d6ffdb4103ffc
SSDEEP 24576:+D3FHshBIYQgA5yxknw4FYnshx8OfVe247:+DVHeBIAA8x4x8EVep
TLSH
T1ED85E17DE79C04E4E47AD1BC8A638606E77138A9033256CB02D491BA5F67EE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/880-84-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/880-310-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/880-82-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/880-90-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1264-36-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/1264-15-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1264-42-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1264-40-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/1264-37-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/1712-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1712-25-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1712-116-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1712-26-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1712-19-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1792-148-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1792-150-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1792-153-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1792-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1792-142-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2460-181-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2460-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2460-52-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2460-45-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3268-344-0x00007FFDB5DC0000-0x00007FFDB5F66000-memory.dmp

Download

memory/3268-345-0x00007FFDB5730000-0x00007FFDB58D6000-memory.dmp

Download

memory/3756-57-0x0000000001BE0000-0x0000000001C40000-memory.dmp

Download

memory/3756-56-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3756-63-0x0000000001BE0000-0x0000000001C40000-memory.dmp

Download

memory/3756-67-0x0000000001BE0000-0x0000000001C40000-memory.dmp

Download

memory/3756-69-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4192-118-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4192-327-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4192-329-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4192-331-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4192-124-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4192-117-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4420-95-0x0000000000770000-0x00000000007D6000-memory.dmp

Download

memory/4420-94-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4420-325-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4420-100-0x0000000000770000-0x00000000007D6000-memory.dmp

Download

memory/4948-72-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4948-78-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4948-71-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/4948-295-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/5164-0-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5164-1-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/5164-9-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/5164-13-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/5164-17-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5236-328-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/5236-130-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/5236-131-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5236-137-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5280-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5280-348-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5280-104-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5280-349-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5280-105-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5280-111-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5616-439-0x000001D4E48D0000-0x000001D4E4AFD000-memory.dmp

Download

memory/6132-332-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6132-158-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6132-164-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6132-157-0x0000000140000000-0x0000000140172000-memory.dmp

Download