6b503fde649a6a22407cd5e01080c62426678aac87300c21c39aa3a08084166e

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 06:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.9MB
Sample260823-g22l6stdnb
SHA256 6b503fde649a6a22407cd5e01080c62426678aac87300c21c39aa3a08084166e
MD5 7851ed616ae4a57bab6578e74f7649dd
SHA1 8958f07662fd34eb8557f916ea021d6e00eb1aca
SHA512 4a841894098dc604d019bf85e7a83ae143405b9d70f0d936827d004455f82753a2ce3cf5784a702b948d69e1baebd763f8214e404ccc492b1170ce7c8d41730a
SSDEEP 12288:K23Jh2CPCcnWZ9bv8XqFS2yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMk:K2LlQvkDrCaEzwAyujOhcid/RrmpF
TLSH
T1FF95BF0267E505A8F9F7A73899F69121EB737C855B38C64F0298416A1FB3F80CD75B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5368	elevation_service.exe
1280	elevation_service.exe
4500	maintenanceservice.exe
4560	OSE.EXE
2904	PerceptionSimulationService.exe
2008	perfhost.exe
2684	ReFsDedupSvc.exe
1836	SensorDataService.exe
5688	ssh-agent.exe
4324	AgentService.exe
2488	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cbc3c2ae23e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dae52c4dc732dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a711f94dc732dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009fb86990c732dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076cdc090c732dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005c9734dc732dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000de235390c732dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000acfab64ec732dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eaf5fd4bc732dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e09a9a4cc732dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084485e4dc732dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5368	elevation_service.exe
5368	elevation_service.exe
5368	elevation_service.exe
5368	elevation_service.exe
5368	elevation_service.exe
5368	elevation_service.exe
5368	elevation_service.exe
1280	elevation_service.exe
1280	elevation_service.exe
1280	elevation_service.exe
1280	elevation_service.exe
1280	elevation_service.exe
1280	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5308	2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	5368	elevation_service.exe
Token: SeBackupPrivilege	2684	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2684	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2684	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2684	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2684	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2684	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2684	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2684	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2684	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2684	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4324	AgentService.exe
Token: 33	2488	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeDebugPrivilege	5368	elevation_service.exe
Token: SeDebugPrivilege	1280	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5308 wrote to memory of 4964	5308	2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe	91
PID 2488 wrote to memory of 1848	2488	SearchIndexer.exe	103
PID 2488 wrote to memory of 5552	2488	SearchIndexer.exe	104
PID 2488 wrote to memory of 5508	2488	SearchIndexer.exe	105
PID 2488 wrote to memory of 2484	2488	SearchIndexer.exe	106
PID 2488 wrote to memory of 3436	2488	SearchIndexer.exe	114
PID 2488 wrote to memory of 1328	2488	SearchIndexer.exe	115
PID 2488 wrote to memory of 2736	2488	SearchIndexer.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5308
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe" uninstall
  2⤵
  PID:4964

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1280

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4500

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4560

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2904

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2008

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2684

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1836

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5688

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4324

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1848
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5552
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2864 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5508
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2896 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2484
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2864 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1328
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2896 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a8b8cb82049464ad44526f7c08d3b79819c68787c54b853da6c2da4eb22a20aa
MD5 bcfd517de86875bf9a9c58537f9fe3cf
SHA1 fda0ca3a02c94ce19f4cc75ee3a32b7e77ab4961
SHA512 95113ac62aab2c1d5b1410ef21bbe2e08b852b38a21b64e0593ca1cbe99ef7eed8db264f612c56c45f1e54fee46683854384c8b9d9da8bd019f85f365d9d9576
SSDEEP 49152:Ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxngCaEucW/Rrmp:O3q6HjB4nudRSp
TLSH
T1D8D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 097d8b431d6d11b67c5ab20b92837c87954f1c4cdc54df60528447866fbc7771
MD5 fee4192fcd870fa69bb0937607383df4
SHA1 9b06dd9132b2df79f1ff79842b698cb734c7867b
SHA512 c5c0d9b8c92b864d024f08b6b2ca4fe19e2a29d239f84caa832ac230fc0208d9000ee21a079c7551571e6ad558257304cfa8ffba1b63dee162f2c8a90612ff21
SSDEEP 12288:d1XLsswWkxy2lRq2czAUyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:TXYfDtczAVCaEzwAyujOhcid/RrmpF
TLSH
T18085F129B7D509F9ED678239CCA28111EB733C5147A4E7CB03A8A9690E333D45E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 25b7cfb88f3948dc1a262e06820ee3b0e9dcfff3e46946b34d435fee6f6b24fb
MD5 5c86ffcc6682e8192c273df1ece5348d
SHA1 b1a0103a15c554f38a22143a7ff6f05e01fa14a9
SHA512 6c50ce294be392249c86bc143c23843724e2ca85a2a55c1df394dd91a59425b86e4dac25c3103ebacfa8a5922eece14c78a1d345d8e337d0c3bb39872be6549c
SSDEEP 24576:K0Le5ji0hmxCrMICaEzwAyujOhcid/RrmpF:KPji0A8PCaEucW/Rrmp
TLSH
T107A59E26F6748331D073C0B9C5D2A69EEE71308657308ACB4286D77C6E67BE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5324325dbc318b7d73c9a219a57371f13257464d984725fb68bb0b73bb4a987a
MD5 bb3e728a34f79da2475e911092b00225
SHA1 a0d5e47101cbd028a8bcecf9d18d47fab824f789
SHA512 e61994d862baa475779775dee0fa039bd895663725003ac7f3c7f06eac678cd657380307ef3f7aca1306a0d34ee0399763643e67901a4d7c0053f3a09f29a460
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWE6q8wyuWCaEzwAyujOhcid/RrmpF:1/ezSC6vUzPvxHjy7CaEucW/Rrmp
TLSH
T1F9755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3248fa9d25385a7d3bb281f7678661ef996c6ebb008e47903fff7ac52b55d7db
MD5 d25a112b32ceddf0784ddcbafb769320
SHA1 e305144e4585f10e7bee0716dd2b1f89f67c9ee0
SHA512 3347c1f904a8697f9e57c86b343fb8583d20686aba2c1e7b4d26bb165233a84489adbca10809f057635f21781b3f3ca131ee3263ec4128167b77c9e078fe7d4b
SSDEEP 24576:dVbqPb88hv/l+6ZCaEzwAyujOhcid/RrmpF:dVO88hXl+0CaEucW/Rrmp
TLSH
T160559E66F5748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 42965fe400b45db81c9db1a9264964bb898405dbb2ae650ad0778d48a00223c5
MD5 ba6036045b9b2d4a6721da23c8abbef2
SHA1 60af84509c04b81999013b755157413fb5533eb5
SHA512 327f3a47cd54ebb610cf8e3c3efbd0fdef14a940397b3ce5667bae461815ff33627a77ed63eaa65eaf964d7386dd70adb03e2b90c83c8dd6a981c0d90d69f89d
SSDEEP 12288:9ENyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:9EsCaEzwAyujOhcid/RrmpF
TLSH
T1AF752337CF8997F1EB4A67331CF61024DB562C9625AACE8FB16DF6AD44BC6C0C849021
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 ded6f579638c638b373dc64de065ba0dd8560f929e7f3150a327c36f7191309d
MD5 f8b871c2c1413a23ac2e829d964ccbaf
SHA1 008fe49e65f52dfa19254c7d3ce3c5d4886885e4
SHA512 66c0f919075505bd74fa283866b731b8f4cb2d9176a3b51aae0ae1f688de5a38714a1a61200380e44c7afa607ec110496aabc5b54cbd4597cb914773713fd414
SSDEEP 12288:heBNUbTVO86UQyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:hJIUBCaEzwAyujOhcid/RrmpF
TLSH
T14685CF3BEE28FCE2C27E9D795A918200D77278714B6293CBE169C20EDE235D05D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8ec605a0b687f54449774a8de408fe2fb8062ae7f1ed0b70cac35ddbfbbd76c5
MD5 76bc2b03fa5d1f56ad2b1390d302539d
SHA1 901d99f69f7e065e8f484f90d41447180d6624ce
SHA512 ba985e71baf592460edc4efe272b009295fe3e3e9b2b522befc5f26f5c87d4092c1eabe373b041a8c31c36f9be5a0ce7ab65ca7f6724d6df06432e5d69ab4015
SSDEEP 49152:vQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH+:vQvGAdlCEL8c/yRNw5CVnudRSp
TLSH
T174267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 76dd3391ad2ba275a490122e60a222966fb5e37c03ef8953eee737c38369c818
MD5 318739367b6f4bd7ead7dcbbedac20a9
SHA1 64b7794c9224aed94c106875b511328c86c0f6bc
SHA512 f25bd95e0f4e7abfdd37a1ea7a5859d2ab1e9758fe4662240e0e8e28b3718d04639061229ef9537331147a1dc4fc0acd677ea8565a62041dec99ffb2a2d911d3
SSDEEP 12288:qAwSfxL/2Dc34DLLmt0LDQewsAjayCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm5N:/dewsAj/CaEzwAyujOhcid/RrmpF
TLSH
T17695E031FE74E032C77B0EB21B36C316586D79604B611AC3F3A89E9E49742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d39dd3ed42780f6961cd06a5fa7bc1a30501013f2ac80aa9c70f3d227d7f77a9
MD5 cbe124bdcfba4243104f0b5bc83f23d4
SHA1 5be483832eee9c638ec3e2c731c902cf045e76c9
SHA512 66dd5bd8b8c0a2d693c5d447ad6fc2120d71963f929ddd89bb477192343604a9418285f1eecea0778c6b78f5e7de1b471160f81c311d7191a853612ae2313899
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHynFp:mUEtQevvqc2W1cpV2EI32yn
TLSH
T122474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ac69a8f9f1b77b2921920996b768ac5f0321b77b0d43705296681d9ada5ab0ae
MD5 626c53db430eba404c1b465ee5e607cf
SHA1 fa474176463b1eb05f7b4851306c76f44ec42d23
SHA512 24a24d63ff94a995d63ee47279fa5541d40d614634ee41dc97e9c99e0d0457cec3dce4793c40293cccb76d1577d26adaa4e7e866b35fcac02a5683a7d6a82aed
SSDEEP 49152:nCbRquA/m2yL5zLfFiV+XenmE3/zfCaEucW/Rrmp:woq2VjnmhnudRSp
TLSH
T1DCD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8899c2f07c5634de2291029993519cfda8e119d7ddb46c4137bda5bc3ea9a1a4
MD5 36879d4043e3c6aabb1a39f296c6cc95
SHA1 f64c195e7dbaf19ad755c1d0e99515fab4b1fc45
SHA512 8bd2afc824be1f97cc048926c0f498d81156b33cd909d0142d19198a109397bf95ff1c653903253a835760b5aad6c1e3e476e09e80114a3298c585083792a42e
SSDEEP 24576:tAhGLJIFoiwtA5l7S53SCaEzwAyujOhcid/RrmpF:tAMyFoiq5iCaEucW/Rrmp
TLSH
T1F2359D81EBF955D4F5B3AB7899B68170EA76BCA65E31C20F2164D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 bf133f7202cb158e5dc93733439c9fa4201803cdeac6b124912dc68f2cc1697d
MD5 2d2566bc77b794950342709251ab3fad
SHA1 3fc99b94d5c7f097d9b75fc0d8c192435ca25e29
SHA512 fb3f2019bde5a74cfd6d32ad057eba7a016239321d59fb01cf5dfa8e9b2377605a128d19a4a7a11ddeeafb6b8d0d9d7d50044b98f81dd87be1798a7578a53f69
SSDEEP 12288:jmw5HEjsChNyBFgl0WDm+CbyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpD:iwuLOWbCaEzwAyujOhcid/RrmpF
TLSH
T11B85F14A77A80CF9E967923989978135F7F27C022A25CB1F1364C65B5F37360AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 041183e11a04840df088afbc164d9c6031c557474bc1e9eeeb90f0dbcb872b72
MD5 d34f99db3ba018767f3a600a01c62cac
SHA1 c9ee4732dafbe97224bc6ba865b6d385044660fa
SHA512 9bbe5fb0f07df30e5d52d52f5f554795717b41c414bb38f202b0e9da7f9a637522c2cb25958180ee6d45e6118400bb29c615b5f98d36492a72ff92da0ab15532
SSDEEP 12288:WSZ1IyqyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:TZuQCaEzwAyujOhcid/RrmpF
TLSH
T1A875126B67D462F5E697533A8CF10104E7B23C52237683CF2668A26E1E76BC15D39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7431c212524e9500f9c53a0107b8d454fdabd12380215e6bcd99782326571f80
MD5 f6f02df4e4222d07b323d0ac9fd1a36c
SHA1 37666eb4885146780681f451c7ceed13507dcf64
SHA512 9bfdcb334c1210358f987a141a71c641f09618e69ee5b329772cf58ea4fc0b4feec96e0a0a29fbac171190770c4bf8a8c446eef2420ba5750b2c248daaa0c2ed
SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:7QRQyi36YOcPQLvw2gAf+PN38nudRSp
TLSH
T11C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 81dbb9ff832a66d1c7d816b937b067935cbfc36a17f1ba58e7a4a4f1f7942756
MD5 8c6e3ae193f9b4258141f5167f65627c
SHA1 646424344a9e72b122338503e3f09b85b7708565
SHA512 cb3673f5bd3a84924af433a7e6f05a724cb9a8275c5d7c712cf8d92c2a3dab140ee7cf51b82ebedd26f59dc9772ac06f692a4d73fd3c7dc884955f129fea75d1
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:XQRQyi36YOcPQLvw2gAf+PN38nudRSp
TLSH
T1A3667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ed43b4ddcaca52e7dddca27cd5fc4d2e02caec50bef249963eb5a1cef50cb178
MD5 83400817d1b04a73b13d69486a8aaa9c
SHA1 1b7f2457942bd0c250b42bf4d15ace66759c5b96
SHA512 c9b6426ceb98c16e3e29f423a1bf296f6643668087b6c85888cf3d71cd8eca8db09a3e249bb17f4c54e0a37e3b87529c5afe70278d7398cd92bb119876a1135e
SSDEEP 24576:cwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0gCaEzwAyujOhciK:i68Qg55nhheWu7PNU3/PCaEucW/Rrmp
TLSH
T199B55A33B2F600A9C44DE1769F4A873196D27C758FE0D3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2fad79e46a4bb3ee0401e3920430c0d9c20addbfc47ce23fb6f3ab081ac1d07e
MD5 726dafb89685578c61551a0db0cd9c5f
SHA1 0d4570b18ac8db640cef7785ea3eab5f443cc731
SHA512 0f28ebad624287ec46d5635daf9a48989cbe3aebd3120da841c1a8798cf2875e3f3332548926b638a763d21faf22645995e6bf432e7c5801a6f469daee89484b
SSDEEP 49152:w3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk990:9y5112gYy5azzVvL69nLKnhZ3nudRSp
TLSH
T195168B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e8944b3000b5623a104b0de0e5e44fc8e37b587ada75cd409a0558edd7bc7cb6
MD5 49ce35e783f30ac8cbe80dc737316092
SHA1 b597477283832229a688521b38f2e78547607485
SHA512 9e83ad4aa800246914f795af96e3bca5f95efbc326e8b2e31a56338f7a8e2186267a5e470023ad6419244a36a1b23ff9fd5d0072a1b9013fc58b87bfe764592e
SSDEEP 49152:bB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glrCaEucW/Rrmp:Nu6JmVxd2dWnudRSp
TLSH
T1C9D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 10b974e814135db472de1ef2ed8cad84e421d5d2ace9dd503dddc4a3f41b7a84
MD5 2f24c65fa1ec6573e5e38982d5b6925a
SHA1 06bd805a4b8bf9543050050f1526f406840556cc
SHA512 5402f8245302f6dd77d4b54dc37a006e25e6fc45aa8ea82190773b607029eb1e4f5853ecf3d86a3fb608b9d54066f6b0c277f4239a9af3d1ac4f29ff0770d212
SSDEEP 49152:d1hpsNoJpF1A6UU44CwH7R4xhCaEucW/Rrmp:dmifPbRhnudRSp
TLSH
T169B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 13c62a416cf251494d0c9d3a3441aaeeb43bf85a9bc3efbe828fea62a4ca3d85
MD5 27c9202d7732f12cb5533e46cf2e3830
SHA1 7c7a4977f2d37a6e138c0523705b3db95d696470
SHA512 16aba41187926856a5be90df66d9bf73b19b30a8716d4ed80608d4c9f927bda2ab44a9a1e960bac5f3b26b9af786a1aa06ecb139f2198d8d75657ceb24c213ed
SSDEEP 49152:dSuZQIY0Be2KRRVtOnks6NMHqQCaEucW/Rrmp:z5dKTi61bnudRSp
TLSH
T1A1C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b15bd40f031fcf8f43f213e4816690e15a69c9723227140884a806ecc57b447d
MD5 f06de426eec35aa4ae7b8b94eb18fd0d
SHA1 e7d8f6cd3c1ab82b2b1af1be0d9bcd47acaddfea
SHA512 719c7d10b283ff79900329caf3599e28f5e6e9101191d7c68eae353c28d832906974e0ecb92aa1ff83c68b0e6099b170e1f539d722af612e5ad328c76b2e2c35
SSDEEP 49152:KhtSn8EApI0figngiDn0AP5wVCaEucW/Rrmp:rX2iyph9nudRSp
TLSH
T17895CF13F2D901E8D05ED174C7568632EA62BC060B39AADF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 74f5ad84c0b556fa2f029c28abc9ca42d8e29c819c8b5fcb1352c3b955c839a3
MD5 24bc100576bfa97cd8778664b93edbb8
SHA1 595a872f8f933b17d8c9b4bb981761090454d892
SHA512 7ea867b186077b3f8c8c84b89a68711f134cd35b369b8a5c35316707d182aacb7b7b4584fa0059ab6cbc713668bac2207a35733dabb68878133e105e389ed4fb
SSDEEP 12288:zVyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:z0CaEzwAyujOhcid/RrmpF
TLSH
T1CC752337DFCA87F2EA0567331CB21064EB993D9776AA868FB65DF12D44B8BC0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 3fb8f5d3b29a1c226b2cda3b001914191a1279e03a210e5a73502e2d7aea6304
MD5 5a595ffec810349fd9813ba79e1a6a61
SHA1 745e6c508a18bee10b571e8dc9c9e7e4ee23f705
SHA512 f42d3ceb5ef609df621dfa8c99168d828ef6b46aa56eae8c257db78663b1011aff7ccdcf6b3cdc34d298d0ffd59996fce5e8886f1f8425f3bbbe8ce8d9e3487a
SSDEEP 12288:6eyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:6TCaEzwAyujOhcid/RrmpF
TLSH
T1D2752337EFCA87F2EA0567331CB21068DB553D9776AA8A8FB66DF11D44B8BD0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 d1e70af90e85a7d26e76cc231ae6fcdb52cfe51da75ab30ad8f74f8ae626f67d
MD5 5afad4a17a56e0feec87ed0808d0a793
SHA1 64b7877c436fa9756f3c312f23b8c1f3bead09ec
SHA512 1d5df958a4e0beabb5a378773264ab73495948eeb5afb31567bef5f86c82ac4f9afb89ce1084b43bda465b18f1b250fa5ba4d8b11b94ca88cefbf094d2126b0c
SSDEEP 12288:7YyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:7pCaEzwAyujOhcid/RrmpF
TLSH
T190752337DFCA87F2EA4567331CB21064EB953C9776AA8A8FB65DF12D44B8BD0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 1cbaedc1a34d22f84614a5e2f9395e64119b3a69b9be1e2cc1a91c226e3b6ab2
MD5 91c1d3668d94b5b9a270d2a547ffba6f
SHA1 dd4f3c975b5c5bc55d8bd8556aa1877fa20f089c
SHA512 28bd1c2db344c3b3b70ed2863ea94d85a5b3119d30dc38fef5cf7573516aaa8518c5375179ece1b47537bb43acab0dde0abf01840c46766853512fd17378d6ec
SSDEEP 12288:ZVnyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:uCaEzwAyujOhcid/RrmpF
TLSH
T196752327AF8A83F1E956E3324CB21024E7B63C966776C7CFB61CB55E0CB47D05869620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 096b73ddb6ceb19204c2cb2d2fa7bc5e2d48881707784aa81aed7cbb9720d911
MD5 c11bff184aaa7fd7e05d738eaf3555b0
SHA1 d300cf2619d7b45f894c7c1006df72c6939eb1b9
SHA512 b4a952c58e9ebe8d152a3b89c77338e9a15f4ef1e0c1de8173d5f8933ec648161f59028593cd5222429a6281498e8122c9844b8346c70ab8d0f25453531b6569
SSDEEP 12288:X/yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:XqCaEzwAyujOhcid/RrmpF
TLSH
T1EB752337DFCA87F2E60567331CB21068EB953D9776AA8A8FB65DF12D44B8BD0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 c5a19c23e696e9501340c808870ce341cdf927df3698b2abfbdefe0980092a09
MD5 b4df099ec963d943c542fd813353a492
SHA1 247f010bbe9a98cdf9fab9b0ef48e4a87c182852
SHA512 7281a56fce2d4fd58900c70edc31aafb33cb72bb2f2781e6541e35a117292d743d6645e1777c55b86362f53ba0d140ee97ab32e2190dbe214c9985480309db62
SSDEEP 12288:TCyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:THCaEzwAyujOhcid/RrmpF
TLSH
T1A9752337EFCA87F2E60667331CB21068DB553D9776AA868FB65DF12E44B8BD0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 3e69daf55545bf0774db2d5d9320083506e3c47467f82d290cef4ef023524562
MD5 a75762387932d210b7ba179b4a2b6d10
SHA1 4cfd5df08e1eba599b026962a3db35c629cc024b
SHA512 3e2fd8704fec9c2371e46a83d2b885e0bd40413ce49a2872b84035b78029f542784cd3c3879e2c5e31dcd8dcdf6dc4518f9a17bef4f6638de5bcf8290569cb95
SSDEEP 12288:v2yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:vrCaEzwAyujOhcid/RrmpF
TLSH
T1F0752337DF8A87F2EA0667330CB21068DB953D9776AACA8FB66DF11D40B87D0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 891b9f9caf2683b4aa8485386c206dd1c14b8644cc9bd3417524ff4ed8589729
MD5 e43938ebe1d26f317cd375aa4c71ac1b
SHA1 25652a52c66b8e5b745b8571e92b5c8b2d421430
SHA512 a600eb6a1c45dd82600a8e2406e117d985b5d102fef4bee8d278c4cd402714f78685427b53fbf90a2d3f3acf06ee9ca647a8a3bc6825bad09c5a751e127126a9
SSDEEP 12288:kiZwbazzFEoS2cPvy+yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:HZMyzFVSOzCaEzwAyujOhcid/RrmpF
TLSH
T1538501A5B39019F4EC67823ECD654915D6B23C5A0BB0CA4F13B8366B5F733A01C2EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 3ddc52416f718cb235af5cafa3479f1209d44dbc5126f0d4aac34f3ae384579c
MD5 46f684424c800ab02eaea7b813282470
SHA1 ca023f338737beb850961736abae9f16c6f05e62
SHA512 48d8b967c6ded7e04441d0947480debe065c015c0326047a5b1de2344275ce33458bf6bbd6a4c193d34516917544a06a82f14dfe63c72793879c60e23f0251a1
SSDEEP 12288:GhyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:GACaEzwAyujOhcid/RrmpF
TLSH
T12A752337EF8A87F2EA4567331CB21064DB993D9776AACA8FB65DF11D44B8BC0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 4a24df1fb6f8963fd6ad0a6ee69a5664108e4dd0c6223d1bff2cdc86812d1d50
MD5 52bf1d519820d2d30e7a837faed58638
SHA1 802879857c145d4bb74f19c8588fe2243a9e0adc
SHA512 383bc9e833bbd8fe73aa9741ec9e5b98b4f8236ae16c853888e400c211e1a7d4357720dca1d4b4f2afb21afea517362723392ff66a6f027ff8f12d41c60d90d3
SSDEEP 12288:NdyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:NcCaEzwAyujOhcid/RrmpF
TLSH
T1FA752337EF8A87F2EA0567331CB21068DB593D97769AC68FB66DF11D44B8BD0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 fdebdd4a2c18ab69d64d01de99d9fc6f6fa8fb416b6a989308e58811fbd1ee68
MD5 aa125813a7c99cf7c820854f9fdf1929
SHA1 ce5e30dc2d3874e240feeca6d09a93d111ea799e
SHA512 a990b3ade59ea28dc044d6e95b961d50616ab2b22ce98ed92ba3d7fc17714788ecfccdc9b48d32d77007d4fd3d321c5a4952007f3726ec2d042ec518a9d55b15
SSDEEP 12288:ryPz5L8qyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:GzyvCaEzwAyujOhcid/RrmpF
TLSH
T1AD850117B79631F9E12693358CA21601F7B23C3217258B9F63A8667A1E377D09D3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 b2ea2f50ed2b585c2b8b25afbdc34d7f1f3ffb11fa5b7f20e243a91d1e6afe42
MD5 d9f73fffc0797a08b79ed59f206d7d74
SHA1 a9fdaf66e7406c2f9015283ff66b91672604b213
SHA512 994509ba80bed8e89edf474c8270717a83cc9b6560c0a2d8dca62f0b6632dce91b315897654dd0b0158fc56869a09daf59753a4e3456e5ea65237e3ef118d995
SSDEEP 12288:yhyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:yACaEzwAyujOhcid/RrmpF
TLSH
T1F2752337EF8A87F2EA0567331CB21064DB593D9776AACA8FB65DF12D44B8BC0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 6cbd2e05ea9b6a4f85465b9c90157140ca5bd7b5ca5b54c1d32b9cfd61c0b01e
MD5 28566c139372aa164d59d78ac1cc135f
SHA1 89109863a529843f3f91b06d3467c90d83689b59
SHA512 de7f49436d8680c3b33ed1b2fb3159c3c4f6a19b0b7d7557278b782c55d2794e5c6e1625ec4fcadc6b64d831c80c6fd79808eb9f6bc53e69c816880a69e90934
SSDEEP 12288:BhyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:BACaEzwAyujOhcid/RrmpF
TLSH
T1B6752337EF8A97F2EA0567331CB21068DB593D9776AACA8FB65DF11D44B8BC0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 9f182d3bf02e33fe0b9d7fd842efc64d1462eb5a507b73ce73c06ff79d06503c
MD5 51ad0fcbe6b977bb8a29b4306f30e76b
SHA1 a7dd084236ea9435262c78f19b307db409bf7bb6
SHA512 4e8d4eaf8a61a1cd9febe19f9cdd4641f473ae0ace1563424b3c70367e2f59026dd86e110de4c205e8437d66dd003982b6f0b5d3bdc4ffee2e2ba8093cf99317
SSDEEP 12288:wyPz5L8qyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:BzyvCaEzwAyujOhcid/RrmpF
TLSH
T12B850117B79631F9E12693358CA21601F7B23C3217258B9F63A8667A1E377D09D3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 5dee1c18b67cc201606e54c1fd3a20af578597f89b24ec430e998ffff6dba23c
MD5 9cffc751f10a68685319a35a2df92f35
SHA1 bf59364fe49a1d205932620ca8b1776ee24c57c5
SHA512 ade22d57bf10ed0b11a95e3d0753addde20c3d911986b848945366cd06cb910ef93ac29e620a83c396170409d24dbf72fbd208fe7bc09ed4076d57f446195b33
SSDEEP 24576:ITnaLl3z0zD5CaEzwAyujOhcid/RrmpF:ITaLljWCaEucW/Rrmp
TLSH
T1868501A5B39058F8EC67823ECC664915D6B23C5A0770CA5F13B8366B5F333A01C2EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 2.0MB
SHA256 59558f6867ff93f5b5247a3e783b49c4741dce87555486779dafdc29682ea0eb
MD5 13fb641586f82e63aa8db585b2b81562
SHA1 7c622275de67c118095c875d51734796c3baf1d3
SHA512 e218d0cb58d89fe13e08d49291db955fa0bf97ff57d4af95b089b4771ea6ca8b7127403eab069d62078e0431626593e46f4f6ba6a027eacf19153ab667f86f69
SSDEEP 24576:93sd9CHKy7GZ9CaEzwAyujOhcid/RrmpF:dsd9CHKya3CaEucW/Rrmp
TLSH
T1D295CF90F3E415E4F0B79A358D764511DAB67C9A1B31CE8F03A8661A1E33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 6bfe25ba7d7bad26ebcb1b68eb47a9a943abf36fbade900b05140d45d05321f9
MD5 7819a7689b37332c10dfd4c84a303343
SHA1 36c6f28625f234627deabff7eebebac78bccad10
SHA512 2629416b95c55da7c827353d84cbfa67cff66d62e2fda752be447a934164519abc0ff614b101ccd34ba1fb82cda3cbbb19e55c2c6ff8b8ff14da9bfcd6f6003a
SSDEEP 12288:P4yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:PJCaEzwAyujOhcid/RrmpF
TLSH
T18E752337EFCA87F2EA4567331CB21064DB953C9776AA8A8FB65DF12D44B8BD0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 e0531dc93fb82af9c2bdfc409225a923afe7a2305583cd66b1741ea37057f97a
MD5 61f8fa676bc26833a785ae2f9d4c2c4d
SHA1 b42a0c4f72e65bb60023a0bae97140289b729ba9
SHA512 d5a600463a10dbce6ef3840c6ac111862c216dd0ee577ed38d1c0ea09fbae98cf77329c82abac8ee090dd4252383b55be96d7502b5b83c53a102e5cafd23dc20
SSDEEP 12288:eKyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:ePCaEzwAyujOhcid/RrmpF
TLSH
T1EF752337DF8A87F2EA0967331CF60164EB553D9776AA8A8FB65DF12D44BCAC0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 99eb4b55c7635d171799fe1a5895d6a9c87e75889d0257a1954dc7f349c92668
MD5 891b89f5474d2cb9935816cadc968c2d
SHA1 f531e47b4fe8d6bdd98eac2d944042b90e3a9b3c
SHA512 7d943506170b8406bfc7542613d6e5a0a5e3c7457b4e5e4ed22b4a3af79d3570ec125d30d724a00e12621184c70db2c5ad7db10c07fa309796c6dbeeb636bf80
SSDEEP 12288:OzyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:OOCaEzwAyujOhcid/RrmpF
TLSH
T161752337EF8A87F2EA4567331CB21068DB953D9776AACA8FB65DF11D44BCAC0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 77d20a5d2a0131d15b00cdf76e1148797e5d452b986421cfa736301b7eb108d7
MD5 169bfedab4472f92d06c051b2ebdeae5
SHA1 fceb860a27561cf549386da84cb14ceec623adce
SHA512 b9fdd30e06d96a2b35ffedbc73cf578fb9f95f3144735c9d713d5cc14e23518fe19234da9b36f43ae1f3c53134e296aec10d79de10e9703d580fedfc57811f30
SSDEEP 12288:NhyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:NACaEzwAyujOhcid/RrmpF
TLSH
T1C6752337EF8A87F1EA4567331CB21068DB993D9776AACA8FB65DF11D44BCAC0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 695465ad08cbc45d1647c12ed029f9e6d0b5e0b8e34b99c517ef3dfa54a58193
MD5 4a097669fb076e5356e16b1dbe932dcc
SHA1 806738e91e1d6468e6f3a6c3f4c09cc1311dbd84
SHA512 2bbb7f6346557b7d46bdef3e820469fb13536d70e2d347c04d08d0f01c603b11a104f3872203956547b44f4cafc14d6a9723f843e75194b8eb18ff51a486a484
SSDEEP 12288:I4yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:IJCaEzwAyujOhcid/RrmpF
TLSH
T1FE752337EF8A87F2E64567331CB21064EB953C9776AACA8FB65DF12D44B8BD0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 8c403eb7c8812ad7b2c4fff8596680b88df412249ca62cd3d3b7e65fe3fd30e1
MD5 40d2f02dd9cf3b5f82d00881221149a9
SHA1 2a6a5fb26a787e46b77115901313e358c6ab154c
SHA512 1870415079c4507a8a6f3dfec37c2aacb3330077e7218890d3621563355614e144b8b8a6eaae94f7ae4171a4310a94f1557ecc90ba0531cfb997505db9bc9298
SSDEEP 12288:pZyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:pYCaEzwAyujOhcid/RrmpF
TLSH
T1DC752337EF8A87F2EA0567331CF21064DB993D9776AB8A8FB65DF11D44B8AD0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 8c8114cab7833fdea1ebfa5ea8eef75613f5f183c9aeff46e26ce1518adfb601
MD5 6927d494ad361a128949bab82dc793ac
SHA1 851aad786fcdfd376a7e7cf6550b5208156ec99a
SHA512 6a63383954670eeaf764c94654591452f7ec9a3c6151e7b6d188b7a0c81108f18b3b592a098f4bf27dac604a12c3ae0e282e15a9adcd52c30a6c4d32c43ec0c9
SSDEEP 24576:ifwvok9RX6wkyAIMCaEzwAyujOhcid/RrmpF:uMnYIMCaEucW/Rrmp
TLSH
T19BA5CF29EBDC44E5E1B7923C89B3460AF6B178591B31C6CF129A53AD0E37ED05D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9b494da3eef8a79a00019a8af5f3bde67db009f74d5ea7fc5c0912fab5802cf2
MD5 e67cd1f801e08267ff6f37ef724a588f
SHA1 0c9a7e7e449c639f8f98e631ac1faca8b2721ffe
SHA512 b125d05135275a4b3926b226a45c2ae4826ca844ffd52a9a0c756145497dd3ee904f7e766c1a1d96019212000694e75b9d92f874ded77749f87059418542281f
SSDEEP 49152:pYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK01CaEucW/Rrmp:RySzPcnudRSp
TLSH
T10D066C56A1A841D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 bb06817868bd7084e97bb35d6e1c238b8015edce995dc0028054ebd9597209c9
MD5 ffc040ae3135529ec8b74749b657aa0f
SHA1 183f4bd10dac13c48abe6709ebcd00a0d19d0bab
SHA512 8237031d75b5cdf71d44bd98b82c08bc2170a7d6133dac17a10eacdaee6329643234f214134d6e401edec7a0666b1967905187285ce56fc2785e5b1d186d80ce
SSDEEP 24576:y47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYjCaEzwAyujOhcid/RrmpF:y47JUQj1irIhCnDHUPfF/lCaEucW/Rrq
TLSH
T16965AE1EA3EC01E5E1BA92388515465AEA71782E1F31CACF2270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 2b35b4b9900618f3291f75a3b867183e1bbefa5a3d6fa74bcba2996b9383e37a
MD5 99d17e241dbf7109e1f79da92dce1810
SHA1 8fe5317c6d4bcf83aafa9459a4a54331a32d2348
SHA512 c49d26bf8c51d04752b2851b2b698ee85fba0a0bf898527b35f0ffd18c63c0dc68e7f27acdc9853e52e36a516faf92e1a8405981dfc42f7aea5679f742720829
SSDEEP 12288:84sfRyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:uQCaEzwAyujOhcid/RrmpF
TLSH
T11185F11AD68842E8D06E6236CBA64640F7733C6693E1C3CB62D4F53E0F796D05DEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 d743ca31ebc1a9c4adf968df0c2747b86d531453ce7cad98012ee71ace302dbb
MD5 f709c4efd7060e9b03e76c775f649082
SHA1 51917b9bf211edcd493a0de698f204e5a193f4a9
SHA512 c64e63b86bd82ba193116104c8eac3c93f574c41fac8276feed674ef29cf244b1b86331023aefd725d7d6320b4e825aec449fad7dcdb7b3afc7699ed84c4f3c1
SSDEEP 12288:8Nk2U3feAe3nXuRXGh6supeHDSnNyDARMYf3VCfLZMKqhm:8NTUP8eVtLcHDSNyDARM+3OLZTqQ
TLSH
T106452951762AC74FC6A940325E32D2CCA7707D01EE44AF0773C99B3F9576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 36d65e23dc9486d2350eafb2ff36c8aa36e2a041d810da43be763b60be477e9f
MD5 3a89f3e2a7cfd682a590072a8f4f9455
SHA1 7259b1e086c7385441cd36f6084424a68cbb240a
SHA512 23f7f351826e85ea6bee091d256ff2fc5eb3de0018c952c5301dadc7196995e294b1ece53d0874111a2a74cfe1076c14b0095c33dfd9e7a8021517e62ccf1627
SSDEEP 6144:N7sKYzST7iGbGfXvrFXERWGBQmNu20aMZPrDzyKkW9qHPL9D9tMxBBb1k8/7bGob:BkFES1N0fWjXtv9lT
TLSH
T18565E980A537A38FD1BA6032073A5B4C7BB4EC06B7456E26B3C8153AD866715B1FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbc3c2ae23e529ce.bin

Path C:\Users\Admin\AppData\Roaming\cbc3c2ae23e529ce.bin
Size 12KB
SHA256 30c49b4a02a510dc33a0120d8831cde8591c45061dbe6bbbeac30c391cb99b5d
MD5 823e091624c9f3f17b8d2691c174e6a2
SHA1 58b11f2ae3591e47163a2e4bddce5ab169091918
SHA512 92a4d12c9e2fa75e47d5f5061033d34adf08d041ed943b10de3505fcdd84fe7ecea4c191c03a7a7ad66154f037eb6502f5a08b1b2a8bd65c802262632cf13e8c
SSDEEP 384:IZZjbawILSu4D0ib1IgTsowHpW4tfKhWbcfTofWZoT:IZ5Xz0ib1IgRwJW4tfKh1TzW
TLSH
T1A542BFAC9BEE9317CE03505E602FF99424CA26D66B1CCEC7F84756C001209A596A7A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 2b2f2efd51895f935bbb1d6af0f821461a1494ad42f3e0d09cd78ec86e99b293
MD5 cd84256cf3c49041644df8081dade503
SHA1 fb8ad0cd67a9d91a84758a10456f56dab23c18dc
SHA512 e709be7c6a0735c6468b1068a4f4c25fafd878872fc4aa8785937bf64e6fa505460cdb5aa77e44d63e1cfd71bbb58753871384b02676d34e86aa8fc531c00ff3
SSDEEP 12288:eG7JyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:NoCaEzwAyujOhcid/RrmpF
TLSH
T117752333DF8D9BB2F96A67320CBA0034E71A3DA61B59C6CBF51CB29D4478AC08C79115
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1b025f9f230ee05be0154c30c30c32ddde43c618a6fd7ab04be27dcb6d1d5081
MD5 a6615e33b0ee3648c07f21dc6d53dbb1
SHA1 4caedf7325528784c8d82358f356e7763116e141
SHA512 42244f91b389fffe823cfe67d3e8d697ecdc40c298d16cc947c2d0a29c18a6bcd236e47f448b4bb0d734d0af08f3965e09038a673d97e793dcfcd4512b0033e3
SSDEEP 24576:zgb6bmBIi49WNNFpg1rSvFv7bYWCaEzwAyujOhcid/RrmpF:zgb4mBIBhGFjCaEucW/Rrmp
TLSH
T17465AE1E22EC02F5E0FAE3B89DA64417D6B278161732D2DF1151422D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 0cc5c8e707eff5a87cc9016b461ba668e8debc9971422bdbacad56ce158c9774
MD5 4db5cbd652825d42ec6655443a0e328d
SHA1 b13fce80a1cbad788dac5c9074a0749e8ea0e601
SHA512 39c970f4c6718e2d14b2d99901078955a8faaf45f1a44cc01a13f547025c91ba1a3b7631c779b85571c61a5f9700ab4f7404b53d6c99cf833085922940b12521
SSDEEP 24576:DG88u8FpJqH10zria7/mzCaEzwAyujOhcid/RrmpF:y7ZFPqVDa7/uCaEucW/Rrmp
TLSH
T198A5F165A7E102F0D47BD23889924663F6B278251364EFDF07AC8A551F33AD04B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5574ab2f73373c7e28efca90f8583203c223465afc34eb4fe98156d9b8217bea
MD5 d5dede89db687f2fc0c6312931c5b6d5
SHA1 cf5de26cd3709022e6fba173bc58d3519eb749fb
SHA512 74c80b9e51a6f16cb90660db65242cb0c58bd37fbc76638dc3456f066ca8f73847407db7956655dd5b0eddb31cc007a3f58561888ed41dbe6ca484bb7eb5b5ef
SSDEEP 49152:QBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjHCaEucW/Rrmp:LG05lO43bfnudRSp
TLSH
T113D5CF6A62EC11F9D1BBD17CDAC6460BEBB23815033556CF02A486A91F27FF0997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 991fc117c7551b1c1a6bc8fdaa69cbb08c32676c8cc1bafc5cd124625d73ba99
MD5 3e4b722e8710c4fab06e6858310f0043
SHA1 bdb13f7f5224dd4f7e0c7a0bc2cdb92b36db2623
SHA512 de66dc8cdc04ea98a0648060225d44d2d099f12112d5a14ecd88dd3ac4ce053c805c6e7d3c41dd27c72867375a9530044c28f4bf3935c1a8c5f727ed4dfaf3cf
SSDEEP 24576:Vfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn1CaEzwAyujOhcid/RrmpF:1a5POZ3+Jt2pasx2+mPCaEucW/Rrmp
TLSH
T13565BF5EA7EC01D5D5B9D17DC583461AE5B1342213329BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0ab5af7455554c618ebd705a7d734f4534da2517bde6d2273565af25c8d9af68
MD5 50e17c65f4e7c3179fd93452a6d5380e
SHA1 7df4759021722093899d1c53bea9f0475f5f79db
SHA512 979ef335ea2316c85f13d94d41c762ca01b0c25b652d5c72e17c7a9b69858f741162fedde1e9260043938cf5d5535c9ed41184139d50327c3c34c686750be52a
SSDEEP 24576:FNcwHdjbyQ4nLC18lb/EOjowL7Fk7CaEzwAyujOhcid/RrmpF:FNc/zEOVHFOCaEucW/Rrmp
TLSH
T1E0857B2623E901E4E5BBE1BE89779546FA71786513348ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2afa4a8472a72022eeec16b370a5b7f8810627941e6226ede00b3be46e00878e
MD5 d9f1bd17a24b49bafca2e211fd0ecd78
SHA1 ae4c75e4bc59b2b930844d904cc136d669e37943
SHA512 c3431bc4ebb827452f66e8ff94856d98f5958af48035f08fbe138c8a41796b182ce3e22cd2ff845094fedd6530a3df3a0b03115690824e883fe6820fcd39b79e
SSDEEP 24576:u8kNvNnaFeYhJNtmZBmXCaEzwAyujOhcid/RrmpF:u8MwBtOmXCaEucW/Rrmp
TLSH
T13755AF2EBAF846E4D1FEC6758D238112EA727861173293CB5290C13F0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 522a0538927176f811060599f908e0c50f0543fb9d2504dee76ec5d20b8ec081
MD5 12bf0bcf0dff81c80a318590bb5b936f
SHA1 214f7fb7d514bccb5b8962c07e3bd4e3123f29f8
SHA512 db13a592b64616f0316597d8e1eb2392b36d0d23779988dd787660422ecbe87d1fefd91c9280c2020c6688965b744b01f97b0ced9d492eb2205753df0a659e07
SSDEEP 12288:dHvUrBFrEjwaQSyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:dPUr+NQ3CaEzwAyujOhcid/RrmpF
TLSH
T14785E12F66DD18E5E676A23D89924219F77278621312D2CF02E0917E4E77ED4BC3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 41e91a54b6d1ba1ed3659f29a72af4b25d3977a7fc6d724c3ea83450cf565085
MD5 fc47193d39c95e3fcdacf9bb4c37e585
SHA1 db0194d7de959de75d81d80ccd2c545b7dfa8f9b
SHA512 90eb0e28a36abe0cefad46298947b88c5fc2deff1ff2f49f3f1658b3797612274f63f8fcd493eed5e06821046c2b836aaf123e7b107e12a732636927e030aaf4
SSDEEP 24576:xD3FHshBIYQgAUCaEzwAyujOhcid/RrmpF:xDVHeBIAAUCaEucW/Rrmp
TLSH
T1F095E13EEB9C04E4E57BD27C8A634506E77138A9032256CB12D4D1BA1F6BEE46D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1280-204-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1280-51-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1280-46-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1280-44-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1836-117-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1836-330-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1836-124-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1836-331-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1836-327-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1836-123-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2008-325-0x0000000000400000-0x000000000058C000-memory.dmp

Download

memory/2008-94-0x0000000000400000-0x000000000058C000-memory.dmp

Download

memory/2008-100-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/2008-95-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/2488-158-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2488-332-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2488-159-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2488-165-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2684-346-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2684-105-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2684-104-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2684-111-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2684-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2684-344-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2904-84-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2904-324-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2904-90-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2904-82-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4324-155-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4324-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4324-148-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4324-142-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4324-150-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4500-63-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4500-69-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/4500-56-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/4500-67-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4500-57-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4560-72-0x00000000009D0000-0x0000000000A30000-memory.dmp

Download

memory/4560-78-0x00000000009D0000-0x0000000000A30000-memory.dmp

Download

memory/4560-309-0x0000000140000000-0x00000001401C4000-memory.dmp

Download

memory/4560-71-0x0000000140000000-0x00000001401C4000-memory.dmp

Download

memory/4964-53-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4964-38-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/4964-25-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4964-31-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/4964-42-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/4964-37-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/5308-29-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/5308-1-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5308-0-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/5308-8-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5308-7-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5308-23-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5368-26-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5368-15-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5368-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5368-116-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5688-136-0x0000000140000000-0x0000000140233000-memory.dmp

Download

memory/5688-137-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5688-130-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5688-328-0x0000000140000000-0x0000000140233000-memory.dmp

Download