4963a8d17d0c6e9f6dfa6a2b109f6c13a5905850151276e863172f036cd23cad

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_65cd9b10cd7cf42c79c2ed35db1f2a75_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 1.8MB
Sample260826-23lbssfg49
SHA256 4963a8d17d0c6e9f6dfa6a2b109f6c13a5905850151276e863172f036cd23cad
MD5 65cd9b10cd7cf42c79c2ed35db1f2a75
SHA1 e4d071e0c53622ece0edff47b6e5ac120cda0d27
SHA512 3180debe7da9a2aa3d1a10d1d198bbdce606c0015b9b4a452d2b305d40e62d83c4e8a0ba77b25621e43bc680ad982f86c04c5d463366192c9bcf3ad396c46bf5
SSDEEP 12288:LEV4Lf4JYkm31ujyHTW+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpm:QKLFkmFmiyyxknw4FYnshx8OfVe247
TLSH
T14E85E055B3D501F8E4B78138CA561A03F7B2B4560320D7DB53ACE6792F23AE06A3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6128	elevation_service.exe
2672	elevation_service.exe
4248	maintenanceservice.exe
2372	OSE.EXE
2028	PerceptionSimulationService.exe
2144	perfhost.exe
4936	ReFsDedupSvc.exe
2320	SensorDataService.exe
4576	ssh-agent.exe
2056	AgentService.exe
4980	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-25_65cd9b10cd7cf42c79c2ed35db1f2a75_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-25_65cd9b10cd7cf42c79c2ed35db1f2a75_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-25_65cd9b10cd7cf42c79c2ed35db1f2a75_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-25_65cd9b10cd7cf42c79c2ed35db1f2a75_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-25_65cd9b10cd7cf42c79c2ed35db1f2a75_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-25_65cd9b10cd7cf42c79c2ed35db1f2a75_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-25_65cd9b10cd7cf42c79c2ed35db1f2a75_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-25_65cd9b10cd7cf42c79c2ed35db1f2a75_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c03d9d88b05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-25_65cd9b10cd7cf42c79c2ed35db1f2a75_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-25_65cd9b10cd7cf42c79c2ed35db1f2a75_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e81a4ad1af35dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b79438d1af35dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cbee0a92af35dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a4273d1af35dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
6128	elevation_service.exe
6128	elevation_service.exe
6128	elevation_service.exe
6128	elevation_service.exe
6128	elevation_service.exe
6128	elevation_service.exe
6128	elevation_service.exe
2672	elevation_service.exe
2672	elevation_service.exe
2672	elevation_service.exe
2672	elevation_service.exe
2672	elevation_service.exe
2672	elevation_service.exe
2672	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1944	2026-08-25_65cd9b10cd7cf42c79c2ed35db1f2a75_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	6128	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	2056	AgentService.exe
Token: 33	4980	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe
Token: SeBackupPrivilege	4936	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4936	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4936	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4936	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4936	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4936	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4936	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4936	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4936	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4936	ReFsDedupSvc.exe
Token: SeDebugPrivilege	6128	elevation_service.exe
Token: SeDebugPrivilege	2672	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 6028	4980	SearchIndexer.exe	101
PID 4980 wrote to memory of 3364	4980	SearchIndexer.exe	102
PID 4980 wrote to memory of 5356	4980	SearchIndexer.exe	103
PID 4980 wrote to memory of 4820	4980	SearchIndexer.exe	104
PID 4980 wrote to memory of 5524	4980	SearchIndexer.exe	107
PID 4980 wrote to memory of 3156	4980	SearchIndexer.exe	108
PID 4980 wrote to memory of 2772	4980	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-25_65cd9b10cd7cf42c79c2ed35db1f2a75_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_65cd9b10cd7cf42c79c2ed35db1f2a75_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2672

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4248

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2372

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2028

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2144

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2320

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4576

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2056

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6028
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5356
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4820
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5524
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3156
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c29dd42ace7e7373b2b6d40d1079bc53fb945b11a7a32b6515e133b8e7a95d22
MD5 9760eeb7df2a78be74a1e6ef86c8a86a
SHA1 df9168192efb39c423b3027489ec90ce9967ebec
SHA512 3ca32a691d46c8fbe503f6d17e2015cc4d0299a12d7310f07b9c98ae7ddaebb12e66fecb43674d648c74143f716be0b21f3b644caa6da8bdc19e9033761c1db0
SSDEEP 49152:Ab+632BuPkFKRrdE6ohmstBhuXjfS4LWxnJx4x8EVep:q3q6HjBqix8EVy
TLSH
T198D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 69b3bf9aa50cd7801734010e178f8d902303fe5ff4a0c1eff9e815865f26ca0e
MD5 2c9c5f08b5cb5d1fd574a39cec011ba0
SHA1 7d1ef9fc35f89ce714c8e4e0119721b6e21837e5
SHA512 a74df2332aa8d3e4a3b757114db23d0229753a7e08857dcdd2a2d44a771d0c3276a2abe4623eb5f3b595f90ea8fb70ca975ee55654a5a4cfaaa004b3b486e65b
SSDEEP 12288:B1XLsswWkxy2lRq2czA7+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:vXYfDtczA7yxknw4FYnshx8OfVe247
TLSH
T11D75F12877D508F9EC6B8139CDB28512E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 f5f04117c2fa31a71f3dea88e9c42143aa7bb73d1955d53c42fa4c6c19c5cca8
MD5 37aea2f9c66efb78dd224deb7680f43d
SHA1 04badd46b953470e2428879065f10dd73b00d0fb
SHA512 ad867fe9db674acd474f27dce0f3517dbeff00cfdc0d6e2baaf1f0ef3aa8e5b4363c3634d6f878a457530a69c8d07148c423a879cf7fdec804a6346417e742e6
SSDEEP 24576:e0Le5ji0hmx1rMDyxknw4FYnshx8OfVe247:ePji0A7rx4x8EVep
TLSH
T17695AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 17bbbf748db7a51ef9ffa85d3f8744b15c9749a221cb438f6e01263a52a63dcc
MD5 dbd444f1d0f91d70fbe3d507745ec30e
SHA1 49908062bcccf00235bc650abc677ad4c382c191
SHA512 a251ad704daa6e9802a0710796d8878376c46563e2a09c76dfba689fe51f2751ba13c51fecf5164a53ca014f1f3839dcb9a52d2702d65c25e218a9324a3ac512
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWE6q8wyuZyxknw4FYnshx8OfVe247:M/ezSC6vUzPvxHjyPx4x8EVep
TLSH
T17E756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c97cbc8a4c3efa7cd5c275a86e011bec11df72dd1f89e94774d80abe0390e4dc
MD5 cb0cc7ab545e92113418e5273cf2c201
SHA1 8a9440d8d1a70bd6d91b1c03e63ac486997d7984
SHA512 3d756f5a9e10a3c4633fb991b0a633f36c9016f4cc5aa33899eea555907e48f0b94ed62a0df358a60e8aa4046008f02ca6d3681fc5ca726fc318213cad87b129
SSDEEP 24576:QVbqPb88hv/l+6Kyxknw4FYnshx8OfVe247:QVO88hXl+ax4x8EVep
TLSH
T1AF559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 82314752ac4703079c016c0ff5e671f4d3b6d1ec303630c5bcae92edd36a2231
MD5 a22bd5574da84653d1e862309980b3ab
SHA1 a45e7a978a16ce5e7f3eb741279ee65d45ae1b82
SHA512 85b014fec882fdbc0410221a2cf7d986823869e8d6546acf0e54af2080fafa5e4cd7f8577c8eac195f18ffa950e89292e9e5fbe1ca16793a3a703a9a93775075
SSDEEP 12288:CNUg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:CNHyxknw4FYnshx8OfVe247
TLSH
T10865237CA7DDA4E1FA5E14331B7572622616BDA4DAB4C11BC778B14EE0F0C60E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 e72289fb21248a75ba31537c94d8a34667c9e54d9f1a1c75230031aa79d193d3
MD5 29160cc627378ef9564f516ddabee23c
SHA1 6da28ec99aeea27785ec7a28a3dad9d14e819182
SHA512 d0a6cfb1a4bdeec341cb0d8e3a24b7ee23d923882a66349f87357f87b8f594b8256709f611d0a106133835b2539dcbdb634643db95b2220a2a386ac142f221e8
SSDEEP 12288:deBNUbTVO86U9g+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:dJIUSyxknw4FYnshx8OfVe247
TLSH
T12075CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bad53edbd33de332b2dfd39f88ad53efd955c56bf7b640bdf710830b572ebc3d
MD5 fa2e09e83e87e92a89c20aecdefb71d7
SHA1 eb6d2de33f2be8140caeef21f49a46cf1de5f9ba
SHA512 1554340e23edccec4190a0d8e8089b36d56c33ec62ef5b89b87d88bd387f41cb1c66482aa9f6758671e224a8ed338a2703fdfc73264dd37c42cb49ed8b76e1cc
SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THd:FQvGAdlCEL8c/yRNw5Csix8EVy
TLSH
T19D267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 477d5aff832a41f0cac27398fd5f7c07b2e1184e73d02be4ecdd9c7405056cc5
MD5 66fddce1b2c873f1e48efe6e540f876a
SHA1 5aa9a0abef0c812eca7412be7e48b861a7818524
SHA512 e88f24832f63730ab82338519231993c646867c24a7ea08c10c747c50f9ca61e54b39a037017fc1dd2c8ef93f478d2c0d554f4339caceacb076914ec2db35819
SSDEEP 12288:+AwSfxL/2Dc3LDLLmt0LDQewsAjfg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGp:j6ewsAjYyxknw4FYnshx8OfVe247
TLSH
T1A785E030FE74E032C6BF0DB21B36D716142DB9604B611AC3E3F89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a20aa4b0f1e2a491e8219eaadd67a9583d89ac23d7fea128510af5fa3480d8b6
MD5 b17ac797c5a0268d90c1d859de421b19
SHA1 7c6bd5674bd2fe2d96a92fc1715826bdcbde39f7
SHA512 78f48982641d174d6d68b78b7fb66bfaf81a0c6604b59276a17a6036d28b0ba889990b8dd84cede403a933898f8d4015b741276397ceebacaed82c62650ff0f1
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHG:BUEtQevvqc2W1cpV2EI32
TLSH
T15A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 938a02c1d28396c2d1f2375870cb97a5a874f4c51506497e85c10d6a0342fa3e
MD5 ec86e076fbf9eadb1c0b6c6709a4d254
SHA1 76755e87f2cc4a31c60f652a2dfc4c3b1df5d540
SHA512 25e27a743b463c936d2246dbc9e67d6c94fa9d20bfc5959cf4ba2abe89225e623659842bf32350bba333f8b8de09614e987fdbcea8e65eb89b10762c8462052b
SSDEEP 49152:ICbRquA/m2yL5zQfFiV+XenmE3/zbx4x8EVep:hoqtVjnmwix8EVy
TLSH
T143D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c23c3ca0ba14b2c65e61ae9d43107cbb1c36de8257979a4e18108862b1c51ba3
MD5 6d658e338250a1ccaecc1b7fd403558d
SHA1 743b99ea486f6d75f4aa03da63a8c34d71cfe92a
SHA512 e7c985a205bc4a36c07e31fc9427121df21626fb92d430131ae4a44339ac72f5d4dd952608a8e56bb6cf8016163f4b966819d1bfe7db75d97539900c66b104b7
SSDEEP 24576:pAhGLJIFoiwtA5l7S53Fyxknw4FYnshx8OfVe247:pAMyFoiq5Ax4x8EVep
TLSH
T1F335AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 9b4f8ae804e909d76903e9f6198b93ef27b10d5aba05f54544d5745d1e8c3aa1
MD5 8eb9d98572c24591cd4dd5213a3ba749
SHA1 a5e53b468fd158d03deb7e69816dfbe276d105da
SHA512 b06ad62713201f9dc18b2a9f215db3855865dafaf0ccc909fdea9a9fec4325553b84f8557242df23c88450b5e9e20ded3d0594a4c0040b91a58d0dc9653b2c8e
SSDEEP 12288:Zmw5HEjsChN4BFgl0WDm+CA+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:0wuVOWtyxknw4FYnshx8OfVe247
TLSH
T1C475F14977E81CF9E9A741398657D136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 d84e4aa0b93d94fb65fe603da6092409787b0e92410ccad1d42e00c8e02439ce
MD5 0b84750c5319ee7d767894b19da7f46a
SHA1 d46f4b6ef132c62693bbc2f7470de5496c0c925b
SHA512 df6e9c986ae2ae2d786817e6ca4e1e9d24c2b0b3d86efd0fdc7012bc7e5c003e69658ae3586ceb271a98b614335fc286c5f9a0c4f2af57533a315fcf163acbc5
SSDEEP 12288:qFZ1IyPg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:gZuLyxknw4FYnshx8OfVe247
TLSH
T15E6512AC33E860F1E1A7113A89F15205E76274A2677183CF4764A25EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 61683e0054aab1bae876de4160cca6e634a371f2530d7ef296d54f95233a886e
MD5 18c0c1bb3587c728cc4bd03475eddc8d
SHA1 5ddad37004432682496f8bc76e4482cce51edb95
SHA512 851220be9c42a75264be1df5a45d8c749ef6d63d4b90b2c4664e229ffcbbd5bb1e3c3faf3ce2e19cef9b6917c7c0c1c9dc58113e0e3f69e5ad2391fdc5c49866
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Up:XQRQyi36YOcPQLvw2gAf+PN3xix8EVy
TLSH
T11E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 378865cd7522f02bac86a0540f8e20d433826d9ee6c1d549be5b8d7d7a852c2d
MD5 d659d4cf9f969377f914d39141a9cdfe
SHA1 1ec132e748df269f8023a4641a4bd401352970e1
SHA512 b7e1237f5262909f979c89d6d93e62f411c61e15f327e688edd548b7daed8c8123690c95ee4d826824d74626446f99e797bd78a0b28b2b6c98cc0a66945ea635
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Up:1QRQyi36YOcPQLvw2gAf+PN3xix8EVy
TLSH
T183667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a5db47db8e96b23e6812b3fc4d286a00aa47bb3c041234130b4c978f507822eb
MD5 5881523e14fc15110814be35d133ef9a
SHA1 d4567db2a22ec727f85aedd6df1b1b809c040afc
SHA512 8dccc20f2d47de4abe6bee1925148e7d2724316beae90f5cc22d3bc53ceae7b83b80c2d29528950e5e38bb063d2567916b494869643a8e48cf28a947385e5971
SSDEEP 24576:EwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL07yxknw4FYnshx8Z:q68Qg55nhheWu7PNU3/rx4x8EVep
TLSH
T1BFB55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9cfcf13e321953e5174d7408d42541776c371accb7fcb9df5da9ca4747eb4484
MD5 56456ed5b8c0988794a3dca308787d5f
SHA1 6eb3568438c2d66d45693d62284fd70e85cc3a16
SHA512 aabac723492930138b4b0ce7295db234daf7707aabc8f8a6f6ef40759d7bcdb0e2c05d41097671ea95da207ed5fa718bcf74db815e90150a6ce4169aacc0c6c8
SSDEEP 49152:n3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk997:Ky5112gYy5azzVvL69nLKnhZSix8EVy
TLSH
T15F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5de778b958602d57ca71ae26d4e8eb0acd5c2bf82065b6a440ddeb4ec7b084b1
MD5 f73842126fcc9d5140d00455512f2b75
SHA1 eb2a4ebc6b056c93eb2cfa02193e27721eabd7be
SHA512 dc290b2745ace534bb56336b2ec7e50474c538c43cd03e3db3249bbd848a115a3cd578175be0e54ff673fc4e9f049e951153d9d8fd9995c3c1268bb488dda781
SSDEEP 49152:1B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glOx4x8EVep:7u6JmVxd2dOix8EVy
TLSH
T12FD59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 44f02b750f0620ac6446f078ba7daa861925909c6da3585d8514922e2101756f
MD5 32377b140f8e37153e1b16a38324f777
SHA1 ca66fc78a7f80b33c28ddce0940280908ab798ea
SHA512 ed373558777b3caedc12a30fcd74ee1f074c59d94d141b0bd8b090373b7ab6308f11ce0882e119eb979ac8d8f80be16625871ff6bda82fd33f9d532afc11fedf
SSDEEP 49152:e1hpsNoJpF1A6UU44CwH7R4xtx4x8EVep:emifPbRwix8EVy
TLSH
T1D7B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b3ae0e8e997ca532d332d6ac2c4c6977d5c7dc6fcb3172eeee87969dcb5ca951
MD5 cc12b44f09d9120abaa3c9e8559139de
SHA1 7932ece464ea82c0b833856fa5826deca77c3cac
SHA512 62474f81e1aaffe89e98cf8aa8babca1655738e8a583abd8d7bf3267302de9094f8d556261099c0a580f4d24448e373e3178a7233d5a4e2e2ba2fbaa86204bd4
SSDEEP 49152:ESuZQIY0Be2KRRVtOnks6NMHqux4x8EVep:W5dKTi61uix8EVy
TLSH
T1C8C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 639aec1b1ca61acf7d07a2dccfa983d0fbb9763f55f7024028f518917c84ea25
MD5 14290afe0d16690dcf575a0fa19d4305
SHA1 a5e760798248babbd904e8d2ef000cd5158deb71
SHA512 cefb6e20ac61e70ab7ca431301a328c0a139ba36e4c615a285d6d197cccd9f96e5b778e59b0359555c604ce5a324aeb58fa383f3a3d7efde21d7a10ae065af86
SSDEEP 49152:VhtSn8EApI0figngiDn0AP5wpx4x8EVep:kX2iyphEix8EVy
TLSH
T1DE95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 80b2c59b27009ebaeaea620e9bd62369f573d8cbd64d298bf8505af01a82a6d1
MD5 df51e579f807674bdf26ed9a010f3beb
SHA1 d673977cfc62c54a9cd83e8d7650d42a58ee4de5
SHA512 5433430c23c817e9eeee96121bdd15c0c5af281c26f8b857e680041e4347ed43f6bb0f5fe2bc9d8ffeacbb21f3f24eececa7ed3146560e16a54aee39f7639771
SSDEEP 12288:t8g+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:tvyxknw4FYnshx8OfVe247
TLSH
T17F65237CBBDE95E2F50D11734B7172626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 5d1011d0e62fee8b7326f52f2097c8905c275459640d91658c03dc8771e24f26
MD5 16923768aee398ca82714775d118db44
SHA1 ed629add4abeb57c234fa5b66ead5bb8bd1aa2e7
SHA512 78bac20eba0336e37b717c884eefed5dd48464560e9a567d43847ce5e7aac8ca1efaaa8438ae3f12d15f73423c5eb7218cb768175ddf8d89c9bacb08dd102874
SSDEEP 12288:Rzg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:RMyxknw4FYnshx8OfVe247
TLSH
T1D865237CBBDE95D2E50D11734B7172626609B5A6EB71811BCB7DB00EF1F0CA0A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 5ef18b75c3731fb1d2b8ce0d52a9cbe8ad0c4d4f17c1944bce5ab804fd6f3fb7
MD5 077359e65f9aae5fd2af4108802090c3
SHA1 c7c9b2a9595ef1586d7614061b5c9c9670d93e5c
SHA512 780eaf7d0639a5d626c9f0c1bd3faef6bdb315355a88e762017acc93b7c979935647af2dfc85b6b6d58e8b354437dd659e6fc4ae5174145fbd9c6434f63357ff
SSDEEP 12288:Plg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:P6yxknw4FYnshx8OfVe247
TLSH
T14465237CBBDE95D2E50D10734B7173626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 0663eac82e8f5b8e6c869813836b77f7ddf3eca293f719e4a871c1e3332637ba
MD5 27d9fada75615535efbe90fec4ac8321
SHA1 248840d7624f5ab4cdc3c145132e0864f10347af
SHA512 f10982e9c85ee3b8c717d229f32ac974f2e37d51b83709235b10a14199e73553cf5ff2a47adfce91bb1c7ec478fdfe9716471ee605d72917901c6ed9d2b291e9
SSDEEP 12288:UVGg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:eyxknw4FYnshx8OfVe247
TLSH
T1AE65236C77EE50D1E85A51738A716222B265B8E5E731C35FCB24710EE9B0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 866ea8d94359facec8d46f8516171484221070601d1a2a631aebd1610b036e02
MD5 085de879454aab5b5c9981f4eba2984a
SHA1 e50a44b870d2ecf04120a16c1c3efa627bfaa794
SHA512 e4c378013c09b6139cb8b2c8780adb4e45af767099342abd3892c01b99482be31fe1ea93256f660b35a0e07458c47195b79b5e8bfd2f614b2a8a4a5bca7ca63c
SSDEEP 12288:P+g+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Pdyxknw4FYnshx8OfVe247
TLSH
T1D465237CBBDE95D2F50D11734B7163626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 d186c16b0474cfa64baedf59138415b574710e0046848c6c4b9b25ccfbbd55de
MD5 ca3cd75a7bbfcdf566fa63f00d5fb68a
SHA1 b374d002e285dc7671ff7aeab4dd5f20af264f62
SHA512 6216ad171d81d457c96856c124d4c32f636e0a055a5d4585d437fd233eb01880154886f72c544e1696101d6ba39f63994fb193b4e970f82dadf6f5b07e669335
SSDEEP 12288:CHg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:CAyxknw4FYnshx8OfVe247
TLSH
T12E65237CBBDE95E2E50D11734B7172626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 b8a55dac227624b68dbb12f8a27c998f213eb0de8616e9d795a9281661d23163
MD5 68301a02c40d12eb8c4fe799dc1cb98a
SHA1 317045fa70dde42d6ea9464c75e81f10de518790
SHA512 8fb8caf882fe675ecc095522a88c0d2b85913cd3f1e5a0b1493161b277ac606f2ba82abff9f0e40e30a9651ee858f4b2808aa61a0a8a7c947cb2dfca7c3e413d
SSDEEP 12288:irg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:iEyxknw4FYnshx8OfVe247
TLSH
T1CF65237CBBDA95D2E50D10734B7172626609B5A5EAB5811BCB7DB00EF1F0CA0A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 6aa3db8e7c594f1f854e454d5fd0483f655182cb3e5cb0ec8121e6b44d72563b
MD5 b83a8852f590b3b6ec222d62223becde
SHA1 d759720e890435af555616d68a2fde65d1135daf
SHA512 2ba902eaa3286e2cc7059ce24ab6c1463ea18b474adcca839df90857c8f6e568e9057f31278dba8f9f5c05da9d7285d0d4657dec8b65dc93d8a63e3c53d503ea
SSDEEP 12288:yiZwbZzzFEoS2cPvyTg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpm:VZMdzFVSOsyxknw4FYnshx8OfVe247
TLSH
T1817502A8B39018F4EC67413ECD259916D6B27C694B70C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 a5badffa77ed744eed8c3ea99b29f5fadef47b8197ee4ff6e93382381a03551e
MD5 deec5dfd69e12c829d4a8971ae3514b1
SHA1 7dcf031831a33a16b37a9df32cdd2abfadb5f5cd
SHA512 f18c9c5d203c26dac1afdcea5feffc4ec6a98f6e6255cf272801d11c479f0735b7b1dadcbf21d0019233549a7fc8fd8d0d5c27ea00257cb958409d3b7d182e81
SSDEEP 12288:h4g+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hbyxknw4FYnshx8OfVe247
TLSH
T11565237CBBDE95D2F50D11734B7163626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 74bf8e4d43eef1ed1e23322cb8940e278e6c57f8f1a66af4bd83cf3cef17538b
MD5 62cfe10422f91f991972f655808b5aae
SHA1 c8d44db68089943613d24d4576f08c8afe31ac40
SHA512 f44090b5c1cb9867879e04e27974a1a72e3e15840f2f0f926f8ba7f0a9e445532e2a6483594fe41791d52dc4ff587b3ea6c1c24ceadc7e1b295480b52425175f
SSDEEP 12288:4Eg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:4Xyxknw4FYnshx8OfVe247
TLSH
T12465237CBBDE95D2E50D11734B7172626609B6A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 a452f440ac9e04550ec655826ecdbda02c36cddfc40438a410250be4fe1c809c
MD5 ffb7c29fafae173c9228559c31b3b885
SHA1 509da96c29680c66e256f4d661610273c193dddc
SHA512 cee5059459c58443c0702750489e97a7813f41b202369ce790c974009845e596ccc5afe7f1398bbd44fab0207c28ce07f96f79529a78573b989af4ed66f17113
SSDEEP 12288:CyPz5L8Pg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fzyoyxknw4FYnshx8OfVe247
TLSH
T1A075125B73E530F5E13A4236C9621612F372B872473086AF87A4527A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 65e8078b2152c4e93eb56735d24db17a74256eb70e6dd0ad3989d7f815d8efdd
MD5 035aef4a537b42e2acf0970c05b8fb32
SHA1 1d49042313ab0f43c91d86cc837600379ab5b4ef
SHA512 143c063c4c09a5c245b4e1072d380d047028d4e29e39633f760ffd0791128a4bde55c1231ebb82e0e087dd64d201b03171ccb45a65b265d819c0ab234d625380
SSDEEP 12288:a4g+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:abyxknw4FYnshx8OfVe247
TLSH
T1A865237CBBDE95D2F50D11734B7173626609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 3c09ce8a81f9e85f760e663f0a7cb0004428bdf8530687b20bdb96978cbba048
MD5 98efd1a4b651430c4a6e765406ac337d
SHA1 ceb81b7bf4586da7f7e4e668634b1acfc5fb38ea
SHA512 713959fbdc66a191761c6f3326ec03ce692a8ca10d26cdec206263eef508c74af6ccd9ce47e2ef96d6abff6507462550785fb9e0d0cfa5278b46662177b14a29
SSDEEP 12288:k4g+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:kbyxknw4FYnshx8OfVe247
TLSH
T1FD65237CBBDEA5D2F50D10734B7173626609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 41399f208d853b1d7ca4a01f822c214f2ad86a1c8254e6d15977d7381ca786f4
MD5 927bbd95f328eea295779511529146a8
SHA1 eb1df11a6b96727a5237579ecb4c971c3d1b39f4
SHA512 669323ea57197cccb3c703b634d13cb421cb10314f79b4761a0c48f8fc089dc54eed184e966da9aa6c24ed6ec35ed44676363f964b6a5038ba4c615dd4202106
SSDEEP 12288:PyPz5L8Pg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:izyoyxknw4FYnshx8OfVe247
TLSH
T14B75125B73E530F5E13A4236C9621612F372B872473086AF87A4527A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 bfa91864a83cf3ba6926c431a40374971c00b7f3d97f54b07059c59e88900aa0
MD5 a63d2c8ff80540d2e548b8eef1d49c23
SHA1 fa689e09e8a5821c07094e271ffa492dfb993490
SHA512 f64ad9af31b3349ea91af3ab50dbdd8369dc92e748df71bd7ec35a9337e0810cc84f506beaa9fc59f6e10e02e135ebaed868f93124806d54ab009148f69c4e35
SSDEEP 24576:gTGaLl3z0zDqyxknw4FYnshx8OfVe247:gTFLljcx4x8EVep
TLSH
T1B37502A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 aaeb290155cbfd68509db39c0283afba6b48e6b367a97c2a1dac50b44e840a33
MD5 1978b29f96e18cced804690d2012d456
SHA1 ff6fad753209196ccc0fe8425709c57e5a5311b6
SHA512 ba2bb307019c2398bef37d0519794225a498baf45975e2f159eb677ec4963367fe565b55b4207dbcdce8efcda00491495e5b9d82ca2a5322876861c3f53700be
SSDEEP 24576:v3Xd9CHKy7GZeyxknw4FYnshx8OfVe247:/Xd9CHKyaTx4x8EVep
TLSH
T19795CF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 1ed54ead2f17a0f271568425ff50e95d494717f5e529ed9d31db11b02221f7f6
MD5 ae74a7d083790c38e1992a3436d82b2d
SHA1 23bb98368bdb3bedae1c7bd8e108279e28d6fd8c
SHA512 0712b20b138dd2e0ee3f5dc2001ae8f868c3cab9f3e341d7146d94b2697226eac05ec12c303c138092046a170eabdda3f81bc158b0247c991250e73faf67b625
SSDEEP 12288:tFg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:tayxknw4FYnshx8OfVe247
TLSH
T11165237CBBDE95D2F50D11734B7173626609B5A6EAB1811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 e0add11e3a523afc318d11a2d4a1ba173a2317e874d0adc05aae3b52961bd13d
MD5 ffa3f20ea4bb427e27c43a5b0041b47a
SHA1 5855319476045cab2fa2c9b0b206d6d95b505146
SHA512 4a97802f2f389d7efd58d8675dad2aa00f78ad84911e240143e7c8f0deaf3b3b2b081e5ebd5db1c244b85d0a4868d6f89de486b9a772318f24e7af27aca73649
SSDEEP 12288:Ivg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:IIyxknw4FYnshx8OfVe247
TLSH
T1EE65237CBBEE95E2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 4ff6b5a802ecb659c79d482dd20ea9605ba7947a634f8ecd4bf6ab23f4a20755
MD5 8baa59aff96b6f82102374a06cf60b3a
SHA1 4d4ac059d4a5a0a612e3e783860921aeb2fddc4a
SHA512 b014b17cc80577270af87d1e07a27993efb639c5b4ee02697bf1157934aa3c0deecc8fff02081724592deced869c35e020523f09fbc2b74df1ddd82e4b708df6
SSDEEP 12288:6Sg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6Ryxknw4FYnshx8OfVe247
TLSH
T1796523BCBBDE95D2E50D10734B7173626519B5A6EAB1811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 75f2334177d5e9516c40de459ac4c3924fe1d1a0fb86c3a09a56bdd6c9ac2119
MD5 7b2df772794793e5480cf489233b4541
SHA1 b20777dd529cd81da3cdbec80f7ae813db54f498
SHA512 7a742b6d898fbc94d59763e9b00826c14123b5ce6b9b584d648f54070b6830bbed007a663448572a80289dc17ca168eba64d7d9b24bce42523e6ba43979edf12
SSDEEP 12288:A4g+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Abyxknw4FYnshx8OfVe247
TLSH
T1656523BCBBDE95D2F50D10734B7163626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 bc253ce14436b21cfffe233fc079e78c82cfca8449647351f7e80234611c82b4
MD5 9acd1334bf84aa889d6b2190f71d602a
SHA1 f0dcd2a9369bb5bd3c9e88bcca25aeee73a0d04c
SHA512 989c1d5c534f212c8ef6418caad65c1c05cbcdad8713e9b0103eae6c8220c015cd5fd6604e68181f00768edab1555f040b29bcec907b888da6c9022b0a976511
SSDEEP 12288:wFg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:wayxknw4FYnshx8OfVe247
TLSH
T12C6523BCBBDE95D2F50D10734B7163626619B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 b63daf77fc4ebe1faa90e730855009f2039ed6bd24c65523b88743c5cd699692
MD5 600d56a030a59c5e13604d9638789df1
SHA1 650e78f100abfb86aa89af3c8d17a2452ce5cf20
SHA512 00ed688e17f105aa4c99d02c5909886a7b5d47de8b3aeb6fa998514fcc89fabca9e0dd1b90b9580dc5b648f4a454f535d8be84d20766b21f1054041c5f4913f9
SSDEEP 12288:Dwg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Dzyxknw4FYnshx8OfVe247
TLSH
T1A565237CBBDE95D2E50D10734B7163626609B5E5EAB2821BCB7DB00EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 3b0a8f36f40726b642b34a142cd4f9ee8ee5713dcbaf1f8cdecf18e14cdf0397
MD5 ab5ad579c52ca993e4234cb80a913455
SHA1 85aad82e3428ea0d4d181fe0e9f83dd0a17cd2b6
SHA512 de7793aa702abd104aecbf8e39589b72cea33c2c8cb95db769343fd432b3c445cd533f79dfe233bbf5ec34637afba314323c56c1eddce464a0f72bc2d6c3ec0b
SSDEEP 12288:f+g+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fdyxknw4FYnshx8OfVe247
TLSH
T14265237CBBDE95D2F50D10734B7173626619B5A6EAB1811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 3bb8171ce9b12e2d8568397548f8fa365bdf49682e927f2fb7ae2bc4a05c5ead
MD5 b9775b0a03a596857937510ecd006910
SHA1 50b76fc22b3637e419e1f252d4a8cc2e30ed1a3d
SHA512 2f2b12588a22d82c848c5086bdfbb354eb96d03e89cbdc1a11ba09dbbd3328fb98d26f16da8da0bfc316b54e18c40fbdf387ce301db35547175965097698938e
SSDEEP 24576:vfwvJk9RX6wkyAInyxknw4FYnshx8OfVe247:oMnYIyx4x8EVep
TLSH
T18B95CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 89c58ff7abadb5e05d850244c84c9a1ff98199503d230664672f61a35cc271aa
MD5 1f660fe0c6a8e1089f585f5870e66d37
SHA1 fbe446f0bb6edbc2d69f2364775612579a05a3f3
SHA512 ebe2866e29d5851f099f645caa0ce3f358d79e6eb637b115ab4b1026db41044a597ddb78da480e73a8770793bd60d00db5e8451dcd7c9fc7ae46346862782476
SSDEEP 49152:mYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Jx4x8EVep:YySzPRix8EVy
TLSH
T166066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9c72299001d36e138a2797c029294bd1efaa7eab7ff75ddb7732bb4ff33ecd4f
MD5 2c1e05c010145110d3bee379278b16a7
SHA1 708cdfa2f897bcc9f267b2db2349382e2f7f13bf
SHA512 2013a43713e8787bce83865a0dc50e1b277e96c21913f427c6230cba966e2908d0123a1b7c58663c76c26259ad2b20e047887f08e4c5de5585240e31803f0665
SSDEEP 24576:X47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY8yxknw4FYnshx8OfVe247:X47JUQj1irIhCnDHUPfF/Zx4x8EVep
TLSH
T19265AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 dbaea82691c35f1f06338d3f1a223d2e0fce418b66af8d331c122e51d6656a5b
MD5 66caf64c510a3b1fc2d0ce3bff81e823
SHA1 15482a52084596e29002eccd133949b84ca5b167
SHA512 eb8323544d94a259864a18f184218298cfd3e8ee2ddb6ba949072f40b2ccbb951e6fde1e4ffaca555d92512ab6007ffb91ce8c882667df44fc4d02a9a5803936
SSDEEP 12288:O+sfIg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:WLyxknw4FYnshx8OfVe247
TLSH
T16C75F028E29802E4D06E2176CB625641B3237C6597F1D3CB97D0F53E1FB1990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 fc8bd6b8ec9048578f8dffa8b8d7ad3e75ed4195fff5989b7f89c5ae7de13d8c
MD5 03d89d0d8059e7664b4858b71483fb84
SHA1 39c049c128935733cd3e4d1e155e16444b441b11
SHA512 a64753b46b3268f72f8a32b920b6fe5fd1abbccc0a38584a2301c8f1ca287491674dc5e76c04b9ea314df8f37c76442c040ba9d4c0316fe299ffa7b3e6779050
SSDEEP 12288:r41EMKIU3frQBgQQTWXqoUwIG4c98Uxt2Z:r42MnUPrrdWXZUwIZc9hT2Z
TLSH
T1F9352841766AD75FC6A940325E36C1CDA7707C02EE059F0372C98B3FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 f6a589ff2cde0bec323df1f774c773eb908b43658b521d3c4bd644186374da7e
MD5 a3c5c4880b8052e1547e3a39841716dd
SHA1 2f6eba38a0150987e5b40fe1e7a5fff2e1fe1286
SHA512 9519b3c7f73c649672dbf20a65912e2d81fbebcafaeec28feeb94c6c3547f66de08ec8045359d8dd5e6993cc2bb9bd34a40199b19c7ab0b9ef480e491c174af4
SSDEEP 6144:ENW+UjRFeraR1V0oI1LI1XI1kI1WI1/EGUwaDGLBC3tMxLC3tMxo5wxDTS/0Zej8:ENW+UVLV04w+/Bb+mhgTaE
TLSH
T10975E8819137A3CFD1F62032072A5B4DBBA4DC16B7096F2673C8453AD826B65B4F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 901a440f82701d6060812378f0fbced1791e3178a3f02cb13dc376e152fdc540
MD5 6770da9a42176ce9546135fc65269beb
SHA1 b59ce6f9f6b27bfb30cfbcddac61cf5c30c2f1b1
SHA512 4582792279b5ae412ae7c918e3e8d789c9be4479b40a67e68736bef0fab29c1e47b8139e64c143e5320af503162aa98335edaa9bf3244ddf2473953dd20f62cd
SSDEEP 12288:247e+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:neyxknw4FYnshx8OfVe247
TLSH
T10E65237CA7DEA892F86D11730676A231360AB5B49B70C1DBD728B14EE0B0CD0D97E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 46c32f0a02ec79706f8401af9dfdcb7bcc7781619b6ad7a82c7a31ed8a21fe19
MD5 c7105bbb08b9c478e7d822b18bb3cef7
SHA1 86d62287cfdc04d17982ae6028dc0687564026be
SHA512 ed5aad775b62f27964a8b1ca0dc4afc1db8ce6d5fd3123822329216a225760145e896c0f2a0aed88a6863d9d2e6d793af1ec3911b6c7af63ba7c280d030596a9
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bYZyxknw4FYnshx8OfVe247:ngb4mBIBhGFXx4x8EVep
TLSH
T1ED65AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 ea876a55de9164962b3549ede5168498b85d214f95159f209421569476d9fe43
MD5 c823266d35d2a152756515686e9d8fc8
SHA1 3fbf5f39203f548729884a5d451ef25b06077959
SHA512 f79d93d59bcb7dbabc07bb819d3a1c368d17a17ab665adf478eb647cbd21e4647384f61f7550a4ea3dfa3cec2ea37dbae5eede65d21ef5b0f7c3f2246ae8f31e
SSDEEP 24576:kG88u8FpJqH1azria7/msyxknw4FYnshx8OfVe247:X7ZFPqVla7/0x4x8EVep
TLSH
T12995F16977E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 85f41ad3d657ee34e6068650f7f4f97eadefcdb5063dabd49fe9d6c5175b8e74
MD5 579903617376b918f993a99e561e2b28
SHA1 dc734a8dca401a58b35ffb116894680ff1f2061d
SHA512 a028692c952e87603e22636f6874cd3fccd7ffa28f7c1bb12ecc481ae76649fd34e6a17330daab70cd2b02475e7863897a3755bb9cc5ed41684edec515e79f8f
SSDEEP 49152:TBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj8x4x8EVep:8G05lO43blix8EVy
TLSH
T18AD5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1d211398c375b333765a604e0e629da3b41cac379475586877d4c204e39603a1
MD5 e7a71b8f0b808b361507d8de691ee633
SHA1 7fd705c151c35c20697d5201bc51b93d3e0bc120
SHA512 231a1d85eaac8e3a4fff7fe947f330a905e6d7da7c6233420e1eee2d7004e7bdb21d7841d71a72d45ac71be293cd2b64cb8605057e3815f253636a857633ae8f
SSDEEP 24576:Lfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnWyxknw4FYnshx8OfVe247:Ta5POZ3+Jt2pasx2+mrx4x8EVep
TLSH
T13E65AF5DA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3dd3edb957967e034ba0bd6cc490fdd7cd674f614dc1c2a6e618e40bb52e6161
MD5 b36b101ba0a7e031f31435fc9e52c1ec
SHA1 f11ccf533c7113c3429960771ea037d20a6032ae
SHA512 d55d564cba7600743bfed14ab159414056928d5bb006eb7017c71802f12bf28dbff2c85f2b07eea506fc6fdc55c826487dec555600649d616bd777bd1881d816
SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7Fk0yxknw4FYnshx8OfVe247:NNc/zEOVHFUx4x8EVep
TLSH
T12D857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3f5fe5a8121c3dea861c69af46c04e362aa7595ca0b4debe5ae508114da976ce
MD5 9f2c4ead16e773e926b82f45b1c848dc
SHA1 4470aa6727d0135c0e7e3591b11c02cd5c45bdf4
SHA512 2497c7fd83c6831f68c9d9e5756d1ee1a73f0330ba8459eb194a8445c01c7a3343256ef166e146c264145af108f41bfde215b6ddb8ac29b7ba0e824ce2476c67
SSDEEP 24576:d8kNvNnaFeYhJNtmZBmnyxknw4FYnshx8OfVe247:d8MwBtOmyx4x8EVep
TLSH
T15555AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 f3de615b3c2bdfb4617474b03fdac2f1531ea0a0772eb921248f7b5a83e2fae5
MD5 07386553e7fa1d64a3e326fb15838990
SHA1 50e891ba98c495cc170aa2d791ac25d803b1dada
SHA512 f2b351549fe32d2c019a8c214c3f6732e09b425e64955091f09bfff4d329cc6f5d2a312514dbad74d65832ff8024ac01c73dbd83c5330f0103ee18701cfa5c5b
SSDEEP 12288:nHvUrBFrEjwaQJ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:nPUr+NQJyxknw4FYnshx8OfVe247
TLSH
T1B175F12E22ED18E5E67AA17D89828319F771B4621711D2CF02E0917E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 020c8120a8c28d77b1d7dd5154c8b8a1f473930216b32b71df58239f612bf6af
MD5 57b907938aff0401e699b904ad0f0f22
SHA1 4e6da42d184310080cc3c0350fc433cefdac4857
SHA512 cb32661c26763210c12c4c52fe8898c9b8332654d5e7ea236f57f10d8f27ed1d62e12567f8f601be8d44cc839cd0b42a5883fe9f498f650c14029d981070583e
SSDEEP 24576:ED3FHshBIYQgAPyxknw4FYnshx8OfVe247:EDVHeBIAA6x4x8EVep
TLSH
T1CB85E17DE79C04E4E47AD1BC8A638606E77138A9033256CB0294D1BA5F67EE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1944-102-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/1944-7-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1944-1-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1944-8-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1944-98-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1944-0-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/1944-78-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/2028-66-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/2028-74-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2028-68-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2028-312-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/2056-140-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2056-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2056-142-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2056-134-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2056-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2144-85-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/2144-314-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2144-80-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/2144-79-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2320-114-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2320-318-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2320-108-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2320-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2320-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2320-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2372-54-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/2372-61-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2372-285-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/2372-55-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2672-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2672-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2672-119-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2672-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2672-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4248-47-0x0000000001BD0000-0x0000000001C30000-memory.dmp

Download

memory/4248-51-0x0000000001BD0000-0x0000000001C30000-memory.dmp

Download

memory/4248-39-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4248-63-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4248-46-0x0000000001BD0000-0x0000000001C30000-memory.dmp

Download

memory/4248-40-0x0000000001BD0000-0x0000000001C30000-memory.dmp

Download

memory/4576-120-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/4576-128-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4576-122-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4576-317-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/4936-334-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4936-90-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4936-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4936-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4936-96-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4936-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4980-149-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4980-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4980-156-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6128-21-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/6128-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6128-15-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/6128-22-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/6128-107-0x0000000140000000-0x00000001402E9000-memory.dmp

Download