de121e718ed696cd4d2b7b29b43e904465977a14c358b167fbaf8302dd70a83a

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-28_355d7e19db6662e45b86c493d2e14e04_cobalt-strike_icedid_njrat_vidar.exe
Size 3.1MB
Sample260928-vctrxsbh49
SHA256 de121e718ed696cd4d2b7b29b43e904465977a14c358b167fbaf8302dd70a83a
MD5 355d7e19db6662e45b86c493d2e14e04
SHA1 f7331bcd3221d44da94307f1f4c79c5c33ddfda3
SHA512 899c8a17ce3878b7d6515ba891f856370dfb4d03a0da17fa78c62216df4c3b2cef13550b1b734f89bdd64c673569cfe47b127d290a7dfafdd2fd75eb12114658
SSDEEP 98304:nGIetVu0VLGMb5Cx0taAUgLdpq+Xvna9k7VoiX996Kc2Dfb9s/JTHfb9s:ZetVu0VLGMb5Cx0taAUgLdpq+Xvna9kE
TLSH
T1AFE5E05A679C00E9D167937889E68906D2B23C06B7618BCF03A57B6D2F336E05E3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
928	elevation_service.exe
3452	elevation_service.exe
4392	maintenanceservice.exe
3492	OSE.EXE
3824	PerceptionSimulationService.exe
5964	perfhost.exe
5684	ReFsDedupSvc.exe
2144	SensorDataService.exe
2600	ssh-agent.exe
1132	AgentService.exe
3720	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-28_355d7e19db6662e45b86c493d2e14e04_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-28_355d7e19db6662e45b86c493d2e14e04_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-28_355d7e19db6662e45b86c493d2e14e04_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-28_355d7e19db6662e45b86c493d2e14e04_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-28_355d7e19db6662e45b86c493d2e14e04_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-28_355d7e19db6662e45b86c493d2e14e04_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-28_355d7e19db6662e45b86c493d2e14e04_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-28_355d7e19db6662e45b86c493d2e14e04_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-28_355d7e19db6662e45b86c493d2e14e04_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3d8069f2b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4616-0-0x0000000140000000-0x0000000140329000-memory.dmp	upx
behavioral2/memory/4616-75-0x0000000140000000-0x0000000140329000-memory.dmp	upx
behavioral2/memory/4616-110-0x0000000140000000-0x0000000140329000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-28_355d7e19db6662e45b86c493d2e14e04_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ba8469e694fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a57cd5dc694fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000085bfc8dc694fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e6216a9b694fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002dfe899b694fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d24e549c694fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe
3452	elevation_service.exe
3452	elevation_service.exe
3452	elevation_service.exe
3452	elevation_service.exe
3452	elevation_service.exe
3452	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4616	2026-09-28_355d7e19db6662e45b86c493d2e14e04_cobalt-strike_icedid_njrat_vidar.exe
Token: SeTakeOwnershipPrivilege	928	elevation_service.exe
Token: SeBackupPrivilege	5684	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5684	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5684	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5684	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5684	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5684	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5684	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5684	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5684	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5684	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1132	AgentService.exe
Token: 33	3720	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3720	SearchIndexer.exe
Token: SeDebugPrivilege	928	elevation_service.exe
Token: SeDebugPrivilege	3452	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 4876	3720	SearchIndexer.exe	101
PID 3720 wrote to memory of 2100	3720	SearchIndexer.exe	102
PID 3720 wrote to memory of 268	3720	SearchIndexer.exe	103
PID 3720 wrote to memory of 4836	3720	SearchIndexer.exe	104
PID 3720 wrote to memory of 1044	3720	SearchIndexer.exe	106
PID 3720 wrote to memory of 4572	3720	SearchIndexer.exe	107
PID 3720 wrote to memory of 1452	3720	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-28_355d7e19db6662e45b86c493d2e14e04_cobalt-strike_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_355d7e19db6662e45b86c493d2e14e04_cobalt-strike_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4616

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4392

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3492

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3824

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5964

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5684

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2144

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2600

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1132

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4876
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2100
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 2952 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:268
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4836
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1044
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 2952 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4d4f3bc9ee050080d6aa407b0ef2cb9addaf53a9094525d0909b687377dd896e
MD5 b48768e22a0c3fc75a022ae693375368
SHA1 06a46bc87055e08507c5bfe56da3475abbc17c1b
SHA512 86559318243be684c956a1de870486468190949d3f7604ef43dac2b908e3f4e449b036e64c1897ada606f129d56c490a178c89aa2a035b42f0b42984b3a98dd2
SSDEEP 49152:Ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxn+A9n/TDbXNKd:i3q6HjBefb9s
TLSH
T1E4D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 c1fd1151275aa95a7deb8b603930ab692597852065d013993ee2e9ada73c47db
MD5 8cdd3af24698fab3ef24bc8f3fafad2c
SHA1 00d8b3a2fc0301dd36a5676ddf48dfb1acb40356
SHA512 7bfbff06ff3ae9b8ec6f3b2e653a2f718c39774055848dc782eac3cb0cad5c735147148ecd9aaafc419e8da3d27a3932b48bd89371c605a353c4e051b01e00e8
SSDEEP 24576:EXYfDtczAdUeA9n/TM4NZYeNm+9MhUwd:jtcIA9n/TDbXNKd
TLSH
T16685012867E408F9DD67827CC8A28505EA73BC454760E7DF03A4992A1F333D85E3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 5db3d90714a8af5e10f8c8fd615b1b5a211d9590a9c7d908fe724a03ccc3a01b
MD5 f4662706e3945f247f06c464cea7d9bf
SHA1 dce5f999436c62dcdee00eace30dc5d5a4c5e2ea
SHA512 d2e89d053b2fde5223f410bc22c208a9a7f2569e4afca95ca95bd18f542e6634d2f80f09c620029deec61a659c5b153805953cc2930b2f98c4e441a565ae644a
SSDEEP 24576:V0Le5ji0hmxYrMNUeA9n/TM4NZYeNm+9MhUwd:VPji0A2IA9n/TDbXNKd
TLSH
T1FD959E16F6748731D073C0B9C5D2A68EED72348657308ACB4286D77C7E27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fb4d6fd97799bbfbeabdbb9a1c4df427fbb92cb941b456e3a85a6aeae32cb2fa
MD5 c7cf59a3c13cf1ba1379ac5e690f2a03
SHA1 0cbbc3b8e0bfb755f737a666b82a7b6e2118435c
SHA512 3e49dbdd8c56b241a23f051ebed8ff4470045b805dbf9d6920c83445d346dbdf635be89a98b171b23388ef02dc425b1d4ca53e79f702e86ef40263c817046457
SSDEEP 24576:ha7/ezSC6vUyD/aqgrvWE6q8wyu/UeA9n/TM4NZYeNm+9MhUwd:g/ezSC6vUzPvxHjysA9n/TDbXNKd
TLSH
T1AE755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 816762cd732284102310309347dcb0374a45157d05bfefc94351d4d1827e49b9
MD5 90baff82d69c788925307336ad7fc618
SHA1 84f2d5ea484dee9ce96e3cd58ce146370c65bd5a
SHA512 1d844fc21373b2f0e57f57129fc0f9b104f10e126723686c510ae9d23fcfc73a8f10cf8684da7b886fab9b63bca174edeaabe91078d6899dfc3c168292ca5734
SSDEEP 24576:fVbqPb88hv/l+68UeA9n/TM4NZYeNm+9MhUwd:fVO88hXl+tA9n/TDbXNKd
TLSH
T18E559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 f9e45c96ee2b0dcfa9d84354de46557865e0a32ec168df5ba3ce4e0e430b855b
MD5 c90ab386a14f0c1e70769bad4b2b7d27
SHA1 e94ad3eb7a94863a141e72d31c064588d77d6f21
SHA512 77cafe6a5a8fe7b917a7cac7738dba66748686138901477eb793d7373555178995abd926d03913cd38efae93837ee712d1fa632ff00bb5ee44c353360bc08623
SSDEEP 12288:bH5BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d8:bH5UeA9n/TM4NZYeNm+9MhUwd
TLSH
T17F6523824FFC08F1CB8E0A7544AABF0CCDA2BD4DE684879D4719762A5E385C6C95648F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 3a43764fda883436050202fca450f997f90e8ed46b26b1d677f58e23c13488f7
MD5 60393bf28580fbe2b9fa6fd0be90a8ad
SHA1 231fbffbe2d84b3bd3c583e5471bfd0bbe768ca9
SHA512 c2ae6fcd84b80ab9b94cc1276fc9c8d93a6ac63938bd79ded1cfaaca68eb6fb05eb79ba0e3ef397b112f8369fc3ab8811694afce7eafdff51c047392b6428b75
SSDEEP 12288:veBNUbTVO86UEBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dC:vJIUEUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1A685CF7BAE38ECE2C27E4DB95A918700D77278304B5293CBD165830EDE235E15E7AC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 65c59a281aba27ddfd3c7866eab9236bdf84658c012ff2e304f36b812eddb75f
MD5 21fe9e80ee3cdea4c10f05367e99b9a4
SHA1 0d763ca0fc88d119d178ecf681b29fb190b1c66d
SHA512 c225127f03981b6f1184250a31e2ab609f77a426fd83dafd8d60d1e0303b18836277b1a944a9de2cc270c2082c244bcdf036b8ea5161bdf5b431467d5455b4ba
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THu:eQvGAdlCEL8c/yRNw5Cofb9s
TLSH
T14F267D656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 8be61e3271411518ce3811e06d4641b6268b18cc0c071c4a4a9636deae30b2b5
MD5 42b299a435024b60612a73b5b1d7a2d1
SHA1 fcaa4f6128113ddddb34e3a1b61f9ca8c6f7e8b0
SHA512 e560550a27917e9b801d7adf482e111466558e8339a998337cb8fd37328d5f124ead4e128e9c45c1dd7c0b00745a854ec06f415d478a650f4ef23da522468e51
SSDEEP 12288:KAwSfxL/2Dc3SDLLmt0LDQewsAjOBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9E:f7ewsAjOUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1AE85E031FE74D432C3BF0DB21B36D706586DB9204B511AC3E3A89E9E59302D26776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7370737730c906c4a2aaf44eae52b2388dc23ea5689e22a1fc2fd8a28f1c8f08
MD5 02f5fae121b48d69d431a5a33e27ae29
SHA1 0f7fc3f5662f280477410f4e0dbf9635c0b01ae8
SHA512 c39c7c3fdf588788a38526976a94aba1cd62881722f2e3d7079f13726df4c21e16fd0b28b37643799b7d4e9bc1738dc95533dd8c05834d01e16296966d61d1fb
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHt9:AUEtQevvqc2W1cpV2EI32
TLSH
T14C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 53f3663e7420953efd76c0e7acedfa578356aec96d4090573345e98dd4afbf34
MD5 64acd33edbca512756b16cb2f1cc64b3
SHA1 80b3de3039a68e5568392e6d99fe7a476305f1f5
SHA512 d3f88425f26a1e7423071ee063f63157ac36a86540a96b10f64e9d0532e64b8c6f640302edee3e8f8b6efd9cc50ad394f841ed2524db53fe4ecb73c23a168eb2
SSDEEP 49152:7CbRquA/m2yL5zTfFiV+XenmE3/zYA9n/TDbXNKd:koquVjnm0fb9s
TLSH
T12BD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2010c5843b670fa43e6ffc869a7576983475ec7d9e6c67fc4bac6a8f7e927590
MD5 14c68a7fab029762271cd779fd00ebd3
SHA1 fdd043fcaa14b0134119101402c488a3a78fe4c6
SHA512 0b9ea592a124b32c0851ea3de4d29d53a3df86c1fe9b200c9c30a34266751df4d43d9ece988f03ab33e2e215fbf2bfe8e288e38ec3c742bb718de7488fef6cad
SSDEEP 24576:+AhGLJIFoiwtA5l7S53jUeA9n/TM4NZYeNm+9MhUwd:+AMyFoiq53A9n/TDbXNKd
TLSH
T1DF359D81EBF945D4F5B3AAB899B69570EA76BCAA5E31C20F1150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 f274182f91cd312da26f0da54277f4669e92f4300e2f24ce77ffd176dc4bacbf
MD5 554b8de61650d65d2f5d4a5430f166e1
SHA1 b7866ba881a96b0ef778f6ad58b416bfdf840b87
SHA512 60ae3f307c685ddd68fc8efe29e84715ec3e30343fd97f9fccc7ccb2a5983a39ef3bc8f9fa9558f51d2ff61f1cf3b035073b3ce4c041513571cfb70c142ece85
SSDEEP 12288:jmw5HEjsChNzBFgl0WDm+COBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dL:iwuSOWfUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1BF85F14637E80CF9DA6742398597D635EBF2BC062A21C71F0760C65B5F37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 dd87a8af46e540dcc4cad55fb660d0e3d726ac54f7b8b35af44cb1a015fe8e4c
MD5 040ed80109a590f7c2b84db0f889803a
SHA1 2292bc5113e2bdf9b85bdf44be11fcf96f4c0761
SHA512 0eb2bf48b48bff51fafb26ce893d359bd587b2be4f5359054b0ad21468f91b08c2397e8d8510684391fc2cff935ae605de523591ec3f5b04aac49c6cdecd1e3d
SSDEEP 12288:zjZ1Iy+BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dQ:PZu1UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1CC75128627F814F5C397467CC8E56B08DBB27C5A677543CF0225626A1F32AC28D3A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0f54b91e5ceae1eab39afa3f88a2cdc8baf997a55ef4f8526de599c106eb72b9
MD5 866cb5f4d513d2e67660351a23486338
SHA1 ba03399e28a89fd0da771512c3c76440b951d869
SHA512 58b1a1de51c2833e14c08a1934b7250cf5f9745aa4cc571b3dbb228b7fd99573725967678f7f6505bbc6e5c334c1ff9269f9dcef4fed5b3829a05cb6632c3881
SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:dQRQyi36YOcPQLvw2gAf+PN37fb9s
TLSH
T15A666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1821534af950f0d4236771d77f907a5138efc11d1b6018347078b78df03f90ea
MD5 c25c5740d228ca3fbc59ff85a2766c6d
SHA1 8322011606a16be0348092d71db1ffa44d8ab05c
SHA512 48b800b14cfbafaf7525b5b4ff994e8f3ca63f7b718a027668afdd44a91e0b15fd0dc0389fc09c9b1709a9fb8b01cdd5b96e4e7842c3124f9c54bf9a69093ebe
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:UQRQyi36YOcPQLvw2gAf+PN37fb9s
TLSH
T1CB666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0d77ac813798bcc666ce6dd887f26a686f7790dd52b3e93f5d442badcf420e87
MD5 06450a61bd3954a5eb6862e2267722c9
SHA1 ed95af537032be9c72c3198b1e32f62a0f2df91d
SHA512 208dd900123df96e955008f56a4228e8cc3add57327bc2128eabd210c3d3387e50fbb23614ca97d0d800c85157c1e867c0f043c2f0ab3f93702b04af3033c153
SSDEEP 24576:TwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0FUeA9n/TM4NZYeq:r68Qg55nhheWu7PNU3/IA9n/TDbXNKd
TLSH
T1FFB55A33B2F600A9C44DE1769F4A972196D27C758FE0E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6a5e926aad28846b1468da9f417afd3e6ed9bb3354f52e533d69616583f60935
MD5 ace9315e169b23334c5c930501a91436
SHA1 665feee456523b64786f97e9b23b21f982dc2bc6
SHA512 c3182a5df665c86485bd1c57f5c0a00e5b43805542bc908bbb7dd23db701ae9c2debfe3bac49ef2f1e163a784d56ae692697c2c33f10f3e7084ea6777e18e925
SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99M:Xy5112gYy5azzVvL69nLKnhZGfb9s
TLSH
T110167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4c3a82e4b20102ee21bc9940ce0ce2a8a3b3380b1b09fe161213e58fba70928f
MD5 903bfd0042ed8ed1ba8aa9404a2c144a
SHA1 257eb2893e93765dc2acac9a51c19e497c412d98
SHA512 45040bc051093a4777f58b1cf7aa5d6576a93ef859f76771c06c1868d433589a8e72f67cf1cb2826806a1c6311435bc5b405e3ba5d196a83a301cc85f91abb96
SSDEEP 49152:pB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glJA9n/TDbXNKd:/u6JmVxd2difb9s
TLSH
T1CED59D13F1D901E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 80099cc2d4518f9d6e985f513664c250c8ec10a5ee275ef1fa1b2b30ae62c29e
MD5 02e1b157db2511a098239a624c5f1b5c
SHA1 3dcaed95595e54af7fcc6f2ca18bdbc280db5d39
SHA512 22f2075bd248279ab0ae93f18ae107212d5540a746f9a2f1e2d276f063377df50404167d4f1854c57f900e65c18b7739e1516f7e875e7e9d3579379f27b3b6d2
SSDEEP 49152:/1hpsNoJpF1A6UU44CwH7R4xGA9n/TDbXNKd:/mifPbR0fb9s
TLSH
T1F9B5BE13F2D800E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1d24d6d48a3aa1518462a0d01c7649558a128d5664d0d0e318effc509b6445d6
MD5 921456a8c6b241cad555df5465ecdbd0
SHA1 cb36f285b5ae4747296dbefe543755393976934d
SHA512 11c0b6edf08f5980d2bc20d004218dcb3bac399afe689dd470cfdc7b9dbb9bbb466eaa90f9ab444028fd2fc361153abceb6d5d1c3318e96e25486b9fde20c173
SSDEEP 49152:HSuZQIY0Be2KRRVtOnks6NMHqxA9n/TDbXNKd:d5dKTi61afb9s
TLSH
T1EEC5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 76468227b9d97ba75f49ba401a6abb45750fb11537621f631f28876fac688ea2
MD5 b21c0fcdfed3a79d73db1debe451c301
SHA1 7346f3565f3324d78d76d8f709cf6bf3eb00eb9c
SHA512 adb71cd4b969795fbd4ae2991288c792bd46c77e7d618a73aba358ad72a5795631e83ca449a33ca088a19616333213678d3d4fba4af1659fb9a58f7502c6a68b
SSDEEP 49152:MhtSn8EApI0figngiDn0AP5wCA9n/TDbXNKd:tX2iyphQfb9s
TLSH
T16595BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 e898f7d396c4693769fa423a141bf070d23dcb04571d988fa8c99f317c9dc0cd
MD5 20e0803f559899301d86862368d4736c
SHA1 8a557c671c38bb93145262e3bac578d534de9a51
SHA512 58e961869df8f9a5dc632c4aa6b1779ef9d2faa8f519389a99cfe3af1b950140965f581e163e51ca0c635078bb84046eb03a98e384f19be6462d7e25e785b739
SSDEEP 12288:3hBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dn:3hUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1636523824FFC09F5C7490AB584A6BB0CCD91BE4EF68543AE470E722A5F385C6C9564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 8b9b5454a3f9369689e32fa099e87320a046da3a98e584692e3fe24e2f356788
MD5 4db5ac3154da60ef378de05b5939b89f
SHA1 dfdeb4b41313b428ace831efc46608b6edda0119
SHA512 f6f4f123cf192e874139d90bb5b6d25329fa2c77e479477a2a8896f038a662217f2b1fc6a0e1df731dae292d753f6e020e2125c25c239f8635f61d16a8816174
SSDEEP 12288:OKBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d5:OKUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1CC6523824FFC09F5C7490AB580A6BB0CCDA1BE4FF68543AE470D712A5B385D6C95688E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 59feb16bdaae593dd51b48155409a485cbc338460bbf29221c601fc7384b3e06
MD5 73ee513dbbc41d7fe6a5528d8f40309e
SHA1 9a4cc4b95e6eaf459e36d6adcd4835a284a643c7
SHA512 b39a67fc34537ce618ec7ef4cc64d538f1fead9082c267e80084c4c368c1950bd38431b311f3b960ed5ad9f62ffac43e392a453a1f9a7581cc2e5d6120d5530a
SSDEEP 12288:eMBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d5:eMUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1B56523824BFC09F5C7490AB581A6BB0CCDA1BE4FF68543AE470E712A5F385C6C9564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 92cebd01da069ea9ba6803bd03e259edccd34c8d553a624be46e3c05afb7744b
MD5 5969d56068724e6efe7a5daf4745bd2b
SHA1 1b61213dd278aecb15c0f40af071bb95d6b9f5b1
SHA512 c26ff52d037d507a7491b680984f9940e032db724995084d474657e160ce49085d72f2845316d7b1b25031621cf36c771cfc76fd7f213349784934000b4b7488
SSDEEP 12288:WVDBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dD:GUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1056523821BBC04F1CB4A9679C4A6AB08DAB2BD4EF76183EF4705351A0F302D5DD3598E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 b4a6e9fe106db6b6e810480cb777df8739e74d7d0c62b4f5849beb0fa60a3c76
MD5 e100a84f44a228d0e42e40756cd8cf35
SHA1 1578eacd28453cc01d5f732832b159fe7282fd65
SHA512 68ed129a5bea6f93e9983cc3f5aba1673a4f0e58893e15bf413be784ad764c4e5b61b9040713c8f839e6213811fa65db316a0169253863e746c687a4c36f24cc
SSDEEP 12288:+7BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dU:+7UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1C26523824BFC09F5C7490AB580A6BB0CCDA1BE4FF68543AE470E712A5F385D6C9564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 039f1b7967b3240be2edfce57bb2e3ce32386ba2e221cf928401796e11ef31ff
MD5 e8682561b099ce48f518f5bf5b00a037
SHA1 1dfaf090b6de2827f286f43b47ba1dd0b33f21d1
SHA512 ddf59216df3e42e1b6cf90ba05fe6fc1d765c56ab9a2fecd31ebb921eda11416c3c21dc8d69c5593d38259cc44e67f9bd17d71d3caadd76ba26564912208aca0
SSDEEP 12288:62BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dU:62UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1936523824FFC09F5C74A0AB584A6BB0CCD91BE4FF68543AE470E712A5B385D6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 5bfb206ead513ff35d919953224af268160abe1507562516f831adb5bb89d7c9
MD5 abf9c2e7244c239f8d59978b974e8a90
SHA1 bddacd9b3742d323152d7f6fc1be3743b02ce066
SHA512 6a90c129f0348c8bbca20b944ed9d39021a8bdaafe448a8c9945695914dee25ef12b86c1af40155f14bd87930000b77565fea790b6185a8e7cb5d3a305b2ad42
SSDEEP 12288:riBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dY:riUeA9n/TM4NZYeNm+9MhUwd
TLSH
T15F6523824FFC09F5C74A06B581A5BB0CCD91BE4FF68543AE470E712A5B385D6C9168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 1c7d5798845351ceff52f0f93f842d9c0df1df11fdc5951e31d8ebfe4dfdc572
MD5 1d626a0b3ad8a8771bffde65d6836a90
SHA1 88b6516d5795200099bbe843ff60cdf58716f4b6
SHA512 9e1639fea59eb809c9cbbf931ecdaccdab65161a69e048fb780a42c16685b592b92e062d242acb5e04f6c580f1a83a0eee7dbfde79814075216b11c875475f32
SSDEEP 24576:aZMEzFVSOqUeA9n/TM4NZYeNm+9MhUwd:aZMEzfQA9n/TDbXNKd
TLSH
T1A5850295B3A00CF4DD67423EC8659A05D6B2BC1A5760C75F03A8362B5F333A14D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 140c2f9c04dea18b6f6effeee5fbf348a2f6b7100b1d3cd28b6073c7dde56092
MD5 d881204f51b26f8e082554e75870e562
SHA1 fccdc10822685108f6ae1dba3d41381899456bd2
SHA512 847ddfde80edd6fcbd4d57f36e70f3c39b58551e6889e9ec2db36a28278108c4336f0d8dd99a12a02825478fd51b5722b01a7d7d8a3a1bddebba1fe542df9143
SSDEEP 12288:mlBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dE:mlUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1B06523824BFC09F5C7490AB581A6BB0CCDA1BE4FF68543DE470E722A5B385C6C95648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 a783c5ac767106173b71cd47080fccdf9671fbc402af2628962167e4a7623ad3
MD5 fea17bba409da3520dd799490a545722
SHA1 a4f328a35bd9a1f8cb4fa02d59efc9a9a760a359
SHA512 1c93e0b5fa803cb064611d8dd5ffc437b6b2bcbdcdbcf60a705a82186625feb6d0cebfe9bc08f0386064cd198c9fb53d6305835bfbe2f49c7a9ec7e2867b13fd
SSDEEP 12288:EpBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dc:EpUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1626523824BFC09F5C74A06B581A6BB0CCDA1BE4FF68543DE470E722A5F385C6C95648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 c2e6644b66933ca68c643fc290716b8f23aa06af6409cbc052e581963b2fd7f4
MD5 8360bc285d01fed68c24985599de56bd
SHA1 22644963689dfab83520eb28d1935f77d15fed2a
SHA512 c3a1f585894b3bfd2fd2eebc1840753f5456370a1320e89604be76a99b8308f1dceb2fb3b9a288be62b7b09b52c7d5c07198054e841fe519f73eb49bb7459fa2
SSDEEP 12288:xyPz5L8+BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dC:gzy+UeA9n/TM4NZYeNm+9MhUwd
TLSH
T18075024777B520F9C2664238C8A21B05F772BC3A57208BAF036417762F376D19E3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 138a8ee246b09e1ad23ee0bc5dbe7c81a1bba988e1bf1927c212aafb77de28b1
MD5 04edf0ca141d8411f2dd5b92e0b1d6e5
SHA1 8c327c5ad9aa4923af6229dc447c64dfcf098e45
SHA512 d63ace4f32ce40ea322443d9b123f49fef39c3e7ea5a463c7df93fce7b03d3f13884942bf31b2843649cf5f34fa69e1dc7638c04593b25d20a5f8c40e64715b6
SSDEEP 12288:hlBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dM:hlUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1576523824BFC09F5C7490AB581A6BB0CCDA1BE4FF68543DE470E722A5F385C6C95648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 e4395d93a292faf1ec860ac1f51f508c6821f70b88db80a08453d00f2199057c
MD5 3c80047ba52b3991b103ad27e1298f5c
SHA1 2a84f1218a68df44bcf53b310ab8022cd4590e2f
SHA512 0916b21eb03d66eb642147a2f2d44eae4ae42605bb329cdf0db682bee1019fdb59e37c7f26df7f3b80e73b0f64d249d7344e17b4d37baa19050e636ae15c2a29
SSDEEP 12288:+lBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dM:+lUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1CC6523824BFC08F5C7490AB581A6BB0CCDA1BE4FF68543DE470E722A5F385D6C95648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 27ad1520f24ffc243b59d42fa00120c54f994f3b2ecf481dc53a56dbf485fb3f
MD5 41f2be839268363e2dcfbdc72687b5d0
SHA1 f88e7d0ebd76478f8d69ad24f7dd0ac3c3b85337
SHA512 19327e9d0cb17d45cdf61b2c31abe296a4ec86f0edc08fc37c00d0d0fe74a48e6268a3a4e69c6c483cfc00938c0c8b43fa15f7a67e6ceae467b40950c38eaea0
SSDEEP 12288:qyPz5L8+BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dM:3zy+UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1A775024767B520F9C2664238C8A21B05F772BC3A57208BAF036417762F376D19E3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 cb5d03d477605fb0a89b747405c89195f008ae283cc187478c988d62bc1216e8
MD5 737d7f96db19341d5136c57fcd6df958
SHA1 e0653dc1b520937409b650131f957491e0f75b94
SHA512 9d45f0f1aef9728ede63722174dd5a7def44a9f2cf0b1fb3199ddda615da5eb399060129aca7ecef87f6adf6044a9d33fe0d8bcc7c963296f51baf0457f74c60
SSDEEP 24576:1TdaLl3z0zDcUeA9n/TM4NZYeNm+9MhUwd:1TwLljzA9n/TDbXNKd
TLSH
T12C850295B3A00CF8DD67423EC8659A05D6B27C5A4760C75F03A8362B5F333A14D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 ecad0742ce522507fac9c7a3d0b4c9e5820594088fec42c1354ee26038c6954c
MD5 69fd6521769f444887b87ec131e86822
SHA1 469568303d79ee70c41553021bc28fac58becb07
SHA512 307cd6dcdb0ab3b592591c1e4c0353e536fd6a28f96035c4896d706532ba194b8d5bc317313c66461d2cdd6f3004dffa5f7ad7e2078d8913e0a193030906539b
SSDEEP 24576:035d9CHKy7GZIUeA9n/TM4NZYeNm+9MhUwd:+5d9CHKyaQA9n/TDbXNKd
TLSH
T13895CF90F3E814E8F1B79A35C9765501DAB67C5A5B31CA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 a11ed9c4b55324c4b2006482da4a4bc889e0f97e8e68f2103364970965f3f6b8
MD5 d1affa0ad0d25ba2b3eb719907c12cac
SHA1 7b688a4b03cd61c2bd4d526ce3596bfd2bebd50b
SHA512 985f933e00b125b79a79a8f5116aa6fc467ac5eb87686036496c39c8f9fd63ef4b62011e6ec2e9cc81725d70c6a3fd0daef2f301acad308b5f09f07bca3ec828
SSDEEP 12288:ssBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dd:ssUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1F06523824BFC09F5C7490AB580A6BB0CCDA1BE4FF68543AE470E712A5F385D6C9564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 5a74d4fc9424353f40956e1c4dfb0c41f3a89f889b5313674fb6556b85ae30fa
MD5 e1bc620702797a313dc5337c293701b7
SHA1 d0fde30b8b0a42c3a0de279bf4888e49598d4cdc
SHA512 5b9c08f8c919614c2f380d3f9fd5f33100c6e237b5ef3d44784eccd7c88493273971b6674439bd42a1042da8a6531b336b0ee4aa909fd0835014f1029037f063
SSDEEP 12288:zeBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d1:zeUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1CE6523824FFC09F5C74A0AB580A6BB0CCD91BE4EF69543EE470E712A5F385C6C95648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 f67b07d65110c2094c2e38ebb78541bd0801af1f9ab5cfe9bfa363a2ea8f97d1
MD5 dc3bf7758202bc2a792207d89a59a3ed
SHA1 93e2084f2a65c14657e7bf5ab592d668457b2f9c
SHA512 99207636cf2293dfff1761d76ddf22033455a04d20edd3c482c70a9c58725b37cf3b38848a5c2a38c172f6b0901f06c697a9d771258dbbd4f51e5d41b78fba63
SSDEEP 12288:33BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dn:33UeA9n/TM4NZYeNm+9MhUwd
TLSH
T17B6523824BFC09F5C7490AB581A6BB0CCDA1BE4FF685439E470E722A5F385C6C9564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 677cbde128db770d3b876dd2eb1f6dca592e17cf84e11a1606e3e6bc0b5cf3df
MD5 394f069b54a293603fdc651bf87455c2
SHA1 f9ec668076f5517f5f15e4f3dcd51b3be2cd0f9f
SHA512 11e3a6737a289f08b463b8bf84f693886b596ac73ac197d2e56bdc58d82333b387988f4cd2d8860ad094cdaa7bbf64593ade4b8881613215424a85325a9f3485
SSDEEP 12288:VlBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dn:VlUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1696523824BFC09F5C7490AB581A6BB0CCDA1BE4FF68543DE470E722A5F385C6C95648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 ff9a8a99d721a836df0a5da0c3e0769733b54c19f5919b1d7bbae0e60607c187
MD5 b273895b64ac42142cce3a2698d268d4
SHA1 d4fc094f5958c3522f413e14c9e4af72b7c972db
SHA512 1e7cbb5d5ae7ca59a264d52ddfe9f54f53365ed3a0c6fadf847682550e9856b497c9be0b2da569d511f0a6dc374b13b399c9cd2d42f9cf80ca242015fb8bcfd3
SSDEEP 12288:5sBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dM:5sUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1B26523824BFC09F5C7490AB580A6BB0CCDA1BE4FF68543AE470E712A5F385D6C9564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 ca1777f3d56ca88d2d2d4b7d30dc6841bb671eae527b27acf6f638fe13b0f807
MD5 72dbe2c1d62ecdbd9dc408ae54a1d6a4
SHA1 cd15cd4f10b051bc0cf060090fda30d33b3b8bb4
SHA512 1cdb614ec76648868047513a79b923a370aea31914e996d7b048177982600bb8c6d34ccd82451b7c30b744177162aeb37c6f3e8ba6259f4e504673bb6b0510ae
SSDEEP 12288:/dBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dE:/dUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1CA6523824FFC09F5C7490AB585A6BB0CCD91BE4EF68643DE470E722A5F385C6C91648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 33bb6c67ff1ce98396c0e5f6dca9b38387d07493f25e1b71befe7eda60b70eae
MD5 13b01ed5402b02f0869109118f45fb33
SHA1 fc0f3b09ce5f4bb66904ad8f311f543f6ebb0960
SHA512 2f4987eb76ef1b6289cf46c374da9d6827e03c9f23a676322984cf54ec9916e6254ea52fb914db46e4fc735a77c7b3fee13bc7999d55b08ce4b8e5ab2c00dd7c
SSDEEP 12288:r7BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dV:r7UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1946523824BFC09F5C7490AB580A6BB0CCDA1BE4FF68543AE470E712A5F385D6C9564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 8f526bceeada47ced2d8a55a1d67861cca1423d590702a662472bc021fac340f
MD5 e0a26e7cfb84587ff4173292a8adc077
SHA1 1549d8aea2d85821c482f09a46d4cad1867a9a8e
SHA512 bce5361be317c3de7d27146e50ae6f8e0f5436129718c636242a5ef92780c49ea5278077a1a658698ff0d09455b1a66d1b02427f7d671f860436995d887e5aeb
SSDEEP 24576:gfwv+k9RX6wkyAIZUeA9n/TM4NZYeNm+9MhUwd:+MnYIlA9n/TDbXNKd
TLSH
T12E95CF29EBDC04E5E1B7923C89B7460AF6B178591B31C2CF025A536E0E37ED49E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c37173d337e1d9147ea09fee06dc5a905ecc3273d64164d4d2fe863823a2cc27
MD5 914f18045af6dd792dc245855861e0ac
SHA1 ee4754e5010bc30420a7eff25705f54ff150cc0c
SHA512 94b700a522fd83e404b80d710f707de1f7c9c1b2ea40f2768a074e4107cd4e486d0174b8b66a4376a5c07f514a55b58c011f74bb32c2091f1966cde3e4e9bfd7
SSDEEP 49152:5YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0iA9n/TDbXNKd:hySzPbfb9s
TLSH
T1EE066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 27e7edbd4229311e0c757c760fa253da5894556ae743c775d70555418cad063c
MD5 3cdd20f26d6c4ec9dfacb8e7c5c9ce08
SHA1 35c2cebf9d5321111be1587a70d187d6beb7c9e4
SHA512 ff562396a0421cb871222cc654244f312c5bc54cf16ef05231f016253619671b87082d6d84c7db18101098009e5d74e33737b5890599a53f14e4e595a74ec66f
SSDEEP 24576:C47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYaUeA9n/TM4NZYeNm+9MhUwd:C47JUQj1irIhCnDHUPfF/SA9n/TDbXNs
TLSH
T17765AE1EA3EC01E5D1BA927885154A1AEA71782E5F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 cdf34d2cac2313bf4e46517a163f782fe144ec02311c25c682a8dfa86d5557b6
MD5 0f16c2342415954c00cf8066005ec41d
SHA1 aac210bc9386fe3b2b96db5c9c7bc63980d68af3
SHA512 32b4f5a1b1723e06235277f0538dcd618b2adc34a60edf19554746607e4198b877c04f5008119911c53773185b97a43a73baac2b8221cea6ab5b0395395a9edb
SSDEEP 12288:Xzsf1BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dk:S1UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1D675F04AD2A802E8C16E6279C7565A04F7737C2993E1D3CB43C0F53E1F366909DEAA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 07c5227d1c604ec66596956937147f37a163d80832bfec5f7f790cf557b65cac
MD5 d4a14bb35909116f57e0c1d2fc7cf991
SHA1 3eb7317beb857481262d9585131e180eee8ec1ac
SHA512 358341f537b1de60e3ed6066c4aad2ccbfd73493cad00a5d00aff3dd7c45980b9a5a116124728123fd02787104fb09b297cf3412b704d4be4f026fea89ccd043
SSDEEP 6144:NFsBC2naVkge/9k6wUbsotMxAHgHhDbVgX8jaoUajdGF0BSPTCICiPCiRwtDd4wO:ktFSDRdadLVFyywyX0w+kuWQ+gaum
TLSH
T1833517117666CB4FC66940321E33C6CCAB707D11EE05AB0772C9873FD576A58BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 9f0e1e16365aae55707cc83e5cc028c07137880b044e67e2649a6908f65d0c28
MD5 6a9c85de2161e1ae5feb578c7e0c9308
SHA1 84a2e7142652d330099b8c1b1bc1732bf97507be
SHA512 f2fbdbb1f37361567d514ee59c477667ccaabf3b307999e6f687f8fbdaed63d6122841ae75edf74f38258e2754c96242b957ef4e4320fe0f005a84d05ba5172e
SSDEEP 24576:Vap2uJlWqI4ONjEbhTtZ3qlbbdnNZbFtOIJr8iLG:Va7ztUG
TLSH
T13655E8816137A78FD5BB6032072A5B4CBBA4EC06B7455F26B3C5053AD82AB51B0FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 446e67933d7102ea3a6eff2d3a1b33d99231f36ca94b4cddd28d9616cc8e5744
MD5 4e1ac2a0eea379b5bbb5d6f67df0c0a2
SHA1 f1b90a1379a742bcc5603ffd7e49738a6852f97e
SHA512 1ccf08588b371efb39f554edd988e2c679136dba69d647b278cb004b8e25ef4fdad2332db3cb5e9ca16ed68ec2322655d9f33fb5126114ef8fd00e6f45a8c9d2
SSDEEP 12288:7O7UBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dl:2UUeA9n/TM4NZYeNm+9MhUwd
TLSH
T14B6523824BFC0CF5CB5E1AB440AAA7089E56BE4DEB40C3DF8609722A5E345C6CD7654F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9c817ac7759b3ad4a7f5b86f8de60c0a925843a5ad1fcdf4502e8c4ca7793122
MD5 1f988bbd80cf3dfd59c7087c6acb1669
SHA1 d59f1c25a20b8fe3e7b01a1697e5ce6342bea02a
SHA512 a9e429a7f9aa630b81d700e07672ded4ea952d1c369bae983b888cbcaf86947f176c5afc189b2f5531b16de8e7171c1e5893bb59b2d4a257ee06b56fd5223815
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bY/UeA9n/TM4NZYeNm+9MhUwd:Mgb4mBIBhGFUA9n/TDbXNKd
TLSH
T1AE65AE1E22EC02F5E1F9D2B88DAA4417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 22381f52d5c9c32627a3efcb2ea4aeb5f6c565718c6f01e64043c4ad297503d5
MD5 fabb91ffebf6dd3c1fab97892679072b
SHA1 4a6231585f1bc7db4aaaf39f20193e0730b72e54
SHA512 43eef4fceb1b010edeb3bf1e552a7ec59a576ff966c601529a8b33394c13deb81bcb82d1ca081d3eba5f293334f1f585149906eaace7ecf8877e4d42c3bba12f
SSDEEP 24576:KG88u8FpJqH1hzria7/mqUeA9n/TM4NZYeNm+9MhUwd:x7ZFPqVoa7/LA9n/TDbXNKd
TLSH
T1EC95016567E401F0C47BD13889824667FAB2B8251364EBDF07AC8B551F23AE54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 88ff198858fdf85121931b914115805d0d27d5bd6ab6b35d570863f52951cf65
MD5 f8ac8b899efdf05f65a0131965c5eb03
SHA1 1e89eeec632e8449dbd425b4ccf9951a1bce8dc1
SHA512 a1dc18cf146d6e46d5071a28d4b124d54630b296e670e2f7a253fcf782cc8a4c0a45844f76181b23fb9de212f42ec7b971814eaf250bf14bade684d87655dcc9
SSDEEP 12288:+HvUrBFrEjwaQLBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d2:+PUr+NQLUeA9n/TM4NZYeNm+9MhUwd
TLSH
T17985E15F26EC0CE5E67AA17D8582870DE772B8561312D2CF0290817E4F27ED8AD3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f8f3462da5386962f023ff4665b1954d3314024c69b92c5a7623cbe62899a3f4
MD5 2316f09539e65d4b59db9db0a69537f6
SHA1 2364c979066878727d07ee6e0db86da945ac04a6
SHA512 4010b4a04ca7f8b0bbeb521df9ad8044f5aeddee09d61444a9aab218084ce72f1d195b56a08de921b5c77f1e7a694a6a17dd70f303ba234b04292eb08e837d14
SSDEEP 49152:vBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/A9n/TDbXNKd:gG05lO43bDfb9s
TLSH
T18DD5C06A62EC01F9D1BBD17CD9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9bde11eaa7461193f3c05790606940dae212153a0a7f47d32e677f89a130d4f0
MD5 fb21fd0412c84c0175ccfb01b521cebb
SHA1 f5622eea54016429e79eb0cf76b24d756ec5a24f
SHA512 b4fcf493a3c81f2c216fbe4ccb4d8cef4b7c205d0ce42f6ed520eeb7d16152dcf16abb829f2952c6ec8ae14559ae3c1f25415bf25bbb104034146bb3f8ccc8b9
SSDEEP 24576:Bfa5POZ3dpFWVM50JicR2hG0lasx2+47eidngUeA9n/TM4NZYeNm+9MhUwd:Ba5POZ3+Jt2pasx2+mIA9n/TDbXNKd
TLSH
T19965AF5EA7FC01D5D5B9D17DC583860AE5B1342653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1a2ef3910f758dfbde20332468e0f2b12a47eb6d16b5ca6c6f2c9d664f100794
MD5 dd01ca2a4512c31b967cb13a28f67d65
SHA1 553b6b481f1aa4c0bb3ba4d8de9beb24d99a3e4a
SHA512 cca4791f2fd745922459ba54b07d7a366e2f216232d7a45e60542a2e6719bf4015afe85432dce1d14d0399ea71f34bcfbcd356cb5de11edf3c01bb8596dcaf0b
SSDEEP 24576:CNcwHdjbyQ4nLC18lb/EOjowL7FkyUeA9n/TM4NZYeNm+9MhUwd:CNc/zEOVHFrA9n/TDbXNKd
TLSH
T1A8858C1623E901E4E5BBE1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b03f93cac4e5b03fa158f06e55ef043fbb3ceeea1401fb50d014cc615b0b3b34
MD5 f712a8ba5066414597678f87fd3a74cb
SHA1 a7be50f4e4645f71ae95c1027b6efc6493356929
SHA512 ec26087c1bf708a9ce273830aaf14b499268bac70255f75c079b35f2d85bebe246092a0c6c6b27a500e895c37e2399e3032c8aecc127b56b6cd6bea0a7a001c5
SSDEEP 24576:R8kNvNnaFeYhJNtmZBm5UeA9n/TM4NZYeNm+9MhUwd:R8MwBtOmFA9n/TDbXNKd
TLSH
T13055AF6EAAF805E4D1FEC6B58D238516EA727851173293CB4390C13F0E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 2b43052b5120c9f9e74c8ec229615bc7e4bd55d6befb0ee0ae0c06748a490ae6
MD5 17b1b15975326584e38a199404914ef0
SHA1 301377ee724853609e6855260dd713bfb78ba148
SHA512 b50839cc8dab1dadb32dfc1189d4493abb8f2ca1d8b9e951e9fd1d3684aca5f4ac210c7e416c9b49a09b03854d70e1f05378065aa6e40c02e29503e4ee1680e4
SSDEEP 24576:dD3FHshBIYQgABUeA9n/TM4NZYeNm+9MhUwd:dDVHeBIAANA9n/TDbXNKd
TLSH
T1F095E17EE7AC04E4D57BD1BCC6638A06E77138AD032156DB029491BA1F2BEE46D39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/928-116-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/928-23-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/928-30-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/928-29-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/928-31-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1132-153-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1132-163-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1132-161-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1132-159-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1132-152-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2144-337-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2144-134-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2144-339-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2144-127-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2144-128-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2144-335-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2600-140-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2600-147-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/2600-141-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/2600-336-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/3452-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3452-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3452-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3452-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3452-42-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3492-297-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3492-64-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3492-65-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3492-71-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3720-168-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3720-340-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3720-175-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3824-84-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3824-319-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3824-76-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3824-78-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4392-48-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4392-49-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/4392-57-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/4392-60-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/4392-62-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4616-103-0x0000000003700000-0x0000000003760000-memory.dmp

Download

memory/4616-7-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4616-106-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4616-104-0x0000000002940000-0x00000000029C3000-memory.dmp

Download

memory/4616-99-0x0000000003700000-0x0000000003760000-memory.dmp

Download

memory/4616-93-0x0000000003700000-0x0000000003760000-memory.dmp

Download

memory/4616-1-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4616-75-0x0000000140000000-0x0000000140329000-memory.dmp

Download

memory/4616-10-0x0000000002940000-0x00000000029C3000-memory.dmp

Download

memory/4616-17-0x0000000002940000-0x00000000029C3000-memory.dmp

Download

memory/4616-8-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4616-110-0x0000000140000000-0x0000000140329000-memory.dmp

Download

memory/4616-0-0x0000000140000000-0x0000000140329000-memory.dmp

Download

memory/5684-354-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5684-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5684-352-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5684-115-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5684-117-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5684-123-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5964-333-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5964-92-0x0000000000400000-0x0000000000577000-memory.dmp

Download