cf9f15dd0e7492e8af1a804fd0d63b44733a2ee15cf668d2de55017e5b4b046d

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 22:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-15_f49fa89b3988dc7a80e216cfa24b1f9a_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.5MB
Sample261015-2x9gfaef37
SHA256 cf9f15dd0e7492e8af1a804fd0d63b44733a2ee15cf668d2de55017e5b4b046d
MD5 f49fa89b3988dc7a80e216cfa24b1f9a
SHA1 4eb121da005851056d7454b5c021adf8dbf798a4
SHA512 63df9e00e4862ae82e349aa9eb574d01e53686dd0f3da0503b14b3be819d9813e932da8705079923b5cae2becec93d2d16b289360dde1cc8393298de1e0d0649
SSDEEP 12288:oxmnz41s+VSsfT+odGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:0e8q+VSsL+GnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T17175F06977A40CFAE833827988424502E772BC461BB5D7AF1394422ADF372E05D7FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5072	elevation_service.exe
4444	elevation_service.exe
3576	maintenanceservice.exe
5552	OSE.EXE
4380	PerceptionSimulationService.exe
2008	perfhost.exe
300	ReFsDedupSvc.exe
1556	SensorDataService.exe
712	ssh-agent.exe
616	AgentService.exe
1316	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-15_f49fa89b3988dc7a80e216cfa24b1f9a_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-15_f49fa89b3988dc7a80e216cfa24b1f9a_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-15_f49fa89b3988dc7a80e216cfa24b1f9a_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\24d73af4227843b8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-15_f49fa89b3988dc7a80e216cfa24b1f9a_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-15_f49fa89b3988dc7a80e216cfa24b1f9a_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000057c6d40ef95cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ce211d0f85cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c8faa0ef95cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000012506cdf85cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083bd31ccf85cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003f30bdcbf85cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd3af60ef95cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2284	2026-10-15_f49fa89b3988dc7a80e216cfa24b1f9a_cobalt-strike_icedid_njrat_satacom_vidar.exe
2284	2026-10-15_f49fa89b3988dc7a80e216cfa24b1f9a_cobalt-strike_icedid_njrat_satacom_vidar.exe
5072	elevation_service.exe
5072	elevation_service.exe
5072	elevation_service.exe
5072	elevation_service.exe
5072	elevation_service.exe
5072	elevation_service.exe
5072	elevation_service.exe
4444	elevation_service.exe
4444	elevation_service.exe
4444	elevation_service.exe
4444	elevation_service.exe
4444	elevation_service.exe
4444	elevation_service.exe
4444	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2284	2026-10-15_f49fa89b3988dc7a80e216cfa24b1f9a_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	5072	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	616	AgentService.exe
Token: SeBackupPrivilege	300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	300	ReFsDedupSvc.exe
Token: 33	1316	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1316	SearchIndexer.exe
Token: SeDebugPrivilege	5072	elevation_service.exe
Token: SeDebugPrivilege	4444	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2360	1316	SearchIndexer.exe	101
PID 1316 wrote to memory of 4932	1316	SearchIndexer.exe	102
PID 1316 wrote to memory of 5172	1316	SearchIndexer.exe	103
PID 1316 wrote to memory of 3408	1316	SearchIndexer.exe	104
PID 1316 wrote to memory of 3464	1316	SearchIndexer.exe	106
PID 1316 wrote to memory of 3208	1316	SearchIndexer.exe	107
PID 1316 wrote to memory of 460	1316	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-15_f49fa89b3988dc7a80e216cfa24b1f9a_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-15_f49fa89b3988dc7a80e216cfa24b1f9a_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2284

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4444

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3576

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5552

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4380

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2008

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:300

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1556

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:712

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:616

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2360
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4932
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5172
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3408
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3464
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3208
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 94560c97df46f19c676bf41dcccd783a2c7aa0a66470c0d6758bad8fd9217af7
MD5 877d666f2325ac98a7a4208b079e4b13
SHA1 5c98ba0016ca5fab6de94c5e9229e6cca231e4cd
SHA512 e71b9bcf55b47be9bd0376b454ac4ab8cff1056f3a9ad2d1bd4b2632e8cf0ca9105b43a1091deb31a050a7b66e9ccd678bb88cef1cfe25a0d78aaef5ba333e6c
SSDEEP 49152:lb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnaQ/lFTjN4:73q6HjBuLm
TLSH
T119D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 ac00f99b9341566259e4fccf3371c385b07e9c5c9ee42c4649fad9c8b01f9fc4
MD5 2dd3ac45411f41e30f43065089aa7cc9
SHA1 4e1d06fcd738481210724105f0d029275c2a1205
SHA512 5ded0c76e7e0ee125408a07a9804fa5908817e0bfd177a93c93fef98ace648ce3abceb897b209100069b8a1eb85f2f407ffb10f7a9ed4c6617c5ab61be434454
SSDEEP 12288:/1XLsswWkxy2lRq2czA1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:9XYfDtczAVnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T17165F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 10b3b2c4505fcf268def732afdfd3b481ce484029fdf6763486819a20e0860bb
MD5 cdc7176f46be047e47e2b8c5f046cbe1
SHA1 7eca56a5406d72fe1c49ff68c74f0679ea747668
SHA512 c434ac96de719c967d500210ccc52f34e2336489ecb55b61ace309b68d5b2be6d53cfcf15b31e7a667983e5b40067c91deba58ee048c514d2ab6ffc58b11133a
SSDEEP 24576:T0Le5ji0hmxLrMCnQ/tbw/2Mkjy6Fr7g0ok:TPji0AlDQ/lFTjN4
TLSH
T1F5859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a78c0e130bd84974fce5025ceea6f3a2ea3ec180ab577e49d3c725a440ef36cf
MD5 b82d0d3cc6605da8dee488ffc7a2efee
SHA1 fb73962b281278d7875999241ea1af6ed6bd3c1c
SHA512 0be19fc777f5cb2399e9e1607911ed10889e0a80d330789346bf566c2b1cd766fe6a3e6ce88c907b174689eb76ea7bdcaa22588931c0fb4804d5d20b112eda9e
SSDEEP 24576:za7/ezSC6vUyD/aqgrvWE6q8wyuknQ/tbw/2Mkjy6Fr7g0og:e/ezSC6vUzPvxHjyvQ/lFTjN4
TLSH
T150755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e7ad3732bc61c7d0b99021dc8ef8e28346f6f0372d7c5c8bb8efd750a2eb020c
MD5 c700aac406fc67b4f262d9a8690919c5
SHA1 b124be4bce1547e139d9fb7488d5aff0b09d3eea
SHA512 849826fa57d89950b2bc6fe62d333226a4a7826b16664cee75b0b3923f00d4b65336cdb0a3a37c26d30f26249f0ab38e867e7c00260bd17a772e3b30c72ec523
SSDEEP 24576:xVbqPb88hv/l+6JnQ/tbw/2Mkjy6Fr7g0oK:xVO88hXl+OQ/lFTjN4
TLSH
T120559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 214b640914dbc3f3412d19c0422f42bd15eb043f9df226406e31bc8e2eadca4c
MD5 d19a94413e6b3f7d6cb7ff7d6718d960
SHA1 a89af6f0fd5903b528f22689756b839b05092fff
SHA512 6369ce2c379baafcf1e4484d6bb5559ecf69c0191f85accc51044796e65f758ca2d16e16dbaf2c28029478b6f2c052f18de01a3f881abfa3e82b702e0d76d15d
SSDEEP 12288:bzGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:bzmnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1515523796A24F897FF2B06B15CD284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 22fddb24e18ca6ee43df6a74458c2fbcdf3188dbce0d4ab844d574edbcb54668
MD5 e5f2aadde725099b56bc29b634bb76f1
SHA1 d937d75f9fdffb0345c7ca977e31be78ee24f278
SHA512 a0d60faa318a03a52a7c44102e0c0657c35784d3fa9a8e8eb914d7fe8718a84c1d2811fa00a56d24221bffc084a0f1cef30255808527c7bae7fd686153c9d68a
SSDEEP 12288:WeBNUbTVO86UBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:WJIURnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1F175CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9d409e0427175f36c40549db2e539faa36f571a05febc3d336ca615954e3d4da
MD5 25e6e2192a6628a59fbbcc9bd5f6885c
SHA1 d47310c63e9e1b21593ee3a4e0678b3c3033d24e
SHA512 36e067891bc3798323a81c861d8ff2be11fd64d4d3542e3e18fb57a9151fe0f82ffc1cee7db939f07099aa1419b1102dc5f61ea535b1656164782b7b5eab37df
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THJ:CQvGAdlCEL8c/yRNw5CnLm
TLSH
T1C7267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 1b9c4652d3385aa69853e3efff13236e3f48e32c8ecb3e6d8ead2d6990ff587a
MD5 312d8e3a2b8e65106b94ce02817bcfcb
SHA1 820c5e5a8f9753588ded68f4ab15819ff8ef2b49
SHA512 466025059722c56d3ee9d4115b58db2e035c9a12fcefa046b17079f57022031db37399f1bcf0c6aad92de0407978a4ecfa1ffc09086bb53cf4a0471853052a41
SSDEEP 12288:GAwSfxL/2Dc39DLLmt0LDQewsAjjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg1:bQewsAjTnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T19075E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 92d7c55d2d325b4880d39406bfb9525c3866f9b99ea7c9506cac5715d2aed133
MD5 82527b7830ff4c7e9734b5d8f433e6d8
SHA1 9d7af53b14b3a7301972654c87f70ba3ec06dbf0
SHA512 992041366bddfb2f410620116179341993aef4b45d669c869e6c7cf9efe7e080609342fd60d4b3e3f2215feae1b023d979c02cee688cff026d5462ff292da7e1
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHgL:NUEtQevvqc2W1cpV2EI32
TLSH
T12D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 77e1bdd1dfe0ef8b76a77bd0abe91b17c4be7b63c641752ed5053421e94227a2
MD5 ac09d7394631554726c5d493d019b3f5
SHA1 3cb957f05719c4523af11a70806b437f7cc13256
SHA512 dd41d8812b8fa2c76205c67e92e12d5b8192d1b41407f2c4cc8b6518a40c53f6d1b88bb03f648a4d034c33d6fd5b6f36699782abf085f11c8e2c6b27f0eb944c
SSDEEP 49152:mCbRquA/m2yL5zQfFiV+XenmE3/zzQ/lFTjN4:LoqtVjnmjLm
TLSH
T196D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 efa37c1bfa75db601729aeca108e7fcf1d3f38cf3420a106407a8995625ddfe5
MD5 27895772f3ba81d788a13940f76ae455
SHA1 84955f9148ba2a9d644b92446b55a938fe6d634b
SHA512 4f62877a6ecf0de1f378b8cb42e3765bf37204911a0c0c9c6b156bad4a7718feb1e907329ba180f2420b9db6afa86c0ee86bc6aeb6d00cbff4e5969bdb62d10c
SSDEEP 24576:5AhGLJIFoiwtA5l7S53wnQ/tbw/2Mkjy6Fr7g0oI:5AMyFoiq5gQ/lFTjN4
TLSH
T1F935AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 f23198b79063ad555eb95ab422178ff9197ce992270f088dc365456cd1d2020f
MD5 43a2892e81006fe6e2646e64801af913
SHA1 fd03e7ba5d2ebe3259609c32a3720eb685343b8b
SHA512 d8dbab04205c51ba74506cfcbf09332f33aff4d14859512b3b0781186b4ece16a8aafc3829da46c3d42343f8081b28fb7cbd2de0a94e11dc2bd68bf46ca12902
SSDEEP 12288:Jmw5HEjsChN2BFgl0WDm+CkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM7:EwuHOWPnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T16665F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e4e83327e9eec3fe240d82e572fd22d99a59e3c870ebd31715f6a4cebdbdfac8
MD5 19373573af2cf1eecf5a3e898f4f58b6
SHA1 286e845fc6f29a34e726dfa24152e3a70038ef36
SHA512 602b2407130621e7bd3a023b725f7f0090ec8e92ceb4519830b2ff68d5663afb4eb51ab749b9c8ba41eb13e1bf17c8719baab91ee15119351754028578079071
SSDEEP 12288:DXZ1IyzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:bZuqnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1D555126933A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ff195dcf436b521bafa769208eb9322aa05199b24741cf88d069629c931efaf3
MD5 87e315f5866ee1cadc657831f4b24e42
SHA1 3d9992f6c500620620c717b82cf3aeea80b4b01e
SHA512 7583ef3404ff17e80a522c6d8d4b74a25e269ebb1ed79fcba15bc14a7769811c7200b455f590b8699e2325765444f97d26f798e0639e8a90cf27f972ad119f8d
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ul:yQRQyi36YOcPQLvw2gAf+PN3SLm
TLSH
T1D8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 559c53f38ce968efd59d55f3ac4a12d8ade0a3de1c77dd44e24765b01b0d0d5c
MD5 bcbc357bb873a268935deb230b6090c1
SHA1 e1bf5fc2ce5ec927ca98587d61fc2daeff4d4660
SHA512 eddcb13077174cbb636863d6c4494e8423c1f372ba8e813a5680d9642095c83f7e5969dbe75c42ce4e033e07b02612700220cc68b09e62667e6864ed9684dbdb
SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ul:lQRQyi36YOcPQLvw2gAf+PN3SLm
TLSH
T1AE667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e12756c8d8e9e15c8da991f29de7fb8ffa4231acd64a53547201a376a6eced34
MD5 0e5c1a2ddef13bbbdaf82313b30a8f66
SHA1 8d298c8b4c793c438dc63b9e3debc021a268eeac
SHA512 4ed607135ea34b4c85be7dacac1e185d9c839510ada0f3a1ddbf03de83ab9a863b3616fc06894b8055cff606d5b93ad29c66fa3bd940e47dd8c8a1b8b6158274
SSDEEP 24576:gwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0anQ/tbw/2Mkjy60:G68Qg55nhheWu7PNU3/DQ/lFTjN4
TLSH
T1D6B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5e3c44eaf5674bc1ed197d0d9c753d0e557ee34a806c70e0043e3223cc8fea4a
MD5 e1a48b126766952c21520f28827e5bab
SHA1 09a3b1b613783dc50010b793234e56a1ad8850b6
SHA512 964b811349742bf8b82adafa6dbcd323c427160390653555ededc3ef07704fe151b098d89550570c145be382b8558e0127eb0e0c35e0e193946f803bec1d31e5
SSDEEP 49152:53aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99r:oy5112gYy5azzVvL69nLKnhZxLm
TLSH
T17F167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 59219a30d66bb43fce3ccdb0ea144597f909cef2fd872ae69f51fa8e0893056e
MD5 e46f9faa6def29a1c808fe0fcf57a64f
SHA1 e0733d1bf264a1bd8796957d59d918b81b1f8f33
SHA512 4bd9c6250ccfca5536e607ac04537f7c168796c4679f059e21d5ea028f872910ca67440b9fb21cee660d081ab637f3b421b6bf2f1648f945e1e958b661e27c85
SSDEEP 49152:RB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glpQ/lFTjN4:Hu6JmVxd2deLm
TLSH
T14BD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e1300baf9afb8425b5f056fa5aabfa6de334303bcc54198c74621670af0b1331
MD5 22ae26f4af323d600780c5ed5c71bf8b
SHA1 39d001bd3defa987d393dc8788ce1e4c4e5177c9
SHA512 24bcbdd54c252db9e2e529b86f76f4433006a9f642a5dc22602c8d196e559639db463f85db862a8292526ca3742c45f75a80ca3f64d98466abb6013bd658b4a6
SSDEEP 49152:U1hpsNoJpF1A6UU44CwH7R4xxQ/lFTjN4:UmifPbRjLm
TLSH
T178B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a3bf379fe2fc068c328352b9e14dc87c9ff4f6f53b45eff49dac808553494bf7
MD5 253f8ce175b59306890ea82700884c75
SHA1 88bd544add0b65023f6041f9a080d35bec4de510
SHA512 9dddfdfda3595a8ca9ef96a8fdeb5fb756894eb3f0f7a2ce31e07d76153edce588dcb964140bc293823eb8e36c46fa86711e3a1d138433cea2c6377ccaef4b37
SSDEEP 49152:HSuZQIY0Be2KRRVtOnks6NMHqqQ/lFTjN4:d5dKTi61lLm
TLSH
T1C1C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 adaa4e717aa5c2589f54e64d82c8e3a7f024c475f80dceb478c23ad75ea158dc
MD5 c6e0bb07128bb0237b97d52cfc641ff8
SHA1 741ad597433565536f6012f9435f62cc6594f7b8
SHA512 9d2cf1c6ebe8d3b9ec01c6a928af2420e0eeb1469396acdc6369f7a2b725ea1a4e95227aa049812cdb462f028dab9c82b9a95bc052ec72d57d46e52ea67e55ad
SSDEEP 49152:zhtSn8EApI0figngiDn0AP5wVQ/lFTjN4:yX2iyphPLm
TLSH
T10A95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 518b84ef28bbacb592f50f1de98252ca9fe3b31c24944167c3ed9246ae33b011
MD5 dc81f13d2bfa2d0587a86c071b7919c0
SHA1 f170d740a519ab2770a98f75867c4baf51434e07
SHA512 1f83a5877d2f995c4a0896d694310d01154d21abb4e9f3abce5e74f67c0b2737208a0db402dd84cdb2798ea85c2ec500735565e6fda03af4c3131df2dd935a33
SSDEEP 12288:oOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:oOnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1055523697955F98BFB1706F18C828182A73F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7661d7b12a9fe303b8d90b16b0a68479e9b6ad916fecd77234fcda9349f75a40
MD5 d9bf55f43ad55913bd3fb57404c2c901
SHA1 a50a562eb9c71d92a0f699e4fecef725b4770153
SHA512 b16a29d7029dbf03dbe29ff1eb4749ac112f4d86e04a1e35c8d3c4ac7d87692fff19b4113f38da88b90d1a61200228a45e5040c34e810c61bdf257286f027e74
SSDEEP 12288:rnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:rHnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T14A5523797965F98BFB1706F14C828182973B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 763647b1cb28d58193c4dc079e1b617e546a329330114da936aaf3a693b8167c
MD5 53ae486eef2838f8fe8d4166a2b8fd06
SHA1 ab98e4b00f2d588b60d1f82efa5673a2863d6de9
SHA512 58e8618c7d8c1ab805db0338cbbdc4264087114bea96abf26e6c9c3bd9e47a83adc100db2a4a3a7f78517ae9862c1f67b66d37f3023c795578369fa06dfd1171
SSDEEP 12288:ppGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:p5nQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1BF5523697965F98BFB1706F14C8381829B7B0EC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 121a16f030c4de895cc596e9d3314d0b6d891f242d9febaf2a3f9524295c00d0
MD5 1cea4d51fa35bc28efc45c8cb1aa6b8f
SHA1 d203c80965e342c7d73a7acfb632dcd05313a848
SHA512 1514af27c720483cb59c2e16589cee7377523c0f76cf534913a6f06b68d03e3f1001a37c5ca24a18c40eaa53fc28a5e8aa9658e61e9bacf9a548c50106349d81
SSDEEP 12288:PVwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:WnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1635523693A69F4C7F92742B4CC938142E77B3DC5BBB1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 bebfa7bc22e31cbc5ec7517e3eeb76124fe30ed955bd354f2b4f1f8b96b9bcfc
MD5 442ab00c5e101093e81d02cd45cac3ca
SHA1 6061af654440025089da0fb923b4ec12ba76ba1c
SHA512 5e788e024b965f09b7a9e4e6f128b1570cd828b0fa5102a5a039577eda9c98ab36cd75917894f9248afc95926b1622912c2bdfe828c596b83a1ed99f6533a0ed
SSDEEP 12288:5IGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:5InQ/tbw/2Mkjy6Fr7g0oD
TLSH
T18D5523697965F98BFB1706F14C8381829B3B0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 3c6a00dbaa2614a38a98dd863d88ab141afe646d09754643342694153cc5efe5
MD5 64aa4b47effa4721a1d6974ff99914e5
SHA1 1aaad146c5f3b3eedba094d2b63960693960a8ca
SHA512 a06ae33beac1d73eabca5ab365b301660fbf366ebce913b47f04ffa7d09db3132ab1a2f54b7b25e5f7a1066e521cb3fbc7456d881bc4b2681fe8ffe7fc5e1839
SSDEEP 12288:ULGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:U7nQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1795523697965F98BFB2706F14C828182973F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0abcf02bdc71db1d126329350f0573e1eb4576458261d631eba9e0b318a24a57
MD5 39408a848d718218030d598281fbfb5b
SHA1 2a7e44530381396d96599f8f136a386d3ccbc46e
SHA512 6a1fe40ef2a47d38f02f8ac7f0c8522ffda7f6bfb304840049d2a85214ff02c197ece6f826552b53dce1e24e5fe7225f1123581f9d35418fe95d5682dcb764f6
SSDEEP 12288:CfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:C/nQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1605523797965F98BFB2702F14C8281829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 1fd6e8c57ffa63afedf675cf8e453421522d359b689a74731a10c75b74f17ed1
MD5 77ea24b4b5b41550a5b70a7b999d2ee1
SHA1 034ab533c80fd8a99c5af0b6c3e817693519d7f3
SHA512 99c896a7c5734c1fa8791bfd49ebbbe97ddf1f79fe2711433771f2f16a41ef8fcba8ab75e57f8f2203e2479163c05035f4bbfd3ca83c113b9e25110fbaf0f56e
SSDEEP 12288:AiZwbDzzFEoS2cPvyHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:DZM3zFVSOnnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1697501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 98a6bab369bac04fbc95f02c5e7d524be7d145ff619a6b1b2ff81055aca2e74d
MD5 587b3433bff61e6a55bfb64e06e37569
SHA1 6474d6968536ced4efcb2159d62405713813ca31
SHA512 ae8710b997147a5e34a8aafdc690f6b473010cc4e7c0457d6eb6488ea362652afc6eb990a301a3d5a78679698f30cf7b38334cd8435358976f59b9ff0948cb46
SSDEEP 12288:e6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:e6nQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1775523697965F88BFB1706F5488281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 22e32f3774625e590dbb41dc3b3eb41712afdbc3fbeee2884ca2740dd0c3f0c2
MD5 339bcdfe7edae1a4bd4bc282375fc371
SHA1 fbc4e7534183a2f9e7a147261eb8cec6d425c24d
SHA512 a203b2cb0500a395027133d7d049088355ac06092a6bcc948be42b9e1029d2cf55f0c96800ed41e43dd00f4cef98dfef75af24aeb83c2ef437020da35c23ddcd
SSDEEP 12288:+WGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:+2nQ/tbw/2Mkjy6Fr7g0of
TLSH
T1175523697964F98BFB2706F14C8281869B3F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 4b876dd400037f5982f78ace33c03414032b3b62501fba5e1d4314f3a215b18e
MD5 2604e577b3a9ad3ad8f31a22b3b94484
SHA1 9ab23990a8928f245ced07d4f16845b5e4bde257
SHA512 6aece80c5692327a7e2ff4148788104d3ac87515e0bc11c0e4bfd2b29a7b76b0d9a81e6139d9396bfd86325b585a71e72ee1bef033dc81209267ca08ac7ad386
SSDEEP 12288:XyPz5L8zGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:azyjnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1CC65021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b4f46ea3acab0bec06ec8060d4a758ac3719d872e3306f3a2e7b2f31471fed11
MD5 53928f84f8b91c3e9df5abc38f53a5f1
SHA1 38ef57620312dae5d12e0ae07d53c8e06ce25ecd
SHA512 0c54fbd4e4d0f22421e719c812ffc87d71cecf070dabeb1b781316613634e03d8875a495c179a61e042251eb37e13cebaa17b6fbbb367caa2f8f93a54185952a
SSDEEP 12288:46GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:46nQ/tbw/2Mkjy6Fr7g0ox
TLSH
T14B5523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4f670af2818eccc23b6a9f4d479af4497c036607976c4616bd8a7018fe157a14
MD5 1cd9f9fcbde85709e19679d69dec7cb9
SHA1 35f55b7d97a1f3912ee9181de61643245409ad18
SHA512 e9d77a6eefd9c49a3c6641ae9b35ac68528a45f0efa95fbcf4e78b751164e88a1dcb35776dfa468d23ba0140a88d8648df892cc68f41540dcb2011c8e086679f
SSDEEP 12288:M6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:M6nQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1845523697964F98BFB1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 e2824d9e6948a23fdddbb49c1e14c6c541bf7b325bebb1f2c475254725de9f12
MD5 0b601c1da2d16e7993451522c2066c3c
SHA1 4042df43260970f1e09cac9caae1aa160256b6d7
SHA512 ad5b29b31ad850c2f4f7cf73e7ff189c7317f83b7733d16034d2796faa5d4ee80ea3beb4cc081cf8c4b373c65230aefdf279b0ace0f3bdcc76f23fcf3e1b2b2e
SSDEEP 12288:KyPz5L8zGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:XzyjnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T18B65021777A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 ac099ceec454d8ca996c61ab2dd22ed48847aa14ef78a5609ad73e34cfef879d
MD5 6b00fa6068ef9cfac17e9172bf0156c1
SHA1 5312de08e71b69bd5f563afd36c210ef8366e504
SHA512 4dfc9160ebdf0e66cfa8ecf9c5352913171092979fb35d9bf2fae3a6eb0e0ed5b4b8b4048e5733d0a37b2dc5499282919825f769a3dea3ee8a4a310dfeb5ff49
SSDEEP 24576:rT0aLl3z0zDpnQ/tbw/2Mkjy6Fr7g0o+:rTDLljkQ/lFTjN4
TLSH
T13C7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 53c784dc7dfb95963f92815b608f3eaed34f163b68698854bd66f01f01600c83
MD5 7e23e4aa5242b81882e526fb35180b25
SHA1 b86829ac9502fca028fd0646c4d72dd997d2b8df
SHA512 e9600b5777906a3021a77c4c4d086053420108b112e9145a177813ebd6a5835efe720e6dba7121e75b0ad3d3b640c97dd4003427359b56b451421506b528ac77
SSDEEP 24576:t31d9CHKy7GZ9nQ/tbw/2Mkjy6Fr7g0oL:N1d9CHKyaLQ/lFTjN4
TLSH
T1E785CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 a23440323b61a4e6be8ae6969157a69685a67406d2e2059d34937138ce656188
MD5 e3d092719f48ede64fda10aa766bf09c
SHA1 3258d8a733d933d0dde6c4f339a36f5fbaede44f
SHA512 62731388adf4a3cfbda0e89da4f95a29f089872e8cf1e7c284134773666ca306315c48fdcf3142cbee82dbe34e9ed6c9634c1815e772061cd6b38e3a667ae2a9
SSDEEP 12288:aJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:aZnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1B95523697965F98BFB1706F18C8381829B3B0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 6b9fb1da305bfa9cfdc2f8e9064d1feb9024b037fe9c743055225e00884ec2d5
MD5 a2ca4b0b0232307670c266f87a9fbb37
SHA1 9b7f7c6a4123d59a532d6fb8c7cfb4eebf39b3e6
SHA512 72c53f71c85265c9830bc62d63e4a639616ff14c7d25edcf16329eff7a5e26174d04409a7315aa719751f3b69433821b618c9376df22b49f5872b9608c3b585f
SSDEEP 12288:bTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:bDnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1575523787964F89BFA2B06F15C8381829B3B0EC6BFD1938F7B481129967D39406C63C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c617ecf3c46ea66e6abe7ae04162fc3f1d70bf8f04b0086d7dd78abb6908d897
MD5 2272b60a04eeaab2c9e1b0e2c41c81aa
SHA1 e9307eaeeae76201d94312948eaadf5b29d0dbd1
SHA512 0fc89de70e992b04ce6d8e6808a99fade75971cd8b3198556d7a7d9c3dc2c7c8bba9da8c1be87b23914bb1fb9788eb7b2e0f9408bef51cd43a6f3833e3f1e1b0
SSDEEP 12288:a8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:a8nQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1695523697965F88BFB2706F14C8281829B7F0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 7aa4e19e485abf9e0b28e382b49d858df7256f095e6c96923df777029f607783
MD5 d793ae6cfb1d08a45f6c592499e2e9d6
SHA1 363f04b9d93397238c7d4f277a75e915981ef3dd
SHA512 440fd18e64d251144e75b5dd99d6c1101ae1e0cabcc3550e82cfcea51fe17dc11b191a4ab8f692c5eb46bce0f45c9f8d71121cf686f84a29c4d102f98ab8e54b
SSDEEP 12288:L6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:L6nQ/tbw/2Mkjy6Fr7g0ot
TLSH
T16E5523697965F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 157d8d0545319d4f39acc2f58a4da40621e0c971df1dcdeb211f7d88eee37bbb
MD5 25897f2800de8d911be1a372d44687e0
SHA1 8ef326ba4fe2c36c1bf73b80970e3ee97aa7d2b8
SHA512 78392a6985e8dd3987871c47fbe431bd9f69111c19367b600645bec50fc0e3330642cd0d53177ce8485214de26f392a96e10cba76cc4e23d64803ed17f7b567b
SSDEEP 12288:HJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:HZnQ/tbw/2Mkjy6Fr7g0od
TLSH
T1965523697925F98BFB1706F14C8381829B7B0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 109c7b137d534880ad51d93fa37291dd87d5b16400f95922a720ec5c889b6ad6
MD5 8b355c4fa4f170f1f32f94a690706074
SHA1 7b34d36a57f9e8a8ea9a686e1724dab7e8ab42dc
SHA512 789ff5ee5af1e0b37165971e628319dbde42a46f2be76d13abb292eb3471749ef8bc443968ce0fed3b79fe363008b8d85036d3a24f483532aabb044a793b8b24
SSDEEP 12288:EyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:EynQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1465523797964F98BFB1706F18C8281829B7F0EC6BFD1938F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 8b3fbd2f377fb737941148e3f8c3837d23420f10fc68496fdc8d8271de15150b
MD5 862dda3396eaee0a5cdb0f38b5902993
SHA1 ea964911f3beea04d2dba476347bc76274c63a61
SHA512 310bed20265b4171a361b95d9b1b21faebb3901b288defef500c521435ddc335b28622d8a7bfa48c7641acc5d9c1ba432770c762ceda1490e3c7ca4ec5a5f764
SSDEEP 12288:tIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:tInQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1685523697925F98BFB1706F14C8381829B3B0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 d7b60f746c2a393dd04074b83a6f577ca02c7e46f4740796efa0468f5044df98
MD5 5478fc10ead6b1a807f68588e5549516
SHA1 edc83c594c7ae2e9b9c7fcf621947a9c3427d547
SHA512 70071e11b96ed76cf6e5190837004db89fdb60d41ab1817cd4af28d756c5ffedaa9222808306f0ab496e90802755302329a56f8e71e518c169e24c49dd16d21d
SSDEEP 24576:Qfwv/k9RX6wkyAIGnQ/tbw/2Mkjy6Fr7g0ow:vMnYIGQ/lFTjN4
TLSH
T1E585DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e68c7e54f524497396cf9d6afb2f8a763e2f5a44fe6556cdc3028ad7bae62b07
MD5 9d73d6c2540890b513ba725c74f5d01a
SHA1 0f24bde1dadaff911f64259949ea62b30483a0aa
SHA512 347c55e1da60ca8a65196dad98114b58ec7abf4558ff0899e914ac532c7a6d359896076d71fcbc990049ca81715db350e425204f3e5b3071c99d7401d3485e02
SSDEEP 49152:LYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK01Q/lFTjN4:vySzPyLm
TLSH
T1D4066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6d394ecde839ec748996292a0d7b5e80c4808f4ad461517b4a19f273bd5fba40
MD5 e4e4fc2e8ca2ec60fe2790ee3ee5fff4
SHA1 767df55cd6512eb828fa28e5fd0ae241a67e727d
SHA512 952b094734eac8528bc01d4f12fa7870c77bdfcb6726b04567ea565b3af880998bb00cb4c3947b0e26c9adf497a479cb48e22620cc2f1712ea47362f0f29be33
SSDEEP 24576:I47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY3nQ/tbw/2Mkjy6Fr7g0oN:I47JUQj1irIhCnDHUPfF/FQ/lFTjN4
TLSH
T1E465AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 016d9ddbd24c7943f6600da282bc3c91b3ba66b1412254d6c052b232b6dac333
MD5 592b34c4129be1fed3af04bec99ff6b0
SHA1 7d3e10e0b130a5e5030901804925bc0e10866782
SHA512 1ec4dc558fe96126b89bf326fd4e5571fcfe6d64322f6bc972f02ef1a3d1aa246af2deefd41db8be1dcad9f85ba8b753fbaab176214a31923585747b67c794ce
SSDEEP 12288:EssfqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:qqnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T12565F119E29852E9D12E5275CB828641B3373C9597E1D3CB67C0F53E0F3A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 dc915efa668471612be4b83715a331c181d21bf858ca03cdb3a8f8a7c3d4fd77
MD5 03f2c2f07ccec3086ef664ab7056ec35
SHA1 f6e06ce6a080a7b3a86cc3690efb4b27cebd2678
SHA512 a81d6186ced4a007b1ebfb81abdf39eb8bbb3455de46ba78d09dcbeb587bacbe126aae0997dc254dc98ba9140c2fad4907624a0550e9f5645b085c0c33250b13
SSDEEP 24576:tCVYGUP7/IwqPgXgFRoR8J26IBje0Fs17P:TGUz1agQFRoaJPIBje0+7P
TLSH
T1B14506407666DA8FC6A940325E36D6CCA7707D02FE046F0773C9873F9476659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 b2a301ad33da307fdb50aa49471779c97ae02c3e6a63971fbe6a35767f2989b1
MD5 4f09747d6033d580f590784c429f9f83
SHA1 44ab24204eed470d65224d3a749062b1a68f6efa
SHA512 6994a082ddcfb7421f1b4329050e6b05107a0f3748152e3b5aab74b6f5833398ffc136c92a66ff207625112d4e4e4a4bdbadd793aa789d616d0ffaa844b1f947
SSDEEP 3:OlH/lIgzsdKSUflgtKYKrds0Rlbl3y8jK63mCllltGlslslslslslsl6I1:KaMsISGgmBsYVKcmCtEEEEEEE5
TLSH
T173819218EB441A60CB62E0324C6803980313E08A7588E79B215A61D6AC142AC4C2AB3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.1MB
SHA256 11b1a4a1013334a1b228b2f78cd191f0e05fa7c27951d17c71fa6fbbd28618fb
MD5 0afceabf258198d42e73f72ee8d9ed89
SHA1 299de83b3ecf33abb1fc00623be22725e7b22d77
SHA512 63ea19a4a53e41916612762e809eaca7b47af021003358ee1d2bca7a465e7e1fcb64049459a161f685973d5cce147814d0208cfeede65652aedd9a405b0fb7b5
SSDEEP 12288:GrNTO+2EAQrKW/u6lhxOFcWrErO8DR2js2PAZg65Z7rXK9gBUPniOZn:gNTXbPxOFcmghVaqOX
TLSH
T14835E500A4B7AB4FC96E9037163686CDBBA45C07FB453F0573458838986B96FB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 5b25f625316a879c5775b31e3110a2c5d9ed69d3dbd8af5c2d27d3ac7ca7b00f
MD5 8b8505fb876dd7c920f9cd9e3ee6fdb5
SHA1 3071afc99ebcf433f8fb8b33bad5ba373863161b
SHA512 82e99499a64134de9d1ec5dbcf585b37932f462e094cd993224b9e61c5875c8cc8d70bf25dee876020123e3ba8937fc1776877039beaf72ab22f7691028af74d
SSDEEP 12288:767iGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:iinQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1F45523796668F94BFA3B06B058828111673F0EC5AF90D3CFBB082229957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0ee0ec7ee21e088b7b81b195fa3f4c63b151176b3c7dec9c368ac7ca80120df3
MD5 2b2e68fb53fc74288ffe58bdc5432556
SHA1 b13e185970e35fe909fd13e045222eca96ad803a
SHA512 f084e11913616a60515fd0b3a5a526636afb3cd1966743d74a3c3cc9ad618387d381b11927bb9b0f707425f3b846e9325219e067351e027b2cbe63e192a8d87f
SSDEEP 24576:8gb6bmBIi49WNNFpg1rSvFv7bYknQ/tbw/2Mkjy6Fr7g0o7:8gb4mBIBhGF3Q/lFTjN4
TLSH
T1AE65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 1e5d5fd86e0ec1b0aaf81dac1876be096c82d530f1c8b355210883d0667e896d
MD5 77f9d981f5af6cf6f222c0fb442e8aa7
SHA1 5693e73a5b1a09f55879be8926fb5a7d52157183
SHA512 af7808c66a51195879d0abf903ee819a392bc6e0e82c50e979c3ff475bf21ad8d1948ded038dd74b9b099e691a4df1f8a48532e113d904840f552b3f675d42d4
SSDEEP 24576:hG88u8FpJqH1Qzria7/mnnQ/tbw/2Mkjy6Fr7g0o7:k7ZFPqVva7/cQ/lFTjN4
TLSH
T10785F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 a2b04ab7852294a90946ddc4cd439e26296aa507fff5f2f87c1d29b0c9bb3645
MD5 13ff2f61085930ae2749be4a32332fab
SHA1 e98655734a382638c339157aabea95f4adbdd16f
SHA512 d639ac3caca0971c2af8b4de6a366137ce012771a8096c942c06f61786248c40fecaed5460762b00965a40175140e74e9f6bfa96e34392836cc5383b81c3719b
SSDEEP 12288:+HvUrBFrEjwaQbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:+PUr+NQLnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T16265E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 caeb7122a20dffa7280286f243431779108cf9b75b49271d2b4e0acd094e5116
MD5 0bdcc980972539607a0a325aa584217d
SHA1 68523a9d98dab37555436b6540e28fa355f0254f
SHA512 85541d007757879b58f09b40a4230613b3c2787eb294628622a071eb1bfc1b826a01bbb78092e705804b7ed157f95f3d7b6f9ce53a9d9f16ab2ca6f036578947
SSDEEP 49152:ZBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7Q/lFTjN4:6G05lO43b5Lm
TLSH
T1BFD5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 74e65a2cb223dbdb075d47f68a4cc24f5c7080184ab59d0a5124cc68efc53357
MD5 4702907be0fa7534a0587bb3c67400fb
SHA1 2ed690bd664af541a1a53188f15aff64083455fb
SHA512 3e3022748bd5ca11bdabc37b763c6677eeb10c7f9462ed49411f87696ab90cf2e7a1f96ead6540063abd7247682ef49a022b8b5236b801329d8c713c8aecd6a9
SSDEEP 24576:1fa5POZ3dpFWVM50JicR2hG0lasx2+47eidn1nQ/tbw/2Mkjy6Fr7g0oD:Va5POZ3+Jt2pasx2+mDQ/lFTjN4
TLSH
T13565AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3bc941bc41dcfc622eefaac6c902b0c097c2c3e1b5a15cc7d612c97f2cd6e59d
MD5 09f7c678ac65b044b8c6040e883377b3
SHA1 70339d65b9a56139ac58fb7df0734e44c55e9ca4
SHA512 a1978f6fcd49e18417f78a4b47cbe798802eaad05708e2686be734050132033cd1b7bbfb0c6f18d6416605915a25eb6cb58649ff8f142ed7770f6be58a30a56e
SSDEEP 24576:xNcwHdjbyQ4nLC18lb/EOjowL7FkvnQ/tbw/2Mkjy6Fr7g0oQ:xNc/zEOVHF8Q/lFTjN4
TLSH
T188858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 abf1b84650236fd0c4e30a57d195cbd1d2394f6d919014d2519dfd33b3745227
MD5 4e1c877c88d8fad8b3198de2f2827e25
SHA1 4c903c2f3182a6294d58ac7a6a8a007543e8e0f8
SHA512 dc38bfa8c02008ad465a424e2044cf8022f357d0637a0c63aee96e75a44822d36af8e0a4d9e7f7e3a223d297d2915e45333f52600b715dc90a55594d0e021c19
SSDEEP 24576:f8kNvNnaFeYhJNtmZBmdnQ/tbw/2Mkjy6Fr7g0o+:f8MwBtOmdQ/lFTjN4
TLSH
T1AC55AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 9eab0e9ef68c5b5c1234fc8106c11a34361e20b06a0523513e60dd7ec03c9ce4
MD5 caf492adbb9d816924ddafce769de491
SHA1 4a450e9537f04b4005774aba00195f74bf55e138
SHA512 6a162888bc5dde8cf1d776f15ac6326e0c5568b555892dedfedefd470c167882c22510b03f2c9ed8f5691137e4c96afb21e6df897ae7e4e13296bb6cf1b99650
SSDEEP 24576:ZD3FHshBIYQgAunQ/tbw/2Mkjy6Fr7g0oU:ZDVHeBIAAuQ/lFTjN4
TLSH
T15975E17DE65C04E5E57BC1BCCA538A06E77238A9032266CB129481B95F7BFE42D39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/300-316-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/300-334-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/300-100-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/300-94-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/300-101-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/300-336-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/616-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/616-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/616-141-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/616-133-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/616-139-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/712-127-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/712-120-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/712-318-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/712-121-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1316-155-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1316-322-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1316-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1316-148-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1556-319-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1556-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1556-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1556-113-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1556-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2008-315-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2008-89-0x0000000000A30000-0x0000000000A96000-memory.dmp

Download

memory/2008-85-0x0000000000A30000-0x0000000000A96000-memory.dmp

Download

memory/2008-83-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2284-0-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/2284-7-0x0000000000480000-0x00000000004E0000-memory.dmp

Download

memory/2284-1-0x0000000000480000-0x00000000004E0000-memory.dmp

Download

memory/2284-8-0x0000000000480000-0x00000000004E0000-memory.dmp

Download

memory/2284-13-0x0000000000480000-0x00000000004E0000-memory.dmp

Download

memory/2284-15-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/3576-67-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/3576-68-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3576-43-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/3576-51-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/3576-50-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/3576-49-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4380-73-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4380-71-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4380-300-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4380-79-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4444-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4444-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4444-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4444-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4444-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5072-25-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5072-26-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5072-17-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5072-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5552-55-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5552-285-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5552-62-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5552-56-0x00000000007A0000-0x0000000000800000-memory.dmp

Download