c76931cd4e8e1250a6e3bd8d8a8dee243315f4ea67e489505c6fba3f141ab18d

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-15_029905ab7df3713c922f840dd0f3ba28_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.4MB
Sample261017-ar2e4aey9m
SHA256 c76931cd4e8e1250a6e3bd8d8a8dee243315f4ea67e489505c6fba3f141ab18d
MD5 029905ab7df3713c922f840dd0f3ba28
SHA1 a0c977bb4cf433e49c034132287592242e42759b
SHA512 6f6af8b4d44a068526fbcae282372532da43ef0ee07e8fe15fbb4bc46061e1f16a3bdba66e21951691a01093915c79d745e2749d6ad7c6c9dbc1acb7998bb2e8
SSDEEP 12288:HTJMACiXFo1+hoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:HHDq1+GEDqHKliE9JdpTCePo9L9QIE
TLSH
T1B265014B77E521E6E1B78634CA604112F773B8751B35978F039426B68F376A0AD3BB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3204	elevation_service.exe
1664	elevation_service.exe
4872	maintenanceservice.exe
4928	OSE.EXE
4888	PerceptionSimulationService.exe
1200	perfhost.exe
5924	ReFsDedupSvc.exe
3160	SensorDataService.exe
1988	ssh-agent.exe
3820	AgentService.exe
8	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-15_029905ab7df3713c922f840dd0f3ba28_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-15_029905ab7df3713c922f840dd0f3ba28_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2df7e2d2f1788cf2.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-15_029905ab7df3713c922f840dd0f3ba28_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-15_029905ab7df3713c922f840dd0f3ba28_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106906\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-15_029905ab7df3713c922f840dd0f3ba28_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000021e78971ce5ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a6b02b6ce5ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067496272ce5ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000149fe3b5ce5ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
5220	2026-10-15_029905ab7df3713c922f840dd0f3ba28_cobalt-strike_icedid_njrat_satacom_vidar.exe
5220	2026-10-15_029905ab7df3713c922f840dd0f3ba28_cobalt-strike_icedid_njrat_satacom_vidar.exe
5220	2026-10-15_029905ab7df3713c922f840dd0f3ba28_cobalt-strike_icedid_njrat_satacom_vidar.exe
5220	2026-10-15_029905ab7df3713c922f840dd0f3ba28_cobalt-strike_icedid_njrat_satacom_vidar.exe
3204	elevation_service.exe
3204	elevation_service.exe
3204	elevation_service.exe
3204	elevation_service.exe
3204	elevation_service.exe
3204	elevation_service.exe
3204	elevation_service.exe
1664	elevation_service.exe
1664	elevation_service.exe
1664	elevation_service.exe
1664	elevation_service.exe
1664	elevation_service.exe
1664	elevation_service.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5220	2026-10-15_029905ab7df3713c922f840dd0f3ba28_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	5220	2026-10-15_029905ab7df3713c922f840dd0f3ba28_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	5220	2026-10-15_029905ab7df3713c922f840dd0f3ba28_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	3204	elevation_service.exe
Token: SeBackupPrivilege	5924	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5924	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5924	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5924	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5924	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5924	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5924	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5924	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5924	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5924	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3820	AgentService.exe
Token: 33	8	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeDebugPrivilege	3204	elevation_service.exe
Token: SeDebugPrivilege	1664	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 1556	8	SearchIndexer.exe	103
PID 8 wrote to memory of 2296	8	SearchIndexer.exe	104
PID 8 wrote to memory of 5576	8	SearchIndexer.exe	105
PID 8 wrote to memory of 1436	8	SearchIndexer.exe	106
PID 8 wrote to memory of 2892	8	SearchIndexer.exe	108
PID 8 wrote to memory of 5000	8	SearchIndexer.exe	109
PID 8 wrote to memory of 4456	8	SearchIndexer.exe	110

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	2026-10-15_029905ab7df3713c922f840dd0f3ba28_cobalt-strike_icedid_njrat_satacom_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-15_029905ab7df3713c922f840dd0f3ba28_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-15_029905ab7df3713c922f840dd0f3ba28_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:5220

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1664

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4872

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4928

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4888

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1200

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5924

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3160

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1988

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3820

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1556
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5576
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1436
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2892
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 71baea589a4d32088ebd2e20d2d95279b3e896a6f1115aeac75e48ceff3ced78
MD5 7c3cde138dc38abc44a5b1c706c25cc5
SHA1 278a73c38380c10320390b7ae5d671d7bcb5b38e
SHA512 52eabbcdf127d0f3022085f5544eee9a877a27209b36e1cf011b19e2505672b08fa3087451d5d13e17404d1110d18f53f3528523763098e172d697e8a0d1eb9a
SSDEEP 49152:Rb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn73DqqldPx:X3q6mjB2DqIP
TLSH
T1DCD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 a4e60af00481b65c37654fb89a91a9ab114b7bc3f524ae472a27f1cb7d114379
MD5 5524183bffd99126ad0a6342267e39f4
SHA1 010d4630b73645fcc7a33444778fbf612ebba564
SHA512 8b044222470b1c41619b38d7ae943b184a6787cce6a57c22a54d7a7033139382b51a97c049b3ee2f0b9af29551f27465757f8085e653e166ea306db22849f28d
SSDEEP 24576:vXYfDtczAeGEDqHKliE9JdpTCePo9L9QIEfGEDqHKliE9JdpTCePo9L9QIE:atcJ3DqqldPxf3DqqldPx
TLSH
T11D65122C77D109EAED679238CAB18112FA32BC954764E7CB03E479158F335A86D3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 58e715f34eae6f80818972f3eb7113e7643fbfd29c21a0ba77a4f7c7e1ba7d4f
MD5 ab4870330a48ab2c548efa672c6a3d3c
SHA1 78c7f08f047521f126639fcc27f3e3c2f8540d59
SHA512 19ed80e42adece142dacf7580d666d7841bd0b3ea280e5184e40a44fbea0b2aca48723205e2ff5a69fce2ba23c2eb180e89bb154e2baeccf9ed13ab241616de3
SSDEEP 24576:E0Le5ji0hmxgrMeGEDqHKliE9JdpTCePo9L9QIE:EPji0AqB3DqqldPx
TLSH
T17F859E16F6748731D073C0B9C5D2A69EED7130861B308ACB4286D77C6F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9752196d17406cc5f95e811b6cd9e7d678577560a13d5ecf50d5a809c81bf822
MD5 cca6e9d38af31ea7a867e92c2c8070ed
SHA1 78ac53d69616a643b5eb324cc35cb2f7fbf7b334
SHA512 3dffffa8255362c2a2d4d4ec6381da810108c4174508d9337b6df2cd10cbff567eed45bc718ceb582afd0aa13eae07f7c797062bb2b98988ee274ea47409daaa
SSDEEP 24576:Ra7/ezSC6vUyD/aqgrvWj6q8wyu0GEDqHKliE9JdpTCePo9L9QIE:Q/ezSC6vUzPv+Hjy93DqqldPx
TLSH
T1A8755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6cc423f4db4a1e7184bffa11d114dd8ab07e726dc3469025741ba24b0b74705d
MD5 e4cb19cb8e5cc2020e98a6a14f72677a
SHA1 dba58795ba4bfc72d84e986f0c6ba28e536ca695
SHA512 ea19ae0f7ce5f1e2cbdc03422d2f274607f13d4c7af9602884dee9b25e9665ca5f7feb15b6a4bbd04d5d7182dd016c525782050e52600d8af186ee9d4580514f
SSDEEP 24576:3VbqPb88hv/l+BjGEDqHKliE9JdpTCePo9L9QIE:3VO88hXl+h3DqqldPx
TLSH
T12155AF66F5B48331D073C0BAC5D2A69AEE3234425B31CACB0246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 67ee2b22412628527b90363f815de0edd99faf15a77aa84ab120ba3de4690eaa
MD5 34c50e8198f2227b6cae2082b5f5b9ba
SHA1 df05a0b80cc2292b5ef6402ace05eeaee4a73a6e
SHA512 2ce6b662e0bd9cb9d22d13f6a2e4fe2568e9b4ffbac7409b19cd642b9354598602e225d8fafb39081028cbc854aa00980fa87b761243e96b97c0cada77847e93
SSDEEP 12288:94yhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:94yGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1B855230DAEC64AC3FBB73A3057B86167FD25BE982C6E768A87833D01C479479E45B110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 2fbc6f00e067a035ee193c0e88807738f49575bb87bb9df17be29dc04e2e4ee3
MD5 934154646e3d9f2adabe2c13bd891951
SHA1 abe771e5c7a0cb4e09b8865b217976be41bbbfe4
SHA512 e8d990383c50a8b1d744fa0c95a5541d1767babac31e0112c42ff9cc73ea3379bb51491df86a51d8e0268c8ea6fc3296f82bc631e9a981dc8149d1c8efa6929c
SSDEEP 12288:1eBNUbTVO86UbhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:1JIUbGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1CB75CF3BEE28FCD2C27A5D785B918200E77278704F62A3CBD165920ECE235E55D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ecd1bffae7d8def25807b0c1594748cafc9110f5b195b9ad12b211a12c1fd155
MD5 12cced5cea23547b141916bd648239da
SHA1 fd9ff805a3d3746fa2773c5d8f54f154cdd66129
SHA512 539adc67c8a28fc4f10540ae9bf8c26549d83a422e33f3702e56766e363e7117cac2515d7836c6783fc51145c39e052bad7e2d2f180bcf151c20385ba3402f86
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THD:ZQvGAdlCEL8c/WRNw5CEDqIP
TLSH
T1E3267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 6fe24293441151e51df08af92e6af7bf5c349ddcb29bbaa6af142042963c1ccf
MD5 3434e447a9573e54a269ad0bc0eba3c6
SHA1 57f830ee453ecbbd9446407d0bf48f143d75a056
SHA512 322263039229566a00f80f0328d175ab5db7e16aac3ab860c536d6071a3f4be9833492f302b1dbf93669e8d593daf8265d9026a660f2508b35ba96e652751b16
SSDEEP 24576:qUewsAjxGEDqHKliE9JdpTCePo9L9QIE:7ljx3DqqldPx
TLSH
T16275E031FE75D432C7BB0DB21B35D716682DB9204F622AC3E3E86D8D89741D22376A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6785d07b0fd9a4dca814fa3999b90ba4b38f1865f1e2a090e9190c7c75cc0e46
MD5 342342205614dd4b3e558e1f65727d4c
SHA1 dc8a27d745aee1fc3f912152b84872caf3ba1def
SHA512 8908695e9c975ecf784115bfa2251e4f33c0eca7e4df5bc2e4084ca8c7d964f6ee56078d30c22804a5a9402d283f325d6635287ab9a9cba87d9dad6061d5bdb3
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHlD:FUEtQevvqc2W1cpV20I32l
TLSH
T193474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 817d4e441a7f8c3b14fe8e171137867a5e7b2ac8aa193439a373b5cb89462afe
MD5 9dc3062fe939ec320a7366933ff1b78b
SHA1 0c6aff22291281782e4c041c7e3c2875bb69573f
SHA512 a88cd4899e41d70204f564750ce747f637c4b77294597d1befc0a4ef986799b6c2eebeac15c8d609256c979a423fcf2f288b93ff17a360835f65b8951d3355f4
SSDEEP 49152:rCbRquA/m2yL5zQfFiV+XenmE3/zR3DqqldPx:0oqtVjnm4DqIP
TLSH
T1ABD58E0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0c97dd43b34691190472c3911966118f4bb3aa21d8854d2853bbe2b2ad776e0c
MD5 1315986eb2e65ead8bd3d0522d4a3c14
SHA1 a0a0c4d1b952e25f01b5a4dfcf9cf27080ad2e41
SHA512 da775daa29f7fc524dc51f3807073130c39e46fb6c5200ef7884e14522e5e555c64514a9c5264631104914aee9a008f9a5ed532e34d94a5648ee66c0ba5cb030
SSDEEP 24576:yAhGL6IFoiwtA5l7S53wGEDqHKliE9JdpTCePo9L9QIE:yAM5Foiq5A3DqqldPx
TLSH
T11C35AD80EBF945D4F5B3AA7899B69171EA76BCAA5E31D20F2150D10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 f4d2d7e950bd109eeb4f5f379b331f2be2e7e12a13267eadfaaf0797507715f3
MD5 16814098af9951e931e6ad5883491233
SHA1 4ff85c8848ad4a37e992161b40abab4d29696994
SHA512 5684f6ff66bcf98d8c30f37259340690de58eb6c4fda8cb6564e825b77c4e607279f967bb1c6ef3ffcda97d78635f02b7b81ed31af54f3834603c5abbc7c4cee
SSDEEP 12288:Pmw5HEjsChNlBFgl0WDm+CUhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5It:uwuEOWdGEDqHKliE9JdpTCePo9L9QIE
TLSH
T18C65F14976E50CF9E9A756388697C136F7B2BC012A25D70F0760D64B9F37221BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 77e8079e13b7b7634e731f0777c7140ed165050aee1ce5766fb90e6fb1f6b816
MD5 11bc00f26630e914d4240e73adb07c1f
SHA1 69548fcc4324b76c76cc924fac95d2c8b8f6b584
SHA512 ee36256e1814d3018a764af1cebcaeb0f407e8ed09e484f60d5bf642ce3b134fa22b0e1fb448da4764de7e131b3b5dda58ced894592d74c20cdf4823cb4742ff
SSDEEP 12288:lUZ1IyhhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:KZu2GEDqHKliE9JdpTCePo9L9QIE
TLSH
T1C955124D36D521F6E2A36238CAF05206FB727C56273A53CF06523A468F339E56D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4cc1e7d386c5cc717b02bedbacc5dfb99cf8c46ca67f7bd126054c1dc8d2703c
MD5 dec8a829496da32a69194af0d6853eb0
SHA1 2783a46c4fc2d1f8e3c7e1fea00eca56cceddf2d
SHA512 e0fbe63a31241cc93116de0348099da0868e8564dc1031f8522184a7f5b2e2b1bb7b689244ea91b3cd54374a4c465105d4d552ef5f8192518b236b241d35e4ff
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uv:3QRQyi36YOcPDLvw2gAf+PN3nDqIP
TLSH
T16F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 686a70fbd4ea6e587616c239ba8905e6dd9a2a8f0541393d84fd64dbc89b8013
MD5 d53e3319940b698bcc82adafc7b09259
SHA1 9908746db365898ae589a91a5a2e384bfd2c97e9
SHA512 7ebc0031438f446263b2c42eba3afb45df02287da7956c9219374cbb3dc09701375c8b97d030335ee256b6be8071225d175b01c0539e11e4aac37c193b7562ce
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uv:rQRQyi36YOcPDLvw2gAf+PN3nDqIP
TLSH
T162667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4fc4ed3a70bb3a253ec2639ed68cfc136d5f6cbeaf663536a6b94cf9b99b9d5d
MD5 f54d569b71328383f9190d92eee85c3a
SHA1 2fc46a41259ee7806cddb7ab4f851f356fdd6a63
SHA512 563e43cfc31aca5edb4ab1008c5c4fa2ed293d6c5ec277b519655a47f9d24b0ed2b6005a7977c449813ce290cb1ef511524e860bcbeed862bece0991fdea8248
SSDEEP 24576:FwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0GGEDqHKliE9Jdpl:h68Qg55nhkeWu7PNU3/B3DqqldPx
TLSH
T129B55933B2F20099C44DE1769F4A873196E27C758FE1E3DB855172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7327f9fb83e1fbe3a5c07128b9065e4a28f6050a595b04fbb354e1f577a68883
MD5 03baffbdbaa0ff7a7fade7c20e4f9520
SHA1 44e52b8ffaac33695ce8924bad14a622aad9179a
SHA512 4077d1f3356b005ce58c1d4f2f6953496592b0f3fd81fe1abf381f99ed092d0872a8cbbdff6056962dee1ef37dea09ec2485ad4456ecf9807579195a8098ce11
SSDEEP 49152:K3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk991:by5112gYy5azzVvU69nLKnhZmDqIP
TLSH
T173167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f29bd011ad5a8d380c3fad8278cfd5bf489b0519e133a13cc2e2a2244b65bbcb
MD5 b3cfc93b44215515b35dbfec710681e9
SHA1 b1a5c081190d62e374817709872332923e0b20fc
SHA512 27f1ee18bcfdebc5ec4ee89e41d5f4b41964e1c9c7b0d7d1078dc77120a61e9b87df2d9913750de9216799f2b727139f7257bc4ec4b2e918e87979776b6417d3
SSDEEP 49152:xB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glu3DqqldPx:nu6JmIxd2dKDqIP
TLSH
T16DD59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 aea310ab8a2a81152bc442a704ac9dd787721b933b1b1caa08e5abba27dab34f
MD5 1e43c174f89247ec71e6556d1338ab8a
SHA1 eb6888ef732fb25c4110679a3d836e92527987e6
SHA512 8decb1cca22323405a0d3d2e318883cf0ea0d5ea82e8422f6aa5dc1ec85a3a776cdbbe20fecb48af0b8d397f7225d2e7dfdd595957152dc4b9adeecd5f643137
SSDEEP 49152:B1hpsNoJpF1A67U44CwH7R4x73DqqldPx:BmifPqR4DqIP
TLSH
T172B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A9077961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 03f29c295fec5acc25d302e36d2cabf1c362ae991c84405dfdd4f24ffeacfc4b
MD5 5c75ff844a3e04332a4348b2fe139293
SHA1 014e79dde067c2f0d7809dceb98ddbb73e19a838
SHA512 cbd7d2541287afe06d8a7e8aaeb70e732f73c8c8e0c64424f1c69fe77fb07cfd6b06ff2b813b739ee9f563c00abb16cff2f3f0932192de123b61af08dbc93e39
SSDEEP 49152:JSuZQIY0Be2KkRVtOnks6NMHq23DqqldPx:H5dKqi61SDqIP
TLSH
T1C7C5BE03F2E941E8E0BEE67487769232EA72BC464B34A6DF064072551E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f2e58ff774c6f599bebbd606513de0dc37cdb79d5b88401e088fc6e1cdc9456c
MD5 af07adcb9092d2fcd2f787f0ba0bfedf
SHA1 d911df77c8fcf2da3a9cdfc118d645590e4f97c1
SHA512 2f2db77d13b997442fc115c20f5d7b984c3c85708676f9ccbd1252ecadf12c77ed8a19e09c52bb7b1f857bbc97abd4e638b7cbe07494953ee64a3f9a8abae7ec
SSDEEP 49152:XhtSn8EApI0figjgiDn0AP5w/3DqqldPx:GX2iWphsDqIP
TLSH
T18495BE13F2D900E8D06ED174C7568632E962BC160B39BAEF0A9076561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 704be138d7e0c4a3dbb259831ad276c6d973bb2c2d86b1e4037c3f29ed7e7d2f
MD5 06ea2bfeac45a5275fc903e54ad81b25
SHA1 81183588a8cf359e67103e7d30a0374e83dc1ed1
SHA512 582c43dda4fd0b98790bae33f81440f9e74c15c1a3b16a6dece6bd9b990c7062d57b1f3b6329ada8216c98dc940cb0c1fe026f9308f5db011571cf34c825aec3
SSDEEP 12288:FKhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:FKGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1CB55230CACC74BC3F6632A7187B42267FD297E8A7D6F328B57873801CA7A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a13728cc47d304261341946c39115a9540b367154ed8cd6f1d012a761534cc36
MD5 36655316520e783410aee5ff93e5096a
SHA1 9aa2bf3e1b2a4d4b4d02b1c25e49178a4036f354
SHA512 c79b26f3bf597131adc798a5464fba8ba2c13ce0ec9bfad990f1f1617caf382674700c27796427c98eb7e8b1c30b96d9d98e4d52c7423f064550927623112b31
SSDEEP 12288:uFhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:uFGEDqHKliE9JdpTCePo9L9QIE
TLSH
T13F55230CACC70AC3F6632A7147B42267FD29BE5A3D6F728B5B873C01C57A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f8b51b0ce469752def2fb665aa161ade22822daae8c8cc3507e41761aab31707
MD5 bc5027dec3d692182a6c23bd9446db43
SHA1 5569b0080c1ffdbd8f799b20720d10c1c4991bb2
SHA512 4e0f58b10e6f732c9478f3da10381bb4deaf7ceccb9b61364d740e411c9f4921a9adcc92a9efea3bcd5afc5bce8fc6a4cf22a8a846a656d7642010f590d9eaa3
SSDEEP 12288:kzhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:kzGEDqHKliE9JdpTCePo9L9QIE
TLSH
T13955230CACC74AC3F6632A7147742267FC29BE8A7D6F32CB9B873801C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 839042ead014096bc07f8947f81d036922491f770bb11d039d6b641205b580d8
MD5 7d0112dd57f1d0e51391a87535596e93
SHA1 cab0d7d9acf66c5ed1a69808aaffc0fcec2e2adc
SHA512 883688533c6ea8fc1ed0328d96fb2d55d2442a8f281f5480d8be830d03928f453f950d85498f73f48fad7d3759ae17b7b2bdcc88dfb03bcef0d18bc2d09c4dff
SSDEEP 12288:rVQhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:mGEDqHKliE9JdpTCePo9L9QIE
TLSH
T14055230D6ED706C3F973A630C7B55122FA75BD997A3B63CF8B423C05CE72064682AA50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 30f051a93a9ddfec3fc9d4cd2aa0ad449becfbcc03c18c0421c0d527ecb5bc75
MD5 29a904468e230ca46fc8f82157352501
SHA1 53db0642d999c7a4a44e0fb142a93152d2614a0a
SHA512 e2e84f5842627ec6b60b7556b35d37f7a38079f7a84b1f465e2ea75ebb6861af66a30ce01abbe90cee7a72af1ee4e6a4bb9b905d40f890205d0c3cf46a2b3052
SSDEEP 12288:OYhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:OYGEDqHKliE9JdpTCePo9L9QIE
TLSH
T18C55230CACC74AC3F6632A7187B41267FC297E9A3D6F72CB9B873801C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c3a9bab68e6913a585260bf246643a6058220df40c28523463d4feaa5824db20
MD5 86826f64e950e495ad89b2bdd2c73eda
SHA1 eb08c26cfa4082782a27bf3d2944b7887437eade
SHA512 bf5793236d6ad96678879f5f3e1d3b9854c278c82713284a00a51d3a4e556dfdcdf5cb2450012dfe648871288abb66e301aebc6583a24a4e726d364d8151261f
SSDEEP 12288:ophoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:opGEDqHKliE9JdpTCePo9L9QIE
TLSH
T14055230CACC70BC3F6632A7187B42267FD28BE9A3D6F728B5B873801C57A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1fa63c4162252930ccedfff4d24a3cd6a5295d94ba30507ad1878fe05799e6fb
MD5 e26fa2cb75fd3641da3af6d9ecaba24e
SHA1 1243920aec1d85ed29b448d1b787a38fc5988117
SHA512 23bb0c3aa0cf508903987deab83d78f0aacbd1989b858a51bf7561df0f5fa1a8214fb64df681c463d25dbb9db08a635eb1bb087bbb531aec37c6b46d99a259c6
SSDEEP 12288:2thoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:2tGEDqHKliE9JdpTCePo9L9QIE
TLSH
T18155230CACC70BC3F6632A7147742266FD29BE9A7D6F728B9B873C01C67A439645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 ab80d0ad34a04e06f2edbf7c54c82580243efd2d2474ac5c826e268ef3ade0c9
MD5 c7fc6b57bfc8ca35ec5b7836149c1887
SHA1 5f097c25a62a6f4e3cfc6f39d3b6d60c7122e195
SHA512 7ef4ab9e140dc948b15b27f3f07b3bd03950b5eeab51a0a300061d8867db2cbc6979e0862d7444900201a7b2e5d8dfd83764c82053394a74c0d44fa15407cb0c
SSDEEP 24576:RZM4zFVSOlGEDqHKliE9JdpTCePo9L9QIE:RZM4zfZ3DqqldPx
TLSH
T16B750199B39008F5EC67823EC9658916E6B27C5A1B70C64F03E436179F333A11C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e85083f472ac3e824c3292bd8b1bb2301432dea8c672ef603d27c09d4c1b8f28
MD5 0703d4a00a0e91f2aa70cc2f4ef45fff
SHA1 c3d67e795fa0d03455659cc005b69935b67d4ebc
SHA512 54dc90cdad908b1e7b303703f0494c37b4feed6d51e2c7179e32c0868de859c2d4699a0e4d0e38a93c46c50ede22d383b716c86b91fa32eefd8a44312e738a18
SSDEEP 12288:tmhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:tmGEDqHKliE9JdpTCePo9L9QIE
TLSH
T11855230CADC70AC3F6632A7147B41266FD28BE8A3D6F72CB9B873C01C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ef8c5f38d11d6990da9fa9422bdb83ff7fa1f1dd36c8d4760320708ace6c0eda
MD5 18a0c6407ee33c4dd572431de253ec42
SHA1 9ebf9914acc2a9c65befb642ca9fa0d583bff087
SHA512 98c1a3cd97555979683abba9f1dc5cce55f6543e2e8979f1f6dd88d339f4ab67be184055071c27db151122ad1bd9cb7aa34ba64acfa323900521906b0f39fdff
SSDEEP 12288:9ihoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:9iGEDqHKliE9JdpTCePo9L9QIE
TLSH
T12255230DACC70AC3F6632A7147B42266FD28BE8A7D6F72CB9B873C01C57A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 2593476f2018d0a33b6285455a6eae98c5109beafb4805c7c66bc92f2c662cc3
MD5 bbf3702c12cff797e74c56292ddad388
SHA1 50f00728f7964a6e0a64afd1777e548db1c8c2af
SHA512 710efc1a745a8543c014c5410ed8e89825ed3b74c65d5d749c594c543f1f93cc8ecff5cd8ca6bc9aeedb0a8d9b845accef6f5b58ef989aa6ec6c36a3c5eebf76
SSDEEP 12288:+yPz5L8hhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:jzyhGEDqHKliE9JdpTCePo9L9QIE
TLSH
T17A65020B76E221FAE1779234C9A11602F771BC361B259B9F179026369F375A09D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 cfbb5a8d6e87eade32c3439b4e575655c234da67a1df4a748190bcb6db752989
MD5 f6281295de957eee5d9512f84d874a2f
SHA1 5ae335521e860c5bf4fa986c4e7c981b38c9b6a4
SHA512 2899bf2db309d51a51935248d0c570c231f44b5dc6e30dc91b52d1b41ec1728b85d4cc6e330c47c4391763c10840ae75daf02aa84e8c8e880609b9c81eecc19d
SSDEEP 12288:smhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:smGEDqHKliE9JdpTCePo9L9QIE
TLSH
T10855230DACC70AC3F6632A7187741266FD28BE9A3D6F72CB9B873C01C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 30d5155316548db710b916cacdcd604780f92ecd998e704c6bf2ffa0a25a3499
MD5 2f96645219e734a96e6662f6ff3b5c74
SHA1 98b24d8277130d44f2e4d3fe18a53b34cda4ba0c
SHA512 0f888217e5a06df066175c504efa295f28e836cb77483cec2380b221af3dde8380d55121657ad5dcfec253f433462e88fabc1ee023f5a1ca4a01f93a3508f622
SSDEEP 12288:emhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:emGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1A055230DACC70AC3F6632A7147742266FD28BE9A3D6F72CB9B873801C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 c6de561145eb597164ead7222f5aa6bf4c6e45570e70c5305c25f781824794ab
MD5 24e332af1e83bd57c654cac350ab1874
SHA1 14caf684403713d16bba20ac15ca90d11a09bc99
SHA512 aa0de054898db1e6de86df5b9c13a33ff4b427ad790829f2a55a2e65e248533076f0333eb1b17399d582beb049851f3d03a96fde661efab75e7ad27696ac30c5
SSDEEP 12288:QyPz5L8hhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:hzyhGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1C465120B76E221FAE1779234C9A11602F771BC361B259B9F179026369F375A09D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 73f3a0ee1775b46f30326bfcaeb8c817ee1d0b5efd9f73d49367e5076c958a55
MD5 1e248366b73ace8abaa3bf51b8d86ac1
SHA1 0ccb05d857ce42bd99f25a873432ecb7b9722936
SHA512 b01581309bd6cd1f60d1f9fd9910e6a899196591debbf16a73076c236702a57005bec7f355b809c3b401891564b6b547d0298cb0226cf50110f261bb02b66575
SSDEEP 24576:cT1aLl3z0zDDGEDqHKliE9JdpTCePo9L9QIE:cT4Llj03DqqldPx
TLSH
T131750198B3901CF9ED67823EC9658916E6B27C5A0B74C64F03E536178F332A11C3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 56701dcee557d0b929577faac0ecb2a7f3e4c78e5bf568e5316db542af86baec
MD5 3acca6bc485a41028e459188cee82b98
SHA1 236aa72550c0345a7a9ce71f3f57bb3e7fb14aae
SHA512 bd46eec3bc7a0008883e9e79d065417a47c522fd3101412f68de0adde75f80008c2cdb4304b93c58e4ed0597bbc018b0a0203252dcb9cd463b5b14210bb8958d
SSDEEP 24576:u3ld9CHKy7GZXGEDqHKliE9JdpTCePo9L9QIE:wld9CHKyaZ3DqqldPx
TLSH
T17185DF90F3E414E5F0B79A35C9764512DA767C9A1B31DE8F03A4261A1F33AE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 990eb68912266849a4a83aeaa8f6d7e8ddcee5fb9c2d2dcbafb2e9ebba1cecd5
MD5 1ee18d9d765cf7c0fd4868cae20e7610
SHA1 31b224d070af3c6dd97ae7ec2bd8eae44824b51e
SHA512 1dc1b88ee3ceea60d7cf275389a0cc7bdad261637e3ba73aca513b5304d3e778a34e667267547b8fcecfeb367e73ea0c40deaac3f7b28a47bad5d396e78c9dc9
SSDEEP 12288:bThoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:bTGEDqHKliE9JdpTCePo9L9QIE
TLSH
T12B55230CACC74AC3F6632A7187742267FC297E9A3D6F32CB9B873801C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 262d88a200f614ca99fc47b63163fdaa785a2b80f2ce4fdae7be79b8f006c3c9
MD5 0785ed4a9a057e2f04b8ab011a9ec3dd
SHA1 e254d8ca1a932a1bd15529aad497d5d5d8848666
SHA512 9f98a4500ea2b124274c9734e73c66d50a8f18306bb24d5543f4fab9212fe6917f5666919cc41146b5eae3b708b4246656155db1330cf823b56762ad578e46fe
SSDEEP 12288:KBhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:KBGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1E755230CADD70AC3F6672A7147B41263FD28BE4A3D7F728A9B873C01CA7A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 095a28a4427a236f8031e3b73767f131d00cb0f50fcf4bc479b2d752eca4ba77
MD5 439897086caedb61b8b036789021f3b3
SHA1 1c8a158cdb6908b477eebb59ed74d60dad3b4e7d
SHA512 c4918755336180c08b32ba88789be5cb52eaf29bde6a9c400d0866c2662e88b19fd4706f1999aba5592f19091c42b6490e7316564cf2ddf43e0c2b282178a525
SSDEEP 12288:KchoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:KcGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1E655230CACC70AC3F6632A7147741266FD28BE8A3D6F72CB9B873801C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 1f6df90e23b93cc6550c7b8a2fbae496cd0e8b3382fa0d7024d75fbb04be38c9
MD5 6da21311e916fcfb620870a8f9c7bdf8
SHA1 ee08292fff48972a45422bf5cbd916d2e154df18
SHA512 2b1139b57ec789880ce9a7d810277b3d54d929dd4e3b513136a0f652d49d746466f499476bf0653a64ee252fcbea83e94aad1c0ce67580f587cc0c6b075c00ac
SSDEEP 12288:5mhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:5mGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1BE55230DACC70AC3F6632A7147B41267FD28BE9A3D6F72CB9B873801C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 2e848ef5856abe359db1f8b4f203b838c9ec67ee316f5a4eb4347b19efa5724e
MD5 5ed9db2ee8c898f75587adc33121ea91
SHA1 efcd62b61da8ff7bfa02638cc69f65df0d879936
SHA512 2c7c3366b1745bcb5679491e17da2fcdbf14672922280a1164a23a1dc42aa0af31d52da7ee5ec33b6d8ac98d955205e01f1352ae96ce25e42bf6cbcee5ca1979
SSDEEP 12288:xThoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:xTGEDqHKliE9JdpTCePo9L9QIE
TLSH
T12955230CACC74AC3F6632A7187741267FC29BE9A3D6F72CB9B873801C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 a66c260b64daaae7472e935fbd6f00a7659787a8baae076d5a44943e397e17e7
MD5 505014b8a218944b2921b355c6f348ba
SHA1 5daa05c2b3a644b0b52cd2f744eff0ada6095fe0
SHA512 bacca6ebdc9380621167999d11f11096aaccaa16dd0f57aff2e4d0f09032bf6f7f2cf66afb9b6b25e1b9d815d600d565d9948528910ccacdf5e21ef3a9fbb2aa
SSDEEP 12288:PuhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:PuGEDqHKliE9JdpTCePo9L9QIE
TLSH
T15955230C6CC70BC3F6632A7147B41263FD28BE9A796F728B9B873C01C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 f0e987f22e6d5741e348a7dad806d3b3232a630a0f33a53406a0c0073eb3ad44
MD5 7d5dac269767025762f2db5bd1d29f10
SHA1 176152d8c8cc0129572f1dcbfd66f41b37bd06f0
SHA512 425a2d6e43731788e49e7d28b34daf2426e2b28885508b432b3be6336e5d0670e89259416b88db2434c47fece976e232dab8020bd76724915be64918ef7b5c0c
SSDEEP 24576:6fwv2k9RX6wkyAISGEDqHKliE9JdpTCePo9L9QIE:QMnYIS3DqqldPx
TLSH
T16A85D02DEBD844D6E1B7923C89B7460AF6B178591B31C2CF029A636D0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 041180121013f744bbf6c83ab5818480e2a1f0d049448e1877a58f3f14450659
MD5 b3a6a2c98330625fa3e855f7bbf91631
SHA1 e60fc0535f6f6777dfe240c2bd6726f3f9b1a48d
SHA512 eec42db1cce752aa3462963abd95485fa5659959e21e03fabdefb1315cdfaa26182069697f1c88e294fc8d05e4423d59307687187a46b89aec4ea5955fd425fe
SSDEEP 49152:IYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0f3DqqldPx:HySzPHDqIP
TLSH
T1A7066C56A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 75e7271eb330e6c2427f62427da88f80afc09a20896e4f1c97d2487e0507b6c8
MD5 11a7ba8832be55f8617da110549d369f
SHA1 307c2efcce521bfa71a4c6b431834f0766c019df
SHA512 46ea16077d561abc18bcb220e4883615b6e0527997597671a65c2d692dfbe84e79ec3300b241983d76d46a2e2f0dea50e16177b8a0b7e24cb12c2baa895afa09
SSDEEP 24576:847Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYVGEDqHKliE9JdpTCePo9L9QIE:847JUQjqirIhCnDHUPfF/P3DqqldPx
TLSH
T1ED65AE1EA3EC01D5E1BA927885154A1AEA71782E1F32CACF12B0537D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 d9c085f0c11855adc207f395d8667cad6e36a4a62e4e10b2e988e0688b8c1bcb
MD5 67f8a7d6b465407bc43af4ccbae2da6b
SHA1 4e1f894d49903b3370da3432edcead11b42ce1ec
SHA512 64a8918290ea253f08d4924c162ef1a265c2f57886f942a233bd87393b3ee088ef30c4fb5145ce9953b1e3180b297e48d9bdf314a99fe0ad5fb51a3043f2dc3e
SSDEEP 12288:vmsf2hoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:92GEDqHKliE9JdpTCePo9L9QIE
TLSH
T19065F009D29802D9D06E6235C7654642F7337C6597E2E3CB53C1F83E4F7A5A0ADEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 cd7a719f8451aecbda9299a4fb74871d1c7c433856e269a7dc18e1faf26cacf7
MD5 cc5d7d734a47a990f8928c48c59f0139
SHA1 deb4a6c51497608c2081898a5f4da654db0d0a1a
SHA512 73687c8faffece7d41322cf40da4c29ce7c8aec25f73a61f2f0274d1915a2cf7c9f56bbdd37b5d6e7b69c1b1dabb4b4b5dccd160692216f67610bac54ef80154
SSDEEP 12288:FsMVTwvuU3fbbBT08SCMn523nUWXkx4LnzqrUbQMMZzx+XiOFn52Z:Fs0EmUPrMCkm3qIbQMMJx+XVy
TLSH
T1684538407626CB4BC6A940321E76C6CCAB707D06FE049F1772C9973FD576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 16KB
SHA256 11ee51cb3ee99e60bf919b565c573505f5e8e370dae69d2fee81b41e7676b94b
MD5 ed672c5a01c8dbec0e4016f6556f8fe9
SHA1 de641a10c748bf145b26c5bd329bfa9f48f7076e
SHA512 d6aafc728cb894cfcefd3b8653d13b1b859eac3bf06bd8af226e0c543eefcd14c7f4e593195bc5793e353dd39dff5fbab2d09c6a7c09f72845895bf30a84bde0
SSDEEP 96:2QRZOTllgiwvXzffotIVEIVEIVLRZOTll8otIVEIVEIVQffotIVEIVEIVLRZOTlH:2mQTllgpvDnoWQTlldtnoWQTllJ
TLSH
T10472E00AF3A0FA23E8F715718CDAE7FC7736EC5A6E8443437284365C9C597415A6E290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.7MB
SHA256 5b56c948c61a5abb4d8a6ae5dc20be756b8a6b46fc248c62c9fdb6261937a96a
MD5 1b9636b8875b0c84c6d79aa12a2e078a
SHA1 17acd3f1f0868a9c14bcb22bee1e5395016ee34f
SHA512 5677904e325f26a784f3a2cc4ec82ad89a740736976106fcc4d695fb9d07016ca8826084dd9e4d2695ae1c4694fb3a5a1c7a27edf5e1d7c07c920356d00a0b13
SSDEEP 12288:zfvu9hvF/cgrDD+izSw4vbyaHfHP84YY+sxjcuAwgUpuRp8X+YlA/iLgpw7f8xM:7iT30byMfHrLxVNLgUpI6cK7b
TLSH
T12E85294155B7DB4FC9BE8037033286CDAB74AC06BB453F05A38589399876A5EB5F23C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3011f15265a967fd07f6fbb29579caeb3c0cfeb4ed85b4dc2cf7ec7be75225ba
MD5 6a02e1c6999176fa9915e6c116f00a52
SHA1 6f68cc3ad2c2983b52401101b31d5e10406cd215
SHA512 6a24462c13f27f1047493630e4022343c59d80a74369af1107fd014f0f0a9a1f791aae7ba37a0934f9962ca8eaafc2bbff7af276367c154d1dc8f488ab70d247
SSDEEP 12288:N67+hoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:E+GEDqHKliE9JdpTCePo9L9QIE
TLSH
T16E55230DAECA4E83FAB73A7047785132F92DBE592F29A1CBD6433901C5758E4AC7B510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3297521409fe372a522fd20754e5872a6a3e86e28e2cf4485ef824e749e5cec0
MD5 14e82a18510bc4c825ceda9142cd85af
SHA1 99b503790ad9925a0e3afc4f27c6200a037ba674
SHA512 2b19637c46abdbf221a8585753c29d20c02bbd6db99cf092517e984e9287c04659c50100c5fb008e8027847641e763101caba3091f82596ec574778f84df991e
SSDEEP 24576:Ggb6bmBIi49WNNFpg1rSvFv7bY0GEDqHKliE9JdpTCePo9L9QIE:Ggb4mBIBhGFV3DqqldPx
TLSH
T16865AF1E22EC02F5E0F6E2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 19dfb15099fcdc79ecafbc9af2fd00fdd53a941d203926a089e6cf2344e4e736
MD5 8b8f163bc0127d0b9d6b07a7132fb3bf
SHA1 5386fe7624cf48d84e36438c4727f53e0effc46f
SHA512 c529fb042809d99c3cea2fc9ff4ac427124711cde81333b4fbaea685245af83ecc1db0d42f3a7151325688ab2965715a53689979d72fccdd4683fef62197b3db
SSDEEP 24576:HG88u8FpJqH1Ozria7/mlGEDqHKliE9JdpTCePo9L9QIE:m7ZFPqVJa7/83DqqldPx
TLSH
T11885016576E102F1D477D1388A824663F6B2B8251364FBDF07A89A411F33AE50B7FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 81d37a66f4f7f1fa86c673800481e8c735e7ed2dc2a7f910fb33bd1cc9e4be3f
MD5 84b2912921fffc29228b33e7d7709ff1
SHA1 a79fa88102d055e37afe6ef5bd45d89e00762847
SHA512 fab5e7a07f8151714f4792170bd343ccec9afc0d0c49fb1e5f463be5808f31c1fb90810a207b768c11fe008f40ebe78c066aabd16128d63cbb912a0fc85d8257
SSDEEP 49152:5BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjp3DqqldPx:aG05lO43bODqIP
TLSH
T14FD5CF6E62EC11F9D1BBD17CCAC6460BEBB23815033556CB02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 913c37f3477f80e2bb82f149c1cba81ff459049f5e30828e4dc07240e247eb0b
MD5 096f9ce7a2b7553cc2cd049a17e859f6
SHA1 3014997d752e73863aa691337e98844eb5e8f959
SHA512 73969722de7253bd102eda2f1fc12f8ca473b902d96ba8eba98585eb6f1e9d02265b9a4204799a366c8767ce94c13c61249a1bdebb0bdb723a1036c7d0ca32e1
SSDEEP 24576:Gfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnfGEDqHKliE9JdpTCePo9L9QIE:ea5POZ3lJt2pasx2+mB3DqqldPx
TLSH
T17565AF5EA6FC01D5E5B9D17DC583461AF5B1342613329BCB022142BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0ff62fc26b1e3b83ebbd7811c6b613915c7e76e0c41212e9bb84d8248f13bd32
MD5 ea162d92b669a4255a2efcd9daa71131
SHA1 23067c069c49bbde26a6e51bc6d4c1deab8b1e38
SHA512 86678348e3476072dea36df1b8dbdb1eb6967dadc75c50dc5ded26ae4a69f7a7b79116917474626a9a02c7b2cf1304024d0d0cede74968e104f361795884cdbf
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7Fk9GEDqHKliE9JdpTCePo9L9QIE:HNc/zEOVHFc3DqqldPx
TLSH
T146858C1A23E901E4F1BBE1BE89779546FA717869133486CF0291851B1E73BF46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4687c31aa28d9e458d58767339fae6db3f4185df8444157cf36d51031faf5410
MD5 052d2291feb245751c7b60a614b3780b
SHA1 3cb544714e3c718040dcec91e52604df904c66f3
SHA512 abbcc765a53656eda4a46f52eab1d662a5b089396882274f722405501e52ce58163eedcf8de972861b123b1648d8838be1816916d83e32c443ecda05eb0653f5
SSDEEP 24576:RzkNvNnaFeYhJNtmZBmqGEDqHKliE9JdpTCePo9L9QIE:RzMwBtOmq3DqqldPx
TLSH
T16C55AF2EBAF806E4D1FAC6748D238512FA727861173253CB5390C13E4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 f07a8931b95fd985e06c9cc8556054cb93e0bbcbf5080f49f119ffcedc31acdc
MD5 ee670456724b63d7de310ab1c112c554
SHA1 03efa70efcf80ae232f399b565a3d00b9a75e82e
SHA512 47d2822e8ebe208484333d1d3297bdcd3f4abfcbdb258991f38b6c535f15baaffbe693ccbee9591e8eca6b4f5818be48dd5361b52093196a4b8d43fa3b657dcf
SSDEEP 24576:nPUr+NQZGEDqHKliE9JdpTCePo9L9QIE:nJQZ3DqqldPx
TLSH
T1AC65E11F26E918E5E676A17C86828319F771B8621712A2CF02D1517E4F77DE8BC3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 0e9319efe0240eb39c5834cf8ea70367c10d9e99569093696a3d5eef4e3a0552
MD5 9b11da2e8052638ac70d4df0e3e1b385
SHA1 3c480d3081341089c0363b42cc33a302c2e92cb3
SHA512 6a920f277a40c91cf49c2f2ae93466351e1f9b5ac578ac4fd415a6a2eaf04decc25c70009501ac9bd9b22d130af848c74d3ed9242f23dbae2ec84745c2b1ac08
SSDEEP 24576:QD3FHshBIYQgAqGEDqHKliE9JdpTCePo9L9QIE:QDVHeBIAAq3DqqldPx
TLSH
T17175E13DEA9C04E5E57BD1BCC6638606E77138A9032266CB02D491B55F6BEE43D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-156-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/8-323-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/8-149-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/8-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1200-90-0x00000000009A0000-0x0000000000A06000-memory.dmp

Download

memory/1200-302-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1200-85-0x00000000009A0000-0x0000000000A06000-memory.dmp

Download

memory/1200-84-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1664-122-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1664-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1664-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1664-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1664-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1988-129-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/1988-322-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1988-119-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1988-123-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/3160-319-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3160-108-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3160-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3160-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3160-114-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3160-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3204-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3204-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3204-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3204-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3204-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3820-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3820-142-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3820-140-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3820-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3820-134-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4456-400-0x000001B8F8720000-0x000001B8F8DA0000-memory.dmp

Download

memory/4872-57-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4872-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4872-53-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4872-59-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/4872-52-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4872-45-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/4888-74-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4888-72-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4888-286-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4888-80-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4928-62-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4928-68-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4928-241-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4928-61-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5220-1-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5220-38-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5220-40-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/5220-0-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/5220-8-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5220-7-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5924-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5924-317-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5924-334-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5924-336-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5924-95-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5924-101-0x0000000000720000-0x0000000000780000-memory.dmp

Download