9443d295b8ac775fc45ee8e8debb23797f45ef9a4e92bbc95bdc2f3432afa3ff

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
Size 2.7MB
Sample261017-hasevsay3l
SHA256 9443d295b8ac775fc45ee8e8debb23797f45ef9a4e92bbc95bdc2f3432afa3ff
MD5 ceb74b0c2b77f3598bf28ecfff9f2f90
SHA1 d5d9a5fbce02ff7fe38ab7770eb3137dc2bd59d5
SHA512 3820db3298702f56295b9ecd84d24afd061823252459aeef12e53e878134f1f921dc3d01f5f4fff016d04609dc2863f8e5e57f7deea4fce7ef32f7e335c1351e
SSDEEP 49152:N09W83G9pyW04ZX4CaEucW/RrmpGarSj8RoTCCRCaEucW/Rrmp:Nw3290gTnudRSpGJT0nudRSp
TLSH
T107D5E02EE69841A6F06AA235EC554706E7B33F15137186CF32A076691F776E08F3EE10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery macro spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 2 IoCs

Office document equipped with macros.

macro

resource
behavioral2/files/0x000e00000001c31f-378.dat
behavioral2/files/0x0005000000016a4e-379.dat

Executes dropped EXE 11 IoCs

pid	Process
2140	elevation_service.exe
460	elevation_service.exe
4852	maintenanceservice.exe
2528	OSE.EXE
4832	PerceptionSimulationService.exe
4868	perfhost.exe
6128	ReFsDedupSvc.exe
3940	SensorDataService.exe
2924	ssh-agent.exe
1784	AgentService.exe
2556	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\62bbd3f0e4fea11e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5468-6-0x0000000140000000-0x00000001402C8000-memory.dmp	upx
behavioral2/memory/5468-118-0x0000000140000000-0x00000001402C8000-memory.dmp	upx
behavioral2/files/0x0001000000009329-399.dat	upx
behavioral2/files/0x00010000000093b6-400.dat	upx
behavioral2/files/0x0001000000009952-401.dat	upx
behavioral2/files/0x000100000001b98a-402.dat	upx
behavioral2/files/0x0001000000009b92-406.dat	upx
behavioral2/files/0x0001000000009cfe-404.dat	upx
behavioral2/files/0x0001000000009cd6-403.dat	upx
behavioral2/files/0x0001000000006214-407.dat	upx
behavioral2/files/0x000100000000a0ce-410.dat	upx
behavioral2/files/0x000100000000ba33-409.dat	upx
behavioral2/files/0x0001000000009359-412.dat	upx
behavioral2/files/0x000100000000a2c1-413.dat	upx
behavioral2/files/0x000100000000bd43-417.dat	upx
behavioral2/files/0x0001000000006279-418.dat	upx
behavioral2/files/0x0001000000006222-416.dat	upx
behavioral2/files/0x000100000000a319-415.dat	upx
behavioral2/files/0x000100000000a1d4-411.dat	upx
behavioral2/files/0x000100000000a304-414.dat	upx
behavioral2/files/0x000100000001b98e-735.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107750\java.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002912b257015edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031298e91015edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067e8555b015edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034544359015edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072a63c91015edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 63 IoCs

pid	Process
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
2140	elevation_service.exe
2140	elevation_service.exe
2140	elevation_service.exe
2140	elevation_service.exe
2140	elevation_service.exe
2140	elevation_service.exe
2140	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	1784	AgentService.exe
Token: 33	2556	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeDebugPrivilege	5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
Token: SeBackupPrivilege	6128	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6128	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6128	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6128	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6128	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6128	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6128	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6128	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6128	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6128	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
Token: SeDebugPrivilege	5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
Token: SeDebugPrivilege	5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
Token: SeDebugPrivilege	5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
Token: SeDebugPrivilege	5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
Token: SeDebugPrivilege	5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
Token: SeDebugPrivilege	5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
Token: SeDebugPrivilege	5468	2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
Token: SeDebugPrivilege	2140	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 3452	2556	SearchIndexer.exe	101
PID 2556 wrote to memory of 4816	2556	SearchIndexer.exe	102
PID 2556 wrote to memory of 3128	2556	SearchIndexer.exe	103
PID 2556 wrote to memory of 804	2556	SearchIndexer.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5468

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2140

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:460

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4852

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2528

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4832

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4868

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6128

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3940

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2924

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1784

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3452
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4816
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2732 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2848 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 76cba8f2de2f66cbd537488d8a66cc1bb2d12672507e448824484e9e002abc12
MD5 8c5bacc1bad9326370aa1b72f550b4c6
SHA1 16f0cb7d80660dfb1d2c1a4544c9d46ca2b04c67
SHA512 0e24e7052105e90719f345fa1c6d66682ab2e1f871c731846e296e082191b34f1dd8189fedb1b5a0c05db2e79613cc95f7d1ae91cb706ee9671e3076096d840d
SSDEEP 49152:jb+632BuPkFKRrdE6ohmstBhuXjfS4LWxntCaEucW/Rrmp:B3q6HjB3nudRSp
TLSH
T126D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
Size 820KB
SHA256 7db49e2ae161333941dd1b9a667b8833daeac346c19b7e3842bdb7f86dfa51aa
MD5 0521200d905ba4ec4ddebf83ed879843
SHA1 0ca9641671cccd78f142cfaaad5392dd839685aa
SHA512 42168d5271ae2acaeb247ae13e4687e671a6634c571b2895c89037ea073a6b28467b9303130447e6b720461c0f5853e8d407057ba36a5915bc51d4c5542fc03b
SSDEEP 24576:5TWImWyE9St2sNyj2jzFPhCtZDaN5xm/R:5TKeQJjNhCtZmN5eR
TLSH
T1C3052346F780DB6FE9804272192B27BFFAF46D0114E16E1713E0B9A9EDB17E3981C425
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.2MB
SHA256 048a0f97c6cffefa465951564a68a3c07f185d1d7266490663c955efb143b0b1
MD5 0559d91e306b40c801810c3341fb4bc9
SHA1 90a9952a08d3e346bca1a86663aa0854616f24a4
SHA512 672d004dcc059d8d2caf85d97c2a671b220249f926aa56a8fbd2e7040b56db24181ca43ddce82692092a10d5238d8a39b1d2944cb7d20aafc5cc241b43d9dfa1
SSDEEP 24576:7XYfDtczA4CaEzwAyujOhcid/RrmpF5aKngL2jdshRTdG1YxITqvfPkbIcbjLm:etcfCaEucW/RrmpHarSj8RoTCCW
TLSH
T175B51229A7C40AF8ED6B9339CCA28405EA733C954765D78F03E4A9690E373D45E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.2MB
SHA256 c555b6b65dd49c1250e54f3e0661071184bfb0258aaaddc5c18639141f6b4930
MD5 42228923193f6075b09f7c161eb33a7d
SHA1 4fa6199d07c4591b025056cad39e2a9a0008c5e9
SHA512 6c33025b9ff74ffb07e2780927e7e14289c20e88843c0b76ee943e419874bc17bedc193861f1e25e4da1d94bab7f1795c4220383d5f0bd6e2c862b8221d08973
SSDEEP 24576:lXYqewczA4CaEzwAyujOhcid/RrmpF5aKngL2jdshRTdG1YxITqvfPkbIcbjLm:OwcfCaEucW/RrmpHarSj8RoTCCW
TLSH
T1CDB51229A7C40AF8ED6B9339CCA28405EA733C954765D78F03E4A9690E373D45E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 5d0ea0b6fd4ced84b1557f5dd07913abd89a34cfc2938b78d5fba44b6e4a21e7
MD5 71fe40f4cdb31047afa7f9ae64c0e776
SHA1 cd2eb7b2df8d9fd5359917404df8d87ab5454497
SHA512 fc9b683772a2cc2cdf5d4e4ddcf92f6acd95b8af78ba866f65d4c074fce79936679fd5aab2ceac2221149190051112f762a6d075f6f9b9d8454d2660ed885001
SSDEEP 12288:V1XLsswWkxy2lRq2czA5yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:7XYfDtczA4CaEzwAyujOhcid/RrmpF
TLSH
T13A75F129B7D409F9ED678239CCA28111EB733C9547A4E7CB03A8A5690E333D45E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 8891634c9f06a1b77b6bfb22ebe9dc01874c41081b423ac5d562f8ab9ecc4145
MD5 49921a9135d02c1dc8f207e8f3bae144
SHA1 887692fd57d9a08a5f5f406bb3d888292bf822e8
SHA512 a2d09201497762c48607066b1e4d5a5004d21f1d7695846410eebef5841d4bdef58366003d834e3e6b1cd42f06238f855cfe5c2d52cd6e1e46b43c9922d78a0e
SSDEEP 12288:imw5HEjsChNVBFgl0WDm+CqyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpD:7wuoOWSCaEzwAyujOhcid/RrmpF
TLSH
T15365F14677A80CF9E9A7923989978135F7F27C022A25CB1F1364C65B5F37360AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a921fe6c412edf52735104d0e4d6a7d17538be39e95d1239bd29c9b215ce88f1
MD5 3d9f838ceb9b94c01d9ced64ad7d8a30
SHA1 d3b94685289e6fd49980a1ad119b58bf05a42a80
SHA512 568c0bcc4e85ae3145ae924fd309bf9c5f36c2299a07199467abb319fd3d611be4d227b60a07c61d48ed52a60793c865125118c889d5780bfe0099dd22230ebd
SSDEEP 49152:PB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glICaEucW/Rrmp:xu6JmVxd2djnudRSp
TLSH
T113D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.4MB
SHA256 07c6089a4e8e7d80aac6327038ebf97d5f7db826c47f335f071c9812d84ff47d
MD5 e27e5bdd26ec1e7d54841b03be4dad0b
SHA1 e453283ab8dedce6dddb989612982ccb17006669
SHA512 7d403014244f29c92e4cd9653d02920ceb8be33e79d83b7ac5c4f60e0c60f28c8fd64d4497f16239d0a57953f923f980e6518917d63180048b28e3a4869de1cb
SSDEEP 24576:nfwvok9RX6wkyAI5CaEzwAyujOhcid/RrmpFnaKngL2jdshRTdG1YxITqvfPkbIp:hMnYI5CaEucW/RrmpVarSj8RoTCCW
TLSH
T169C5F12AEBC845E5E177923C9DB7460AF6B138591B32C6CF029A53AD0E37ED05D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.4MB
SHA256 87113904bfdc6b2549fe9aac5e7c64eb3bd4f66da24b19d23adf5ca7c703e40f
MD5 0512240460c97ed25b7c0111ce01ccc7
SHA1 28b7cbfbc448ad2fa59edebeb75b4f621cf31380
SHA512 c7373f7cede67aac076469397d6a595e892287d6028a07e1e5cf8abc761ad2dda788668fe9c4ad2366ef699b23a0a0b99b3bb1b8446c49647d11bb0a811d252e
SSDEEP 24576:Bywv8k9RX6wkyAI5CaEzwAyujOhcid/RrmpFnaKngL2jdshRTdG1YxITqvfPkbIp:UMnYI5CaEucW/RrmpVarSj8RoTCCW
TLSH
T1D3C5F12AEBC845E5E177923C9DB7460AF6B138591B32C6CF029A53AD0E37ED05D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4dcbc671f07a20d3447ebbeb858413b7438d5b81b52397651e7589e9d53721e1
MD5 5c4a6420210687c0bf20b74f6650f1e5
SHA1 b947e996546de752443b2b5fefb6b7171f4dd1cc
SHA512 1b1d5ee6f7934f7d3ecec672cac0331aa8757bc85dae38ec6f32c0c5cf91b7f3983dc346ac76540dfcc7b1365d488397c98d81ed87ffd21391ba59c8e07581ca
SSDEEP 49152:4YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0YCaEucW/Rrmp:GySzPLnudRSp
TLSH
T12E066C56A1A801D5C1B9C1B98F1BCC1BFBB134490335ABEB02E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 57018c0b60741edf70d083d5dd2c824409b46ad770b49417f23491156d1df10b
MD5 35a082b5a96de34c08b10534e96b4c3b
SHA1 d0d01db4f0daabbe28c600b268977bb80a6b62c4
SHA512 f0e80ff4976b409bf102c958024ca916433395d5f2a085090c2ae518b1ca5d149c2b51c0e049d62b591e29f5a83661abc8e442862afd7a71690d84b909195d27
SSDEEP 49152:uYJSNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0YCaEucW/RrmpS:4ySzPLnudRSpZJTy
TLSH
T181269D57A1A801D5C1B9C1B98F1BCC1BFAB134490335ABEB02E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a2e5ba657da17c289a97c6ecbd6d7c3e6310160d03bdd3593cb26708684c89a7
MD5 23291f9e6b453504947e7525d01f207f
SHA1 d2fa598495c1eafdc79cd16748d2a656569deb8a
SHA512 2cddd04a5b0053a18516fcd42f3da1c0e50644384a28eb3dbb3d9db07b6196303bb179250689daff183ee430f0c63ccba5b8e1481d59bc21c1ba2f7921695067
SSDEEP 24576:q47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYaCaEzwAyujOhcid/RrmpF:q47JUQj1irIhCnDHUPfF/ICaEucW/Rrq
TLSH
T1CA65AE1EA3EC01E5E1BA92388515465AEA71782E1F31CACF2270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 5cb5bb88b296c82c23d102f81e7a052d0d7311d5f7d74d2a4b0bb1ddb64b85be
MD5 cba84727b0937429a0b91863ef66e4af
SHA1 d116e957daac1949b01aacba4478df25f138fae9
SHA512 21438204bcef96fb7e31e420cf07a7462e02ed95654c5818653f97be0064a05a651dc3d07f530117083b3df0227821134cef9550f41b6cb83a6c42a7f566ddc6
SSDEEP 49152:DQ7JUQj7irIhCnDHUPfF/ICaEucW/RrmpgarSj8RoTCCW:YJ5glD0PBnudRSpgJTy
TLSH
T1BBB5D01EA3DC02E5E1BA923885554A5AEA71782D1F32CACF1270937D6F23ED05F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 22e72aeafb3993f1c8701cf5373196db7e158a85378641686ca9d3682185dfd6
MD5 5881dc13507d0ab8f35148b896b920f1
SHA1 d2b4f208e61581251db70c52f80dc9c697457264
SHA512 c9cd738c1e0edef5b461a559890bc6bce827de82e5a9916db67dd31ee07579653b612109b8fd866a1e356db750a17649f4e92da829ee0d771ce728078f02d8e5
SSDEEP 24576:+9uN7UPEgllG9YklogEtqftWhID9YBYJlZkk:ey7UMgllGBgtOtWe9YaJlZ
TLSH
T1635538007626DB4FC66940325E36D6CCA7707D06FE486F0773C98B3F9476659BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 61438a1ac0fc89778d487d8992dda20df750d5cff92d557be2c5db6c5a7d4a90
MD5 58a8968212e6423d38819b87464e6a97
SHA1 df6753f853c1b99aafe9b25251e7aee7c505e065
SHA512 1af21e344a326047253ccb6abc1f897834621e02ccf9859388f34aa2a060f9d8766a726c413f41bee2dfdb50f9420278835b03d8c4908d8c19fd19d0fc0440ec
SSDEEP 3:OlH/l/J87N6oli53bLt5l3y9Gxtg3mCllltGlslslslslslsl6R0Oe:KfgNhi53bFQK0mCtEEEEEEELv
TLSH
T18B819292AB250620EAA2E074485D57280766CA4468C0F39BA9413173CC427949C0AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 342KB
SHA256 eba268b27dab6ffea7cf8f74cf2f9c47a04a6a60f26ee658308c55254249f03c
MD5 4fae51e6d3c3b2cad9ed8b49c6ddf8c9
SHA1 235f43459212b428de8c96012ebf92faad1ca81d
SHA512 15343d94a9be0697e90fd17005c7b354f16a8abba15cda1a2d7f774b585394a1cc7096fa13a9dfda67d1f9e1151943fce0ec18e29118566c7c537c3969537324
SSDEEP 768:KOlTP/lToOlTPBlTz2+EQMxdRd8xOlTP/lToOlTPBlTz2+EQMzVOlTP/lToOlTPz:kxdz81zheGZW/B33G2pbfIKhKC73x1R
TLSH
T13A74B412B724B229C4B381775870E6A7EB3DF4228F1246022FD80DA5DCF62576B76F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveEnter.docm

Path C:\Users\Admin\Desktop\MoveEnter.docm
Size 778KB
SHA256 d0d2569546b520fa0986d3ac8246ba647f6c1b5248d484495d74d1c349193fdc
MD5 753ed5579c07f0666edc2c6ae38346be
SHA1 fa13751b8600ac15d2f131bd5471eb2c7e27335a
SHA512 3a0707e8b20da82e7faee5a9143a5f352fe1fb3e2e627d41c6090de1be0245790b42336655deac1db2dda812daf4d81b17dfc435163242f9580fe389013249de
SSDEEP 12288:TUE0e6YJ+etj+uxyOq9UDYyxQHf7XHuRAXndgymOegpvN1J3E:Tb6YAIKuxyOSUPtRAXndglOnPJU
TLSH
T114052397A09B02D2FE16027A94DB60D55C8A4D0368CA47C75EE3E012CBD99163DFBC7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HideRestart.docm

Path C:\Users\Admin\Documents\HideRestart.docm
Size 775KB
SHA256 359a8a556464d3f2477a0b08545dfe4c7e197b1e28d4c36b1d5faf4182efdeb4
MD5 25722f0fd09573b5d1cb08870b31fc18
SHA1 6f80733bd195d617b11dbede01c9c1f16b0cca49
SHA512 35538c702af8924ec94dc2738bf80f98ca3fa9096672f651ce14f3f18005e85a47a70877e3fa3e43f6d654a6615f1a66a8e19930d4b02ae57c6fd9bcf9d52ae4
SSDEEP 24576:JalkH7jn6kBDMDag5gdCpdISrsDyxvXJYHzPAx:oIj6QMZqdujADyNXJS4
TLSH
T1DEF4231C2E90A9F1E62147B175FD914D90BF076709D3CAA5A728B3B30AE91D76B33123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 db251c803aeedce63834f217ef548042bbfdbc3324f80d50a16bf6e3533b181d
MD5 545d0c604bd204467014f1880d64663c
SHA1 99b9dfba79f5e1635fb075cec6e96060f11223f9
SHA512 5fd1982fc106848660456bd548ed087b2f22dfebdf74056b50e392e0f80f3b1147d98d2ac1d8e82f94166c9b2e10dab629a7e30d4fe902668f03de279e1997d2
SSDEEP 12288:yF7UyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:uVCaEzwAyujOhcid/RrmpF
TLSH
T13A552333DB898BB2F96A67320CBA0034E71A3DA61B59C6CBF51DB25D4478BC09C7D211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 997ba35f52655ef99365985ec01e49de138dea5d921f832f6a6b9f850a130127
MD5 764174f6ddfb11c4ea32250ae1f116a6
SHA1 6701e1d832912f0a2805afbb2d362d2fe6cef575
SHA512 5048f583eb0fc58eccfd5acc70bc7eb2f9916ec08b68253ce88ec1becb1956d4a16da3686331c2a03d3ee4636dbf1b92cac2aa6e443ae1eb71c57ee7bcd1d774
SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bYPCaEzwAyujOhcid/RrmpF:0gb4mBIBhGFaCaEucW/Rrmp
TLSH
T17F65AE1E22EC02F5E0FAE2B89DA64417D6B278160731D2DF1151427D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 2.0MB
SHA256 c278aafb2cf74f8c573e3e96d9ad59134efd9fe638e62d59f024a9fac0217686
MD5 c703fb4eeaa26b4247807b4c42494b4b
SHA1 3eec61ea7b3bf8b25bb1d599887d16439f02396f
SHA512 e3d1ad5e3eeece2bf21aa1f965677fb5bddfc1198cbc973b14d1b7d79385fbabd2d0ecec1f13e185704af95ce1d0cc3ca2a83565e6320db72c23fa3840ae766b
SSDEEP 24576:S8kNvNnaFeYhJNtmZBm0CaEzwAyujOhcid/RrmpFBaKngL2jdshRTdG1YxITqvfv:S8MwBtOm0CaEucW/RrmpHarSj8RoTCCW
TLSH
T156A5D12EABE846E4D1FEC6758D238516FA727851073293CF9290C13E0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 8a649dc9b0512770b493f428f8bfb0a10ce80d9673a0ffe7d242b4e423f613ce
MD5 a965e7e4040614c05167eb682611832b
SHA1 0c9a77fd52416906b41df738b15a9cd534d3a6be
SHA512 cbef281dfa45c8af166c8ffed8f0e7c5483d031a0b683dc8b6b7bb72fbd6ae08a5d4d1b755f7682826117870af0fa05b306a0458450e3f32899f04fff5b6d26c
SSDEEP 24576:mGuo5aKngL2jdshRTdG1YxITqvfPkbIcbjLm:mGuo5arSj8RoTCCW
TLSH
T17F05237EA7C566D4C43BA77829B6984A3CF33758970A46DF88E0957C4F6A7E0263CC40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 ce02e1ab3b63367fa48f65d8940b7545ebfcd571b3a9cf2009a362e3cd5abd26
MD5 4815c5075f7f9bc432c6eb61e12b894d
SHA1 864b52059ccc389dacc6a53cda88f6a13d2a88cb
SHA512 16b8ccffbebc49d7ba3e7054cab4a3ed2fd59853ac05cf5c666edabe46c770380269207d9248cc3c768cfd2af8b5d0f492f3e981c043be6d0b156ed4d08f7325
SSDEEP 24576:fG88u8FpJqH1bzria7/mqCaEzwAyujOhcid/RrmpF:u7ZFPqVea7/HCaEucW/Rrmp
TLSH
T1E685F165A7E102F1D47BD23889924663F6B278250364EFDF07AC8A551F33AD04B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 5f7c75ecc96a0a6a04e2836597f4f0cf4bf70b79ee404a8e296b079a17ae8935
MD5 e988cd8e8907c37c7c434535d10460e9
SHA1 0207ee3a5547239621adbda49af8aad4046bf0f4
SHA512 82426c126da10deaba7086ae7ae35e31ee20f6199f64df1ebe16e8b00b92d769168d7f61ca2bc0bca8296e139c5223d1582b6683ebccdf724cbb9cf4781743bf
SSDEEP 12288:gHvUrBFrEjwaQjyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:gPUr+NQeCaEzwAyujOhcid/RrmpF
TLSH
T1A565E12F66DD18E5E67AA23D89824219F77178621312D2CF02E4917E4E77ED4BC3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 0e5c37c29dcb7c0891d00a553b64ac724fbe23299540f013744e51f7fb070522
MD5 c6dbde80dafe25b8a5a58b5fdfc6037f
SHA1 3c9387a4f3f640403132f7045c6ab49c6c9f2a94
SHA512 4e668646d2a330fbed063d3c062bea95eb5cf9cbf353f16ca533abbf240fd522930b6f46837c4f65a854e392dff730517c693351d5d2967c6950a14a768b46b7
SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjuCaEucW/Rrmp:uG05lO43bQnudRSp
TLSH
T150D5CF6A62EC11F9D1BBD17CDAC6460BEBB23815033556CF02A486A91F27FF0997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c8580e303809fbc2b3a1506e968911c20eed0dd7df7b8da49056995ea2de4318
MD5 330a53a10ff363b06a34155c3445984d
SHA1 fb050b71d1035af57d16bc4ecc16d75ce5a0c9fa
SHA512 6b435cee5d383d0069b141572cf2fd35a7eb7295f35071a4ddc640f37cb93b4219e8759e426bd60d1e2b9fefd426f8f7383ed6d0b8b802c8f8c761f75d575780
SSDEEP 24576:Afa5POZ3dpFWVM50JicR2hG0lasx2+47eidnYCaEzwAyujOhcid/RrmpF:4a5POZ3+Jt2pasx2+mWCaEucW/Rrmp
TLSH
T14E65BF5EA6EC01D5D5B9D17DC583461AF5B1342213329BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c261976de817b4faaf040f4c46065e1b670805c92a1f24667e67fd0239d4c5d5
MD5 c5729d4e1c31088ecd3568a6dabda6bf
SHA1 c56cbfa86033d3e8aa8419c0aae4d5b7fbcb046c
SHA512 44c05df9f864981ed2f8c0b24b2bab9c67774e355f18a7d31d074df6bc2ec52d39d37f11840e46ca098e6d6d342cda12ba6d72d81c8d18ebc0a61d3cc547ca83
SSDEEP 24576:KNcwHdjbyQ4nLC18lb/EOjowL7FkyCaEzwAyujOhcid/RrmpF:KNc/zEOVHFnCaEucW/Rrmp
TLSH
T19B857B2623E901E4F5BBE1BE89779546FA71786513348ACF0291811F1E73BE45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\System32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 b79a70bc182d22cdfcbf5d567a4d7174e39c3b5ec099ce031897f6d5fe176336
MD5 a5f4a4f11ec2e475abc8b6371f523477
SHA1 da823dcab5b9eef20fcb6f215a25d5903f9853f4
SHA512 755f2178773f08fa4304d2c07eb6be12698a650cdba77f029dac4d89ee9fc99995f0e9d3e9d6650e1990db389114dcebebfcefaa0dfad4f103e07f1671500e63
SSDEEP 24576:fD3FHshBIYQgAhCaEzwAyujOhcid/RrmpF:fDVHeBIAAhCaEucW/Rrmp
TLSH
T15075E13EEB9C04E4E57BD27C8A634506E77138A9032256CB1294D1BA5F6BEE06D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 711f19a8045f4483c33c2cb59fe31e5c56491740350f532a03b0c2ed686f9594
MD5 a779d869aaedc8dfb604fda6e171f645
SHA1 8a87c776668016af665d73b9389a8e8ecc102fdc
SHA512 b44fa2730c22b2c31fe71adee5aac7605adf3cfc8b55c2a4714bf957909e7376c01d1bf7bf97358903aac1b75c112be400d0175f16537557da892a3ee864d8ff
SSDEEP 24576:y6DIlzaKngL2jdshRTdG1YxITqvfPkbIcbjLm:y6DIlzarSj8RoTCCW
TLSH
T11025126D63AA01F4D06BE13D96934506E5B2B67483074ACF4AE4C5BD4EA3FD8B93CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 c63b55888d2e3ac7690fbe6393e9ce3c7ea0b3c4a59440a4aa627e4a97fa1894
MD5 088b4daa1322c2403b06dbee990d8e81
SHA1 57073c847ca12ac2265cbb76c16ff4e317227377
SHA512 7108d5dcc3ed95fce324fd3b761fc80028053cf00e07a6ae1888d2fb6879e44d5dc0fb015a2e06dc11ca5d9c26898ce9e4e956dfdf9bae941ef037dafa529d2a
SSDEEP 24576:EtyraKngL2jdshRTdG1YxITqvfPkbIcbjLm:EtYarSj8RoTCCW
TLSH
T17615235AD7C456D4E57A27786EB385882D727E249B0783CF89E0E63D2F367D06934B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 800KB
SHA256 e166dcc0e6eee331b174339a66517506846b6c894772a9da0dff43db2e5b1403
MD5 e2aa1a29e1bffd18e9080fc4c8eb7772
SHA1 21fbd545ab7104c323d1b7579d5e58ddb8fc8dbf
SHA512 6b57ac7bbced0890cc4c044a0196501dcfc31f973fed9642e7d31ea27bf92676639133b9725d55fe028930b32172135e6fa97c400066eaf83a98c434fc335646
SSDEEP 24576:l5aKngL2jdshRTdG1YxITqvfPkbIcbjLm:l5arSj8RoTCCW
TLSH
T1D205237EDBC45BA4D41A7B743AA6A98D3CA3376C970B46CF8CE0597C5E7A7D01538800
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 93afc9893e79c689dcd682a9f1e2a26643df87fd29a139d01b0304159712d336
MD5 02f5985386b90ab36a1c20fd521c0f2a
SHA1 3ee221a3174ecd9175dfee48798a7488cb1cc290
SHA512 639953b9a06992a1a73ca9828aaca9bad629493953edf4200dc14e1e97dd55dc6b9d55c2ccd4d7d8ded2a1c1c1d2b61b2a7ac0285d0ddf9368acc5dfdb633999
SSDEEP 24576:l1gKLoTfaidZEaKngL2jdshRTdG1YxITqvfPkbIcbjLm:bgZTrZEarSj8RoTCCW
TLSH
T1CA65AD1DA7EA06CAE2B2D675D8725483D633B4315772C6CF2448C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 935243c94aa3d4f33802c59b5890743bc8fcb1127dae6b0f947a6ef1dd19df36
MD5 35933324d4d031bcb11b4aeda7aa348e
SHA1 fd2e10a6903e3f225290763a22874134edb6b98d
SHA512 49f8a29d83be0bc6c02ec05e34ade76f65ad8925c162082f20d52f4f9b511b53a42c658a9618ce7bdd46c8fb8063923c8692193a89aa6d21c9d2b3468d37c153
SSDEEP 49152:Agb4mBIBhGFaCaEucW/RrmpYarSj8RoTCCW:AtSnudRSpYJTy
TLSH
T12BA5D01E22EC02F5E0FAE3B89DAA4417D6B278161732D2CF1151426D2F3BEE49D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 2a2ab05b98c567d48ff80ab4c8c5f3132d36fdc8a74876e2680c5fce8a228851
MD5 93e7f97908e0465a52e794f6705d6cc8
SHA1 9132695a41d70e664d5510ea7cb4ad37b4cba484
SHA512 1208c1742bc5398b8a278f5f79991210c498fc85abe8ca9a2872fb90e71c5e022b0051a52d2446351b399553f8ae382c1e30e4fba76c44e933c59a339c2a573e
SSDEEP 24576:RDkNvNnaFeYhJNtmZBm0CaEzwAyujOhcid/RrmpFBaKngL2jdshRTdG1YxITqvfv:RDMwBtOm0CaEucW/RrmpHarSj8RoTCCW
TLSH
T18DA5D12EABE846E4D1FEC6758D238516FA727851073293CF9290C13E0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.4MB
SHA256 8f5ac3e6f04fe7e2836f3e6c02f774bcd08a4a2cdd19aae9ac9b6a4758fe1a0b
MD5 092902240e0ba9691ea8bb3a210f818d
SHA1 ece20aa90b8bf1deee5eb3aff75ae945326b28cc
SHA512 e25b983aab262e6326df6cfdb7df203b11ea4585d087f27a8ef51693c949bbe1847a7d3de9170065f95af5cee3eeb6d372396727b4791c9013f3753435753ed7
SSDEEP 49152:VDVHeBIAAhCaEucW/RrmpdOarSj8RoTCCW:MnudRSpdOJTy
TLSH
T1A6B5027EEB9C04E4E57BD27C9AA38506E67138AD032656CF05D491B91F6BEE02D3DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 e0ff0fcb96a1effe7ca895fa4354b9e662d68dfa9b53e218fc0f2d3f5d8be276
MD5 f0fa62829a5c5239e7fc6f91999abb69
SHA1 c4f73f86045df082abe55b61b74d49c8808348e8
SHA512 2ca8cccbdd125da14dae06daf1e54de764241155c3c8ea058b49ccbf75eaa9c0856b4d9221ceb8bad174639cf00900e65786a69d7c4cb839063b5d52983936bb
SSDEEP 24576:6JnJPbzB4SbaKngL2jdshRTdG1YxITqvfPkbIcbjLm:6JnJv6SbarSj8RoTCCW
TLSH
T12C35F13DD29810E8E4B7C2B4815A1B5ABE71387D2F1669CB59B4D4343F12FE0A939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 e5e3635a4d884aa71a3639b16eb2ce4a0ad929f462225bdce2a77f7e54e90e6c
MD5 93b39e3fab8bce4754f6adc1223113c1
SHA1 9fea3a22c6aade2d464bcdffd645a2e715543bb6
SHA512 ed2ec712feeb710205ce2f525aefd7650f10ed919e0746d0210d5d4e0421ad9ff41ec3281ef718b9a15a4c734ad2491c4f207e02d2f7636e7b39f4f951dff64f
SSDEEP 24576:p6aKngL2jdshRTdG1YxITqvfPkbIcbjLm:p6arSj8RoTCCW
TLSH
T1050523AEDBC48BA0D55A3B743AA7AC4D3CA33B5D974B46CFC8E0159C19AA7E1253C440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 74a1e0f81237cf7141214ba2d649c123936e9934de0c9fa23edcc82eb3bd1660
MD5 bb2dcf4c8629bf94648cf79c4cbef164
SHA1 64ac8f9f079424a6563e4c7ccf1743ea53cf0a40
SHA512 691b81e355b29639e9eee4ed0a8a6978004752459c6aa65a1b8a93aa8a1c2347381f5c339171bfcc57fe93191ea5a69ce7d19e990d614683a102f0ae1bbc003d
SSDEEP 24576:B6Uqjp/aKngL2jdshRTdG1YxITqvfPkbIcbjLm:B6U6arSj8RoTCCW
TLSH
T12215236E97C419F4E03A1334A9B6C10908B27E7A035B86DFA5D4967E8F36BD0953EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.1MB
SHA256 c33e875a084e580f1a2da1a938b7d6b194e60d2a35fdb26b2bfa0f033115291d
MD5 3f36f9451056cdbfdf89d12ece8b0d1c
SHA1 467f7f1e41027a45fe26554a56def53a3fdd4456
SHA512 6fbf02d6e3d6aaaf99826f5d12eb23515a525a60b8871dc06b784a9f28f5a9fc66d998d950bd34f887ffe422a9ca8caf2838c9483a2ae9b03e6f9e47247e8be4
SSDEEP 24576:pCLHGL0MoeVtFumTijCmlKQWDk9aKngL2jdshRTdG1YxITqvfPkbIcbjLm:pCLHGeeV5ijCmlDWDk9arSj8RoTCCW
TLSH
T165A57C05E7EB4284E8F3CAF5CA2694169A327C549B34F7DF4E80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 960KB
SHA256 a43474364fe8485055d08e2566b1897a00a781d335715987ccac4279b9f0a703
MD5 ba22ae6c4b09e4566f98b6c5a75946c0
SHA1 1010a92f6d6d8e248f09f250f9022e59bbaca246
SHA512 54e4bae5679f9ac314b0855bbdaedd12b72b6a1b868be28bf4f40824e31ef7fd18beb9f149affd16e23fe331aabe88f7068a7f62f9a4e56ce408fa8ccbb6c000
SSDEEP 24576:2rcmRVaKngL2jdshRTdG1YxITqvfPkbIcbjLm:AcmRVarSj8RoTCCW
TLSH
T1D225015EB7AE00E5E1BB923C8982454AFAB37534530257CF46E0877D4E67AE97D38B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 3704308cfb0a457d9f4329e52dcca7c79852b21a0173017dd08eddd08793faa3
MD5 37e1ea3636f8f102aa1e21293588fb7e
SHA1 2e9efcbf13c96ef373e870e565760f92e07065d8
SHA512 da666370973ef46262d7c509c836fe58369c23ebcaaf108c339448ac904ad752c3e2c0b8b994cb1f44d873fa4349bb6a472b6eab278ca46f300acd8d0190097a
SSDEEP 49152:vDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3garSj8RoTCCW:E3Upow8sBpJTy
TLSH
T116B59C3DA2E800A8D9AAC379C54213A6EA71782D3F3015DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/460-314-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/460-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/460-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/460-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/460-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1784-144-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1784-150-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1784-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1784-152-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1784-154-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2140-29-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2140-159-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2140-30-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2140-28-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2140-22-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2528-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2528-122-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2528-68-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2556-160-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2556-167-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2556-161-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2556-351-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2924-133-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2924-125-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2924-347-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2924-127-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3940-109-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3940-343-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3940-344-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3940-117-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3940-103-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4832-114-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4832-73-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4832-79-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4852-58-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4852-113-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4852-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4852-60-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4852-53-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4852-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4868-88-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/4868-115-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4868-83-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/5468-10-0x0000000002990000-0x0000000002A13000-memory.dmp

Download

memory/5468-8-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/5468-0-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/5468-16-0x0000000002990000-0x0000000002A13000-memory.dmp

Download

memory/5468-6-0x0000000140000000-0x00000001402C8000-memory.dmp

Download

memory/5468-206-0x0000000003810000-0x0000000003870000-memory.dmp

Download

memory/5468-118-0x0000000140000000-0x00000001402C8000-memory.dmp

Download

memory/5468-7-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/5468-200-0x0000000003810000-0x0000000003870000-memory.dmp

Download

memory/6128-346-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6128-98-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/6128-92-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/6128-360-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/6128-116-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6128-362-0x0000000140000000-0x00000001402C9000-memory.dmp

Download