Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 01:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
General
- Target 2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
- Size 4.1MB
- Sample261024-bswfxaea32
- SHA256 e728c58a181dc7171065ff1cc6037b0818c31ade3fe82f3cd746044bb9f38589
- MD5 a8d41a377701b6922eb3f13db6ffb6de
- SHA1 bb3cb8f1bf7596654a60097133bae619fc8b50aa
- SHA512 599461e02f827755753dca7f40f4eaf7726786311edf5078187b347344315f8a00f8bd8170738fe44ce4e352687402cc05858331d517beaaec131f1eb93e2a4d
- SSDEEP 98304:mxmysJpbfAcpyFnStKQIcB/ceQgEOmYognlmH6OF+O4pHiigaPJ:OmhprAcikK32EeQvOnlmH6OF+O4xiRax
- TLSH T1CD163348F68AA1E4EE638639DBE08743F3B67C501748D6DA63CA43441FA7BE04D76325
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs
description pid Process procid_target PID 4132 created 3244 4132 2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe 81 PID 2456 created 3244 2456 svchost.exe 81 PID 4220 created 3244 4220 svchost.exe 81 - XMRig Miner payload 20 IoCs
resource yara_rule behavioral2/memory/2456-26-0x00000174CB4D0000-0x00000174CB827000-memory.dmp xmrig behavioral2/memory/2456-25-0x00000174CB9D0000-0x00000174CBDE1000-memory.dmp xmrig behavioral2/memory/2456-31-0x00000174CB9D0000-0x00000174CBDE1000-memory.dmp xmrig behavioral2/memory/2456-33-0x00000174CB9D0000-0x00000174CBDE1000-memory.dmp xmrig behavioral2/memory/2456-23-0x00000174CB4D0000-0x00000174CB827000-memory.dmp xmrig behavioral2/memory/2456-14-0x00000174CB9D0000-0x00000174CBDE1000-memory.dmp xmrig behavioral2/memory/4220-384-0x00000237D19A0000-0x00000237D1CF7000-memory.dmp xmrig behavioral2/memory/4220-383-0x00000237D3000000-0x00000237D3411000-memory.dmp xmrig behavioral2/memory/4220-388-0x00000237D3000000-0x00000237D3411000-memory.dmp xmrig behavioral2/memory/4220-374-0x00000237D3000000-0x00000237D3411000-memory.dmp xmrig behavioral2/memory/4220-400-0x00000237D3000000-0x00000237D3411000-memory.dmp xmrig behavioral2/memory/2364-401-0x0000023C17370000-0x0000023C17781000-memory.dmp xmrig behavioral2/memory/2364-410-0x0000023C17370000-0x0000023C17781000-memory.dmp xmrig behavioral2/memory/2364-415-0x0000023C17370000-0x0000023C17781000-memory.dmp xmrig behavioral2/memory/2364-416-0x0000023C17370000-0x0000023C17781000-memory.dmp xmrig behavioral2/memory/2364-417-0x0000023C17370000-0x0000023C17781000-memory.dmp xmrig behavioral2/memory/2364-418-0x0000023C17370000-0x0000023C17781000-memory.dmp xmrig behavioral2/memory/2364-419-0x0000023C17370000-0x0000023C17781000-memory.dmp xmrig behavioral2/memory/2364-420-0x0000023C17370000-0x0000023C17781000-memory.dmp xmrig behavioral2/memory/2364-411-0x0000023C16E70000-0x0000023C171C7000-memory.dmp xmrig - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MicrosoftEdgeUpdateSvcs25B296DD\ImagePath = "C:\\ProgramData\\5e00870c63699bbe\\5595CBEF25B296DD\\5595CBEF25B296DD.exe" 2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe - Executes dropped EXE 11 IoCs
pid Process 4768 elevation_service.exe 4164 elevation_service.exe 3364 maintenanceservice.exe 1300 OSE.EXE 3512 PerceptionSimulationService.exe 5872 perfhost.exe 6092 ReFsDedupSvc.exe 2256 SensorDataService.exe 4188 ssh-agent.exe 2332 AgentService.exe 1484 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe - Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe 2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\5e030c12612dd39a.bin elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\java.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe elevation_service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\7-Zip\7zG.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe - Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d0ff2f865663dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8a417c85663dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000098f8eb865663dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ee372b865663dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4132 2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe 4132 2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe 4768 elevation_service.exe 4768 elevation_service.exe 4768 elevation_service.exe 4768 elevation_service.exe 4768 elevation_service.exe 4768 elevation_service.exe 4768 elevation_service.exe 2456 svchost.exe 2456 svchost.exe 4220 svchost.exe 4220 svchost.exe 4164 elevation_service.exe 4164 elevation_service.exe 4164 elevation_service.exe 4164 elevation_service.exe 4164 elevation_service.exe 4164 elevation_service.exe 4164 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 812 Process not Found 812 Process not Found - Suspicious behavior: RenamesItself 1 IoCs
pid Process 4132 2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe - Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4132 2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe Token: SeDebugPrivilege 4132 2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe Token: SeTakeOwnershipPrivilege 4768 elevation_service.exe Token: SeAssignPrimaryTokenPrivilege 2332 AgentService.exe Token: SeBackupPrivilege 6092 ReFsDedupSvc.exe Token: SeRestorePrivilege 6092 ReFsDedupSvc.exe Token: SeBackupPrivilege 6092 ReFsDedupSvc.exe Token: SeRestorePrivilege 6092 ReFsDedupSvc.exe Token: SeBackupPrivilege 6092 ReFsDedupSvc.exe Token: SeRestorePrivilege 6092 ReFsDedupSvc.exe Token: SeBackupPrivilege 6092 ReFsDedupSvc.exe Token: SeRestorePrivilege 6092 ReFsDedupSvc.exe Token: SeBackupPrivilege 6092 ReFsDedupSvc.exe Token: SeRestorePrivilege 6092 ReFsDedupSvc.exe Token: 33 1484 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1484 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1484 SearchIndexer.exe Token: SeDebugPrivilege 4768 elevation_service.exe Token: SeDebugPrivilege 2456 svchost.exe Token: SeDebugPrivilege 4220 svchost.exe Token: SeLockMemoryPrivilege 2364 svchost.exe Token: SeLockMemoryPrivilege 2364 svchost.exe Token: SeDebugPrivilege 4164 elevation_service.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2364 svchost.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4132 wrote to memory of 2456 4132 2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe 89 PID 4132 wrote to memory of 2456 4132 2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe 89 PID 1484 wrote to memory of 1172 1484 SearchIndexer.exe 101 PID 1484 wrote to memory of 2968 1484 SearchIndexer.exe 102 PID 1484 wrote to memory of 5668 1484 SearchIndexer.exe 103 PID 1484 wrote to memory of 1544 1484 SearchIndexer.exe 104 PID 2456 wrote to memory of 4220 2456 svchost.exe 106 PID 2456 wrote to memory of 4220 2456 svchost.exe 106 PID 4220 wrote to memory of 2364 4220 svchost.exe 107 PID 4220 wrote to memory of 2364 4220 svchost.exe 107 PID 1484 wrote to memory of 5704 1484 SearchIndexer.exe 108 PID 1484 wrote to memory of 4244 1484 SearchIndexer.exe 109 PID 1484 wrote to memory of 5948 1484 SearchIndexer.exe 110
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Sets service image path in registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132
-
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456
-
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220
-
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2364
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4164
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3364
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1300
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3512
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5872
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6092
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2256
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4188
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2332
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1172
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:2968
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3044 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:5668
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:1544
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5704
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:4244
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3044 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:5948
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 4a8a8f5acb91f18182138764cd0f883c31a5adfb0ba57bd0248e28272256cd9c
- MD5 283b4cbb4bac8b94d65f9b45fd85d6e9
- SHA1 f9a27766d9a5179c6e20ade5e3e068c91035eaad
- SHA512 d42726e11f4fb59c9571e490f6ac309ff8f4a376ee911c8343b03c8f5035f8e3ec80c2fdf9450f38ac3c92ac8c4fa0f456710f50768760ff908d9cc33be51f4f
- SSDEEP 49152:3b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnq+tgauhwbR3P8wT8:l3q6mjBIgaPJ
- TLSH T1A4D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.7MB
- SHA256 03ece5a792e1330e30063fd489ac997529b14e8ab590e8e508f3c68af39c35d2
- MD5 467f30de5aa285b22da222da1cbb4131
- SHA1 09bad1dac73cc3f8361d1b82a67d97d9a15ac64d
- SHA512 54dc029821911b01de43d407b634e24235e8a31f5bcb2e46b8ed0181b840e9451af7d2b8a4b2a31dff764233cd2fa6a3edda795395cecf6e6e63bd4810303ca9
- SSDEEP 24576:pXYfDtczAR+4ZAgayjhwbmY3MaReFeDvSP3b:Mtcw+tgauhwbR3P8wT8
- TLSH T13C85F128B3D408F9DD67823CCDA28511E673BC9547A0E78B03E4AA654F736D84E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 2.0MB
- SHA256 8544a2a5a0fb133c86058d33ee846f49c94dbc2011999a85cee02b950981d81f
- MD5 06b4cf9487e92b151346621626066cc7
- SHA1 a4a7f597d3b798ecf9a734b36b97fbffe96f47f3
- SHA512 641c881403331884f1a21ae80326314b377618e357dc8583aba5f767adb17a866494c235a68e6a8a007314977398a9562f87890b517f7cd16b8156e73acd9a60
- SSDEEP 24576:C0Le5ji0hmxhrMi+4ZAgayjhwbmY3MaReFeDvSP3b:CPji0AzL+tgauhwbR3P8wT8
- TLSH T1D895AE16F6788335D073C0B9C5D2A69AED7134821B308ACB4286D77C7E67BE68636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 4cf623224532e3c2ae6f012ba02b5d136ee14592c799521a8cfefb4f396c1830
- MD5 0747216e289b59c40930aa37b3093326
- SHA1 23107ed13819e04dca4d9083457bc0f0ed2ba9eb
- SHA512 f5413c1fc19c7a8d33fa976c2a36a6ba3a4a9e5c3403e4f0fc2101b5e3f7d599556cd6c8f8b8e8128d7d96caafbc9a23b92d0ac4805f52246a3eb851ef97e905
- SSDEEP 24576:da7/ezSC6vUyD/aqgrvWj6q8wyuA+4ZAgayjhwbmY3MaReFeDvSP3b:U/ezSC6vUzPv+HjyH+tgauhwbR3P8wT8
- TLSH T163756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 a47b0da11922369667fc9292239dc2957f9a55b71baa17e5a961285237fc5cf7
- MD5 35d288483080cf8937c94321e0a87f1d
- SHA1 dee3118ba834c46c5ba73fe1e74a5b3105d92216
- SHA512 8aa044d1ca5561c0a7d8c8a4f16139fbb32162ca4f8a74f9fa686676baf4ddb7825d96c87e7185e84c9696552b7ca33fcb56b2ad119522d65a06b514678fda0d
- SSDEEP 24576:6VbqPb88hv/l+B1+4ZAgayjhwbmY3MaReFeDvSP3b:6VO88hXl+r+tgauhwbR3P8wT8
- TLSH T1A8559E66F5748331D073C0BAC5D29A9AEE3234425B318ACB1246D76C2E77BE6C636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.4MB
- SHA256 490fe7b1a0fe3578f5ad7d8c9c09509fb1f468aba1c9556d071b493e10ef94a5
- MD5 408115dbc985dbea661a3ae4d859cf4f
- SHA1 2ee2b9ef6a0677a4ff89b708b9e7525c6ef3d9a2
- SHA512 8be28ff39dc53d5f076f9d309f006a40b848faf542c3ed2531832ed18d0189ca67469c1700deac6d6bbfd2a59f9094509fdc972dc83ad285e2c16e71b4c0d6ab
- SSDEEP 12288:GGfeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:GGW+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T119652381D30C98CACB7B0B348B7E0D606699AFD52D85A504E5C97BC9CCF0DADC6B1399
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.7MB
- SHA256 e606defaed9a365b20797af46bb8fd7b0cf517b6640d280796b445cb29e2b988
- MD5 a1072a2ddb01207c76a8e8a07735416f
- SHA1 dab688d54e0d8acb070c957c43a9d0fc245945bb
- SHA512 dfa8f82b515d8d30a69625eede083058785ff945da3e66e7759687b6e2e4ba38678ac16ed851ed6d143676c81a37318c20561c301a6c972cb721f4593a4ca877
- SSDEEP 12288:PeBNUbTVO86UMeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bw:PJIUN+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T10885CF7BEE28FCD2C27E4DB85B918600A76278704F52A3CBD165830EDE235E54E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 919f406c97ce283289279df491ea4a551710fe89f325769eaa700008051a1585
- MD5 ea0d7474f7b5a9305210654980d94cd0
- SHA1 f03ce54d928bd039fd01fbc1cad7c45da9a28c18
- SHA512 d3e36885ff87b18a6a83b6f79140c51484f8b1c4947a8213183b5374110f18074beaf11d78cdb3b3749283baa82cf87d3fde019ceb0eacabc293fb674cb53b19
- SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THH:gQvGAdlCEL8c/WRNw5CDgaPJ
- TLSH T1DC266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.8MB
- SHA256 c4232a77c3f0716182d6ea436fc35ac372a4a8c2cde6057baf1b30a6bb185110
- MD5 04373cc553a34d27f6f24f6512595131
- SHA1 c1f9dce20d378c97dd71389bffa94d3265f47696
- SHA512 573f7aea49f98e5c58da2c1aca96527340942d69c0dd1eb3a44949fd9364b8ca542d0600501da33f21c4f569892326803953fe906ba22187c9ae54080369ff16
- SSDEEP 24576:wfewsAjb+4ZAgayjhwbmY3MaReFeDvSP3b:aljb+tgauhwbR3P8wT8
- TLSH T18F85E031FA74E436C67B0DB21B36C712146DBE604F511AC3E3E89E9E89706D22376A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 5e44301e2ca157cd4876321f63793d1bd4c91498b8708e024140f0ee05155627
- MD5 07b71ee41cbd2a8c4546d6fb63ecfacb
- SHA1 a526694ce9fc28d0bed43e2479f97af95476c07d
- SHA512 e118dfb4e0bbfbfaad5a6f6d29e0bea2a14621afb98157149432262be4c3da06a7de5e2d249602c1d2a3401cdf802c613f614deabdb6b3cb5776b1f14d98cdba
- SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHdax:xUEtQevvqc2W1cpV20I32+
- TLSH T129474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 678f1eb008a0247e4bdde4cc55a274bda8a590bcff8ac50915891082068e9e42
- MD5 44016e894b9d062efca691df40a3e86d
- SHA1 617d9853ae3dd3cffef26e6de28118bcbda95843
- SHA512 34e8f1aa8313ee2926d4a15bfab032eb2e72aecaec499dd364cd77041bd1497d102b14cde2b6ac15b659f3d8239cae8bed9a3a064ec0e582b044350d3e317742
- SSDEEP 49152:QCbRquA/m2yL5zQfFiV+XenmE3/z7+tgauhwbR3P8wT8:5oqtVjnmfgaPJ
- TLSH T1FBD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 4bd2f47f8f7aed26af5a2da1b7ad9da19eca8c796725d79e0046ffd920974872
- MD5 f797813fc52f0b422f98374df61d9185
- SHA1 7ff2c72caac9ec7a4cf23b86a106c34637c58431
- SHA512 90f09767632ff1d57975d13de40ad6de69b381945396214303e0aa609b0e0ae8355321cc5484841800f27852fb3295bafa1281b1bdd3d7d83a6a22ab77ac9084
- SSDEEP 24576:cAhGL6IFoiwtA5l7S53s+4ZAgayjhwbmY3MaReFeDvSP3b:cAM5Foiq5c+tgauhwbR3P8wT8
- TLSH T124359D80E7F955D4F5B3AA7899B68570EA76BCAA5E31C20F2150D21F0E33E509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.7MB
- SHA256 4fd730d11ca04db952c6c1c99d75906d478f777d8dcb0cda733a321600983a56
- MD5 26708cee45eb2c2c4f667e1dc5487486
- SHA1 349153dab76b466433d335254250d22edb7840e7
- SHA512 5c9fd914ebdf7d7010fa392b566dd68184a230eec6a82e2fb11dbfe095b36caa50fb3bd383eeb148e63447a0e4349f1501a43d8cf4f94f538ac9220ff5c62888
- SSDEEP 24576:TwuROWn+4ZAgayjhwbmY3MaReFeDvSP3b:TwSOY+tgauhwbR3P8wT8
- TLSH T16585F14673A80CF9E9674238C6978532F7F2BC022A21DB1F57A0C75B5F73661AD29720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.5MB
- SHA256 8ef2bb9766a7717c42ee020f91afd2586d7c295be2e92f14b28acd137f23e0a0
- MD5 c45fbb1730df878e95cbd286af7749ed
- SHA1 ea33b388df0610a20f96707bd6757da7e17d1470
- SHA512 0cef405538e572091a36f39fb5986789c01a9be7fe04e5312f731f1b4aaeec9e726cfe476699fec9458c063e36bc8827d4a98e9128a82ce3f3016da20be791e3
- SSDEEP 12288:ByZ1IyGeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:IZu6+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T122751285339860F9D1A70338CEF60A10E7B2BC922B7243CF9595679A5FB2ED54E35321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 c87acfcdd5fa60dbc8cb970793814153cbf55c967456628694c922449d02e6f5
- MD5 0261967d79e62639d2400bfb1b0beee9
- SHA1 32c2cba6c298586ed1a538f411097e3c287aee7b
- SHA512 ebeb1619bc92909440b49557c63438ec0a0d20f54677c24adef10ee34f4a401ac5ee23d78133b6dfb3ef55204065f6bbacd72c7c733460868e69e370011a3e14
- SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ur:cQRQyi36YOcPDLvw2gAf+PN38gaPJ
- TLSH T1EF667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 bee26091d850c5d321201abf9c732077237488829fa52de467ab3b3b20280a4d
- MD5 9d3a3edde548f152181405293d383835
- SHA1 0ac10d77e23cf55978e5c5696102bf5745d84882
- SHA512 1eed81eba9cd9755d205479ed903bccc91f8dd7f54d4a122c1d39937bafcdd70731caf30f8813f066d33e4af7ebd5d14fb0e3f3382d7032b965dddaf96e0b9ed
- SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ur:5QRQyi36YOcPDLvw2gAf+PN38gaPJ
- TLSH T18C667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 9291b9b52e74f0e838a400733133be092ddeb4a28d374471d611b1011922c80c
- MD5 a4a5a0baf7e12eaf8b4c4fc99eea154a
- SHA1 b36378f366a16745b9efc248fc4f22033684994d
- SHA512 6d471381e6d132a68fbfa2861305484c7d2115cfd3b521b839c269e8aa7ec4e5463bc47bb0aacd5e88a3ccb388eb0cc342be8597b8cace98d8713e4570dedf1b
- SSDEEP 49152:e68Qg55nhkeWu7PNU3/L+tgauhwbR3P8wT8:sthTRc/OgaPJ
- TLSH T1E0B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8545720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 3b344b6296b5a93c35cbba7e5889d6bad32b744aa221b970958fda9dd5c90486
- MD5 48614c3a76fa3f4e88fa1d5d32bc66ca
- SHA1 9690915631f7c274b3355756ec67e71a37103a88
- SHA512 e53faad3a44a54d18f9e59324e7b6b4cedc3253b62029e1fd9d20d87c0bc7b174429276b12ad4ded13dcefca028596534b024430d39b6a1416709aca43b37baf
- SSDEEP 49152:m3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99F:3y5112gYy5azzVvU69nLKnhZZgaPJ
- TLSH T102167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 f5b121d5406e0eda5239012b754662b1ff1f0e3174263c4112f998b61311caa1
- MD5 908cefa3293fc6bb2eb0b0a55496ceaa
- SHA1 c975fde9c3dc50af73671e7f17f1476d80898943
- SHA512 8f41163699739e1eb494b9357f64626d8317fbec756161e5f24958593a36df18b8bec2f0c008ce40f5b48b06916b3804cd3fe1a0d8237c8587d3ed14d2b10b0d
- SSDEEP 49152:NB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl/+tgauhwbR3P8wT8:Tu6JmIxd2digaPJ
- TLSH T1C0D59D13F1DA01E8D06ED478874A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 8282a11dc06e6c0cd99d132ff05ae7a9a778212afddc946aad5b8e74e020cc2b
- MD5 dcd8cd15cab8ead65ccdfbe51f5c5605
- SHA1 55e67fd579f8b9c0572b1ec14e6bc9aad55c4814
- SHA512 799db7ecfc80579ba00c6b187039b90a88dda83b0b391f4b56f3f64c1197e5f384a84117bacc238a9e8a9231abdd8451dc837e7d52bae239cb1926f12a8da3ef
- SSDEEP 49152:+1hpsNoJpF1A67U44CwH7R4xt+tgauhwbR3P8wT8:+mifPqRfgaPJ
- TLSH T1A5B5BE13F2D800E8D06ED17887569632EA62BC460B35B6DF0A90B7961F7BEE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 cd17646a601e470a21bd70da3ee1ae48f26a721fe6bdcd4e11d2eadb02b3ca13
- MD5 f96d731ea1486c1646c0cfc20660d354
- SHA1 e2fe647fb89d249df406d60af7d17587742011dc
- SHA512 83e29d565750fb0dfc255f0a3ffee81741ab45252273872acfabcae8e0cdb70cd62312d2d653dc033288afaa5201a66482976ae48395f3b019d6d225bd98cb84
- SSDEEP 49152:nSuZQIY0Be2KkRVtOnks6NMHq6+tgauhwbR3P8wT8:95dKqi61tgaPJ
- TLSH T11DC5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 e57e22413d7a25c22c8c6239c71d055c08f5634a0e8221c4e01bb378225be229
- MD5 0efa878401fc5db035399f837c77d446
- SHA1 b40b425fa6145243a37279b277bfc4672a393619
- SHA512 7eaf329804f424c5b20024a1fe22de4dd763e02427e1a2afab64fc6878c57353a815fa1d982ece268c1967a8acd893604e67d9d8e07a6dd3383dc13c7717e8c5
- SSDEEP 49152:ZhtSn8EApI0figjgiDn0AP5wR+tgauhwbR3P8wT8:oX2iWphbgaPJ
- TLSH T19895BE13F2D900E8D05ED178C7568632EA62BC160B35B6EF0A90B7561E7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.4MB
- SHA256 6831dce1377613f629850c50dc7045d687532f64e24253e0cc079b27ad9ec30b
- MD5 bc3a7c83ef976c8fe0eb456b9c7ae3f4
- SHA1 6a091a14912461fe92872b6bf4ccf780d7bd0fae
- SHA512 b23c33440026c34f439579f7ef19c575ae2576fc2905183723236b036a3a06e7660052968684dd70652e67897e41e899ec6be833057348315f8c7af01cc67b2b
- SSDEEP 12288:A3eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:AO+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T14B652381D24C88CEC52B0775CB6A0A606699BFC73E866144F9CE7785CDF0DED46B1398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.4MB
- SHA256 78398481fd630e32e89ff51f6243df137156d215d202c2e5a302f489683d8918
- MD5 ff0278993ed50ba63f3faa12524f7827
- SHA1 4565be518aea6d4b6d9bee972f7b8802d418c7c9
- SHA512 1080e0f55ab7201a6f70bba1b4f728d0d02b088579ef02f74ca18121b3bcee66f0b3aea5d96d705310873b7660073a37edc811c6ba89715300aea59998f1539d
- SSDEEP 12288:yaeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:yP+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T1FF652381E24C88CEC62B07758B6A0960A699AFC73E866144F9CD7785CDF0DFD46B13D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.4MB
- SHA256 c413cfd84ed2231702731b67419ef2dcffc40b6d8d47da2edf4c742000055339
- MD5 2c79aefab9a465a6281afec62074c467
- SHA1 3b874d071183036538a047d9ae2651a027de06ed
- SHA512 a72a30c67c3141581814b76a8dce1fd477571dbb6e92cc3f077852fed4823561d08ef4568f5d47ce2538bb836a1cc27ab675c1a742340247d1a23a5808729e0c
- SSDEEP 12288:4keH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:4l+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T1C1652381D24C88CEC52B07758B6B0A60A699AFC73E866144F9CE7785CDF0DED46B13D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.5MB
- SHA256 4fcc41df203d81e9d263d8292c1b7a01655430acaf8f1a3d4c6362a62a4caf98
- MD5 377ecf7c703e3664777ff0231152379e
- SHA1 fbbfc91adff6629a2ceb0398b5b58ecb08950b2c
- SHA512 1b459fe56cd178955a5454ea9b7b8df89f056627d319b4a68221f59ad2097357bbf521a4ba45f15e871c3d910f27e5a2e3148bd130193c0e879b436bbaa9eb17
- SSDEEP 12288:yVBeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:n+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T17E652341A35C44CAC97B4734CB770520E3A9BED66F62628FEA853B854DF0FE88970794
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.4MB
- SHA256 158c44624a768cc83e544c6b93b4e9d7f6fa30ba8f153f1c991b04d80db992d8
- MD5 31e60d2961faa1a229fbc011175cd508
- SHA1 0397f4e64ea7c5e329d6090bc38118425843485f
- SHA512 a1975058850dd4f12699a1bbc617164ca5ea28fd235a6eaf66af0f74fb182c30333d9a183806158a9475d0eac1014097eb1e772644ec89e636cace3186d947cf
- SSDEEP 12288:fpeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:f0+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T11D652381E24C88CEC52B07758B6B0A606699AFC73E866144F9CE7785CDF0DED46B13D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.4MB
- SHA256 39b14fc0acabbae36f44f64103db88eaf76a1a59ee537275fca6a81eb18c9dbc
- MD5 bac7f1697e6aae090e6abe0b8e2511e8
- SHA1 f6672e8758dad87055a886965965a433abb786a9
- SHA512 313a844efae545133d615bfd91b2f86230a7b44549544d7c068842d8734d627a1d9c44eb63791e1b458924bbad62c36c5c1d6de7b5006a1ffc1c361569f10512
- SSDEEP 12288:IueH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:IT+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T1DE652381E24C88CEC52B07758B6A0960A699AFC73E866144F9CD7785CDF0DFD46B13D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.4MB
- SHA256 7736c89bc43ec9e735317b5ea49914db7566317dec908b3efdc21bb34948ae06
- MD5 7a18b780a1dd88d8ea4e6a1d343f943a
- SHA1 5535f77d8ba7e98fee431f8a7e807a290893ab8e
- SHA512 b6d0f56e870b1aeb143940c941a46898676199faa95676a990f10e949aa98587cb669a30644360629b02167d58fe79b0d3e6048019ea9a0e5d2298fa6963ed06
- SSDEEP 12288:iieH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:iX+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T1D6652381D24C88CEC62B07758B6A09606699BFC73E866144F9CE7785CDF0DBD46B13E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.7MB
- SHA256 6cf149409085ad45dbb1c41e4b4166af6ddded45efa1bf47bf321b85d616bee8
- MD5 b3acbb35226602b21d8a75e14777697b
- SHA1 5fe091a3c259676287fb25405d5a210b7eba5b1a
- SHA512 f155d2cf3c81dfbc2789e8d622f018fc9b040ee42889300fe36046ee56c1419359aa608a549631efa98d2a73d694e6956e3577844e20615f5e741075c6846ddb
- SSDEEP 24576:xZM3zFVSOv+4ZAgayjhwbmY3MaReFeDvSP3b:xZM3zfj+tgauhwbR3P8wT8
- TLSH T1FE850194B35418F8DC67423ECE268911D6B2BC5A0B60C60F53E837665F737A10D3EBA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.4MB
- SHA256 93162d0e7543f505f9ddcbd5b9aa1b6e93d4aa14bb3a68a824de6533c5901459
- MD5 23e5ad493efee26346ff962877c586a8
- SHA1 10060f0b1eeb96f8127f32b3f86114f3f4ecc6cd
- SHA512 643a9868fa5c39cd7537083312b17eb32882d59dc67a3094cc676a9ca39788407c50cf1f173d6d05ec151974d4501d1371a3ee903c4ebb1d33f6ce29faaa22b9
- SSDEEP 12288:qzeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:qK+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T129652381D24C88CEC62B07758B6A0A606699AFC73E866144F9CE7785CDF0DED46B13D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.4MB
- SHA256 a32f252e7131ae1f20865eb1f5d12ba2a54134e1527c27aeeac967af9a0faa7c
- MD5 ea631dd63370dc8bb808d5c415a72c54
- SHA1 cd81fc06a8ac417bf4199b0a773b3ade54e2636d
- SHA512 e0c46a77840b9519eeaa672aa65e537570d4976bce9c704e7dccb574be81257cbf58e57bde8818244cfee35f4e64f3c213982ddbdd75bb699076dac51db1e72d
- SSDEEP 12288:APeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Am+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T147652381E24C88CEC62B07758B6A09606699BFC73E866144F9CE7785CDF0DFD46A1398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.6MB
- SHA256 9b7da674d60d543e25b33817c6fca4c182c7b4bef1fe31923213dd0ab6967e16
- MD5 6233099ddea5b9dd943f2f3171c6bf9f
- SHA1 6d5eddf92d95b031fe32420ce965d46e11214658
- SHA512 80438ca313ad056e6fb161629c6d768aa0d9af99544bb31112597c0e81a613d88e83ee8ee305b4850a56446ad0b536861f1483f9594e6b3b6385d2b7cacc18f6
- SSDEEP 12288:PyPz5L8GeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:izyr+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T1A9751247B3A430FDC1374238CA620A11F776BC721B219A9F579417765E73AE48E3AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.4MB
- SHA256 a9b799f2c9bf99ae1a5cfdbc34512dc0b9195afaf01c18e194e6c0749f45dd34
- MD5 c3fcd27ddddd860b565879a2ed10d477
- SHA1 07a0a52decbdb30f5ce795d4c4aa0d2d08306f0f
- SHA512 6be7067940f2d124a8d55c3004ceff69073595e5a93f6db5dcd0d91617bda42e980948d11d9ceed8eb90c294aab773a5d3c1f6b64025b211c81d83fb2ade19e1
- SSDEEP 12288:ozeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:oK+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T194652381D24C88CEC52B07758B6A0A60A699BFC73E866144F9CE7785CDF0DED46B13D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.4MB
- SHA256 c33d32d64f59f25d65168951cab01065c28ae788cfa0a77c149537a56020cd7e
- MD5 6ba96a500ecb4aa089c9174adc31a589
- SHA1 e8f2de7e03cbc7aee2c1e69778937c789b560bae
- SHA512 63110bf27cfbdd08ece44f47bc70cc38e0b08324df71efe8054d3edfc3c632076d9e994f977d3f7656fbaa9c6c0718b6b1b112bfe1a292cfd8996b5afef266d8
- SSDEEP 12288:1zeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:1K+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T11C652381E24C88CEC52B07758B6A0A606699BFC73E866144F9CE7785CDF0DED46B13D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.6MB
- SHA256 19f212e5b73925146d28e86b4b2f9855712cb028643765e053b3b5cb3536faf1
- MD5 27b328715eef53e0fc6f0f333728e894
- SHA1 599cf946d12d5360d00b82b8e99473f3e73c2fc8
- SHA512 6d89ddd5be299dd39be532d884e897229dca462102528a2274d212cd58483e45d8d3cb7fd2b52f9c58cd9f81825f2aa57356c304c1d1664a9abd106395f361d6
- SSDEEP 12288:4yPz5L8GeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Zzyr+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T195751247B3A430FDC1374238CA620A11F776BC721B219A9F579417765E73AE48E3AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.7MB
- SHA256 198d19b8d39d42b0b6b3bc9189e0963d04a447630dcd79efd6f3623b463542c6
- MD5 e9f9c856619dc9f1ae8e5fd373fccaad
- SHA1 43a91fbc9d83a4fa182eb258ff9f23dcca4e8e45
- SHA512 0acc54cfacd2d48979ea727cc0e2ca645b104972a2fd1637a65202e07dacbe675391f8d7bcf0a4fa8703600132075844f8c4b32a8a9b8d05c712d4feac430fd9
- SSDEEP 24576:4T8aLl3z0zDV+4ZAgayjhwbmY3MaReFeDvSP3b:4T7LljA+tgauhwbR3P8wT8
- TLSH T167850194B35018F8DC67423ECE664912D2B2BC5A0B60C61F53E8376A5F737A10D3EB99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.9MB
- SHA256 b4484c241539077b83bfc9739345b32081a15bb4b40e4846f3fdfe0ac1af3619
- MD5 e39d13cfcbae650e62b9698839da0472
- SHA1 96f78c6414b93144bc8b36ec567201b14a04b88b
- SHA512 c1491634cc55647947cae5ddfb00a23b04d0c3aac301a8151ee543c3f4f3b0cf88fb216dd1014e086acfe808aae949ba8966a5499981ef3d7b3b263d71f7dcf6
- SSDEEP 24576:z3rd9CHKy7GZp+4ZAgayjhwbmY3MaReFeDvSP3b:Trd9CHKyaj+tgauhwbR3P8wT8
- TLSH T15895CF90F3E414E8F0B78A35CD764511DAB67C9A1B61DA8F03A4265A1F33BD18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.4MB
- SHA256 634e1c21535ddeff250c8971c3782dbf2b1570c405bc5c458b03bde961d03381
- MD5 cd6ae689d87f2b764aef6be4668d67c1
- SHA1 51ca6451c6cb6d22aa8b328e2933e903f90442b6
- SHA512 1e977d6c4901abad5abfbcc77b70a24e94426d193c26a72627ddbef8223196aeea6af778d82df40bd4fcbe66075870510a696c4d466785509b1d08237eda6723
- SSDEEP 12288:+EeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:+F+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T1A4652381D24C88CEC52B07758B6A0A60A699AFC73E866144F9CE7785CDF0DED46B13D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.4MB
- SHA256 054d9bb2912c098aed96c04b47388e341450c534fa6969076c4e04d33eedcef3
- MD5 8a72aa511100c335ed6db902cce82f69
- SHA1 251a187a95d32523f28563ca050f446abdc58fa2
- SHA512 de55841ed154a8341161c6827984e4ed26f7942ffb78b77e280b78c9efd97ec0931b8587a0b80ae4d3deb3ddbef5f7a4bb08b3b0cfb6c523462d470348c24173
- SSDEEP 12288:kmeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:kL+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T14A652380D25C88CEC52B07758B7B0A606699BFC73E866144F9CE7785CDF0DAD86B1398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.4MB
- SHA256 7f7ba05e3b7436744a5d2428ef28d672b7cb7f913ab69d51927b11b1b54515ba
- MD5 591e0935cbccc583ce40eeeda86ef2b4
- SHA1 de294630833f206f9d504a7a4c2468d548ffac79
- SHA512 07e9e90e5da0a145e9a1a5d8fce9313ba0cb0f1393e0c96e5fe67fca6c8611c8f8919b93a705824361aa0373fbf7f0a0eed4649724235081f458054370e599ff
- SSDEEP 12288:JNeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:JI+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T17E652381E24C88CEC52B07758B6A0A606699BFC73E866144F9CE7785CDF0DED46B1398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.4MB
- SHA256 0b59d6cd28625f891e7af2f5769fd509f2a30b451d9b38b6e729dc9081e58125
- MD5 55016ebd54435a0680e4d4233f06e83b
- SHA1 65c56eeca76eff7ddd3cbf2cb28ff1828f641669
- SHA512 b176e104dc33843b751db00f7a5bfd1be8ded448da46b3f8b380c21a7cb60c73fe9bacefb4386f41f6dcf5e0e3586fcd8ae08a2465db76696d32f7d880e484ea
- SSDEEP 12288:KzeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:KK+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T154652381E24C88CEC52B07758B6A0A606699BFC73E866144F9CE7785CDF0DED46B13D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.4MB
- SHA256 671c64d8e1b2afaa36059dd52b73480d5ccb2c6724af6e5ab4097731da6841bc
- MD5 1fe9752b7ac8cfa6fdbc1b66fce1a103
- SHA1 67b285b64948db795c37a0bb3cc24612e149c901
- SHA512 d66930a23f787e149ec6992d3bdb2c1fe75283dacc81030561d3e72b605622aed96dbb1ac762c5c5999c573338c1d19c3aa5d6b03e390e5d8ce51e6956d958d2
- SSDEEP 12288:9EeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:9F+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T178652381D24C88CEC52B07758B6A0A60A699AFC73E866144F9CE7785CDF0DFD46B13D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.4MB
- SHA256 3257bcba0968207eb1f14f6ef79b589e3973045a933c9da323e20763784b7c63
- MD5 19e7f95385314a58cb3475d0c0e26194
- SHA1 19c6a81d40cad934b1e6a4ff26fb66bfd76daeed
- SHA512 919da22e1c7b9d624e0eb92f41ff35d602a815a7f41076d71b0dc17cdc52b87dd4188c8fced0a188ef436edb50102f55abbb88d1f4857ec110e2ffcf73843281
- SSDEEP 12288:R7eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:RS+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T1A9652381E24C88CEC52B0775CB6A0A60669DAFC73E876144F9CE7785CDF0DBD46A1398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.9MB
- SHA256 5f3f4ef850af8e2306671579b2cd69f08b4f950b557e0d2132324429ff49cd99
- MD5 1f680b436736e2bdb78bae866357ebe5
- SHA1 07d0c3b806b03fa00c7ba811573e3b0006d5ff39
- SHA512 9cadfa2f173fa34c6dd6f649d8695afad29715309b8e804b05111d33b82d3b32e193020d6ddca9bb67d28b447564e0b6e58ac0be1b3e550859cc17585fe2c194
- SSDEEP 24576:2fwvzk9RX6wkyAI2+4ZAgayjhwbmY3MaReFeDvSP3b:lMnYI2+tgauhwbR3P8wT8
- TLSH T19595CF29EBDC44E5E1B7923C89B74606F6B178591B31C2CF129A53AD0E33ED45E3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 769f003f9862fd5d5ac4d6eb41e1724906b60df5642310bd55b0571393174322
- MD5 2814d4ceb82e8f2988c895213c13dcc0
- SHA1 ee3b08370d570daac0b5561dd70403dcc09ceeb4
- SHA512 98bee41c66b71e68b46dcaaf7c009366b98d6c4ef39d3c654f714c51950493ec90557fa39b4a3609fb151f75f96734d03020855d312f5bfc58028adfddee840a
- SSDEEP 49152:OYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0x+tgauhwbR3P+:xySzPcgaPJ
- TLSH T1BD066C96A16801D5C1B9C1B98F1BCC17FBB134090335ABEB02E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 ead8aaacd72592702cc810e2e1547ab203d5988ebd70a134e383aea62d2314a3
- MD5 a4fe46d168394c8f8d1469da94b81f9e
- SHA1 478d0c1251cef4131539c75f7585dc1757b57790
- SHA512 79d1fe49252a2b734c272037f75136cb62e25965320efbd8fefdf9037339b5fd6ed9ff15880374e65993b182382ce15a0e8af48bad7d172bc8c98a789d4885e2
- SSDEEP 24576:G47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY/+4ZAgayjhwbmY3MaReFeDvSP3b:G47JUQjqirIhCnDHUPfF/B+tgauhwbRG
- TLSH T1F165AE1DA3EC01D5E1BA827885154A5AEA71782E1F31CACF22B0937D6F63ED44F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.6MB
- SHA256 11dfbfbea8f5f074bd88a68376f78a038c05858b734f067a21ab9ff2ecef6bb6
- MD5 5d787ea6d1e310d1b832999b8ac38111
- SHA1 55840046a24d6ed5f9f7d56a9dc33c0607817e0d
- SHA512 29291790c7f363837bb32e17777e1b4f9d6d0207e5af0f15a17137c8cad1e52b64eaab02178cd2f170520e9deabe2cf868814dd4a2e409ad45645d8080b5e951
- SSDEEP 12288:UpsfDeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:F6+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T19175F149D29801D8C06E1275CB564A40B3777C6697E2D3CBA6C0F67E0FB1AD48EEA743
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\5e00870c63699bbe\5595CBEF25B296DD\02-57\40217eeaadcc9867
- Size 124B
- SHA256 c26e8b7c419fe8b00d947956c81ac4556b7f633d59f00c5ded0a8e98fddb2a33
- MD5 05a2c809fab8397da300cb3fb27ce0c6
- SHA1 a64dc4f6fd2a026d5d7c73e2c6f1439f4317607f
- SHA512 cf1a9f9eba2ddb7913ec70a5b8ab1b983263c8d40b25b5b402fc9495cf22e2f24cf027b49f6f48330b2a37dce08e86a2b4ffa7a65891936d742226470a06f44f
- TLSH T1DCB012EE78A49CF5E4A588703640C81F1E57BAF7436C95806109E334BEA26F8674C066
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 39757bcc3b004564b0dd89a02b0e11787f510173d70c37b5730329c2201c1bbb
- MD5 5fec6c30ef72683da3aeea80c770c9f9
- SHA1 9acee2028c500fa821d679271632cd12f7d02148
- SHA512 e08e295e580e474b12a8919e87712c53b5963557a55ca062323ea40d7ff89f82f87542f6515dfb944137d1a54da17c399c7b776ef0b1ffb5d366b83029efbe9e
- SSDEEP 12288:2VRa5PU3fFWgQ88kg2CpYZbRAZ2TzXpz5pgmiHLZY:2VolUPM5kDCGWZyZz5pxiHLZ
- TLSH T1F8352910766ADB4FC66940321E77C6CDAB707D01EE44AB0372C9873FD576658BAF2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.4MB
- SHA256 362115adc1825c9249dbcbfa2129ff3b722492ad081b582043b939016736dc7f
- MD5 e087929e2459ecf0f5fb246a50542516
- SHA1 c4c02e5c6b0fa86b1b5706a5d9337c0cde6b8fdd
- SHA512 1b10af3bad55d7e9e2b76333d4dc55e1f2f4293c2db1abc31e1964bc2dfb2a46d89825e17bba34368b3e72df706a1c8db28a5d9535c979700eda0d556d289b91
- SSDEEP 12288:ubvoLBgK9VHAXbDpC13brhPjhBKEvyXEi5P:egkb/Ui5P
- TLSH T11B6509405537A78FC1BB6031073A5B8D7BA4AC1BB7086F2773C5487AD86AA11B0F93D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.4MB
- SHA256 732de9b816d875c1bf42a8483b24759f8d21304e4210065a0162084261681fbf
- MD5 3bc85eff47e22b213d503286bc95b2be
- SHA1 5866d26494007128a57978d5370d0e421cb66864
- SHA512 15b76fee0a57144d84e6dcf4f190d498604b6fa0a32d8fc954c65649a6299ba4eb1c265d9f46eed927eab6b5cccd0e77dfdecc8b39ce6ef02aa5d13c19b62f6c
- SSDEEP 12288:aM7LeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:XC+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T1CC652351D34C888AD97B07708B6E4930765EBF962F41A1C7F88977C58CB0DE88EB1399
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 be91404a239edb238380b099e17eab1d2621ea4768ae353e01499be61652e999
- MD5 992c81d9a12b889f752c12a69dac8a4d
- SHA1 096925da794ff456a8c5cd7c9772695a9c70620f
- SHA512 ea5a1b363cf9ce1a05897b8beffcd8f44d5842ec00f6bbd0f8a164d60effdcec8c11d75a5bf570267f686c58f7da4cfa250c7fd220c000046bc84cbb60640795
- SSDEEP 24576:Dgb6bmBIi49WNNFpg1rSvFv7bYA+4ZAgayjhwbmY3MaReFeDvSP3b:Dgb4mBIBhGF/+tgauhwbR3P8wT8
- TLSH T13F65AE1E22EC02F5E0FAD2B8CDAA4417D6B278161732D2DF1151426D2F37EE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 2.0MB
- SHA256 0272925b225e33d6eafe0e64f3fb9d92b99f2d6c2da72a6606493fc222139b9f
- MD5 474f9cbc5035a18aa6d449d15a9f76ea
- SHA1 7c0d543bd7ef758c308a3317554c63982201b864
- SHA512 2a192023d14fc68565c5d8e733cf870b56b52ef79e259d96d2db57705436bbd73a75696e5883950628b5d41fcc94c7c4fd3efd4ee7963bdbceb4ec128efd74c6
- SSDEEP 24576:5G88u8FpJqH1vzria7/mv+4ZAgayjhwbmY3MaReFeDvSP3b:s7ZFPqVya7/o+tgauhwbR3P8wT8
- TLSH T10695F16573E401F1D47BD1388A864663F6B2B8250364EBDF06AC8B511F33AE54B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 03ecebf85c847994d286f8ea7d4a2f0fa90057915a51df5260540d396ab3b785
- MD5 f0fce8ef17f7386722463545807d047e
- SHA1 b39879280ddd53497f0057cb577a4b98c690393f
- SHA512 d6d44a54cfef0bb13fc871398f329598b1cf02826d2e76398288ce175686b845ccee57b810bdb67011ee6ecfd51ad57b8778cfecbcabbace9121b60c58a7b1d9
- SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjT+tgauhwbR3P8wT8:9G05lO43bxgaPJ
- TLSH T14CD5C06A62EC11F9D1BBD17CCAC64A0BEBB23815033556CF02A486A91F27FF4957E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 1fe7c2d75f0f873fe531a768b3e97a1cf7feac949d05827741ac3536670e3613
- MD5 3ee83256544f6675aeaac881dd1ccc67
- SHA1 30fca6d5c61a77487c036c8e014c17b50c62f726
- SHA512 9f4bbd339c7fb562213fddf5580980df4ddc8ea3063a1a0214d3bd24779b36bccbe196348ec58814a63e32c63a3a6564a9915f8bf45bebccc3cef512f862092d
- SSDEEP 24576:nfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnx+4ZAgayjhwbmY3MaReFeDvSP3b:fa5POZ3lJt2pasx2+mL+tgauhwbR3P8z
- TLSH T1E665AF5EA6FC00D5D579D17DC6834616F5B1382253329ACB122182BE3F37EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 479f585346f53e4c55aa5f1f724d27bd9fe58d7b988ff802cbae857eb1e27b21
- MD5 1792bc97ad42e3b27eea9a4c1e26e6c3
- SHA1 6258ec4403b93e91b23e0e29a4325f762471187a
- SHA512 b64ab8821b3cc5a1457c3176928c1e228ea8ae57c022345f0284f5073ae88d20ed52675974654c633ef1d4cda4feb61122d059c13f83381a0f9fad607965c975
- SSDEEP 24576:uNcwHdjbyQ4nLC18lb/EOjowL7FkH+4ZAgayjhwbmY3MaReFeDvSP3b:uNc/zEOVHFI+tgauhwbR3P8wT8
- TLSH T135858C1623E901E4E1BBE1BE89779546FAB1786517308ACF0291851F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 c6f24cb765017548b8651a963d92ae057cdc26adc0893ada607070e310ffa07c
- MD5 a35f30aca7fc6953049f0bae47c5cbcb
- SHA1 e94c44671b937dead55bab34e9ed7840dde88040
- SHA512 516e2fda43f79b1279f643c25948e82750f7f06ee18e55bebef2b14be3d7a766457bf5960fe65d6e8d61c8b698b5ec6a7c73eacdb83338febfc869f0b2ce7182
- SSDEEP 24576:izkNvNnaFeYhJNtmZBmL+4ZAgayjhwbmY3MaReFeDvSP3b:izMwBtOmL+tgauhwbR3P8wT8
- TLSH T1C955AF6EB6B845E4D1FEC6B4CE238512E6727861073293CB9290C13F4E679D88E75F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.7MB
- SHA256 b170559767dc77fd91c0f91c76b78840a44b12dc45c23665a9a66113089d28b2
- MD5 52a3ea10115bb7d798e675cbd01f0cfc
- SHA1 0e42091eae5ebe1bf545a974b568346c057cdfa9
- SHA512 67b785114a168790f938cb2b638cf579d411cd9b19ed589ca62e8394e2c74542317d91c2fc57e3593f07c056c0b5f48091fa78ecaa93198f6c5e1db5bcb93d61
- SSDEEP 24576:JPUr+NQj+4ZAgayjhwbmY3MaReFeDvSP3b:JJQj+tgauhwbR3P8wT8
- TLSH T11285F11F62AC1CE5E67AA17C8A864715F771BC621712D2CF02D0917E4E73EE8AD39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.8MB
- SHA256 3b369e95fd1ed96b1f3b01e18bea95b67be2e1ab7d0d8c5085b01bc2c28739eb
- MD5 080e2da5f16c02d8623ea0959c7ad2ca
- SHA1 5b0969345a1e225e8358d3142961350a4865711a
- SHA512 e9a067cee7aedd1d138cdd134a6d3d913aa1231a5821f888bbc85bc87cff2f5fd52d4c4fdb58a7a12ff6e27773d3cd373bb2bba29ba6811d7d6134c5bfaf165e
- SSDEEP 24576:pD3FHshBIYQgAu+4ZAgayjhwbmY3MaReFeDvSP3b:pDVHeBIAAu+tgauhwbR3P8wT8
- TLSH T15995E17DE65C04E4D57BC2BCCA638A02E77138A9032266CB12D491BA5F77EE46D39F10
- MD5 SHA1 SHA512 SSDEEP TLSH