18b42dd6eae46b8f7272930bd78ffeebde1814d4d6011c9e1042295c6f167535

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 11:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_8342a39cd5422e916d00dbaa6b04ab8d_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.3MB
Sample260702-nhndrsgz21
SHA256 18b42dd6eae46b8f7272930bd78ffeebde1814d4d6011c9e1042295c6f167535
MD5 8342a39cd5422e916d00dbaa6b04ab8d
SHA1 cc90dd8a17ece134c2f1c891081e2d078484417a
SHA512 30b09f6184438a80ed382b051163ce943487b53517c74ec33574e329c5ec1ad40ba11cbef12b006d0ec0c9df462171c2a01dc99e2fa86322ef27a698c8e36caa
SSDEEP 12288:fDA9ndd9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2RsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A055126B739830F9E1724675C5A29109FB337C3617204B9F07A4927A6F772909F3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6252	elevation_service.exe
2612	elevation_service.exe
356	maintenanceservice.exe
5276	OSE.EXE
6900	PerceptionSimulationService.exe
2176	perfhost.exe
2976	ReFsDedupSvc.exe
4872	SensorDataService.exe
6092	ssh-agent.exe
5136	AgentService.exe
5720	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-02_8342a39cd5422e916d00dbaa6b04ab8d_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\91c22079e819cbc6.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-02_8342a39cd5422e916d00dbaa6b04ab8d_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-02_8342a39cd5422e916d00dbaa6b04ab8d_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-02_8342a39cd5422e916d00dbaa6b04ab8d_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-02_8342a39cd5422e916d00dbaa6b04ab8d_cobalt-strike_icedid_njrat_satacom_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8153952150add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000483bdb51150add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf12f152150add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000065c4ac51150add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0445995150add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9984d95150add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
6252	elevation_service.exe
6252	elevation_service.exe
6252	elevation_service.exe
6252	elevation_service.exe
6252	elevation_service.exe
6252	elevation_service.exe
6252	elevation_service.exe
2612	elevation_service.exe
2612	elevation_service.exe
2612	elevation_service.exe
2612	elevation_service.exe
2612	elevation_service.exe
2612	elevation_service.exe
2612	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	716	2026-07-02_8342a39cd5422e916d00dbaa6b04ab8d_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	6252	elevation_service.exe
Token: SeBackupPrivilege	2976	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2976	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2976	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2976	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2976	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2976	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2976	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2976	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2976	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2976	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5136	AgentService.exe
Token: 33	5720	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeDebugPrivilege	6252	elevation_service.exe
Token: SeDebugPrivilege	2612	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5720 wrote to memory of 4704	5720	SearchIndexer.exe	103
PID 5720 wrote to memory of 2444	5720	SearchIndexer.exe	104
PID 5720 wrote to memory of 240	5720	SearchIndexer.exe	105
PID 5720 wrote to memory of 2872	5720	SearchIndexer.exe	106
PID 5720 wrote to memory of 4072	5720	SearchIndexer.exe	108
PID 5720 wrote to memory of 6308	5720	SearchIndexer.exe	109
PID 5720 wrote to memory of 3468	5720	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-07-02_8342a39cd5422e916d00dbaa6b04ab8d_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_8342a39cd5422e916d00dbaa6b04ab8d_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6252

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2612

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:356

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5276

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6900

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2176

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4872

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6092

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5136

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5720
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1749168396-1890032557-311772428-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1749168396-1890032557-311772428-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4704
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2444
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1612 1584 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:240
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1668 1632 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2872
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4072
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1612 1584 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6308
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1668 1632 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 43258232e249b3acbe4313f3ff38f189431b10425e453fb72e97680a46055fc1
MD5 0796a87accccc81a06c39b6ff639684c
SHA1 d9fd3603737143127b65b3a40c7ffdb1f3d13ce3
SHA512 e7df97617d0802d9e87e195f24b04170eeb08515cd029eb66778bc86f5cab35d68883d09279e343ea46aae7d19d5d10314f00aa834d2093acc372202f3fb7fa3
SSDEEP 49152:mb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnJDmg27RnWGj:Y3q6sjBKD527BWG
TLSH
T1CDD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 0230c763fa7577feb2e7fbf077e1565b0df03865bb8c16a885881b53ea85d0bf
MD5 66251da83ca8b426d2f5f7cf2e0cdd1d
SHA1 c20ae74625d8b292d363b9f576201b979e3fccc7
SHA512 b4879e216477bc96f3dab4d6c00bb1d012a1409b42b2245b325bb7eeb2aa212fce1210ace41a221f4e864ba25a3b65866b51ac660a7b100076a58c217b662432
SSDEEP 24576:CXYfDtczAXsqjnhMgeiCl7G0nehbGZpbD:JtcKDmg27RnWGj
TLSH
T1DC650129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 608c4e8ce164c90fe4afe56ba1f7b8e1d0d07c795769d360967df416fece0497
MD5 d99cbb5da9c888df2c2b1ff935cfc827
SHA1 4baa72c06de1c969a63dde788bf002e68c9363ed
SHA512 8fde268b66814383ed3b121e9e7bda50f59f2ffc54398b894f53f9dc82460d863fbac5855d839b949a7fbf40fd18d1919ab8ac26b9828b67a49800cd42fbe415
SSDEEP 24576:50Le5ji0hmxxrMQsqjnhMgeiCl7G0nehbGZpbD:5Pji0AjlDmg27RnWGj
TLSH
T1C7859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4d4000a3698bd82f53b8712128accd30b4229e399e87b0e5b358cd7d212dc4e1
MD5 db1f125e9d5a660027ee7ccca6941f22
SHA1 2c370c9ee2a6be8ba4890fedbb1f494b7a60a77b
SHA512 b302e1c018267f6cd9c17d18913fd198fb81e41b282ca8c6c17d202e3a9fc2771a7ebf1ec5d0c2088db096be49ae963e1e0f731f50ff4c3d139f2a2596db39b1
SSDEEP 24576:Ea7/ezSC6vUyD/aqgrvWn6q8wyuWsqjnhMgeiCl7G0nehbGZpbD:z/ezSC6vUzPveHjyhDmg27RnWGj
TLSH
T1E5755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7c4ba566c248c1e6c62c98dacaf886e5216af3bf676918b630b32e7a3ca78118
MD5 43b779163eb9e7c03cf16b22f71d580b
SHA1 e84178529a587aa72851cfada161800f11d88e73
SHA512 a603c48fdc4c866b95ccd6d0810a1a120e7770129cbd98c9afd4adfaacad1862e2511e809ef0fec397165f4b2edba44c459d6046feb4f8aff1edd46589ea95ad
SSDEEP 24576:bVbqPb88hv/l+YbsqjnhMgeiCl7G0nehbGZpbD:bVO88hXl+CDmg27RnWGj
TLSH
T144559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 65a1c06ad1b52c1f909af749f0de5c8a1cedc5de595f9ad6046c6a481e53d222
MD5 6d553f5991092acb091c7ec9ebe9f0dc
SHA1 a5421015eb6a3cab5905f875fd60c9b4f3ae1308
SHA512 a778d5a1215578ceef98c69a3b1453644357b1ef015dec04e649f868849dc504d5f0d8533620e034a6924b0bf21b3b193b497dd099b96881f91cd4c9d4af1fd8
SSDEEP 12288:ILkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ILksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1274523BF865C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 a40b0086db3f6589f2f14d713a8c29c425142e9ed74c16ad5aced36a691aca33
MD5 f97b35d607731e07b734fb1058a97683
SHA1 e5481383a0a97358c5c1437a7c57c7975f215ee8
SHA512 80499d08fd1ce93b2de5a596730bce4e9dcc1c22137a8b5356ad281b7f9976bb770511814f980030a4b18356d2dcd53daba980f99250d626589a0be901b69bdc
SSDEEP 12288:heBNUbTVO86UjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:hJIUjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17665CF7BEE28FCD2C27A8DB85791C600E77278314B61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5b00e76a50ea2fbcdc1fffafaf675f3366e92ad596c1d0541fb3bf81afed50f3
MD5 c527999cd1f513463fccb4fe41236978
SHA1 0be3e6f18733141620ec3616a8b001c2f24d0d8c
SHA512 bd93e45ba24755053bc079444f4ba23206ecb862f0d6c2d5664072e254f332d070d33e9750f66ed2e33795b13b510f7d32081f80d3bf9b8c0e5ecbf156a99a1c
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THO:SQvGAdlCEL8c/DRNw5CqD527BWG
TLSH
T161266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 2fe7c4df7865d1bd2ae073aad41410e3f3552467b3cbe7cb137f1ac3a1a9a328
MD5 c3de50ec0d2699d73666e93ee7467c85
SHA1 a5cc919094e9177d118d234c06eff5d6068c59ff
SHA512 6aa201f7d66d93c84ca47bcb3b49d4942eb3deb220f231423084585b930962ff4cbf7e9a043c1dcfd49b4425fb61bd5c271b13eecff345965f90a5802fa10835
SSDEEP 12288:cAwSfxL/2Dc3RDLLmt0LDQewsAjhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:B0ewsAjhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13B75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 69f1d488c127572e708672b3bae91268925b7df4023880cc1cb727dfd0d019c5
MD5 04c798b4c3d4bc1f46f28b14588a6166
SHA1 080961713a8a708f14b480b509bb47105684795d
SHA512 65b9e23ddea7055f11fa927c74fe1f61d8b3b1a48e0807d4ec7f6c0d8fe95139b17652f0399c7dc3786b0a208815f07fa3420120822b91c43529cb84046443fd
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHdVQBWG:lUEtQevvqc2W1cpV2tI32oB
TLSH
T1FD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 72da3342c408d6a144724841d72c2ae5ace50873b0baf6eb5f12e3e44599bfe5
MD5 58cb8ffef9823969c6ff4be3d3fee165
SHA1 45ad1e17fe02834ef4f656bd18737f1f63e598bc
SHA512 f4f94260bc436d8a7f98ae76d5e1c40160536fa1d3a97f6f54073a2bda015727c99caf24e43bc760ad165ff7e926bfdb7162f07a23659a1a043b0746f588d6c9
SSDEEP 49152:QCbRquA/m2yL5zTfFiV+XenmE3/zVDmg27RnWGj:5oquVjnmWD527BWG
TLSH
T16DD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 eb8667ea3371e3c68a7c573efa7c036bf4622467a34e58b90f1b0f9f1b8013e9
MD5 0d2a997f101618d57291f5eb37077fe0
SHA1 4f05a7d982833acada14476c182dd0cb88a7b1b9
SHA512 ef7c2b5fad9643706393d5a579cb16deb556e03fff2bcae9ab1b196494db95da43579acd7175bb4a3b8900dfd2e89e662fb049c1df667134564a0c599db0f942
SSDEEP 24576:BAhGL3IFoiwtA5l7S53ysqjnhMgeiCl7G0nehbGZpbD:BAMUFoiq5mDmg27RnWGj
TLSH
T165359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 bae1f89f332f57dac818481860037f7eb9f471338bcd7b18af3f735bd8fcb7ab
MD5 d75808612d5a8467d2a9933299dbe5cb
SHA1 8cd4e0e0dd04995b41b92500a58fcd1db517448a
SHA512 d14416e4e77bd1255f9311226207b911621e1c9541bcaaf5cf4ea43dee7c22c7e0715bfce49774f06582c33d3f2711e49fe3599c86b62bd0db9d5a82f3375bb0
SSDEEP 12288:Ymw5HEjsChNVBFgl0WDm+C2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Vwu4OWdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A065F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2fa6cbe7bebc4709ad819343ddfc1bd7cdf86e00e0a2b4ed3d4d6fea9fe6e8a6
MD5 0c48f4b7e7bda13583b9a9acd01e5616
SHA1 bfb31971d37488fdb69e04518431808968c8e8d7
SHA512 16b937a1a01b306d02e21ecfb4803f0b7fc3a7579b3a2ee64b951f29bbafaaab4615a1de106f0fa062eafff23338e2ec293c598f8799b919d8cde3e7b0705116
SSDEEP 12288:9eZ1IyxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4ZuYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14E5512AE239820FAE1A3417CC5E5D609E7337C62673003CF166656AA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a2d798b8f97efdfdd4c8d7773ca9328761b6d8d16050b476f50d767edde0f1ec
MD5 ff4082e9b384ce31991990695a41bb04
SHA1 5203cc6dd60f06df9810bd2acad62e10ae1597a9
SHA512 f0877392f27e24fdb421fba9ced2aa3f4aa76ebbe5224dd24e1e7258a58ba6258a7dc2873ecd3ae5e1aa3936943b510e73d6a04b3a531cd58963399098df203b
SSDEEP 98304:lQRQyi36YOcPbLvw2gAf+PN3DD527BWG:cQyiKa/X+PNzVQBWG
TLSH
T11D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6632f84630c5bf311be07ab386b2f8f0080dce3553aa880ea9f33384cad512d5
MD5 e8c49e77f1b55131c36a3bd8e0e9f1a5
SHA1 30099ba52d4ed903630d1a6475e4a5a56b4e59b5
SHA512 3530ce59c459546f6e892b3112f57c75dc50a9fd96260fcd61eecc7c433e2680e47598d0261c90fa02ef42249dc1c88a179fe5750f67babe715dd56a62cbe3a1
SSDEEP 98304:VQRQyi36YOcPbLvw2gAf+PN3DD527BWG:sQyiKa/X+PNzVQBWG
TLSH
T141667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 844ab6d23242d270bf85c4de91f6eafd8c9a3afc1bd772648d30c829cbde98fe
MD5 e9c268a3db8dcc4b65747708567198a5
SHA1 0aa91f52272206163ce3ec99630d6fdbb14524af
SHA512 61d0e951e64f63ed1adc45e0e22353a701f1831009bba95742471a37f63ffaac30549881c99b08b7d25e91e03bb1c3acaf37e7c964b1958255fb13d8aa5a294f
SSDEEP 24576:0wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0IsqjnhMgeiCl7Ge:668Qg55nhceWu7PNU3/lDmg27RnWGj
TLSH
T1E6B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 15871aff6dd2bcc1a81aa4d783f449aea94c116c3d53d30e840d1f1bc4915935
MD5 f6090d79d2f2f8243a83d83680e7747d
SHA1 8d5bade12bd2820ab9f3fa2c7a1defab62aaf8c7
SHA512 0fdc3b78e6df323b9897f7b7f8c0567949dccee89bcc90dabafe7130344f10dd01c088c69aff3f7dfec4b1768bebfe15c2b5828ebaa4d8b50748580c52ebdd58
SSDEEP 98304:1y5112gYy5azzVvt69nLKnhZAD527BWG:YLIHEWheVQBWG
TLSH
T14E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 455e62a1c7f6f7e85ed32919ef6cb5837b7360c29141946fc7a5641065174422
MD5 2815d6dab9a2dc5009db0a88ffa2a389
SHA1 c16c81063510e64b5d7134fb7a04b8df169f983a
SHA512 59a3350b756834d08fa603a3dfd69dfe2aa92bdaf5234353687d70d9420747167633f0efbba579200eaf8b1d1fb7608aedad0953c72109a24671591e11c01f7b
SSDEEP 49152:hB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl+Dmg27RnWGj:3u6Jmdxd2d+D527BWG
TLSH
T190D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 34cb76156a9adaa1e24f3c713200438312e8728b495957f1ce3ff94c57c28c31
MD5 0b4a100611e6531a0e6876ab6a43025c
SHA1 7c67e512c7961e444524d333c1c9e79fbb1ef7ee
SHA512 b973c26c615b47dc1b6dedea0a924e0303b6a6d0404d5929c085d72a45851ed0b1c19b2ea1b58038050c2a37fcbad6ce8d3f80e97648ecfa63a236686c57bb4e
SSDEEP 49152:l1hpsNoJpF1A63U44CwH7R4xHDmg27RnWGj:lmifPWRWD527BWG
TLSH
T183B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2eeee7b1f0a4617a05b1146d395aeb1eb2bb57d5a56473cea290f3cc3cb6653c
MD5 0a2564c70d1d85396fa68708e3a9c133
SHA1 6557a20dc01bfed8e3ce5e30dc23fd5b88a0787a
SHA512 d1c528e80d1fbeab6599666eb4a0b24ff3287f599045cd5646492ea93e348b68ce66b19891f2154e1738a9fc51e43fc75eb993cbd938fde27aca1a546c842005
SSDEEP 49152:WSuZQIY0Be2KcRVtOnks6NMHqEDmg27RnWGj:45dKii61ED527BWG
TLSH
T180C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b1992e7c95804267732997988fb193cdb676ecb64036db0c2bc80887b374fe14
MD5 926ca31349750f9097f95d8e5f9f3833
SHA1 ac2b121a309fffce2b9c1e9f28f5323443cc1863
SHA512 8b1678aa55e59fb50ea5067763fa8b52ba1448ba8b6626d53708634ac5a2739dc98c4bf0bbb7d0b0340d94c07c619de4ec15a49826e7157beda8ec8b5346a744
SSDEEP 49152:ThtSn8EApI0fig3giDn0AP5wrDmg27RnWGj:SX2imphSD527BWG
TLSH
T1D595BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 af9dfc364c94cd577827d8368753307d1f7ecda2e7e861d06c0d3bfa1108bf31
MD5 d94d966361d58c5ba1a62c30239fad73
SHA1 f17b48f03382753c20ee643853070f6fa9c0ba84
SHA512 ef16bc5bf62e4799394005a375824d2791980738c49830a9e910bd19eeafabb2a21da8a13ce61c75782722d5811249b00b9d88c9173d39bb175d554a6b2c61da
SSDEEP 12288:vMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CE4523BE965C41CAE52649B5C3E5F10DAC073E5BE92004937A977CB9FBB24984B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 eda81110230fa7c4a520633995b84c59e2f22bf8056bb253d34dcff1e998520a
MD5 311e124d90fb15b9319108ef0d36eb50
SHA1 2502ae1c668ce70a8b7d58367d463cdef95eafe4
SHA512 b3f72d6e848c1c41fb08c26b9be6121000d55d0feb159aec9530387c9ef1b140b90906e76814281edaa6419a534ec3b81f475ae82ac9522b342a5d4192f49321
SSDEEP 12288:x1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:x1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1004523BE955C41CBE52648B5C3E5F10DAC073E5BE92004937A9B7CBAFBB14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b08d92bf387bdb0e0aeb0e9e81ec4244d876fc8baeca7f061acb7462e9aa9751
MD5 347548717a916f9cef3c7e81e6cdb584
SHA1 597dcb4adf5ce6ce182092cd866a73e74a03c149
SHA512 61c13e6ce94ee4a40024b32e5ca87f7891dfb01d1bcd61a64fb2a62a188dc95a0e66849780f7df8dcd68c1becd67b83327969101dd6475ad2f280da93bc7e61b
SSDEEP 12288:ELXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ELsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1114523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A9B7CB9FBB14984B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 60be9ea2ebab861bcaa96c82aab157516384fd5549c291f1d19468cee2b55a8f
MD5 1e64c80a53a92a9919a8038e509ece08
SHA1 aa091abd8196a61840b82deb3b9291fc40407a3c
SHA512 3e3cdfb70915e5c9a9f1db26971bdbd604197fffb825eb8dd8cc41261ca6635e5bef7cc8057180de978e512b5a2ddb8db89f3f1bae1e747ba0b5c0f251f47b12
SSDEEP 12288:wVSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BB45237B675C00C6D87285B4C2F5E11DE8237D96EB30059B6B532CBE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3622a17ef237674d9bb396391e119535d6d66a4e0154624ab3463271a2c034e9
MD5 50925066a9ca9ede2f4efc4d2bc3751e
SHA1 6930510791a78e93071cc2884e2262a05b2c963d
SHA512 12b3d762c5982ea5c5aa0e5c4f12e0c4295f5716de884b377cc161b5a6d31699b529754721f52dc5e7edecee91bfb6fa2339237d0d5d7b6516e9ccb0be99a041
SSDEEP 12288:7qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7qsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B04523BF965C41CBE52648B5C3E5F15DAC073E5BE92004837A9B7CB9FBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 7e680fb73ce63504644d00a51663d032aabc56dff7f025af0ba19bca27603eca
MD5 805503c8a4c0d71ea7208c432e990a22
SHA1 7cb111aa84a16e497431e33a72836f376ba6c6e5
SHA512 669d3ed4f91308529296d4faa0fdc46d334eef5b5fc10fa01777a37feca1bd71a8893596f901e743b0ad5af8d844131e717a0de9b719b3dad9b060131d50a75d
SSDEEP 12288:SpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DA4523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 85ee1ff7826a1ee4726a8af6aa9734bdeff1413e36fab6d902091e46c67d1032
MD5 9f21ff7848afcbbaec1d96739efae87f
SHA1 a69aab3df4b622e7e0b3aa66715d1d8f6dc76e85
SHA512 a666f4e6638d7302686a081508895732ac33099fe4d4d2dbfe8baff52440459cd8e6fe90869b771dc3ab8b2e7677babfe0ae3dd43bdffb0dc9164c4c89271542
SSDEEP 12288:cNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1934523BE965C41CBE52644B5C3E5F11DAC073E6BE92004937AABBCB9F7B14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 dec7e83daf4b50f37a4e25876dffde7e40051c753adc352877804a47e200743f
MD5 d869d7957adfd084985ae2a8d0d68844
SHA1 729c18471f983518503480b2926e0520ecb733a2
SHA512 bb243676d6778f00cedb671b89ebe10f62385093c16d0ff437f40726005021db2df1af4968c0f83a4facd5a9be3c52f320e469d1395275e130be10f44f601344
SSDEEP 24576:NZMRzFVSOVsqjnhMgeiCl7G0nehbGZpbD:NZMRzf9Dmg27RnWGj
TLSH
T19A6501A9B35418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 6df30b350d0a13fdf68684d10059f66626201cb91f3ba7570ebc04b6b2041361
MD5 e618f765f74f24e3aa980180b37a7d66
SHA1 6886bf7ba47c6039ebb15cbf6cb60888c7e94dc8
SHA512 17227c2051b154f6b0e8ee03f5f2819f61ea47e2b6c2eb4c40ab7c5052491a80a095982435a064d888d1a308a0de8d3ae1e8633624324face6f4bf5af935319c
SSDEEP 12288:+oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+osqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EC4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CB9FBB14584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 80e5fa8f925f17f72060f31d9f767bbab957bcc4502bea31dbfc3d94998b2a9c
MD5 ae2aea4078ea19c807e4a03be5b675f2
SHA1 8773e39e73b79104d0615b7cc2f6928b753905e7
SHA512 c3b2c85b704dc8dbdd90aaf558c2e3a8e33e9aaa6a38fb258e86ed04a3009f4ec618b67f1ee67ed9f102b68c9dd93d8f3726e9fe39af159a47880493226a7e60
SSDEEP 12288:Q0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Q0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1974523BF965C41CAE52644B5C3E5F11DAC073E5BE92004837A9B7CBAFBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 30e692381ce414bc29be6f85914f1ec53314ab78ec5ec378f14838bb92234aad
MD5 b99e7d6cce5e9b9c80787f379d17c832
SHA1 6db334e35e6555fd9dc00d0da0ace3a4f437ac99
SHA512 95dec40b167b88feb4c21d64e28645ab26f3d48e3504281b883659a402e3a893b597e3768956d25947af91fafc8716135f634333f1639d67f0cc85650e447469
SSDEEP 12288:HyPz5L8xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qzyxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13A55125B73A530F9D1368178C5A29A06F7337C3647204AAF17A416BA6F736D04E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 08701fa976027e5b589817c1e1b4a5da91c63fc6a0d528318f6d0a4cd0cb6517
MD5 5e749ba1af5057d982cdcf095381d16b
SHA1 1d28459479506a7f3466b26909cf0bc0a5212c74
SHA512 ad17d32a61b266938fab08894823ddd50ee3db0e5b97243398de0d782e0f538c0351f9e35c23976e3e5cf1a8af0a461e84689707a0eb8d6e7b004df79f0c732a
SSDEEP 12288:coXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cosqjnhMgeiCl7G0nehbGZpbD
TLSH
T15F4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 78d21d31c7da49a8451cf07c2b69626e4a4ab05ea836c599bdd591cf6c84f49f
MD5 1af47ca76f40cf0ec6e8e0565a91700b
SHA1 c58fafb841ec337b057c33001e17271b9ff8b0ff
SHA512 6788ded7ca5a40a9b69aeea5932f4439a6795100d2e118109041e8941c886f88226caab93c827c362c040987e09c7ca907c6b94fcf34b94212dcba7dc2c17441
SSDEEP 12288:joXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:josqjnhMgeiCl7G0nehbGZpbD
TLSH
T1314523BF965C41CAE52608B5C3E5F15DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 5215283f2a005164b86f92f065af68e42cc9875573a381461c86ab35ca6c6fdf
MD5 da8858de63e90e9f3fd138dea9169db4
SHA1 1e4d051f55bb44482203b998ae6218882d4feb53
SHA512 5e6ed43168c97f83f185788a0fd7d34ae6e7cb93d94e7458315819f8901c98e20285c768ee55195fcecf071f39d25e4a462d51fb0b23e0552dc2f13c480df5dd
SSDEEP 12288:DyPz5L8xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uzyxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15A55125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736D04E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 2cc382d14c37eb5f0488398801e15fef357fe735de7c18aa86fa2255df6b1024
MD5 cb50fe11e68c2ba47aa9342e991dead0
SHA1 a24ad86f781adbada358cf5a9276e4822b0f674a
SHA512 e61fbde9de5f02daa11abf1c19752fb561133de7ba4a27afcc8131c99bac22f45b67bfcacd3abc7195dae10ed410a5135f95b3c8e8f0d33d2f6293ab6bf7127d
SSDEEP 24576:OTDaLl3z0zD7sqjnhMgeiCl7G0nehbGZpbD:OTuLljaDmg27RnWGj
TLSH
T1FD6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 51d9f7cddeafee83e4d7e5a875221c039a94048a67b5047965da1f130512adec
MD5 4542c97420c8744dbd23027040582862
SHA1 c07e856d7788f016be66ad4aac2c3ed618e1d9b6
SHA512 137e465ad90f67bf1bc7983094b9cece87d23ab23c036b25d5ac42f178fa0fd4c90f0f81f9c403d78bd9fd32b44b781d864d2c6684275ac6b2cdacbd693795fd
SSDEEP 24576:33vd9CHKy7GZ/sqjnhMgeiCl7G0nehbGZpbD:Hvd9CHKya9Dmg27RnWGj
TLSH
T18E75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 fbe507fcb06f08948fb06bb444e1ad558d31a97485f4bd2efb9b08fadf23324d
MD5 983dfb3f673117bfa0e9c80280e5aaaf
SHA1 8f0daa807c0b7b31f9fc7736afec34fbb83629ba
SHA512 1a400cc69a24059ee882799e7ea28a2ad993ae95096447103bd1a94cfca39943c0b89e78f7fa60605ee9aca5c5b8e63b8b8beb1309a127826f236d556c68c2de
SSDEEP 12288:UrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12C4523BE965C41CBE52648B5C3E5F14DAC073E6BE92004937A9B7CB9FBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 24111d42af40f2c4a2b7b49a288e72a3af9f3b95bd3fe996f63b3051d78f1bf1
MD5 083945fef38838622beb501b9f0296f3
SHA1 fa50ee8d5fff35f505f6e0f128b5cf89f773e4f6
SHA512 50afccec6b691ceb4e35f6deb7a558a40c0d3fdc1a5bb91ecc181867f44b6bb36ba01a1454a742b239a57aada132d66cc8a892aa03acd046edf3726eb22b6cf7
SSDEEP 12288:6RXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6RsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DD4523BE965C41DBE52644F5C3E9F10DAC073E6BE92004937A977CBAEBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 fa7605f92a18a2ebb27d1e3798a23122c00cf024650d45b730418c724c3b5d4a
MD5 9db44901384b0a3d8642617cbaf30071
SHA1 56caf226f835468a743e678bf160c4250bd906df
SHA512 855b8c0d5beebc40b130666a6c7da8e2ca85bcce51dff1b18fd9e2f8be57484df5242093e54abfe9fb869a46d16c79b789f9ea788d1322d9ad5b0812362b7b65
SSDEEP 12288:hOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1594523BF965C41CAE52648B5C3E5F11DAC073E5BE92004837A9B7CB9FBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 d22ceb486b60785d0d916dbad88935d77cbc754752299f88969697b915de83b4
MD5 b74066e62db98101700786df9aae2c7f
SHA1 647e89940a42c786cd1aaac7103e89752e026122
SHA512 6ff11ec404ff21088404060e61c47b2ffabc8851e4704fa0b6e7b56931362f28f7e20325eed844981690166f3a665291bb345ecae3327e9d0d9ef410b0c3e409
SSDEEP 12288:aoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 bd4af7582b10471ce882ea76709c85ff9f27af7655af80b149ed2c80c10eb0fd
MD5 665552644c3d6d5336435de0936c25b4
SHA1 c16ebcdbb6fec5e463320c9d11e5cf4415bc5714
SHA512 ec65654a873cb5ed9c9cf7688acaf0605b8ab49949f8ddb0bb441851e05f799af4442f83ed498e968f7ed7b518ac4129e165fc4a9fc5d30483001d4c9bc0d473
SSDEEP 12288:0rXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0rsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A74523BE965C41CBE52608B5C3E5F15DAC073E5BE92004937A9B7CB9FBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 0e4dcc7ee792edadfd965dc3b33406820a8ff03fa61dcd67bcf9753986135723
MD5 b57be9cb47f590a1ac5123e40f2dc73a
SHA1 2dae5bd54550f0cd29823d53011129cc050216c0
SHA512 23203fd4100aedd0c8b1cbc54dcde65fb19b64c23194590c614e7b614af9135af330cd7613f959244a00880df288ec172d23ce1a99186181b74acd6a310a5228
SSDEEP 12288:pAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1294523BE965C41CAE52648B5C3E5F11DAC073E6BE92004837A977CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 34a790a2b4a2dfbbd8205213946b5a6907654ed175b7f9283fb2b57aeccd75fd
MD5 e27d04d268e507ef5624b76f25d01948
SHA1 623811d44781a8f06b27b2306fb74a9e73ce6768
SHA512 a832994f790e760b4753afd2d7a657ab1b563b0ce258aafa4673bccd8f358a8ce7ff71535d1a3a4787706b880145727e1e5bb81a82634cf6fe332843d3bd3867
SSDEEP 12288:kqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1734523BE955C41CBE52648B5C3E5F15DAC073E5BE92004837A9B7CB9FBB14984B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 4f84c28636bbcccec772202ae81cf5c398618d86e4780d9fca780b4f5dc5afa0
MD5 91265ac8e150d7865cd3edf557319f7e
SHA1 0d0151302214dee4fe1c2b8705de591340a0fcfc
SHA512 3dad074c4694efc0a397dcaf9d7877d7ac322427512f2632cd802221b60ce07551e9e818d5b0b43756f6df04ba05a8be592f8173d7adc05a559c53933a2168b5
SSDEEP 24576:wfwvUk9RX6wkyAIEsqjnhMgeiCl7G0nehbGZpbD:EMnYIgDmg27RnWGj
TLSH
T1E285D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 aa5c08993e0f3d26b022da15411da311e411074311c24e0e198c29777fad5a1a
MD5 99bd15fab372cf1c0a27ee0266a7d10b
SHA1 f566c3a4ff86d66ba118f309d815d865d545838e
SHA512 ceffaaf723c3e98ce050aa10d0c4e6593f9323bdd429721622a8bde3fc0cfe56e9af19a0a035ab900d1a8df8cce12ee5bddb59a758d6bd4a02d4c40569551b6d
SSDEEP 49152:rYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0LDmg27RnWGj:uySzPjD527BWG
TLSH
T195066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2eee208ed546bc7b9af2d5376a38266ca7eb1d00be92ccf9ca8d3d2d69cf0a7d
MD5 725d2d134d6dc58abcd654ea9e650767
SHA1 f9d563d3fddd38e28ad127134d8311491668b7c3
SHA512 0cb9215e2a1b04b6fe0fbf5723ad744301c11b1a2b8a8ce51ec4d2671f343121e1e8ab8ac0a901787dba52d9cb1173e8a4d10ea4a40096d4955bfec8255ad799
SSDEEP 24576:c47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYlsqjnhMgeiCl7G0nehbGZpbD:c47JUQjTirIhCnDHUPfF/bDmg27RnWGj
TLSH
T10B65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 9cea9af445cc648e869cb8ce19eea248bb4e9d8010366dda27c5cbccb41f624d
MD5 513d98461c0a06f1aa1d883678797366
SHA1 373a8bd4c3cff835f1cb8b170f3b094056add1dc
SHA512 821036049ad609a0c6cce2dd82dbbd8bc5ba6215fe496d6ca516b41650014970a780172ecaeb9bca452bd9bcc0c81e7738f42409b10edb701564651139fef82b
SSDEEP 12288:ubsfYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1YsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16055015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 936KB
SHA256 652292c9e5bf8e52b28d35ece409d25e3225f783b42fd51c6678b0a987fbbc00
MD5 a549cdd0bfe98ba2b02f2cd883b99643
SHA1 af7279d3b9d20d6ca44a6eec34e87dcc788224a9
SHA512 14a0bf4f08b64debc3b871096b63b3be55d6738de3c01bc8ef9ac21ab876da5bfa0b58c00da2e9fdff426e9ba0c54f988c450254638c8b9498530ce78e20ba40
SSDEEP 12288:t3hH0U3fZNPUJ1SZGn6kiq5vXcy4oAi6MVAHRMVMrq:t36UPYXSZGn6kl5vKorbKHRMVYq
TLSH
T14C1506417266C78FCA6940321E76C1CCAB707D51EE44AF0772C88B3FC576659BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 313KB
SHA256 82d07a9699836b57e01d22e0947dfd7caa2a7f75793147aac7bbd5fdab6446c9
MD5 1679de5eda83e8b6050567017726cb29
SHA1 65d9ff8cadc9187bad9cc47ea3a2692c333dd523
SHA512 ec0fe0a48c95fee5407048ed6b571a1a207d8b58522ecbd234b2f843283f6d0c5deaa611899bda45da97a818604a0e38a8f4c5974bb2bf9e32d3351920dcde5e
SSDEEP 768:g/TkQlTPBlTz2+EQM/d/TyQlTPBlTz2+EQMd/Tv0HqlJe3QlTPBlTz2+EQMpRlTS:BmWKup+cwpxxz
TLSH
T1C9648411B714F319C0BA82769CB1D19FAA39B026DF2353033FD81B9EDCB22463676A55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b3036f264a57d479ed976afb231fa11b482bcfc1f6d97367de7a938a36fb1270
MD5 e8339fd4690332e8204385a99fd9c5d8
SHA1 73df49f0d3aa2f448af0a5d52a082cf01a81120b
SHA512 0daf70c9db9b9d2aaebac53553954f02bdd9733a23eaccffeb950f9943034e40fd01611ba7da68e8cef7997d41cdfd3a0a986e4dc46d9ec2e52d82c3e96d1e29
SSDEEP 12288:f07wXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:swsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14745237B935C518AF83605B482EAE12D681B7E669F1044C3B90778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 53257874c19aa3a46459001c9cd2fc4ee4ec8908e49d880500bbf83da8e7fe23
MD5 abd212671a30a076ca800b0ffce0df4b
SHA1 cd2374a7f41070c43f26fde97a715e8ba27fa65a
SHA512 c559724fa2ed9f1bd5a0d01244b8092553d0e12c05fc4d446f9084577b1a8c013ae6a3b3e9de67a3b221bb5bab14a4fd901d0c34c54e2df331b45ea8e7aed97a
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYWsqjnhMgeiCl7G0nehbGZpbD:Mgb4mBIBhGFZDmg27RnWGj
TLSH
T1BF659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 3ea822981a41b107b1098ae5005977d52aeccc65a30726bd5ad34c40627895ef
MD5 fae6298e76eea61f029bbd83a26debbe
SHA1 6e8f15be9d1347a1f9fc10d1d60ae37faf0bf33e
SHA512 1eaad3736bf1f58be7214ea005d39f90b2584a7f07681d84a5dbaabaddf7364474ccb1708705ef6190f9860ea2860812e891d4ce5115a768fb53fdf30f131371
SSDEEP 24576:eG88u8FpJqH1bzria7/mVsqjnhMgeiCl7G0nehbGZpbD:17ZFPqVea7/CDmg27RnWGj
TLSH
T10185016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 633dee418cd066b433217cb9496cabcf6269f18df63eed559d08651c6dee9377
MD5 33d3a8b391854ef02af048283fcc1de9
SHA1 53a49f29808a8974b7afefa849433e0fb8d334bd
SHA512 a29c701396dec6f819430d020d98b92506d26f059b6d6a3b2d9e5e2c66ff6ea376288a42a34f27ee5ccabce42160c94340f4cc98720e52fcaa614e38623335c1
SSDEEP 12288:oHvUrBFrEjwaQ5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:oPUr+NQ5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14765F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5a5c3b560083b9afd236d87287a097fde03c386d1ec86c65c2d3e4f9364672fe
MD5 d26cb44a30b277bb0250076786ce886c
SHA1 be72f396ca60c076906618623d095d94c203e863
SHA512 692d23c89bec1cf9def1d23f43ba403dabbf6b2667c83e1ee54c34809f7364c3da1ae0017f0a1acc9f0f5793b1690cec85287304e651ea968529b97bcd7e25d9
SSDEEP 49152:tBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjtDmg27RnWGj:2G05lO43bID527BWG
TLSH
T1FED5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6c00771f2bfeba0dc94bf8519e8d4a4d9028b8354133272630d27b164c956294
MD5 36299ca4260f8d73cd57899dda7d1982
SHA1 18cb2ec80da381b410681f7abd0dc89fa44c4184
SHA512 e09844a4d09b3da97c83c473741ee48cf08df766f61697b40a0fc3137ccfdbff1bba530252b6baeb71873baed6f50e08fd3fc4838e743cc1ebc2ffb7df4dcb80
SSDEEP 24576:xfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn3sqjnhMgeiCl7G0nehbGZpbD:Ra5POZ3BJt2pasx2+mlDmg27RnWGj
TLSH
T1E765BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 36f7463acb76ea667d0d58c0df5bf3fd611c6e81bbe57f13962e599971c94cef
MD5 09fed64d9d8134ac85133168f0921376
SHA1 57192ed2d597d9229e255385c7695312f330faa4
SHA512 e5ee4602b7ff630abbfcaac34c20dac257970ec9c8b215f116f8d071879ff2fb2d5f988d43f24c5bf23aa3252861ddf97f4904aaabe5992fedc842d32b14b2ca
SSDEEP 24576:JNcwHdjbyQ4nLC18lb/EOjowL7Fk9sqjnhMgeiCl7G0nehbGZpbD:JNc/zEOVHFiDmg27RnWGj
TLSH
T175857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7ff6753f63535748514383560921d14a697a9a7677720239f3182461b9784814
MD5 55147043fc3b45a2dc214b8a9515d883
SHA1 62ee4259b99f3647e064cfa90d2362cf74cbb840
SHA512 48eb98e3e357e0e1159e2183e69fe7f0aa5779d0c14f33680508826971c49d4a378b60ba2b59a6fd2792ab39f546e678d04345dfc22fa298b05a5f2dcd6bdd68
SSDEEP 24576:1TkNvNnaFeYhJNtmZBmusqjnhMgeiCl7G0nehbGZpbD:1TMwBtOmCDmg27RnWGj
TLSH
T17D55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 734e1f5858af9bb9699ce8d7e7b938a3669c837d69fc1889c7a690022e1d91fe
MD5 ec217ab878c7925ce8365a83f306e128
SHA1 055e5812fb8d5359226169e9f14585995d88bc54
SHA512 bfdb4d1521e6d1004b7d3cb9751b702c9efc527ff6d4318a1b5074f3f29c8060364256f3989aa1dd087bf90ed1f5302d9dccf3bb8990034f6a14a56447d20a34
SSDEEP 24576:lD3FHshBIYQgAssqjnhMgeiCl7G0nehbGZpbD:lDVHeBIAAYDmg27RnWGj
TLSH
T18675E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/356-44-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/356-51-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/356-50-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/356-55-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/356-58-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/356-43-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/716-7-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/716-31-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/716-8-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/716-6-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/716-0-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/2176-305-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2176-82-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2612-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2612-122-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2612-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2612-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2612-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2872-331-0x0000013C3E4B0000-0x0000013C3E67A000-memory.dmp

Download

memory/2976-86-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2976-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2976-344-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2976-306-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2976-342-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2976-93-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4872-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4872-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4872-99-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4872-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4872-105-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4872-309-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5136-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5136-132-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5136-130-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5136-124-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5136-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5276-299-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5276-66-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5276-59-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5276-60-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5720-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5720-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5720-312-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5720-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6092-112-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6092-118-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6092-111-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6092-308-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6252-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/6252-85-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6252-22-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/6252-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6252-15-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/6900-71-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/6900-77-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/6900-304-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/6900-78-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download