65e3dc07ef01b5e9cd66181262a22bc51ea81c8cb513098c172f44f5ec1bf8da

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 20:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_ed0d9a5373c3afd95b09237d0245e381_icedid_njrat_vidar.exe
Size 1.3MB
Sample260703-yrdk2afv6s
SHA256 65e3dc07ef01b5e9cd66181262a22bc51ea81c8cb513098c172f44f5ec1bf8da
MD5 ed0d9a5373c3afd95b09237d0245e381
SHA1 e6efe614af94deabca41628268bf582493222354
SHA512 645a9b3ea3bbaebe8e459a360bfe8029c72d6eee36b5fb8d44e2dfe5754af55024fffb545a8bab397cef762f959f5d1319224276537e05804277d0585ad49070
SSDEEP 24576:TEgxVkhGJEk75NUiBR1NyBo4kx929bL3Hnx:TE8Vktk75OiBoB+kn3Hnx
TLSH
T13F55CF2937E501F5E177D23AC9A64656E9B278051B21D7CF03A403BA2F337A14E7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2780	elevation_service.exe
3388	elevation_service.exe
6020	maintenanceservice.exe
4520	OSE.EXE
5784	PerceptionSimulationService.exe
2608	perfhost.exe
1596	ReFsDedupSvc.exe
4044	SensorDataService.exe
2332	ssh-agent.exe
204	AgentService.exe
4400	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-03_ed0d9a5373c3afd95b09237d0245e381_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-03_ed0d9a5373c3afd95b09237d0245e381_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4e093b71a22d4d5d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-03_ed0d9a5373c3afd95b09237d0245e381_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-03_ed0d9a5373c3afd95b09237d0245e381_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91390\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-03_ed0d9a5373c3afd95b09237d0245e381_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-03_ed0d9a5373c3afd95b09237d0245e381_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d263d8f0260bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fae4baad260bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd5f50ae260bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e9585ac260bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000221913ad260bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000032df81ac260bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2780	elevation_service.exe
2780	elevation_service.exe
2780	elevation_service.exe
2780	elevation_service.exe
2780	elevation_service.exe
2780	elevation_service.exe
2780	elevation_service.exe
3388	elevation_service.exe
3388	elevation_service.exe
3388	elevation_service.exe
3388	elevation_service.exe
3388	elevation_service.exe
3388	elevation_service.exe
3388	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
800	Process not Found
800	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5548	2026-07-03_ed0d9a5373c3afd95b09237d0245e381_icedid_njrat_vidar.exe
Token: SeTakeOwnershipPrivilege	2780	elevation_service.exe
Token: SeBackupPrivilege	1596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1596	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	204	AgentService.exe
Token: 33	4400	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeDebugPrivilege	2780	elevation_service.exe
Token: SeDebugPrivilege	3388	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 4860	4400	SearchIndexer.exe	100
PID 4400 wrote to memory of 5288	4400	SearchIndexer.exe	101
PID 4400 wrote to memory of 560	4400	SearchIndexer.exe	102
PID 4400 wrote to memory of 2876	4400	SearchIndexer.exe	103
PID 4400 wrote to memory of 5668	4400	SearchIndexer.exe	105
PID 4400 wrote to memory of 2764	4400	SearchIndexer.exe	106
PID 4400 wrote to memory of 2656	4400	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-03_ed0d9a5373c3afd95b09237d0245e381_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_ed0d9a5373c3afd95b09237d0245e381_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2780

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3388

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6020

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4520

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5784

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2608

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4044

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2332

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:204

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3865087520-2734723108-1233268525-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3865087520-2734723108-1233268525-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4860
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5288
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2520 1500 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:560
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1612 1600 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2876
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5668
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2520 1500 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2764
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1612 1600 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fca209d5dc7504240db2a0d1cd0ff7d7fa323b6575151b19680e47184e6d9d83
MD5 ec0bb6499c50c4a1c04a0de8d88646a6
SHA1 a02dc22711e5206cab6f784a9760ecbe24af7f66
SHA512 2021c86ee26d679834a28cd06abfa5468c9e5f7bc9238157c91b27ec7fd1c6378adbbe86ad395c25b8fa13e69966364ca9260e4750cce7e7d0cc56cda4fbdb8b
SSDEEP 49152:ub+632BuPkFKRrdE6ohvstBhuXjfS4LWxnoB+kn3Hnx:w3q6sjBj+k
TLSH
T135D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d16c4f857cf7f469ee8efeba17284be8b417de698be2e68f3bea946c28a804a6
MD5 2a79e58c698521deee352bd47d8f2645
SHA1 a5b15d405aa268195f4268a89767a689a9f2be80
SHA512 f937ebe605d8b21e25e1174c80a5bb4534924779047321fac368e2ef54d7b1cbdfc4ff771bde8fa59a425297592584d73abbff2883b8fb7a208a4e1d1df099a9
SSDEEP 12288:l1XLsswWkxy2lRq2czAdLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:rXYfDtczACNyBo4kx929bL3Hnx
TLSH
T1B565012967D409F9ED6B927CC8A28511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 386024b4a6e368e4f8dbfbfdbcefa5bfbd69b221df33cefb28ff3d73a0ca11b0
MD5 ad163c2b33a14637488a3bfda15561fe
SHA1 eb0ef1d682e66cf03342df64694d8c7064bdd486
SHA512 b97ed8b470dfd63722bd68125e2e0341c91b0d03a06f2446370e901f4b9c7beb27f390bd86849b39f38cb55dceb078f77db5ab28d420130d6fdef1c3b18f3e9f
SSDEEP 12288:3XZNYVLeyUji0h90ZD0wxpGZIVuArHsALDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:Z0Le5ji0hmxfrM/NyBo4kx929bL3Hnx
TLSH
T1B7859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7671466cfe0afb568617dc130be08b7cf26fc59b93c829c17823f57ba685b170
MD5 1869400efa601ae70bcd255e13dcaaf3
SHA1 56c5f13be11d460fec3cbf1ef360bdc6684146f9
SHA512 01b11cb5cc2a65d358acdee885b0ef12e72f2c658e292072611918a90f33219faf75e7d3b32390b50ed3aa4e7122faa7b73eb3ce93fcc3d12413b297a5a6c8ff
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWn6q8wyuJNyBo4kx929bL3Hnx:G/ezSC6vUzPveHjyPB+kn3Hnx
TLSH
T1FD755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f6e0edbb4def50ba640a3bf55b32b8b7295f6589306561e4d8d34ede05fa72e4
MD5 ccf0918e034d4f3e2e90437225465767
SHA1 c2252bc28bf4a3d4165d6288c90138d97bae0bd1
SHA512 c961f02d9ba5b0d392e61adcb8d8feab2b30f8d20daa99739556c9909e5674ce2d4b7b7f58c3768194e9ac21444c40753da00d5dae05ae65653d4a1044979733
SSDEEP 12288:qVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98RLDAptNyvUgXZ32dT4ePc7N29CD:qVbqPb88hv/l+YuNyBo4kx929bL3Hnx
TLSH
T166559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7c915c5622e3f81acff53e4384ef54fdb91da7c4ab416d17e0be532d27e8658f
MD5 3b002b0e4305d580bb047f8798580be7
SHA1 5506cd22961d2c17ed4a47930ce057300d35a4ab
SHA512 36ac6cddec3c047ba2c5a1f776dc0c6c9b523f635679601e87d0ec4efbb253a02eba919883b66022738e14dc3e4b0f2baf583c01abb270c031727a6a8fa79803
SSDEEP 12288:AmULDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:AmLNyBo4kx929bL3Hnx
TLSH
T1504523124B0C627AFBBD3E70749E8454CC35BC8D0D95DB94DE62ACBB58BC9A2DA21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 134c8df57ccfe11040e3ea4354f4a4b2005c5be14a1b909e108769dfd75b3bf4
MD5 957f8f184c9df40840b920d018c0a407
SHA1 cbdf499adbf96db38e2b84475ff2096db9478387
SHA512 7f315ee8d41130b3a79b4c2d88c1a43cadcd1a9cec1f49f5c23f4e74a83dc572316bb8d9260fcc588ddc87b08b1f6b5e685973bf4d0b5753bfcddd3228687f58
SSDEEP 12288:jeBNUbTVO86UZLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:jJIUGNyBo4kx929bL3Hnx
TLSH
T15365CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 53cc5985c4b64b038599e61d551f48b33ad550d11af9990c4e5223ef4b8d1a2a
MD5 9408633615ece5b9623e70b6a7386d75
SHA1 e7e5c29d6827c34aefb3b8bdeaff5467f3147db5
SHA512 a910a3f69bd877b52ba50dc75d67c35d705f3feed278911129d1bcbfd47387addb824b80f28df11a57bb79c9241aacdabd3ffb40cd437ac7ab2239c4e12d8173
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THr:2QvGAdlCEL8c/DRNw5Ce+k
TLSH
T18F266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 197ed82c956d07b1037cffec88c72685ded4d5af34f183fa117432527444d163
MD5 916b2da9ea571d57001796bfad68b649
SHA1 fb9dc4cc065ed421e592de90e67b2fe49f4a3462
SHA512 36b333632d1c64cf37e49bfb62aec8e835064606bbc4e0338b9e8aa2d3f6d0794925538bbb9249641ebf3e4cac96e35598f0dea5bb89215747206b04656a29a1
SSDEEP 12288:rAwSfxL/2Dc3XDLLmt0LDQewsAjTLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:UOewsAjANyBo4kx929bL3Hnx
TLSH
T19B75E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0e066ea153e25e1efdd44c4570816749b0e3475bd8065b908853c0b8965d6d85
MD5 627c713a47e242aa45dc8e8662f5d648
SHA1 e4ee77f0fcc196df9568d5a0081b7d695a3d9beb
SHA512 be3c15ffa81068f6a9e7825ba820ee74e36b5eff0db831a9b4fe8ade012737d9aa619f1560cb33d78153b1184fcc1c5184ed1301d985f8cae0e5139475bc4143
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH9+k:rUEtQevvqc2W1cpV2tI329
TLSH
T117474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 015e5bacbdcff71a5cd566a1f88804c3f9dec84b6f5d9e0911640d18c866b3a0
MD5 247e6ef5d9c98b41087750ead3cd64cd
SHA1 556e82c0d89bbaa66d5ce4d16b24ec7dfa7f7b37
SHA512 76cc15975ec4168ccbe5d7ea5a44d8372c50e7b1ecadbe7a2fb32c01f130fc9cb32d6efcebcdf21e694903e921f7c061bc8526ae46d9756998b3fb0e78233965
SSDEEP 49152:2CbRquA/m2yL5zTfFiV+XenmE3/zTB+kn3Hnx:7oquVjnmC+k
TLSH
T1C2D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9ad8ad999135ef2ac02938c57819348fa038b2e8a4500d6036af84815ea515d2
MD5 6ac9600c6f6827c249e333d69ad5b6f5
SHA1 fc648d5bf7fbd87b714a797e891f5eaddac8106c
SHA512 e7307b55374e7074403f15f4edc833426f824cad0eba4df2fa628e2a0e0ae754d128bab861695d0cbaf93a58aaea22c653546e1bc1c0039a261f323a917f98ad
SSDEEP 24576:rAhGL3IFoiwtA5l7S53NNyBo4kx929bL3Hnx:rAMUFoiq5aB+kn3Hnx
TLSH
T1DD359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 5ad24c4a7e0e94cb9a68e38fcbc9c786285f393f7f6206146aa38458f4b85dc8
MD5 3c08da9a98d075bb56fa88efa29b96d1
SHA1 438cde34dd604f04a26b805e389c7d2da41ce6f8
SHA512 21cd9e44e13e3c8548ffd5f06be30aea94b576c519d21877021009d04f7e3ff9f634fdb8683c81d53660a7513440700f8e92e5eee97a2b695e3d89f3b7625dc4
SSDEEP 12288:imw5HEjsChNzBFgl0WDm+CiLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:7wu6OWUNyBo4kx929bL3Hnx
TLSH
T12D65F10677A81CF9F96756388587C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 34d983ac021ff7ef794d67b432f23155192c096e891b622d9faf9e9b36bcea8d
MD5 d1bb70b221a7e1e25a0d5c22245c4ad2
SHA1 8a5b7ad77617a63dcc149134081e55b0740296dc
SHA512 28191d79a42ec3122244528db8484936af99d39fc1c8f9fcefe7241aa7b64df8eb3a424ffe2661bf97791908e235a31cac964ab0d3fc8255a42b68ea26cf11bb
SSDEEP 12288:pgZ1IyjLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:CZu3NyBo4kx929bL3Hnx
TLSH
T1DB551216239831F9F2AB2678D8E58544CB32BC461B7283CF5A2146BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4fcb59fdf389342662698dbb9cbabf52977810cf55e244f80e6a675a0eb1f161
MD5 239633fd17c0e638fc2714f9d6c4aafb
SHA1 3c1ba643bcffd2eb66bac926240719c680eac0b2
SHA512 2b86c5840741f3c458f1bf64b173012941903beade799c50705ae1615ceb574128088c1922f9e600006c24f7f40491cd61cb8c365560c1b5139d508b44d40b59
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U/:pQRQyi36YOcPbLvw2gAf+PN3/+k
TLSH
T1FD666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 950625fbfeb680c40cff33f0ab89645555fe58df01f4edf9ca3e2ed27d620472
MD5 479255afa811bacb5a46e7290e83e891
SHA1 d33023ede7a0e852f645575fa0a0a25dd9e48ef7
SHA512 8ca96dd9b15761fe1fb20f91f398c7d92247746d79f39ce30a1bda231ab66bc28664294ee10c0a3f1b0c06eaaa19612fbf8c27e5b917d3db092eae7c75a4c623
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U/:QQRQyi36YOcPbLvw2gAf+PN3/+k
TLSH
T1C7666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 60567a1ec03622e18a287e3e978cbbf0f89c5f32fabcf42bbcfc2902b5dea42a
MD5 25c106df84e80f414c6d1964ef4bd99a
SHA1 424dc9632beaf28247816e1710d17dc88c25adf0
SHA512 201efdf496accaccf5f8240fda384ceed6398cd284dd22e15fff296467d57f748b2f3e74705363d500069a22881ebdd4138ef8faa486f4f0eea1fad351989fe3
SSDEEP 24576:xwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0HNyBo4kx929bL3R:d68Qg55nhceWu7PNU3/jB+kn3Hnx
TLSH
T1ECB55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f82a08df843705433a9b2ad15cd1ab5ee9e740ea6c3ac901763a77ae8400dca7
MD5 28439150184fbeed780b76b3fbde2261
SHA1 0cdee2ca33d9530ed4ffa396d04f2d56a28335c6
SHA512 9d5ec9c3e6e52f4725b0154c59e61c9460d92528e4979984776c78836eed504a2bb2b69f08bbe649828709189b42f223a04c06f264e2a6685f13a774b9e35386
SSDEEP 49152:e3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99Z:fy5112gYy5azzVvt69nLKnhZ4+k
TLSH
T1D2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c1074cb31c77f61421d1e9c302268a1d12b303356ad54370db50153107c2bc53
MD5 b1ce3c229ba106f99252020d7fdb6048
SHA1 c9e5114494cdd7585555a9963a922255d5ea9d4c
SHA512 7110227c983d09c877a283dacb76b90ee2eedfc87d0d5eb5408cfd1c5396f081b7f854ade4533396f201c60e28e5641059a8674fa192fe05cc48235757418453
SSDEEP 49152:sB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glyB+kn3Hnx:mu6Jmdxd2da+k
TLSH
T116D5AD13F1DA01E8D06ED578974A9233E962BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d8dc841a7b59f71e31db759b68f4d30c1bcb122821cc9246a9211c180ca242b7
MD5 fd645f58fcf028c32da5b8debc846336
SHA1 30f874ea957bbb52fc8a410bbbfbd4d5b732599a
SHA512 9739f1b9638abfe4ce5feaa7b266aa29b5fa27cb5d189e33b096923b79b4c2215b653f01b30aa1d8ad9946ab3168c6b2a34145f402c11abd9721d73c82ea06a5
SSDEEP 49152:l1hpsNoJpF1A63U44CwH7R4xNB+kn3Hnx:lmifPWRC+k
TLSH
T1B4B5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5f87d52a37ddd329a4f53458e7908f02fc26aa6e1ce0e07db252849ee9c86587
MD5 4a26e024c172ec1d08b4205214a93b0c
SHA1 900665ed26a6c880d7ec2a5576ecc23de344b9f4
SHA512 036815e91d6e85a250fd5f749ae06747ad2434e7209b8b7460744aea2018458c0dae7e25b61a11a76ac91a2c2cea9aae9acad700552431f8ec90ebead2cfcbf5
SSDEEP 49152:8SuZQIY0Be2KcRVtOnks6NMHq4B+kn3Hnx:+5dKii61k+k
TLSH
T197C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5350bee8dd038cccfe3613c85d4f67edb517b158c143588a5ee7ff31645f4af6
MD5 2954cdba9887b58dd364c7ced6ab36e9
SHA1 ca90f9beb9aaea3528219e408366c2eab3760258
SHA512 3ef35c5ceb8d85f040ed6f0ae6daf8b13983895fe1469c5efac38e12911286972c95458a524981424f20914914db23e83f3f8408ad85ab65627fd962cf084a04
SSDEEP 49152:VhtSn8EApI0fig3giDn0AP5wBB+kn3Hnx:kX2imphG+k
TLSH
T13795BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d086fbbb3e80e62783f0a5f1e84f79930dbdbd23ef4d5958eee368ae54e74334
MD5 4ff596662798e78b75b7c09d21560f84
SHA1 02479c6f800be99433f845ba51075e164e60a341
SHA512 05aa58e26584b55e7cba65dd8c000352da77445402e151041365d034d298e3a7ae190e0305692574b6cab2fe4fb352c831b10fca552890dbc94d739b37250f14
SSDEEP 12288:y8LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:yjNyBo4kx929bL3Hnx
TLSH
T1D04523125A0C627AF76D3FB0644A8558CC34BC8F1E9593D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 367340ce2b108ec9ef9aeafd79b30fbd57bd800c24f6d3f7f21990848e6a3adc
MD5 1df700729a0c35276f06e2a50d59fa18
SHA1 9c345932b2945f6817784efe230e2f8719d0494f
SHA512 9356578d5707271332c262f143754321f13db981b776b38c06365ff77b786b640bcdf3e16090f569a117a1751a27f35d9ac1f936b92b11ee055cfc339266ffa8
SSDEEP 12288:xHLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:x8NyBo4kx929bL3Hnx
TLSH
T14C4523125A0C227AF76D3FB0644A8098CC34BC8F1E9597D8EF67987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6d4ea09eed09d70f721c3abf3dd1d5d676e13e76c27c7482f92ff5850cd406b5
MD5 5f361c20b249ca7fbdae7bede9a3255a
SHA1 196a73d70f80cc4544525319ac5da8000bf033e6
SHA512 f679fa8e83e18b6f0dc9abf76981d003836baed4b0dcfd065f186cec7a5823f432e690cbc651623f81f6b732e9605f22d92dadfa978479a53948273c8f60df0f
SSDEEP 12288:bBLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:b+NyBo4kx929bL3Hnx
TLSH
T1A94523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 6b8206e8c2c79d6baedee8284adfd1c8ddcca5463b125f6ba34eb7bde873a114
MD5 b54900dbc38e8a34fbfb33b0255fc4a4
SHA1 b953f5ec8b7afb1c7573d8aaba1bcf2b655f2b49
SHA512 413b4ceb87ce3170fb7117798f41ef704678da1a92fad9dda9aa8b2e0fcce028ae394dbd4fcca6076f36b01e957e402a89738c4e3f8f3e74a9849690828f80e4
SSDEEP 12288:dVeLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:FNyBo4kx929bL3Hnx
TLSH
T16D4523025B5C12BAF9797BB0D8568054C835BC8A5B7297DFDF124C7B0EB8BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9961793509c561cd147aca085509b26e68a8b64ff5bc10e697ce0d76691adecc
MD5 5a069a6d6d1a801777d682ed77e9f61a
SHA1 49b4d8828ce3079e85406c40f2bbaa521a14dfff
SHA512 1d6ac9a2f86280e54d60cfea19b454effb5d206bc4a78d62f3b95428a1553885e19741bed699881383d8c35e37da5d63d0894f695988f77e70b1adbf38872988
SSDEEP 12288:12LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:1VNyBo4kx929bL3Hnx
TLSH
T16F4523125A0C627AF76D3FB0644A8198CC34BC8F1E9593D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e7938bd0abb3ace3d97148476e5bc2ecb489f1e499f2f4594b107992c1e99fad
MD5 aedb16f92ec869958703a176a0aac3c4
SHA1 42990313802e16d5124361395e9ebe01fd21fe22
SHA512 a660971a6ebc6b8a756a63409fc91dc105b9849b83626d462e9966bb6043feb08bc2c34e0dee210c72de90259c6b179324f121560cf71199ac5ce632c4a87c5c
SSDEEP 12288:I7LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:IYNyBo4kx929bL3Hnx
TLSH
T1E04523125A0C227AF76D3FB0644A8498CC34BC8F1E9597D8EF67987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7b78a33df30cb098b26d5a88802f16cfdc76f1363bc7398b317aa972e07e5b98
MD5 4d21c1c17cddee1daca43c016b3163e4
SHA1 3d642c3c020e79af4026f530a141eb4a19b5fc98
SHA512 cc859e73a801d0431a42abc90e262039392c0d3fc167c71840e4235442c0c83af249f52cad74600b1437187bd3ea36ede95f99b900f5762da740c1d25ea4948a
SSDEEP 12288:vfLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:vkNyBo4kx929bL3Hnx
TLSH
T10C4523129A0C227AF76D3FB065498498CC34BC8F1E9597D8EF27987759FCEA25A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 43b6606accfd905b3d33a8eb2fa8aa49f05adcf46429b96cc914318ac301a8ea
MD5 99f3d8c12d1e690c5d4a0b0f049ba1ab
SHA1 c8c635b09179374b5150190aa49954f1c2152db2
SHA512 8510e3534fe37583bcf71cb7fb0d9ff2f9f22cbf5798b5d1fb3bdc9dd162db00bf3c24ed470a3a6213d57009104374948c59bf1214339f0bcad97db125759554
SSDEEP 12288:KiZwbjzzFEoS2cPvynLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:tZMXzFVSOcNyBo4kx929bL3Hnx
TLSH
T1D3650195B39418F8EC67823DC8158906D6B2BC4A0BB0C65F07A4367B5F773A10D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4b4871a98db969b1a8170a1ff23980b51cf646582626c335457d3f8781268a7f
MD5 67d7870c15bcd7d9b38f997357b15f80
SHA1 ad03be0d872b2b32c24b71cfd7dd0a3de37627af
SHA512 5707d56fe81a23a43581402312afd5ab9e775f6a718b1d4c9720f8023c46fe92f6575e18baa63783ff5bf0a73f77e3ac01ab62d9969146da38dcb5c99a33f6fe
SSDEEP 12288:O4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:OnNyBo4kx929bL3Hnx
TLSH
T1544523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4a0a3bdfd30cae7df851e89eb02ec2b8e1107ec4ddca5c62039d15504172a5e9
MD5 01546f44ce86b59d457e775153c8acf2
SHA1 357603aa957f9560bb04decc02f6802b62e38b44
SHA512 1d21df11e22b36ad114378cc5768af70cabd1d4d7d09a26e0c0f991a3727bad52308dddd33c14e7e7440ad5b2fd6b61422a83f9b5c5f4de684a4e6cfe1841074
SSDEEP 12288:qkLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:q7NyBo4kx929bL3Hnx
TLSH
T11E4523125A0C227AF76D3FB0654A8598CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 cedffa949a1d81bc74ffe7fef8a8c99c328bc1ee21258c59d0e70010fea2c2f3
MD5 14933328dcfce9dd3cbac635e19a8528
SHA1 e14e37ca028324efd340340a6c642d84cbdf32db
SHA512 b2701b81b975d88a74f4739d39d0a9577eae35784ec8c096932fcd271e7bb8504f30388a4fdabfbef5820cb0dac2d9759ed90c04ceb876d6d6e6670d9eb4a26d
SSDEEP 12288:SyPz5L8jLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:PzywNyBo4kx929bL3Hnx
TLSH
T10755120777A831F9E17A6234C8960A01E771BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 73d2e56ddd153a73064cf9247ab93e198f651980a66f4ea5f50d659e658f6e17
MD5 cffb260c29d886471400d00aa1a0bf0c
SHA1 af60697cef1a8885653410f40e395e021713d0bb
SHA512 c11b56914a4bfdcc01181f34efcc0e773fef3048b7f3cf038866e59ea01eee18e083f5f7c8162a7dc00ada00430c5420e33d0d8c2a0f14a6a4742876038bea3e
SSDEEP 12288:C4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:CnNyBo4kx929bL3Hnx
TLSH
T17A4523135A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF67987759BCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 5714881d5ecfe2c89b491f4f0c398cacc2dfe521943aa9fdc7ec0122075c1ae2
MD5 04e92dc48a3e0df930c1c57228d639cf
SHA1 e19a5778c0350156f03a86237ebf333dc2d37d06
SHA512 d12dcf08e3ceeeb9ee27d169c7c3975a551cf6c7fa753eac2830cb8cf7350a525e87f76e50002ed73c5a47c95ce241ba78112f8b1b41a8dcce5e6c80dcfc9bbe
SSDEEP 12288:Y4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:YnNyBo4kx929bL3Hnx
TLSH
T1544523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF67987759BCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 d3abc674ffabcc2d8cd2db79f0ed3e2ee4f378a2d6e26df64bbe796a201e00fd
MD5 020f7dbc69408b945b5ada93a3aa1b70
SHA1 221199739250aa323954f864df4348d37e6b6dd4
SHA512 4b2e95ca7e4bcc7630301f6fece0684adc56e50f5b6863208a58125cd7bf4fb9f5c7e55ed53f534e1b2a7a931e0d7ca418e7c5b3f256698f72402ae6e5ecfd32
SSDEEP 12288:WyPz5L8jLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:rzywNyBo4kx929bL3Hnx
TLSH
T1F155120777A831F9E17A6234C8960A01E771BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 865df864afba5a7e2430cea326b204ebdb57816a980cb51e2652080f203a1132
MD5 a02cfdcfac6a650b60c836b937b33690
SHA1 05fa73d4ae3966bf918e23a8f2bc6c4b882af039
SHA512 f5a9cda136822d831d2a757e0bf248191618b0dfa31bc1c7f6657bfaee5de10a38d3d4f2bd4a914702b2d0a58e47f57eaf53698e90c64f2133e394579ee23d15
SSDEEP 12288:YCd98WYoaLHF3z0z04PDvhxLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:BTtaLl3z0zDONyBo4kx929bL3Hnx
TLSH
T1076501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 4e5ee3c38635d6d34ae3391e046ff34377bc9ef22110ea564776cd4ea7202cc4
MD5 9f665f3ce6055b1b169068ef35493047
SHA1 9907c3bfcc918fde325fc291db60f6a90c9e65db
SHA512 bc857cf98159f57a3d94e39332dbc5122a40f6b50d10234d3307b3a3d9d276025d7b200046b2100617d2a58b14b50472c23d3bb33cf2f960699b957bab7110e3
SSDEEP 12288:Wi4e7ARdTfgwCHKy7GLbbdIv6LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:W3ld9CHKy7GZaNyBo4kx929bL3Hnx
TLSH
T18775CF90F3E810E8F1B79A3489764511CA767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 59dc886c2b9f3ba6b1373dcaea6e840b9bf9506aa79618e0030059ef04dc194a
MD5 6bdd6b4246c6f43fb8d8a0ad5c631218
SHA1 a347ed643b2efe4dc8242ba2f8e01d0bbc2d33b8
SHA512 3d014879f419d9044cfee1321fbd1217e3a2a2f6deebb6bdd8840f9093558cd895317cafe16d4612a1a85a25b131e8b39dbe18f6e2d1f105b76a47b8607c59be
SSDEEP 12288:xhLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:xeNyBo4kx929bL3Hnx
TLSH
T1604523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 3ffe70277d2abc406a01f4700931328466c321356dd7877800f2733e92348bf7
MD5 7a9d107b9403581a3837a7734778cb22
SHA1 1f24bbfe482f1027fee3f5890e4c6d05256f38ed
SHA512 3f3b48277c23962a7f564721b79e7767bd0522757cbda67c2b0dffa152397d7ce43ad702aef31af3c9f06320183248f3c6cd729f5888ccddb4fe5d7dc6e64c54
SSDEEP 12288:4DLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:4QNyBo4kx929bL3Hnx
TLSH
T1864523125A0C227AF76D3FB0644A8558CC34BC8F1EA597D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ce40b5c2ed66904184310fa2c32b3320f9090b8688f9f57fbaebc53246935c78
MD5 7716ce5966620ad84d3922e588c857bf
SHA1 646593f9a38f7cef160c023c98f7663658d54728
SHA512 a9693922c16cb09486ba7970cdbd27a0e51ae660c92de6bb2ef3be2d23a4de427d6605bd72c704e1b2e24c70e5c372c24b5b6a05879af8646238a1750cf35806
SSDEEP 12288:L6LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:LRNyBo4kx929bL3Hnx
TLSH
T1234523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 1618c511587f6ecaff58f1e992c1e913dd6caa626f512a756ab741ce381d0c66
MD5 e57226e306d56489223acec3774d9e3c
SHA1 780dd7649fff7b20539f496b13a983e556374baf
SHA512 c6e60df813d516712ffba9b86196f14c9381e787fd410abceed2080b031187c88679a0385e020cec53ff73230fb5208a23b1835d09f804294350fb4753b2820a
SSDEEP 12288:T4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:TnNyBo4kx929bL3Hnx
TLSH
T10F4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 c671230127da00392425cecac43791d0711765b8939db992d082ddec9252273a
MD5 55a737ae7629f4cd50a362b36483c48a
SHA1 6455be124ca2a223254e6eed6b7f8fa9bd46421a
SHA512 4745fff7137d791c5626d06f27a7559936aa9eca2ff5ac42391e8c59b04856e92916da9809102dbb5bb4ad39f902114e0e026a1ff0c9173945ea5fdaf868a71b
SSDEEP 12288:1hLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:1eNyBo4kx929bL3Hnx
TLSH
T1774523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 683eccac5ddc4857186312ac813f1676b7af28952e79954cd82272b1e995c9a9
MD5 dfb917b7ee8a8dd164f735fa5863847d
SHA1 74083a02f79dbce5f32d6e0277af2f7ca364bb8c
SHA512 556f7c77871cbb79210370afe80aa6d22d08efed63fec32d94392b5de0a6ffb19eaf562778e3e746cf6650251f184837c8d737a0a1e39a1fe71b2edc7fa8b7f9
SSDEEP 12288:xwLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:xPNyBo4kx929bL3Hnx
TLSH
T1BF4523129A0C227AF76D3FB0654A8554CC34BC8F1E9697D8EF27987759BCEA34A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 d0172e0c4d9a37a7a39fda1024b99fbfbb7af2f4b3829a88f4619f171321c9d2
MD5 91e176c0f591d9224c553b454de66f80
SHA1 ca922cb5b5a7a2486290e3b598199438bb05ba89
SHA512 2b9919b44ec1e3cfb6265ee238786b92286dc193fb8605abcd760ebaf9cd94c02b0ebfdf8b689ba2e4399d02ffe979755d6e834e38ece50018fdf3a26c2e6ad7
SSDEEP 12288:x2LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:xVNyBo4kx929bL3Hnx
TLSH
T10F4523125A0C223AF76D3FB0644A8198CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 6e6d706eedd875f45e6f8e6707c66e6937d333ef2705d9782c31fceab730847d
MD5 918ddaabadb09b6f8d24bcc6cfec219f
SHA1 c4349723a58186a7bc477e4a453891cbee6bd632
SHA512 8951570e656fb653978dbe81586ee1e018a15829bc54991d01e2c94d4bfbb60455a69749b4bdfc2414135827904defab687e3b16c48485365f46076046345d84
SSDEEP 24576:Xfwvqk9RX6wkyAIrNyBo4kx929bL3Hnx:bMnYIkB+kn3Hnx
TLSH
T12785DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53BE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 53b5820b4771c822f6a3c522688e8fc38506beabf0a32968f21a23632e9f94eb
MD5 511c1b0cd6ccb24c466172bd098d24a9
SHA1 38bbf32ab4ec966b856c8e30a3c9bf63d514a295
SHA512 fb9a51d8db93ba94081c4b1e8589c907ceb40792fc68ae6866f8006fea531b42d9f856f9c32e4eca8619d3eea791d4add6a07a0ea1bd8c7b23431181b735ad12
SSDEEP 49152:4YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hB+kn3Hnx:vySzPf+k
TLSH
T12C066C56A1A801D9C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 bf74f871d52598083c014e194d07077bc6ea6d1d40ea0cdf114d080b0e1754fa
MD5 4c9d5d6a6e9092ba9fd78814fae26e7d
SHA1 47bb46ab7afa987d071cdf3a4cbe9bcd9a614e20
SHA512 c6a204a93dd14e944712ec4e610b849ef575defbac3ce064ad2b3de6cf5b3880427c7d0f88285a72f4119e8ba6de7b30d7996a2b8647074c6c4e3e379cc92f18
SSDEEP 24576:I47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYMNyBo4kx929bL3Hnx:I47JUQjTirIhCnDHUPfF/xB+kn3Hnx
TLSH
T17C65AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 9937a1ac26bd5c3f74b562c248d71820569b139a31b1854e2bbd54881990e2e1
MD5 8a95e6436a5c536ca919070ae363c015
SHA1 f163b1ee40db7ecbaf806fd912b1313b518283cf
SHA512 8ba272bcadbf94128698cde1b252c94af59bf3167915833344f1ff33945232a49efb2988ab527a7d9e8705c122466c9bd99e9cabb6fc23b492b1f6d83e6f8f86
SSDEEP 12288:GpsfoLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:H3NyBo4kx929bL3Hnx
TLSH
T18955F00AD25812E8D16E2274CB468A40F7337C5947E1D3CB97D0F87E1F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 02c2f1703f89d27e8b37a58987ddb38c9e062e5fa5155fdac097ddbd3cee5a3c
MD5 35fa824ff251c5bc950c7ed762407f6b
SHA1 2bf5b80b85b620a49b6c63bb5b032ceec33c623f
SHA512 0a28f5b9d6297970cbfcf184a40257b53db1133401fcef92cd21de5c5539044183f55a00e318dc83783c8a2ed379e51552c2171fa1a07202d271b727b398a664
SSDEEP 12288:zI4uU3fAiH+FkS2Qf5FMHKMzAJ4hFiFEu9o1i/:zIrUPL+GS2QBuHtzAq7iFzo1A
TLSH
T1C3351751B626C74FCA6940325E33D2CCAB707D51EE05AB0372C9873FC576658BAF2682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 9d556b1b9db68f7bedf406d3549cd3f82b761e799d8cd20be45f02b2cbd55249
MD5 84c7e873f7c3310cf0df71895a5fa9ba
SHA1 01516bdac5a195b3cca2188a395c8a1d615e3a2b
SHA512 debbbe741da38e2675c961053b5b4b32a86bfacd52f1a61d041f99502249cffb48b84b564e5b3069d3b41a1bedc408447b444e0e19bb2043661b249d1cda099b
SSDEEP 6144:K7swmF4xmx1lrLEYW0Yeb5Z4QmtMxCEQmtMxArQb5uEwZt7QdZRGxjlcAHv0:JT7Lrt7PpY
TLSH
T1FF65E840E537E28FD5F6603107266B8CBB68EC17B7056F2673C8053AD86A716B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 33c02f343fcab977499840b5d59ed4c784d7c31af159ac056511a77161c45a90
MD5 f8844b86bc6b99ae5a80a83c30483d2c
SHA1 35307ffabf30bb7c3cdde87a1576e6a5fe442c6c
SHA512 b6d26bb08b273e873d60a0684c2cdda18da132153667884703626d8e8e3ce7d19ac73dfa524ebb129b91ba4797f474191c5b177a26fa03cf021b105fb453b321
SSDEEP 12288:Xy7gLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:WfNyBo4kx929bL3Hnx
TLSH
T1CA452312974C623AFA7D3EB0645EC124C839BC490F50D6DBEE1658BB59BCED28E30207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7287ac07606ab00f30fc20bf447e49249089c00accb825427b7dbbc993977344
MD5 ddaf69ddc50f342bf38f9e5cef331279
SHA1 daee94e822568ce2baee90c71b589738f29e5999
SHA512 20d3a8c45b1c1099bbb81e592b070e2723c26d6b7105b2d5293f86d88bb09980a0c16ced7d2e73f8f23812ff1d278e6f14db7524c250dda5afb68d23c148447a
SSDEEP 24576:1gb6bmBIi49WNNFpg1rSvFv7bYJNyBo4kx929bL3Hnx:1gb4mBIBhGFXB+kn3Hnx
TLSH
T1BB65AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 5068b927f6461a07d1e132fd42062ab2a797f434056eab8c39469afb5ff1bf9f
MD5 ec9f0ae1c691af257a0dfa19bb574ddf
SHA1 ff3a0815ec155165a55ea05f16de015a2be04ef2
SHA512 0be26e6c2d7082f3926fe4622358912719d2c5c0c45cb0254f4571c37e36464e84d880637c0f69ab14403523a64e744fcc59b5aa835194960fc9888995030fe6
SSDEEP 24576:DG88u8FpJqH1Jzria7/mcNyBo4kx929bL3Hnx:y7ZFPqVAa7/mB+kn3Hnx
TLSH
T13685F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 83c190f740eaa9dedbf596a1ae2ed06ec8ef97170009af4d6cd1434174385b87
MD5 3e898d71801964424bf6a7b0b07f8629
SHA1 96650d01f6d12d67bf1f60a971dd9afb7dcd4e79
SHA512 a73e091fc6ccf3a0ca25336f2db7abaa488eb2be185006731dbc25f0b581c23d06984bc58037e651c2e846f97b1465db12669134fd04b53c2a9c9db9919a0435
SSDEEP 12288:UHvUrBFrEjwaQLLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:UPUr+NQINyBo4kx929bL3Hnx
TLSH
T1D865F21F22AC18E5F67AB17C85868609E771B8560712D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c6a4b4d9c898655c3b99f86e505d16e256a3365422f805f883ef9cf99e38017a
MD5 e2dbdab2c205d6037556b35af73038a0
SHA1 eb082e4bbe998185bce7e252c82864f3b76bc231
SHA512 3d70cfb562178c732a603e687b97faa25b1c64d276de32b91bc202a953fa0785b84f8c93a7aa433dd9c33393d0d6d23f285eebc0c3de2a4827118af3e8e174ab
SSDEEP 49152:PBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjbB+kn3Hnx:AG05lO43bg+k
TLSH
T117D5CF6A62EC11F9D0BBD17CD9C6460BEBB23815033556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3e9b75dfa69fb8f01a49e09ddddd43649e69459c60273a00941bd43c5b4c7667
MD5 0469da740ff822b3cfae7bd2272346c4
SHA1 f077705514f6ba658fb05d1ed3c77a1ec188e91f
SHA512 609a3c2ec2fde06f4031c3d903a00d4c408c53f2f31f1e52228ef70369d52980121fdf9864f38ae25180f5c59e74962ff6db123a5a2d7ee0ef425087716b82aa
SSDEEP 24576:Kfa5POZ3dpuWVM50JicR2hG0lasx2+47eidniNyBo4kx929bL3Hnx:Ca5POZ3BJt2pasx2+mjB+kn3Hnx
TLSH
T11665AF5EA6FC01D5E579D17CC583861AE5B1342653329BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4e6bb028eb3167e33b5d0916489a9938de0f5426ed6424d6691672fb8c6f1baf
MD5 b48143d81712fd17534e0a378b9c45b2
SHA1 668ae1b8419f242d434d6baea501991eae471759
SHA512 686d2f7f42ad6cdde66982011e52292dff8e223a7b1a1943652de6cd20e3bb1555a1ae6ec934ec99149dfb4ad04b448ff9bc7d06f2bae3f1c055b69ffe4ff422
SSDEEP 24576:BNcwHdjbyQ4nLC18lb/EOjowL7Fk0NyBo4kx929bL3Hnx:BNc/zEOVHFGB+kn3Hnx
TLSH
T142858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 94236a16e77b125ec072beb6e1267e6291f9f3ba41baf469be00a3cfa1c8ab4f
MD5 92ad0e531e1e76b34cc28e0272d753ae
SHA1 b0220176c4dd4bd8f5f74aec9a5ea38a83e707f7
SHA512 03fbb48c2a6174fc7eae00c937048fc500b298010149672932fa15282bb0cf31191c7b930573157bdc444491cdd514daf966a145ff69be841e3bde46824a9b1c
SSDEEP 24576:RTkNvNnaFeYhJNtmZBmRNyBo4kx929bL3Hnx:RTMwBtOmGB+kn3Hnx
TLSH
T11655AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 0ba81c3dd33365130f49448fb6354ff405ad0521f8653650c6e2ff3ee385b329
MD5 c83b0e72750dddacbcf8f76ac90d9d8c
SHA1 35fcff90fd280885a8c9876bbd6d5c698dfcc36b
SHA512 390ae44bd73a32468cfbd93c6439c755376a065433eb3e96dd3fd2fb4a36b265ef169548c3b8fabb49183d4c1cd9091a05354065e79647ad6f0dd95a38be1a56
SSDEEP 12288:cQcMxWDXN1Dp/fshBItT1IQgAcLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:mD3FHshBIYQgADNyBo4kx929bL3Hnx
TLSH
T1A875E13EE65C00E4E57BD1BCDA538906E67138AD072266DB06D4C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/204-133-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/204-131-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/204-125-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/204-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1596-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1596-327-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1596-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1596-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1596-94-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1596-88-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2332-311-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/2332-120-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2332-113-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/2332-114-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2608-84-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/2608-308-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/2780-26-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2780-28-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2780-20-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2780-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2780-27-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3388-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3388-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3388-41-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3388-43-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3388-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4044-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4044-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4044-312-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4044-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4044-107-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4044-100-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4400-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4400-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4400-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4400-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4520-298-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/4520-69-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/4520-64-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/5548-18-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5548-0-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5548-2-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/5548-9-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/5548-16-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/5784-72-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5784-307-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5784-74-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5784-80-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/6020-57-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6020-53-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6020-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6020-46-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/6020-59-0x0000000140000000-0x0000000140174000-memory.dmp

Download