183d77b5bd6cf2678ff7135af70273f900ac6d51824aee6d0cefef2fe91be6a1

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_11d291f60d3e931523e3041903762e6d_glassworm_icedid_njrat_vidar.exe
Size 7.9MB
Sample260723-lblv9avdkf
SHA256 183d77b5bd6cf2678ff7135af70273f900ac6d51824aee6d0cefef2fe91be6a1
MD5 11d291f60d3e931523e3041903762e6d
SHA1 7620c518daff8c33f93b4f74b2f77789105da557
SHA512 29b22a4f1ceaa3cab52ae606d08eeb94db269663aa644e38129acbd4451e9aa39574ded621faebf6447e36e68c5b6dc44c4c562bd67deac45c2bdd249532af2a
SSDEEP 98304:9SELgWozymQSACwG0EqvJHuI99oZh5UfNc:oQgWozymeCwGmJHunoN
TLSH
T164866C1A3B6880E9E077D13DC9978A86E6F274054B319BCB12A1479E1F33EE44E7D721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5012	elevation_service.exe
1272	elevation_service.exe
5172	maintenanceservice.exe
5892	OSE.EXE
460	PerceptionSimulationService.exe
1280	perfhost.exe
4720	ReFsDedupSvc.exe
3044	SensorDataService.exe
4868	ssh-agent.exe
6064	AgentService.exe
2940	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_11d291f60d3e931523e3041903762e6d_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_11d291f60d3e931523e3041903762e6d_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1fe9c8fce05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_11d291f60d3e931523e3041903762e6d_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_11d291f60d3e931523e3041903762e6d_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_11d291f60d3e931523e3041903762e6d_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000013a82af7841add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000001c722b6841add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bfd903f7841add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009cecf1b5841add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003eb39ff7841add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001eb136b6841add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053cfaeb5841add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5012	elevation_service.exe
5012	elevation_service.exe
5012	elevation_service.exe
5012	elevation_service.exe
5012	elevation_service.exe
5012	elevation_service.exe
5012	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2000	2026-07-23_11d291f60d3e931523e3041903762e6d_glassworm_icedid_njrat_vidar.exe
Token: SeTakeOwnershipPrivilege	5012	elevation_service.exe
Token: SeBackupPrivilege	4720	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4720	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4720	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4720	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4720	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4720	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4720	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4720	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4720	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4720	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6064	AgentService.exe
Token: 33	2940	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2940	SearchIndexer.exe
Token: SeDebugPrivilege	5012	elevation_service.exe
Token: SeDebugPrivilege	1272	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 4424	2940	SearchIndexer.exe	101
PID 2940 wrote to memory of 4152	2940	SearchIndexer.exe	102
PID 2940 wrote to memory of 1548	2940	SearchIndexer.exe	103
PID 2940 wrote to memory of 1672	2940	SearchIndexer.exe	104
PID 2940 wrote to memory of 2924	2940	SearchIndexer.exe	106
PID 2940 wrote to memory of 2608	2940	SearchIndexer.exe	107
PID 2940 wrote to memory of 3484	2940	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-23_11d291f60d3e931523e3041903762e6d_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_11d291f60d3e931523e3041903762e6d_glassworm_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1272

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5172

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5892

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:460

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1280

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4720

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3044

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4868

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6064

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4424
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4152
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1548
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1672
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2924
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2608
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1ac7920de27b45bb298ee705b7cbcaee06f8d0f08c5745b7c946be6658b6ae9f
MD5 bdf0de36b22b5227f258d6f6144d8863
SHA1 877b88bf706f0826ea1a03374854d436b7664134
SHA512 c57097cf209dea04ce388bc45ed632b286c2f3d4b345886cfe1ab105d7981b3d694e7ce60db98f329165fd5f177c1a1fb5244e8e7451968578dcfd3040bb3a58
SSDEEP 49152:yb+632BuPkFKRrdE6ohQstBhuXjfS4LWxn45UfqkdirbGbc:U3q6tjBP5UfNc
TLSH
T170D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 a370493d339431ea652b9d861c025c704c059a54073876da3e4d0c721fe0cf3a
MD5 e1ff80b5027561c283860fd7b278fb0c
SHA1 dca084fd72794bb5d25a094d160a06b7cb7b5f41
SHA512 60c4e2eb3422214275932dba60aca7df8c9f793a28812bc5f984a018d288c44387d6e1d88a9028d708b8268da108388b3313824780debe56d2bb7143d4f09882
SSDEEP 24576:8XYfDtczAlt5wXWotDWi//dirlvZGMApYSRiO:7tcC5UfqkdirbGbc
TLSH
T12985012877E508F9ED67813DC8A28501EB3378914790E7DF03A4AA251F772D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 b08c48dc00c5225e45240d3a23fac793060afe9c3852f42342e99370e466cfec
MD5 ea753d8e349260cca8f5bce9e8f0c960
SHA1 0641bb53bd121aab7f678bb8594f26f46a22174b
SHA512 a2b7c5d067fef62fd17a7c45a21b43fa93a599adb950c10eeaff5ebc9a41dbee8e1ea9b7b2f03a88d785094b7831221ef44f90d82061152a4f898af3daa7e47b
SSDEEP 24576:b0Le5ji0hmxMrMYt5wXWotDWi//dirlvZGMApYSRiO:bPji0AGh5UfqkdirbGbc
TLSH
T16AA59E16F6748771D073C0B9C5D2A68AEE7230825B308ACB4285D77C7F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9b9a4f4e56b073deb9c729d90bd15e52713fd847030ed8308963909965acc40f
MD5 4de8cba11d50a5e0b4fceae9ff884105
SHA1 4956c9f77da5e22a29293eea43b37b60f7a76616
SHA512 3280dfc0b4fc87752b34eb4f308ff076269133174270dd11fe485dfff97da9cc2cb1efe5ddc54bab6991ba313ac452be30c740ae1bf64b2ad99c9ac7206b4290
SSDEEP 24576:+a7/ezSC6vUyDZaqgrvWx6q8wyuit5wXWotDWi//dirlvZGMApYSRiO:5/ezSC6vURPvMHjy15UfqkdirbGbc
TLSH
T13F756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a5848677668a4288910d8abf09f3cbeb962379bc592cd3d29a53d01f2777ab85
MD5 aff108f24286758031ab81c64f57fdac
SHA1 0b96bf66a5f7742f46ef615fc125d044c69be42b
SHA512 6dc792ce48d4fc2a22256956b6b781393ac38844e434619aa8470cb8ec58a54e8f91edfa19815cc27823ee01958537fce330555b1cb264c559586db34bdbbc0d
SSDEEP 24576:3VbqPb88hv/lV7ht5wXWotDWi//dirlvZGMApYSRiO:3VO88hXlVb5UfqkdirbGbc
TLSH
T1CA559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 23932a82b8435d5e77a0e89e3d765b92c13c4594d94a64d760e198eff6526157
MD5 ebc0fcbc18eba246b254fa23a08cb721
SHA1 820fd9e69d7a4f8ec8cd666c118278aee57973f5
SHA512 5b9ee9419c7e950c8597ac85ae2617b56ac8a0e2706d4d68c59ae63c9bb99c55202e252bd3a78462d89fa79b7db987f922b231b92edd7b6a3219735d4f5dd4ed
SSDEEP 12288:kUkYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:kUkt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T182652346DF5568F2FB5B4532B06D4E46AF227EC088C1866E89603B6817FD1F4E13236B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 06e32145f48083714729ecb71ff1466fae2a06f8c3bd8d6f33e53417d4741bda
MD5 896cc232545acc71cab50ae33fafdbbe
SHA1 b59d30bf7efad4dccbc501e90cd06cf3cf83e443
SHA512 c07f062b9ec66de2b2b5178b2785ce40beff616025b5b176142f3443a497b0369df640c98e86a1906cb6e24460c36c0f2e6692548262217b5f76eec8acf8fb7b
SSDEEP 24576:rJIU5t5wXWotDWi//dirlvZGMApYSRiO:rJIUX5UfqkdirbGbc
TLSH
T12A85CF3BEE28FCE2C27A8D7956918600E77278704F5293CBD164830EDE275E05E7AD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 34dcea4c085dee7a13d0a3fe1b903dd00e29f3d978a35c1c2d3c85ad1909f7c0
MD5 a68a1ba6c3569d9cac3213292dab1a3e
SHA1 9b0c546846f1b2f5af7b37d53f4a7424a4a5c69d
SHA512 7836179f110830cff4096d5d5e598eabed158cf0dfe583ea1fe1ffaf3a90cf8032b8f923680700b1ae01dc73cebf260459e1f9a74b87f2e3f19fbc4e870b45a8
SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THz:QQvGAdlCEL8c/pRNw5Ci5UfNc
TLSH
T1C9266D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 130a3574b6684a7aec38fefb16159243cfa389811a71d2356e7f2595059969b9
MD5 72c3e12f0719efc2069ebd44d4cbe417
SHA1 3da7ff6509e22ef6e860b7df8e57224aebea6aa4
SHA512 d77592494c890039e5fddb57bdc8c597b1e18e27ca0c140e595ea0320414a9dfd62e0bce1d79e2107cc39d91a143ed5fec72f052c45263bbba01411d5b7d473c
SSDEEP 24576:BmewsAjrt5wXWotDWi//dirlvZGMApYSRiO:MljR5UfqkdirbGbc
TLSH
T1E785E031FE74E432C27B0DB22B36C706583D7A604B911AC3E3A85E9D59742D26336B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2ccafa9b9fc8ca3f769c9566f50472ce9f45ff7a938424c3c6ed4552963a9bed
MD5 55498e7ee7a6b8bc19e3dbb487778eb2
SHA1 2d8bd910a34a301beb57e1a5575c0cf0c189f6e7
SHA512 70716faad05a833659f0871b9865d93ffa2f5f2b77a41736b6132114e858c596c048cc5e3421ecef3e505b39a35317803ba05578ce85ee79d9a14d41156f8847
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJH/oN:BUEtQevvqc2W1cpV29I32AN
TLSH
T1B5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 efb0af9ae438afb5d3ebcc5a7dbe3ad423a5462656b9ab0603ccf0fb5191898a
MD5 912dbc66eeb49dba3d98f275bfbe7c9a
SHA1 8e9c82c6e61056b67e4150c8b9f9b4d36260f3ac
SHA512 e66d8ad0e19a09e2521719409769bf6097d55004e3dec563516ca52d98bfe77a151967cbcfa5ccb642afb879a912d8269eecbcfefcb5fa91a8667d912c31c14c
SSDEEP 49152:MCbRquA/m2yL5zTfFiV+XenmE3/zx5UfqkdirbGbc:loquVjnmG5UfNc
TLSH
T11FD58D0976B8C1E4D1F6C77886A2CA47F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 016bf1af9bf856c4cdc71bc5931925875a0a0b5d720b04209ecdc6c13c181808
MD5 fb732e95f523fa2c23ae431bf39b3d78
SHA1 dcc4014d4fb845212ff0beb9d29646e9ef25354f
SHA512 ed9d836989500643caf695f1e1f18a3fa1177d851cb0ca8787e4c8afdc97be997c3aea4456de96cec200d405e39fbc089ab25b9738b2820f73bb524703bac5a3
SSDEEP 24576:nAhGLmIFoiwtA5l7S53Wt5wXWotDWi//dirlvZGMApYSRiO:nAM1Foiq525UfqkdirbGbc
TLSH
T12535AE80EBF955D4F5B3AA78A9B68570EA76BCA55E31C20F1160D21F0E33A50DD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 4518ae2e8f0e781d9ad0362f4f90f831d553e8f68d7f921e0431e04a6ce288fe
MD5 9e30abf32682184da8405aed80ee2a20
SHA1 69ad3b7578e53845a5fde8e33600bdd6b723af68
SHA512 0396e2eafa765cbf4c14e8b0b2e42a847143197600f2fc26d0e639bc838c3ee497a3354af0a28d037364246aa3198873bd8329464c59c2000f45395f02b4a7ce
SSDEEP 24576:swu1OWPt5wXWotDWi//dirlvZGMApYSRiO:sw6OK5UfqkdirbGbc
TLSH
T13885F14A77A41CF9E9678239C55BC536F7B2BC012A21C71F0760C75B6F37261AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 d2a81aa803bb154198537a9f391497a6580d3206bb2261f263680cd1ae123dc1
MD5 b8177f093edd884e54b8fcafbb6c2e1e
SHA1 5ceb11dc5406293151b5fbbaad3c350f4754647d
SHA512 29faafee31f3ee54d3ce8b2e08de328b7d5de8a75ebf901e8fea78b43f1f3faf51681f315fd02693fdbfdc7a2ce3762c93d5771cbbf539ee70c97166b9bef045
SSDEEP 12288:/tZ1Iy7YbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:FZuwt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T11C75128A37E430F6E267423DE8E94A05E7727492576283CF062027691FBB6D1AD35733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9ab9454f86f9b87ffd264be06df888542bd53c8a8d151e257e959a0155b2652b
MD5 752d81d444b34c3fe3395d30d0d30c3d
SHA1 72f0d06195ec63c7da5644f3b09dd17ba595f3c2
SHA512 4c44e59347fb91933990f128ec5713d55ca10c5d7768e517ade6047985281183f39a63cadf3126397a226fff5cf4b5261b4a7dc8b641e100605f217b1612a2d9
SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23U3:VQRQyi36YOcPuLvw2gAf+PN3r5UfNc
TLSH
T170667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c78e5a23bab67a38d1ddfa53af0865423962719c279f0d500a4551eedf2906c3
MD5 7423d8392a8d0a189018e4af70db92ed
SHA1 03d98a569bc8043a44940d5aee94a6433ff1c99d
SHA512 47ea76b896616122df9d045fdc426b209b1e24c5a37d9c6f3ab4788e3f8ae85c04dd1668dec21618f1b0eec343f36deb3590008b752989b3f8bc18f6f18e8b17
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23U3:oQRQyi36YOcPuLvw2gAf+PN3r5UfNc
TLSH
T19A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3f38ce73a1c211e619d7d5013da0f51a050b52390dd0a269d33a65d32bd95c11
MD5 96aa0c2085694d507ecb5d3657384569
SHA1 d654f82b962fc3f8a1fb7a1b18698a03c52e3e54
SHA512 51844e343e2209103046fc08e7c5b36e5c7fd5c0f530417e894bfaf277381ce021e5865e9f1dfa66a1e333325d0dff6b0acb33e731207d54fbd3d2b2273a0ccd
SSDEEP 49152:b68Qg55nhxeWu7PNU3/h5UfqkdirbGbc:lthGRc/h5UfNc
TLSH
T197B54933B2F600A9C44DD1769F4A872196D27C718FE1E3DB8511721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 eee4da26c1a9103aa892fb47b817fbc79184d9e6b1c6e122687886294b4348a9
MD5 73db79a505489b224e5394d79204d124
SHA1 89e70739e0e3e6e529ce09b4ff9a9b0c6350020b
SHA512 e153c3baad00aa064a849e10b71e68198af75b8f6c16eef1d7484a109d5c54e2744939e1203e567251ed9049c5284dbaad468d60526931eebc76521e85d0a49b
SSDEEP 49152:l3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Z:Ey5112gYy5azzVvD69nLKnhZM5UfNc
TLSH
T1F7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 95c26d273e17e300acaede26c03f94317041d2eeaad0937837039a9c803e09ed
MD5 e40c5d7cb18e18d95c3576002a060ff2
SHA1 760c1b8e8de1eff84e3beadf91fa78df60802dfe
SHA512 c18ba14678a8d07aefc1f8e7a9379cf21493fdb76d148f3acc6ece9b8ce2dadee9e4884bb5ebddf3a9ec7fcf54e1dadbb4d91eebabf487cce08a481a0efe1188
SSDEEP 49152:YB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glN5UfqkdirbGbc:yu6JmQxd2dN5UfNc
TLSH
T169D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 64df63a68146dac77c2a5596180e7f154efe6f97a75b03d084bbcda3c62e5a73
MD5 b0a867c00d8a8192212829d87f92eca6
SHA1 78a7ac6db39b3b76c9a808e42ac335aa2267a544
SHA512 d1962134082993c6945c55c91477ce1f3d7a612ae2e359f2818609712ef033429566504c44e87bcac00fcc7605e3fe283ef714a10e71af194b49221e3dfbeb17
SSDEEP 49152:P1hpsNoJpF1A6yU44CwH7R4x35UfqkdirbGbc:PmifPVRG5UfNc
TLSH
T16EB5BE13F2D900E8D05EC17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bf5ffd7005be991d4a24e3889a8c0647911d7083470094976e0c236f4d1d1a95
MD5 cc64466014cd7a73bc10915039213dd6
SHA1 5191e80fee7096e66b6a96a1205f836289b9a47b
SHA512 6f4151810a84a4557d64df9159f3354fb59739c53992efe4aff4cda285a5078712e2587e80f354e2b0ab00797e6d18f724e91b9f2faed7cfb4376acbb657a12f
SSDEEP 49152:aSuZQIY0Be2KIRVtOnks6NMHqo5UfqkdirbGbc:E5dKOi61o5UfNc
TLSH
T147C5BF03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b88bf1252aea6f9691b4fa6a895aa992c01807a07752f987321a5197c3ddbf98
MD5 c05b6639041baaa78f928b18cae65bd3
SHA1 eaf46d7ab28d0ae23fbc832138582e6ff6e3b88b
SHA512 4d0ec2eabceaa194301790e5567ccd7b399a647161fc91fcdac203f58102ce86aafde1b90cf55fff7706ca818be4d9b5ce2d4842b943872e761d572946b23306
SSDEEP 49152:AhtSn8EApI0figGgiDn0AP5wT5UfqkdirbGbc:RX2i/phq5UfNc
TLSH
T1A295BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 0b92f50cce6a8509fe17acd860d55a2457a49bc04149adafd083b8e15b71fa99
MD5 96eb0908bcd78a491a9866c9845a67cc
SHA1 48d4bc142e39f8851fb5fc005eb2e8d401892921
SHA512 36dd622530aa934823944c5bae842238774b41e9af548a720d878f59727433a5924bcac777a7ad6fee3f646ebdb9028a284a5704ee0fb726b5167e28d15c6140
SSDEEP 12288:JcYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Jct5wXWotDWi//dirlvZGMApYSRiO
TLSH
T134652349AE9658F7F6078572F06D4E49EB253AC1D8C282AF4A20372417FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 3d83456d8b2fde16958d3ba0dbb3f337224d032de954477a157830ceb7d5e80d
MD5 c147e9ef07891b153f6ce086e26822e4
SHA1 5517f4c940b74789b17053572088e0de90f46e03
SHA512 aeb80e840fb1ebba1fc69ca1805854afcdae4656c7389d2a4c51b7d440f10285dae44da35a8cb7d1b05ca7b55d6b4ff7fcb42ccdfe53be2d502e38ead2cd2bc3
SSDEEP 12288:63YbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:63t5wXWotDWi//dirlvZGMApYSRiO
TLSH
T19B652349AE9658F7F6078172F06D4E49EB257AC1D8C282AF4A20362417FD1F4A1317BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 60b9312817aa6a21334558bce0c574e9785c8827f7d611a7f081647f2fc5fa6d
MD5 d59784a1fb2ace250b6147e84d5b19b1
SHA1 b8252bb2dc6446f9251982b480a743318e3d87d8
SHA512 6112c911551a25013114b4739ca213fc59981d2c45f567353f0ccd84d868d8cff9853c5d51e5cf6a2ccc1822e5e19755d677d7cc25303f76e7294d4e809d2882
SSDEEP 12288:xRYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:xRt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1256523499E9658F7F6078573B06D4F49EB217AC1D8C282AF8A20362417FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 a41167d832b2d57f40e936e7216a50613d4a5fc24a7d84bda6dbf56a73c5444c
MD5 b5afbe8f86af1a3998747cf65455297c
SHA1 206283c3cf43d24eff54fe37f4843598fc0d6b9c
SHA512 cd34426819c43a7228b1d682ccf855faea8b23820c0394d6be3b36c46f72f2432284e4ecb07f7cb03aa3a3c852a872483efcfa4c0bbd077a65a5c4b25cbbedd9
SSDEEP 12288:+V2YbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:7t5wXWotDWi//dirlvZGMApYSRiO
TLSH
T11F6523456FA654F2F917C236E4694A05F7717DC0DA4283EF8A103A280FF92E4E531B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 1902cf48488935cafe79ecb4669a53fe570be51efab40805708ddd2ab6ab24fb
MD5 3b1da3c617fbdf1f1fb1d79040cfbf0e
SHA1 99d9703074096a74c644ef3e347e4354ac40f15d
SHA512 20df34389a5a763185e82e6eb876d5c816390ed28424e7892506d6075ea507e5fab7a1e144930c2cc1878b98ebe09a04373ad2a483341a732bb9e34377787c51
SSDEEP 12288:OeYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Oet5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1BF652349AE9658F7F6078172F06D4F49EB213AC1D8C282AF4A50362417FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 2e3db9ebc3660c81469805f8ce4b3669171d54cee76ea7982671a4c889499cd5
MD5 432f0a327cfa0883e252f1c276f941c6
SHA1 5a11ce7f5a06aff0396e971142f98b8056ed67a2
SHA512 c93bd6d61cb4ff2b652583db0e6de5ec291b6e8105a76c1f7062d75a22fe9b504cf9876e5feda0bc63129cd14a53f6e39f590dbc9a47f579ef37500f3770d639
SSDEEP 12288:dDYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:dDt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T10E652349AE9658F7F6078132F06D4E49EB217AC1D8C282AF4A20362417FD1F4A1317BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 eba1da2a0e0448751c8e640063b3955ed1fd015ba2b6116f3dea2321a63fbc13
MD5 90df90e4b97c20a484748e924ce8bf76
SHA1 0f424ac8e7391531f517b3635cbba3feadf220a2
SHA512 97646f7253bd457b74fb8d51d425dc8902baaff9451188d3c61e9a82aac47c3986d71da6f3b2d04e954a7a8b0e937b97035f7ad3264ee083db8f19309c80211a
SSDEEP 12288:f/YbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:f/t5wXWotDWi//dirlvZGMApYSRiO
TLSH
T19D652349AE9658F7F6074172B05D4E49EB257AC1D8C283AF8E20362427FD1B4A1317BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 673f73aec4786561035dbab7c0bd944e943a7f3a34df498964c020caa9528785
MD5 7ae52e1a9e104539522651ef4b47d184
SHA1 9f7a30588fb13f58ad0b97727982bc94572d745c
SHA512 16b39ff2ff6974e75e8d3cb48181c67f5ff32b5c9a36da3e37fe4aa2c3bb6ee93a16f3b8a8f258f935e4e90c74e5c10f04f94c42e5a5a482c701cf066bdebbce
SSDEEP 24576:cZMLzFVSOXt5wXWotDWi//dirlvZGMApYSRiO:cZMLzf55UfqkdirbGbc
TLSH
T10F850295B3901CF9EC67813EC8658D06D6B27C550BA0C61F03B4362A1F773A15D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 935f539c47a8ea6cf87f6c4bb5d4307c83ccdcd3ca7e9a82cfd17a8303dac982
MD5 77c471c49f1b31badd82a3d1e3eab330
SHA1 1a72c8a673f6ae6fbec5b31d12be5dd22a88dcee
SHA512 b96545650629236d69f015393fec619fb6f62b507d7f8164cef7ade26dd5afa44ef0f63658647267a651cc5f5b405af55d2da30087239f1bd80969027de65c30
SSDEEP 12288:IAYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:IAt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T18E652349AE9658F7F6074136F05D4F49EF257AC1D8C282AF8A20362817FD1B4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 f01112ad343f00fb10fcb28f9929964a5379bc5ff289cbabd715291ac34ed9a6
MD5 7dc0828b83382029a277c5f05eb72a70
SHA1 7a7ac003bd8c2f7f8b01eac46c00d4775b09c259
SHA512 1ab1015cf0e0f403af5c707ccccd7877b97e7827ac18bade184a46cbb40a964b7011db07e6f739feb80121606f5904cb74469ca9ca932887f94f9fc14fbd6caf
SSDEEP 12288:G0YbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:G0t5wXWotDWi//dirlvZGMApYSRiO
TLSH
T196652349AE9658F7F6074172B05D4E49EB257AC1D8C283AF8A20372427FD1B4A1317BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 dbfeab8b920dd8c532dee854e93bc4692fc4f2708103088638001c71f188da0f
MD5 930e90b586749ac0be7eb24f164cfb46
SHA1 7e2c599e1fc2beeffe9e16c368b6a22073c4dd38
SHA512 e33f1458e88753bf7639767b30804d147bac54149ebc34d6e45705270491404681e696f3dda038a2146e48dfcd704ec3ac46e45adbf27dc966d8c225e23959a6
SSDEEP 12288:KyPz5L87YbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Xzy7t5wXWotDWi//dirlvZGMApYSRiO
TLSH
T19075024777A130F9E1278239D8660A06F77278724B508BAF476017762F772E09E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 70b281edd07b27d045d94760d5cd69dc3a4d0468bdbe44601f52811eb26cd0a9
MD5 81d293fe5380c15e10a51c88a1fb5550
SHA1 612298aca795d6f7ce266e37ef3b5e692174c546
SHA512 beca9f2910d2ad783a7f3f582c80cacd518bf7563de11290ad31b8c93633cf4dc9ab840c10030afc2c8b12b733efd230bf524f6549d3b9ba8a9ae2fba13a979d
SSDEEP 12288:dAYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:dAt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1AB652349AE9658F7F6074136B05D4F49EF257AC1D8C282AF8A10372817FD1B4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 3b8dab937a32490a87cfa7c8b341832961f1cbbd3f0cfa91a98a019fad552d7a
MD5 db22eea252096ba29e76bb81a5827368
SHA1 8844b4546a7f5a186383f9d065fb686654c77af9
SHA512 53c08dfe5ec725c42d8e9ac5eb474eb4e999a6560c70539ae7ea12147b58912a48b47020846058b867dfc15e90043afc19b0fc03091233a15c8cabebeed72e3e
SSDEEP 12288:KAYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:KAt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T126652349AE9658F7F6074137B05D4F49EB257AC1D8C282AF8A20362817FD1B4A1317BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 09d56f3769cd72383a619a2e625b869c8c6bfee7c5e97502e4c427012e6581f8
MD5 7ba9444fd1028d0db65f250ca2ff0f00
SHA1 4db7dbfb26cbe2743eb7d31042f4b652263359c6
SHA512 4ae351d14b5b0574c2a7fccea9500775c43db97bce8403e331d7d351758d253ba7204515266290cd737e298bd4bf78a9c74d4db4d045ad27bdaad29977cc9b67
SSDEEP 12288:cyPz5L87YbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Fzy7t5wXWotDWi//dirlvZGMApYSRiO
TLSH
T11875024777A130F9E1278239D8660A06F77278724B508BAF476017762F772E09E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 de93fed73c2f717ec1912f011ed78c408054d704bb13bf153b9f58812be7bdc6
MD5 0e22df47807fb07c067acb57750b6ce1
SHA1 f8558f55e3db013b57c019698481a511cd6989c1
SHA512 506f2307541f3796f34cafc1605ed16bf4ea6346bf7c47d79d2541fab5ae226ea612bc3852a3973774e945b4c95c27b97ea3ef660a574cb61f8d6d8420726cf6
SSDEEP 24576:xTAaLl3z0zDBt5wXWotDWi//dirlvZGMApYSRiO:xTHLljy5UfqkdirbGbc
TLSH
T189850295B3901CF8EC67813EC8658906D6B27C560B60C61F07B4376A5F773A05C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 803a731a1528379309e54f870f71b2fc2841b3cf4d38cb1373c589d2c1a95f35
MD5 f5e5be4f1a2f0437b5ce0c6972c77074
SHA1 d5cb65a602cf17b041eea244c7fd6370faddb037
SHA512 5864b2c2c5b9c87b6c75fd05e146f2d3ba431f15cf648ed53d540b34b717479737a78cfcf03e09e57dc2e63062dc50fbdae5b904a36965c4b358aa0bc7b26ed4
SSDEEP 24576:P3Pd9CHKy7GZ9t5wXWotDWi//dirlvZGMApYSRiO:fPd9CHKya55UfqkdirbGbc
TLSH
T16A95CF90F7E414E8F1B78A35C9764502DAB67C9A5B61CA8F03A4261A1F337D18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 a82a4e10f7317386da16f1e6289fe37c415d9dbe7162a3a4b9a37c7ea268d814
MD5 adaba1d8da0b1393a9307b40f303eb05
SHA1 be4df65cacdd247c5ecf1c46a69b6c59104e9a22
SHA512 043b4c5890b0c498fb7482a6714bf85a5baa542242b9eec5ce79ae8c5e28cf7c4c2aa06ca11b498a0e3ff56dce6394ac76ae1c5357f998973c2ab244824e7e30
SSDEEP 12288:exYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:ext5wXWotDWi//dirlvZGMApYSRiO
TLSH
T109652349AE9658F7F6074172F06D4F49EB217AC1D8C282AF8A50362817FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 8dcfb2dba2d18c63998c9782955dc3892511f7bf56e086b7f8e70cc6c7c4ea2a
MD5 b44eced92f59973612583ff5a21a2f74
SHA1 216ff3db5e1499eabde182d0308d4e50b696da2c
SHA512 e5cee32e890409544f1e000f2d5cb1640e84ea2a1d8fa1b4ca16f0e11b6d94cc947c9943506577e2daafd8b81539889cbd73dfa0b1e8c766994ead873d7d390b
SSDEEP 12288:bbYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:bbt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T12D652349AE9658F7F60B8172B06D4F45EB217AC1D8C282AF4A60362417FD1B4E1317BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 9f30c94a8a1e1fabc5bc5800ad9eb251d1cba119477a8bba4f478539406e7a4f
MD5 f24937046e81c414f4620f555c8beb16
SHA1 e3e9a80714a6e67b197deac3a589ddd1ce2f3266
SHA512 2780f60d283ecd930e731e2e16c3b11786672011aaa55b70209cd35b7a6ca37b7fdc4dff6010960cf94dd5cfe90081a2e023be0670ec33895236376ae61ddf29
SSDEEP 12288:EKYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:EKt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T142652349AE9658F7F6074136B05D4F49EF257AC1D8C282AF8A20372817FD1B4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 253a50fefb4f82e40c5a1de22b8cf5b76b246a1e677fd7f832da300237d25540
MD5 ff4524d0e7b4c64fc9fd65f0e65dd07c
SHA1 e8a5b44e1f998ff6e26a7cf49f0a17f500716390
SHA512 14fd66b496658140a448362cb7ce1bec1586dc91b1248603a35f8bcbf812cb5f84eba2bb3c6db8d0d8380f956055b62566d293571eb8e7013242b0f9a8cf0348
SSDEEP 12288:sAYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:sAt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T195652349AE9658F7F6074137B05D4F49EF257AC1D8C282AF8A20362817FD1B4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 bcc8dbf438e92fe2228f3fe1494c12a5ddf5870120a4f93e6fcb756e10556a2e
MD5 f0cb23f05423e6f2ef03495d4691d774
SHA1 b37c30f513fd002fb2e642c518a624778cf5039d
SHA512 0bf8a3101c5073612006346c08f2fa56f01dad14c1b3031f63eca26613f8650acf4ad7125c2cac73177f291a19f1749aa14f7b9edc4799cad4060051469f8e52
SSDEEP 12288:3xYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:3xt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T157652349AE9658F7F6074573F06D4F49EB213AC1D8C282AF8A50362417FD1B4A1327AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 9bcc9536efd771b8ff3ef8acf782bf730483694d174571cc56b1dc9f0c5d0c7e
MD5 2e3aae0786227e800ae9fa5daebe1dea
SHA1 5d6b8d677943bec9bd6b81885d8434919a5f5211
SHA512 fe01ae5ba524b8cc49c63b9a115a3a050a32f77f4598834d376690f738ecffc0755454a447a3f2b8552da64e66848c16e25fb6db35938da106489901a6cf51ba
SSDEEP 12288:tIYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:tIt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1F6652349AE9658F7F6078172F05D4E45EB257AC1D8C282AF8A20372817FD1B4A13176F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 164bd6b6bc3cdc0b0b90e651e4eb00cd52de35e3133aaa52bb15bc874873661e
MD5 eefb4da4860edc8d9673978ab9506a45
SHA1 95c90f1b976441400a3e8d284e704755a3fd363e
SHA512 63019c92063bcf887d90134e11778a029c9420b7f414c6a85cafad86fb2273b033ed44d5cfd969121e64d35f7eb417d2d2975431c40f3fdd6aadb5ce58f73781
SSDEEP 12288:UeYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Uet5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1B9652349AE9658F7F6074172F06D4F49EB253AC1D8C282AF8A60362417FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 25b5b84e966fad3b5c7747da752ec0d5a4de11d9cddd7958b6557190fb6213b3
MD5 5831085ee713706ded4603f7ebbfb53a
SHA1 6269c39487dd858e820cae06b49565604f231172
SHA512 ee4f5785f42aa31f6bd21acf202cb57499b0e18674730161a1a762982f5149bab5d8e1828844ba4a0f71f77bec32a00994a2584b4774ed8cde0e672f38101f20
SSDEEP 24576:GfwvLk9RX6wkyAIEt5wXWotDWi//dirlvZGMApYSRiO:ZMnYIs5UfqkdirbGbc
TLSH
T11B95DF29EBDC44E5E177823C99B7460AF6B178591B31C2CF0299536D0E37ED4AE3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8c1e49dbc3c6ec1fdae2e7b30e7504a34bdd6a2047183f9c3f6818c292a88158
MD5 bcb704bfe2394dafc9a6c6b5881a57a0
SHA1 dc63634c16fd85fc8050d6597b1cd44d3e2f1f70
SHA512 7bd223d9f35e2bc4696ea8e2081effc9d875f2e7308434748a288051f6cc531fa1d047a913f357546eef34ee06efb6c42b7308a3b79554b491a4125866728364
SSDEEP 49152:TYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0z5UfqkdirbGbc:NySzPL5UfNc
TLSH
T1C6067C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9571bb15edda59ccc23dc03fbd8e35c28c423568815392e6cd32a824a2e4cd83
MD5 5e542bc9cacc629512e4d32224a45424
SHA1 80f5079f5d438a518cb360e3534cb4424da4d815
SHA512 7da113a16010e770081284c308968c1b6cc18843d6ffee6d03d4c8cb61d4f0af3fe2ff69211593f11ab0869f93d0064f19d288ae029cc199b48a556534a9f263
SSDEEP 24576:M47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYnt5wXWotDWi//dirlvZGMApYSRiO:M47JUQjairIhCnDHUPfF/j5Ufqkdirbr
TLSH
T10F65AE1EA3EC01E5E1BA827885154A1AEA71742E1F31CACF1270437D6F67ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 9d4ba6bd196485796edf3fa127899fa95fba9f5d11c92a8459ff2e3eebf64047
MD5 ae5496063da5d7225bb92fe14e8ce187
SHA1 1b006775e859f598578a93c09fc327c9dc210c8c
SHA512 0400887028a61957cc95bb596397a6c93389da03cb93693936f46ad711359ce45a15daef1790cc4b551b0866fc53faed3c4258da94ff935754db52ccf7d8c011
SSDEEP 12288:RasfwYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:zwt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T15975F109D29801E9D06E5236D75A4A41F7337C6187E1C3CB46D0F63E1FBA290ADEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 996KB
SHA256 8e9d95185441881fbae91060ab32d4207904e0b28ba0d87a95a037dcbcad7ebc
MD5 d0ba1fa7a67c1a45072bd66ec66cd163
SHA1 ed062f340e73861f0435a7b5ae7a7f08f3ecdb1f
SHA512 2a745f36a6429eb7581a4eb01ae09accfa8798568a11db93e3e644e825fc2e4c7d3bc5bb067012cb5add7346601fd147ceba6578af5e73cc971187dd864338ee
SSDEEP 12288:MW3c+eU3fZuucNIJdFBHXYMx/k8YsnFDxx1u:MWs1UPwuEEHH588YcBxP
TLSH
T1B5252710762BD75FC6A980321E37D2CCA7707D41EE059B0372C8872FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 a7519288b614016c7239823318ca0736cbdceb0bc91ddb530bca005fba848cf1
MD5 4847a4872eb61657cc80bddd8a825fe5
SHA1 77846c5d800aeeece77ab3ba4cc16e4ca86b5674
SHA512 32f7fda7dc135d62b35f87a7b735cd2032ec2f3ccd94b7067b4696a043af22e2409df67ee6e6b2cefdbd2b0a375cc58411687b546e825d4ceb6756396314a0d6
SSDEEP 24576:XsnO5w0+OhTjpSsLJecPat0MqNN45WDRtzO66AN/k9zQJt:XsnO5wWhTjpS482at0Hz8A/69M/k9zQz
TLSH
T17965E9816437E3DFD1F66032072A5B4CA774EC0373096F26B3885539D86AA66B0B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 2a21217e1ce47fadcf7a95800eeee75627292d5a76c39f6f3168a2f14e15c572
MD5 7e594535b1a8918d4c170909734489ed
SHA1 ab58463c33aa45ec91f75a66c2064c8f8b493eb2
SHA512 21ac2abf5ad5a15135f5d173a98fee692102db37de8226b814fe59bac6fe83ad37b631f5ed1866814fcf089fd386d6a818bac04948230d6a4d69ebed46464a9c
SSDEEP 12288:v+74YbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:64t5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1A16523469F995CF6F92B4631B06D8A05AB267AD08F80C1DF8910376827FD1E0E93176F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fce136ddea5b33049234916eafe81cde0b3cfac806c75fbb231b59e8d7ce2f99
MD5 c94faed56d1d4c347311a443ca467389
SHA1 2bfb58ac722112e4239aaa3f8594e1afc28b25ff
SHA512 36529b3b43219228e7a6f65895530c8ac27cf9f8ab82721365cbde499e2ff1f57ea11e806311d933637c42a1ffe4cb490eed83d6aca88411543043fd60711d42
SSDEEP 24576:pgb6bmBIi49WNNFpg1rSvFv7bYit5wXWotDWi//dirlvZGMApYSRiO:pgb4mBIBhGFt5UfqkdirbGbc
TLSH
T183659E1E22E802F5E0FAD2B8DDAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 8c173a299e35a40fff227dccd7d0402cf2c774fc61aecff50518fefb04c6d889
MD5 e28838357cf31bcf913577ed19adecdf
SHA1 112b47d9a8ff6eb08ae862155ddfa498919ad936
SHA512 dddfa5759c85a6986cdde9a7039a44d90e40bc650f239fd52ab97352bc03271719820d487c45f0220fac3c4261f676166672b53632215f1072352db301396654
SSDEEP 24576:wG88u8FpJqH1Zzria7/mXt5wXWotDWi//dirlvZGMApYSRiO:j7ZFPqVQa7/65UfqkdirbGbc
TLSH
T1D4A5F165B7E101F1D47BD13889864A67F6B2B4210360EBDF0BA88B551F336E54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b1b9a7d5a6ff7d5d17252c781eb1c65ae4d8267876591eeca24fe233022863d3
MD5 8fe5f7189cf31792ef108e95ae73c29b
SHA1 08f31d3c53ab5284c83a10f3d5fa9b5caacc6516
SHA512 71342db8bc68024a10afc41a5dce39a8db11a79d8142d8785fc07059a41ebfe62ed88e5bf716f79836650a13153a39f8d2c3018ac7b968dfa6f9e6aa781a3a40
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjJ5UfqkdirbGbc:WG05lO43bU5UfNc
TLSH
T10FD5C06E62EC11F9D1BBC17CD9C64A0BEBB23415032556CF02A486A91F27FF4A57E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 dbdbdb611ea189caa45c2009bc871d5e5cf42844a43cd1290949cf8c3d1448e7
MD5 28013d7dcb1259dd08ceea7e69570c7a
SHA1 7e3a8611ef2ac67b85692b467fc755567c0d3694
SHA512 2f4b0a29228d31bd4725ef185851811f157553f64f6128c0d8a1be29c8c578765c2ebc0ec61e1534759d7644f7518086a6c68ef71e80377416c8b50391a63346
SSDEEP 24576:Vfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnFt5wXWotDWi//dirlvZGMApYSRiO:1a5POZ3hJt2pasx2+mh5UfqkdirbGbc
TLSH
T15E65AF5EA6F800D5E579D17DC5834A1AF5B1346153329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 414cf8cbc861b717696c2252fd50433d158da8b1e31d72dbd31bf1a886030e0e
MD5 6693f4ac656ab2887dcb24668ddc55d3
SHA1 87381f3bcd3df35c61b260b26ab9908c83c32853
SHA512 3049567f80ff064edcb8879dcfdeead8b66184b17737822741f708bb5dfb41726664ffc7fe8fedd41f73e1f644f7415220dcd7104c78ea01c746e3e3ba0d44a9
SSDEEP 24576:iNcwHdjbyQ4nLC18lb/EOjowL7Fkvt5wXWotDWi//dirlvZGMApYSRiO:iNc/zEOVHFa5UfqkdirbGbc
TLSH
T10F857B1623E901E4F1BBE1BE897B9946FA717865533086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d8a7cb8440460f6f6e88faa4644c7b8876c66057c7518a1baeb3ac68ae200408
MD5 ef0e9c81984fe45f2ddbff70f08c801c
SHA1 d04b188dc296f34dca80e6cdd69028467984f956
SHA512 b2fa9ad7ba6217bd9559b9a57dfa03664a2fc3ca651011a48fc6597736b9e512d0cb9b765f8f5242e3f8c8795fde7eed1944c6336bf99daa1f4c98c2b456bf6d
SSDEEP 24576:j3kNvNnaFeYhJNtmZBmrt5wXWotDWi//dirlvZGMApYSRiO:j3MwBtOmR5UfqkdirbGbc
TLSH
T16655AF6EBAB845E4D1FEC6B5DD238512EA727461073293CF4290C13E0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 4a28096eeb82dcba1e4ba4700606252fe2b6466a4eefe4abcbfcc6e8bfe25cbe
MD5 9c7e523d6df7f9ddf3ce4a4810ee6e67
SHA1 cf296666815716730263b0610e90d7a4892d6674
SHA512 cacbff10462d52ba5511d3c83850ebae75215799963c5e3c77dc6a8dffc92d86aa71c283484e649ce8586282f0ca84513ab4018029394b4fd54cb514d4e1f5cf
SSDEEP 24576:OPUr+NQTt5wXWotDWi//dirlvZGMApYSRiO:OJQ55UfqkdirbGbc
TLSH
T1AE85F11F26A91CE5E676D17D85868709F772B4620702D2CF02E0917E0F77AE8BD39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 dfe11e1bbe2b1f34a54a260802c43d0dc3943abd9bebfd1bc93e7fb70f18aa5d
MD5 dcc86fa44853fddc4eb1f5d0a5f315b1
SHA1 bf6e19cb61a8a2ce768764bf848103d17fd06f9b
SHA512 14a6a97fa2e8e4e51b83fe7490c91678c8c88478b7e8b285837b75c8faaf300b51b2433f8e63dede1af51db4e11a22b927831d0cf141d80af37a4ea7bd537414
SSDEEP 24576:rD3FHshBIYQgA8t5wXWotDWi//dirlvZGMApYSRiO:rDVHeBIAAE5UfqkdirbGbc
TLSH
T1DD95E17DEB9C04E4E57BC1BCD6638A06E77138A9032256DB029091B91F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/460-291-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/460-70-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/460-78-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/460-72-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1272-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1272-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1272-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1272-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1272-123-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1280-82-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/1280-306-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/2000-0-0x0000000140000000-0x00000001407F2000-memory.dmp

Download

memory/2000-15-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/2000-25-0x0000000140000000-0x00000001407F2000-memory.dmp

Download

memory/2000-1-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/2000-9-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/2940-313-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2940-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2940-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2940-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3044-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3044-99-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3044-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3044-105-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3044-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3044-310-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4720-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4720-86-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4720-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4720-325-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4720-307-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4720-92-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4868-309-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4868-119-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4868-111-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4868-113-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5012-97-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5012-26-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/5012-17-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/5012-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5172-55-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/5172-51-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/5172-43-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/5172-44-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/5172-50-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/5172-57-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/5892-59-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/5892-66-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/5892-279-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/5892-60-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/6064-135-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/6064-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6064-125-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/6064-131-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/6064-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download