0a7c2926b7ee9e7aa66db04890b58e9922b886dce68b79e59948addd7f627233

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 08:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_905deb44882d3406e2318b44a896d69e_cobalt-strike_icedid_njrat_stealc_vidar.exe
Size 1.2MB
Sample260724-jwt19afb48
SHA256 0a7c2926b7ee9e7aa66db04890b58e9922b886dce68b79e59948addd7f627233
MD5 905deb44882d3406e2318b44a896d69e
SHA1 e399536d23ef5417935bc2a952eb29e2931facba
SHA512 66e3e2776f9b9136aaea7e8a2d800b566495ec1b56fc75ccfde02ec0c1ef84ffa3669f47563139f9e36a119536260e47d3e9f3e1a12510d014d607f054aa6e22
SSDEEP 24576:v3WpRwENzlNhc+mVpKdwqrDvoKFLgYHJWwl24C15rDY:UDmV06cQKKYpWwl1+NY
TLSH
T187459C4663EC42E4F1F3AB389972455AD772BC515B38C6CF0254566E0E73AD08E3AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4492	elevation_service.exe
2932	elevation_service.exe
404	maintenanceservice.exe
3672	OSE.EXE
2140	PerceptionSimulationService.exe
4544	perfhost.exe
4540	ReFsDedupSvc.exe
1180	SensorDataService.exe
4528	ssh-agent.exe
700	AgentService.exe
6044	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fc69c998e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-24_905deb44882d3406e2318b44a896d69e_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-24_905deb44882d3406e2318b44a896d69e_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-24_905deb44882d3406e2318b44a896d69e_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-24_905deb44882d3406e2318b44a896d69e_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-24_905deb44882d3406e2318b44a896d69e_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000098b84f4421bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000710c5fb4421bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000848d61b2421bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000239ab4f4421bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f4caab2421bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d565bb4421bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4492	elevation_service.exe
4492	elevation_service.exe
4492	elevation_service.exe
4492	elevation_service.exe
4492	elevation_service.exe
4492	elevation_service.exe
4492	elevation_service.exe
2932	elevation_service.exe
2932	elevation_service.exe
2932	elevation_service.exe
2932	elevation_service.exe
2932	elevation_service.exe
2932	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1036	2026-07-24_905deb44882d3406e2318b44a896d69e_cobalt-strike_icedid_njrat_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	4492	elevation_service.exe
Token: SeBackupPrivilege	4540	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4540	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4540	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4540	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4540	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4540	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4540	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4540	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4540	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4540	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	700	AgentService.exe
Token: 33	6044	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6044	SearchIndexer.exe
Token: SeDebugPrivilege	4492	elevation_service.exe
Token: SeDebugPrivilege	2932	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1036	2026-07-24_905deb44882d3406e2318b44a896d69e_cobalt-strike_icedid_njrat_stealc_vidar.exe
1036	2026-07-24_905deb44882d3406e2318b44a896d69e_cobalt-strike_icedid_njrat_stealc_vidar.exe
1036	2026-07-24_905deb44882d3406e2318b44a896d69e_cobalt-strike_icedid_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6044 wrote to memory of 5716	6044	SearchIndexer.exe	100
PID 6044 wrote to memory of 2224	6044	SearchIndexer.exe	101
PID 6044 wrote to memory of 1308	6044	SearchIndexer.exe	102
PID 6044 wrote to memory of 4252	6044	SearchIndexer.exe	103
PID 6044 wrote to memory of 5128	6044	SearchIndexer.exe	105
PID 6044 wrote to memory of 3296	6044	SearchIndexer.exe	106
PID 6044 wrote to memory of 5040	6044	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-24_905deb44882d3406e2318b44a896d69e_cobalt-strike_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_905deb44882d3406e2318b44a896d69e_cobalt-strike_icedid_njrat_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1036

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:404

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3672

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2140

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4544

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4540

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1180

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4528

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:700

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5716
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2224
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1308
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4252
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c342c2bc8c8bdbd383b868a53ae4855f2cafb2579c3a3e6d2f28f72a23bf8e1e
MD5 8400d7c3058daed25aa30d25d044ffc1
SHA1 d601ccdb5a78e2ec6e864efdd0929757cbfb855b
SHA512 23bae3d2ddd7448949a8fa3482a3369c66181f7e9be03b58bcf5b7db20dbe5a972a4a63379430788b0ddedd1edac9211bd49209cdc9ea0440437b7dd04c43d62
SSDEEP 49152:yb+632BuPkFKRrdE6ohvstBhuXjfS4LWxneQKKYpWwl1+NY:U3q6sjBBKYpfg
TLSH
T1B4D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 07073969d4aa6bccb28fb280ab53539bacff34a3f2dd6c31eecd487a9ce34933
MD5 9ef3db1a7095be8f9e0f567b4bde2c3d
SHA1 5132e1da430c0c092bbb289a160cc22c87510959
SHA512 c238bd0bd8234d689049c33e2e7c04435f62dee12e13fead7b45f77ed6c066bbf3650f6a609cc8a9a6164597cc8a7a6cf8c5896e76c2c56a7d9d611d19b08b79
SSDEEP 12288:j1XLsswWkxy2lRq2czARJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rd6:5XYfDtczARvoKFLgYHJWwl24C15rDY
TLSH
T15A65F12973E508F8ED67817DCDA28402D633BC5547A0E79B03A0A96A1F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 9f0ab0881404a0ee6333d3027b20d80438d09569ce4483b9efaf6055b9ef623d
MD5 6063e79ef16cc80c96718ddcc798dd68
SHA1 87ddb82ada6aa5fc00b5c21e86775174a9ce8afc
SHA512 6c8b44f121a7f628131012936edb382435079feefa726b62921e8b240cbf69d8c0b33a609e4d2c6176817ed277ad63e5ba401b5c3b19106d55387c3d97273e89
SSDEEP 24576:50Le5ji0hmxxrM2voKFLgYHJWwl24C15rDY:5Pji0AjHQKKYpWwl1+NY
TLSH
T16885AF16F6748371D073C0B9C5D2A68EE97134865B308ACB4286D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fb755549cde4ec5819b80a96865185ae4d6ce50b5e638ede95ed2d8731a6edf7
MD5 36f8cae714f133559ebd0ccf7c217748
SHA1 f8377d2468e7ba2b0801414b8527d8ea0e4a13d0
SHA512 d38b3e710072a2f592168ed51c78565521e53d0b513009bcf790279fc48d42e57d1539a4fce1ed0848747e28f20a620f7f0328f7108c681d6bf484c87e5250c6
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWn6q8wyuIvoKFLgYHJWwl24C15rDY:W/ezSC6vUzPveHjybQKKYpWwl1+NY
TLSH
T167756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5a80e19c0aed206982c79d54d018e49e6fd78854e0f9965c3a62ba9d36d3fbdf
MD5 d04b58770f1f78f96d04f38e5ac8514b
SHA1 d1265465889a623ea2aa272b34bd951b3e2b8894
SHA512 3cf362c64e394f0ca0e167855b8c1750a8cc8043cb70117bce12a123f40384788c7b31110865342886d73fe0c7321db1696a4059d6db0e64a11d7648c45647fa
SSDEEP 24576:JVbqPb88hv/l+YNvoKFLgYHJWwl24C15rDY:JVO88hXl+QQKKYpWwl1+NY
TLSH
T1BA559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 28e5df2327342ac9980ef2794758088af5b90d1f693b20db70ea4ac14d09bb1c
MD5 e510a718ec09f6b0054083735be2147b
SHA1 23f9098654a228ae42867e9eec9aaa665263a8f4
SHA512 47e58cc8463bdad738c19721cd1b9c3749c35042040078a1c60cafcbb8af3e3d038536213a0349c91c0d6bc9152f3fdd95bc08f1080370725d7e1814b100b258
SSDEEP 12288:NLSJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:NLSvoKFLgYHJWwl24C15rDY
TLSH
T1D545230771ED80F0EF1A0EB9BAEA64478131CF0858C84A57D5117ABF28B7EE8B71D159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 f3b41559f94a63602cf6576d09312c5d33fc200d74d205ce8ea3c8361cb083ac
MD5 85a01dafaeefce8c9c9bcc07a16ea9d1
SHA1 ca257f0b0d7f548fc2f5ca8abe0c7a9be7e7c421
SHA512 f180c6a7eab7f2e495d85798057abb869173a6a8e4c1c17808d1f361da3b937b2242468322883dcdb1098f82ed17ab55fb562138f41559fdd656109f3e55f0c6
SSDEEP 12288:AeBNUbTVO86UFJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:AJIUFvoKFLgYHJWwl24C15rDY
TLSH
T17C65CF3BEE28FCE2C67E8DB95A918600D77278304F5193CBD165830E9E235E45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 35610eff293a5be6b3544c21fca18661dd8ae9a01e121647c92ffee998de8ff6
MD5 c81bc3b656231ce492c23ed82818c745
SHA1 e13273909350dd0a9fc0b6b49077804917176de4
SHA512 f0f5176582f027c64c78d24ff90f1ff2846dc2fabf62fc8e6e6fc7072f05167f615b9d60007dd5848500ef411b1d30a2a3bc1da575a0b43016a12c24601fc16f
SSDEEP 49152:yQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THt:yQvGAdlCEL8c/DRNw5CMKYpfg
TLSH
T15F267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 933117e7a7930c0f745ab58ee96bb2435f86e9f19ff274d4faefaa15ffb4d5dc
MD5 9c1fb9d07270cff3eaa071701accce12
SHA1 c0111d6883606ecd5600268ce0197e2ac02446ab
SHA512 d6f5810d7547fe9fd64eb5079c040a9f2413f6ae5efbcc71ba2983e244ffb7a32fa90c5a757663cdc70578721fe8a39a68ba1fa71789b4ccc9dae2f3caba1a2e
SSDEEP 12288:QAwSfxL/2Dc3RDLLmt0LDQewsAjXJlARaGdf1IrOrNhyRfLz707YH7lk9wl225Ck:l0ewsAjXvoKFLgYHJWwl24C15rDY
TLSH
T1C175E031FA74D036C77F0DB61B26D706543CBE204B911AC3E3A89E9E59706D2237AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2d6e444398a5afcbcd488acd8b335230e49843ed74cb5ac5a8e5223e5973802b
MD5 023b5890af73bad753431132685631df
SHA1 0eb0c6b30c6373e59edd6cfedd978ce853119ce9
SHA512 c9fd056e52030093531b4677fc2be1329e410a239086ac6dae75ff930e9ef8e9a376005717cd53a173555d980d9b93b6f392ccfe577bbf0ae55beb3f99a51770
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH/I:vUEtQevvqc2W1cpV2tI32w
TLSH
T138474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d6901185c4400d88bc215748b346648dadc1bf81b8fd725c89f65708dc5aee0d
MD5 cb3923d840d3e8df4c5f64ce877c02e1
SHA1 06a14eb179c670abcb4b0dd7715811e623cad437
SHA512 bffb0c5deb817aeb9f2205a32a57ed93f9cd52de6d252fc068340230ee814908a37cbc34bf63a01b98389f5e4b6b6416c31f3f0f2b1212bdfe6b3e4fb715dc5f
SSDEEP 49152:WCbRquA/m2yL5zTfFiV+XenmE3/z3QKKYpWwl1+NY:boquVjnmAKYpfg
TLSH
T1C7D58D0976B8C2E4D1F6C77886A2C647F37178154B3497EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3d283148b512d494c7c0f07cda4d03799a11c5653d81efa918892f6923bc11c4
MD5 a0c6f5d7eb4cabcde6179d392dbe4b55
SHA1 ffb71f2287c2e01970c8fe642f2851a76f83ef99
SHA512 cb3b7378a493267a880120be1c6d72fbbb5648a9f5c72a1e360b076d8f75c50ec600e3e12fdf0e2809ef7ab94b364b848a81137c366af9c7d99ebc265cefaaba
SSDEEP 24576:zAhGL3IFoiwtA5l7S53cvoKFLgYHJWwl24C15rDY:zAMUFoiq5MQKKYpWwl1+NY
TLSH
T18535AE81E7F945D4F5B3AAB899B69171EA76BCA65E30C20F2150D11F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 b20768d8de595e1629f5eddf09cb3b5d7c7d029df9486ad3ded39692a76838aa
MD5 4f16cc88a20679981284424a76091886
SHA1 0d102a5f7cc70eb87e60f89b837dc7fc5bd868d2
SHA512 2f7ad48fe796d58059a42f5e5467a5b79f4aca14e9dc1fb72484c9473cf992d84098ee4277619241ffd8e3d70b5a31c756909927c157a9a7836fe5fb1fc04e0f
SSDEEP 12288:4mw5HEjsChNVBFgl0WDm+CoJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb+:1wu4OW7voKFLgYHJWwl24C15rDY
TLSH
T1D765F14A72E90CF9EA678639C597C036E7B2BC012A64C71F5760C65B2F333616E2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 efedf0ef9526f063c774873be1b5fd5d0aeb77d0e14232a3aa3e6702850af0cb
MD5 19590a8b5349d7df0f74a3412704cc7c
SHA1 081660010da36c219112c3504eab4af745a7917d
SHA512 bf991a6cd7ea755efb1d24c0d070e9c42c97d33a234f4841cac9fa3ac3fc4a5d90d23de433f111a33c11e419618a9d0121461b66bf77034128924c0234764a5e
SSDEEP 12288:seZ1IynJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:1ZuuvoKFLgYHJWwl24C15rDY
TLSH
T1F455124A32E860F4EA67467CD9E55506C372BC1627B443CF522162AF2E73ED52E3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c256486b6ba3acaad6aa792d20367123ef7cdfef6c41197ec4c5d9cff2ad7d4a
MD5 aae3ea92eb31382174a80ed1fea2ee54
SHA1 7b7522bea9bdca82a9994f9d5d96393d901685cb
SHA512 68cda395c696fdee1ba2760d2a0e1cbd057048b2ff1d05c36aea3767d977d06b34a6f6e9ba96bc2fcf42d4d759cd2b31bb07b0a39a0c1671eccee9f4170900fa
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Up:oQRQyi36YOcPbLvw2gAf+PN3NKYpfg
TLSH
T1A5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2fea005cf734458934635d13e7695347d0ee9af309f5eba4fb233e0a54749b54
MD5 f34a5d76dc5e2ee8cf72b66f8a415cfc
SHA1 f7338d827cc7ff689bbbeb8768c42fde2d6cc0a7
SHA512 2f5b08c5d52626c10c79ab16e8304cd4890806825548c610ee689731570af08586d8cd8084e29ed3db25da4f0b3cb297531044b348e10f6b3fe3c9cf8dddcfc4
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Up:DQRQyi36YOcPbLvw2gAf+PN3NKYpfg
TLSH
T144667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 78057b6f54de2aa15ad764c931797502768b7848b71e369e53de6054294b68bd
MD5 49ca22e68cf033b5d79363f47bdfb0b8
SHA1 2d8e594e23de4e02253a229c33343cdd6fc91990
SHA512 ca1f7552b6bc2ed542a6106ea4f3657fda9c9e0d1e2de023cb062d4c31677a8fb70659c3e2e76407b0bb66ebb969f239ca764381a9401d72dd93f4a075d3b1f2
SSDEEP 49152:h68Qg55nhceWu7PNU3/HQKKYpWwl1+NY:fthLRc/3KYpfg
TLSH
T1E3B55A33B2F600A9C44DE1769F4A872196D17C758FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b4366651035ac774f1acedd737587a15254929ba845582560ec7939ccde7be81
MD5 6ca95ae9b818dd946c73807ce8f1be81
SHA1 e15607bdccfd9451597cc61a8d550dc7a6bb6347
SHA512 bb345a704e4c798201b46bf3bb89db8e50445cc8447c5d0ac22cd272997d19509091691f01181d8915b7b9d01a0b7822f451d27fd96f8296359eb1dcb4be7642
SSDEEP 49152:L3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99r:Oy5112gYy5azzVvt69nLKnhZKKYpfg
TLSH
T1AD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 54bab204a5fd5e37bcda165149abd0ccced55e799e40743769b891912dded71f
MD5 44586dd2d0a7e17bfbeb27d368334695
SHA1 4731d6ceb9d9e605b0f98f9ead9d30b4c8df45d1
SHA512 863e64ef1c5eaebb5562ea72e289afc63c6e896ca59488927af8cd90081ab5cd95f32ec275961fd70b882f336eeb7ded9b52f3fe7946ccc6a3728d8686f9ef51
SSDEEP 49152:qB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glDQKKYpWwl1+NY:4u6Jmdxd2dDKYpfg
TLSH
T1BCD59E13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c17a6f860c5876b6b8cb4529a29425cca5befe81ccac02ef340d82c3c365e1a0
MD5 507866b4a934f6dc0ed28bc94118e134
SHA1 548c7c66350fcf6944b4a0452c36b62b3be42c11
SHA512 25bbcf7595be286109b061bbb4ddaa0e963758fbe297a62568182e695552514ecf0b91cb95f5ae8e42b431ebb15ae4f748e7e578c23955a1e0bea453d18c3190
SSDEEP 49152:z1hpsNoJpF1A63U44CwH7R4xlQKKYpWwl1+NY:zmifPWRAKYpfg
TLSH
T1E7B5AE13F2D901E8D05ED17887569232EA62BC460B34A6DF0A90B7961F7BFE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 de9de712bac0fafa7a4aaee241deeb4d58ad8ffc6f11f947658dc37e32e07019
MD5 f2bd8a135cefdec86bff002a2e4011a8
SHA1 461502ee8e22ea0684ff8d9a29f8c3b33ae3de2a
SHA512 2e169cc9e90925e90a995d543ebe31ab000e93b91ba202f9e7335637eef4ff0f4da4bf918569e8bbc8e9b62fea7e2b7ee461078692290cd6c0aa83e16d36df57
SSDEEP 49152:GSuZQIY0Be2KcRVtOnks6NMHquQKKYpWwl1+NY:I5dKii61GKYpfg
TLSH
T1F4C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 cef31b9e6ffd5c4dd88d6aafd28543b75459a16bab8dab0bafc94597a9dfdfe5
MD5 a33db350ef8b16a04f5071cd10e3c95a
SHA1 33b359a095a16d5d9f8c956dbd765eed46040ef6
SHA512 5dfe1cd96df4942acbbe5fe62039031d352de135f760023958e82fb68d0dd127f261f0a0e599fc9c6cffc6fece33cf6a0232f6ea8d2eca13e9e71e433203f8f2
SSDEEP 49152:ohtSn8EApI0fig3giDn0AP5wRQKKYpWwl1+NY:5X2imphEKYpfg
TLSH
T10F95BE13F2D901E8D05ED178C7568632E972BC160B38AAEF0A50B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b3cb8fef73b68b73d89e382daa66322d73652458023a8e869c0f0a908fffe515
MD5 f671b6d551ea696d445c3c29d81deb1e
SHA1 c7fb02c4027b5061d338a728b520917b7fdc42ff
SHA512 a72cacf36a62cc75f3defea0a725a0538a96bd91b65d722e7ad7c16b92252de859d50381b29abb46c9c12670c1e5a3f66b2702ca10d9e43de7b7f2aabb9ab47c
SSDEEP 12288:iKJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:iKvoKFLgYHJWwl24C15rDY
TLSH
T18D45234B74EF81F4EF054AF5AAD56047C1249F0AB8C8069BE512757F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 08ec1867b6eb8bd9cc96531575899fcc1623caf92ade48cbb379c4bf2d64dd9a
MD5 aed6d5c8775545e388d5189e35b9f55f
SHA1 02cf25c215bcbddb114b8590afaf6a5eb10e9f05
SHA512 5df98fcf168723f99522ce88564b7a9c0a7afff36b20ff5c809db9f08fc3dddd879c7f29476e82d9b293eba159509a4b7a748e0791980f944284af96cbe7e7c7
SSDEEP 12288:eDJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:eDvoKFLgYHJWwl24C15rDY
TLSH
T1FF45234B74EF81F4EF054AF5AAD56047C0349F0AB8C84697E512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 25ca30bb1e8e58e8db15947b0b95d973b313a4c55f85455c97213e6db5ab92f8
MD5 307b63d617e8006fa441d94127220df4
SHA1 bc466932b935b7dbf6f3f61d671f044d2ee0b582
SHA512 f5c94bae13ad619a2587b8784f3ba0006b6bd6da0a83f0c27bd966d40e5a242808234a803576750308db43208c195d0f8a1a03a7447d28087fd34eec1a887e7d
SSDEEP 12288:i9JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:i9voKFLgYHJWwl24C15rDY
TLSH
T1F145234B74EF81F4EF054AF9AAD56047C0349F0AB8C84697E512756F28B3EE8271D19C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 8add8dffc08a8d70a129806872ab4c7be5950a7d85d3e037f481a858d37561c7
MD5 98eff2550cc721876eb4ec8cc87abe00
SHA1 17540c7d76cfec7ddc42efd3c666c447dc9a1e37
SHA512 63caeed1efe15caf4b384b5c22fb57364a2ccbe0bb43a809b6371e50040f3ce685f9dacf70c0614a3aee80de232e95d86c62e78b28ca8035fbb58c89346b5f3b
SSDEEP 12288:oV8JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:9voKFLgYHJWwl24C15rDY
TLSH
T18C45230732FE40E0EE16D6B9D9A65003C271BE59A5A4479FD601356F1CB3BE83B3C668
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 338863d61fc19fe1d77caac38ed97d0fd93b5a7a9c0463dd07cbc2392c8295ba
MD5 5eaa94fe1344b06d326316e3bbce57f0
SHA1 3e499b516f94dcd8334e6cf83da0e58eb73770e0
SHA512 24eb8b77b56765064cbe3df436071c15300a67e1c4e2a25fbc49748afcda50e472ac107034c0e1d572b978a5edde1d0043e6360559fd3696ea24fd8f47d1b004
SSDEEP 12288:OkJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:OkvoKFLgYHJWwl24C15rDY
TLSH
T16B45234B74EF81F4EF054AF5AAD66047C0349F0A78C8469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 243c07844b1502e0e4a3d5adb7a1b6b6c2e6d85c62478041819a36d5be2b0c36
MD5 988de21c58d35d01dbfcc70482ea08fc
SHA1 0ab7842a1716db862bd156a55de136c099c28540
SHA512 99c2bb0fc3ba98b64f44251f0734ecd52c01a83d54c26251d018525e105e8bbc780749bfc723df01d39811671c3e504510401ab555176fa25edfbaf818e25f4f
SSDEEP 12288:RPJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:RPvoKFLgYHJWwl24C15rDY
TLSH
T17F45234B74EF81F4EF054AF5AAD56047C0349F0AB8C8469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ee6a874440c169e099af3327aeedac717e15a071a5d5e45c8d55c8a29a8cb46e
MD5 253789a2f03e59a65a2f12f15fec601e
SHA1 8daa9dbaaabafc65803c5656c1d504a688ae7ab7
SHA512 3adbfd5bd328d4b60afe9a997ff893a43821983b4ec3cae11f902a855dea655dc1f8ff2131ebce579580e36868844267cd63442f06125bd2ff0dfb0b2fe2a3e6
SSDEEP 12288:trJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:trvoKFLgYHJWwl24C15rDY
TLSH
T1E745234B74EF81F4EF054AF5AAD56047C0349F0AB8C8465BE512B56F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 9b55c65c6d4c4ac4ec081f51daa4c8becf239690ca7b4efc1896bbe4f263c471
MD5 b34c842849ac7a02c4b31d78f867c97f
SHA1 8b6d9e844b073bc961e861c859ad429ebcb62856
SHA512 8ade4038506cd03f0ec0383fd8407870a81ebc6998bc45cb260a1aad55b6bd9a55a8d061be92158bd42c3b3893ba12ce177b7f257e5e78472b5de621224e1720
SSDEEP 12288:7iZwbVzzFEoS2cPvyjJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:mZMRzFVSOjvoKFLgYHJWwl24C15rDY
TLSH
T1E565029573A408F4ED67823ECD558806D2B27C1A0BA0C61F53A4366B1F737E11D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 a9b1be73e0067c31bb1d65973557cb88f22c4c26f8ed48c4c94624ceec417e51
MD5 c290ef6dc18f0bb97c7b3ece4f7f7186
SHA1 e0298b968b9c4b211e04dc535d3244de0183c4d2
SHA512 f3d34c8fb4d78c859281f61843006df10a841b0b2257870f427f92a6ec18dc563109fe8a8340f642a6616a95f435d054031f1e51fa691e7f0ecf6d5e76720c08
SSDEEP 12288:P+JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:P+voKFLgYHJWwl24C15rDY
TLSH
T1F445234B74EE81F4EF054AF9AAD56047C0349F0A78C8469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ec7e01768d110f01a34a0f630ce6877bdc89c7036da9e80fccd9c02038c25a1c
MD5 23d0d8806ff220df2aada1ca1454dc4a
SHA1 61671f149e877d8ccc003cca0c8efd05423173a5
SHA512 ec9b8483191c6783b621f0becb2a74da5b4c996fe6b6d288e3a39a68cbceddd6d3ae1a61ed39de881c08274b966f01b77a1ac8ff9397e32b79aeebd87164a30d
SSDEEP 12288:piJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:pivoKFLgYHJWwl24C15rDY
TLSH
T19E45234B74EF81F4EF054AF9AAD56047C0349F0AB8C84297E512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 a94d3d55d4c09bfb65a14d7969acfa70dba25579eadc7803eb5c3999cda3d49a
MD5 9c8355cc4649898f25d7b009cbf9a58f
SHA1 60f0bf56e16bf6c46ce4a56e78905deb5c1e0bb8
SHA512 7bfbc3b750e0ea0d680731ffd2b6351a9ba8a569a5916dffab9520076c07e49846111f7991b88c2840a81b707736953ba58e2cfe921ad6a90ca30050dbd9edc8
SSDEEP 12288:QyPz5L8nJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:hzynvoKFLgYHJWwl24C15rDY
TLSH
T1BC55020773A520F8D6268279C9A21902E371BC3657648BAF5760577B2E337E05F3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 af6717d40663499c0ddfea082befb7faba268d8d4833cdc194b54544f10293ac
MD5 aa81c7c781b0fa37b6ed7deaaf8e7447
SHA1 27e79ca81f3ec8d3daa098e1bde2c9ed3670d9a2
SHA512 27620f2a6393e562f4a19c9d80b8f38af51b82237819e22fb4960cff2d8fc53f046ac1ae4a8f923e1d55de8a2f0fac8cbf296171df6ca09e0c0e1121f156d22f
SSDEEP 12288:++JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:++voKFLgYHJWwl24C15rDY
TLSH
T1A045234B74EF81F4EF054AF9AAD56047C0349F0AB8C84697E512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 9b7da5dc80a0719465ff8b3acc042c027962e6debf4b83fd377685c581103835
MD5 3f9a6cdab0c4d6964e7f0185786aa201
SHA1 56ab9cf41998a674e3075fb3f1cd481804169f4a
SHA512 e2c1d271afde7e32d137395388c46ce44a76263f00125dcfa73558aacc0da84a5697c3ad16d36d20f32042e61b93e9d42fccf2c6ff51b77e73e9692f66f10cdb
SSDEEP 12288:D+JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:D+voKFLgYHJWwl24C15rDY
TLSH
T14245234B74EE81F4EF054AF9AAD56047C0349F0EB8C84697E512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 58a8fc9280f6dcfacb234d07dae9e1fb157ea01de8adc3410ec32bddc30b1406
MD5 de186cc0f066dbf180fc24a777f9307e
SHA1 b8a0f1baebe6b2cb4306bdfc76649ae4cb634159
SHA512 56c95840b93d1fe801535596fa653fc16b7e299ed4c7423f278b5292e180a16663e94bccad3b0e241bb62fb9da2aa8428a3c9bd43004065a1b01c8bcaf94b639
SSDEEP 12288:1yPz5L8nJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:czynvoKFLgYHJWwl24C15rDY
TLSH
T1FB55020773A520F8D6268279C9A21902E371BC3657648BAF5760577B2E337E05F3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 864b6c7d82deb8228f266d58b8870475b2b09d1ff61306c030b9318410f014be
MD5 38ed7f3c333f1ed73e40c2c763dfa30c
SHA1 645e20245b958a8fa11248523ad3ac9af4dc498d
SHA512 34a8b851b26fef2ccb76c76a015aa1053bdde8624bec21c022beefaea214aa3bac0423603a44f1249bbe3b5cdd8be65d05cf15dd0caeca72224f79598525e1c1
SSDEEP 24576:cTDaLl3z0zDtvoKFLgYHJWwl24C15rDY:cTuLljIQKKYpWwl1+NY
TLSH
T1A6650295B3A008F8ED67867ECD558806C2B27C1A07A0C65F53A4366B1F337E11D3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 cb6d980d2b711e5dd6f42b136590e46254480a4f7e13e0db33cb9f7a7653c4c8
MD5 16f94074cab8c49140e0c321e7293201
SHA1 7e52856f51eba4d9d2962ccee973ef544bc609a5
SHA512 d5824020dfdbe7493f1a64f25852f57e463d1a6753917c67e3e5090d2bb768b5da0a835b97689d66b434885a209e95d0c880c84ac3a8e7ee3f1cf74f9c4bff69
SSDEEP 24576:x3vd9CHKy7GZJvoKFLgYHJWwl24C15rDY:hvd9CHKyafQKKYpWwl1+NY
TLSH
T1ED75CF91F3E810E4F1B79A35CD765512CA767C5A1B60CA8F03A4265A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 cc8af9156ba05350a234a57ddbf2927e3c569f7858fd28992fdbb6c345eb1422
MD5 6db24b12dd6ceb6fd95e4cdb634367e5
SHA1 d3e57815ace88879e40b67d157f85d39cd60ab4b
SHA512 f3bb72794fd706b88ac21a7627e7b72b819c060e04a71828d4334aff582dfd1c0e6b9941ca4fde3938b4b047a5f285e7d50c2dd76140cb02b08ab1bb897cb781
SSDEEP 12288:GdJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:GdvoKFLgYHJWwl24C15rDY
TLSH
T1DE45234B74EF81F4EF054AF5AAD56047C0349F0AB8C8469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 23ed9af2413228fbe10a70c073163d95f0565f31f6091b04182790625ef86340
MD5 f5d58bd8d6a977894603d8bc8be75962
SHA1 dde9d419e5e78dc577d8d601917ac8ee22ab503f
SHA512 6156a703996c71ffe4328bc3062a04bc459b7170da9b95cd75248cc511a66bdf51ec586f2949b319627d207ce8edf6a8237af0326adf5afcad4b852f17be9850
SSDEEP 12288:wHJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:wHvoKFLgYHJWwl24C15rDY
TLSH
T13B45234B74EE81F4EF094AF9AAD65047C1249F0AA8C80697E512756F28B3EE8271D16C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 f8c7e0b3ee10375c31edcd9673087cadeb1ae3e33d314984e3b71b0602db1d4a
MD5 9ba889f1248bb19650ba3f4569f5d86a
SHA1 30f906e29051d3207d79699946e0a876c7363113
SHA512 d97c88a45b8be4df72212fe7ccbcae9a6aab679b18795bbb97b61decfb7315a17e168e31bb12283540c19d41df262dca88797f59f07611c387cc4d6591fa06a8
SSDEEP 12288:XwJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:XwvoKFLgYHJWwl24C15rDY
TLSH
T1F245234B74EF81F4EF054AF9AAD56047C0349F0AB8C84697E512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 8e2c780c18128ea9238fa0718d8ec5b79ac755909590124f5667c5d74b19b950
MD5 ea164c51890f6817d278aef01e34946e
SHA1 fdff0960139ae0622b39334b23ea486a4b3532d1
SHA512 149468be8e18d22419f2fea239cb679c632a5cb71fcddf0f1eb4f9015110f72b2b7077d6848d3a8fd2ba4f78fc0160308ea94d9ce419279a3f53ba47bdb462b1
SSDEEP 12288:V+JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:V+voKFLgYHJWwl24C15rDY
TLSH
T19745234B74EF81F4EF054AF9AAD56047C0349F0AB8C84697E512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 31b6a209cae6274c6311ce049c8a7218b72a944f4751bb4098ea49e51bf7eb3b
MD5 20423b7ff2c09d138c5baa3491c39dce
SHA1 19cbcc05f78ab48e528bdd7730dd60c3f1dd7213
SHA512 daffb292457392172e6a5aa82bc5e37c6088013f3aad29e120c765250f65e8257fd150d60fffdf7ca8528768a7a8a94107d7c4e36343e94e8a25b6af927bed2b
SSDEEP 12288:RdJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:RdvoKFLgYHJWwl24C15rDY
TLSH
T18145234B74EF81F4EF054AF9AAD56047C0349F0A78C8469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 257f37a0649fe9897efdf7a6d0d3090be05339e2e0e5fbf49eba0bdd08bd0f2b
MD5 a6451d9465f147a3a4d05a8611dc6acc
SHA1 3be51b1feac05b8d44c3fbdfad3e02b6dc960b13
SHA512 683babd151a4c570865eb66a3a1084a3a2d92f32a2259cdadda0aa799a6fe221c5642bd3044c145ab3fe87b10fc3fd9c7086327cbde5b2988ae20fd80914e366
SSDEEP 12288:fmJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:fmvoKFLgYHJWwl24C15rDY
TLSH
T1F245234B74EF81F4EF054AF9AAD55047C0349F0AB8C8469BE512756F28B3EE8271D16C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c3f7166e8b32d43f5a1c1f4a6d9d6e820d92eae6a06275543ee6c14378c6b264
MD5 b851662bfbca5c1e6752d102d586f3fc
SHA1 32abbac562f49b81de284dd775ee3f042a976f85
SHA512 50d8e40c5f3fc1cf0b9dd139463298e80abbb3c0e496acde1772a838cf176ab2fb7f6ea276be03da91241ba143b0ce8fe0f993955422761a2b143c0e1a331937
SSDEEP 12288:IkJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:IkvoKFLgYHJWwl24C15rDY
TLSH
T15345234B74EF81F4EF054AF5AAD65047C0349F0AB8C8469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 f9172bc493a6e8c2bebd8f6db56a701169eb7751fba51450c3ab1b0c2d13e516
MD5 66e8c12d6ad70ebf2f7dbfd376ca0279
SHA1 a4e6768b4e55894c69ece3b99c79f56b12bcb6a9
SHA512 a9a9fce5aa7f3e5af9955d9deb5a690ab3be6aeb1ccb1fb8f607fcfa803311b6c0e1a888786c6a30362c773233967760d687ab5609c13e503166f25b514103f6
SSDEEP 24576:lfwvUk9RX6wkyAIyvoKFLgYHJWwl24C15rDY:XMnYIyQKKYpWwl1+NY
TLSH
T1D085D029EBDC44E5E177923C99B7460AF2B178591B31C2CF125A53AE0E33ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 480881ddb7e27964478abe9f54f3c688c45c3b6061561453d05b1a67369dbc86
MD5 63330cd28ea66e183b9867c136503108
SHA1 e3dcb0e47c9f4cad14289e5f6a3e19ee2e62bf4d
SHA512 a00a28d030b35107058d91f061033a82c46e61462e9c56320de60b749bf5591d84ad21fd5d06a1847beb948dc9d29acfd307b58f653a23f6b8d9d9f5c7f81406
SSDEEP 49152:5YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0xQKKYpWwl1+NY:UySzPtKYpfg
TLSH
T135066C57A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b7bbbb476af9f0867f81edc1b941f58f6aff781e7304687270abf3b399db474c
MD5 f282a5f643ae836771a0f186424b4e67
SHA1 30c4ec1a57bd89d4019412382caf5112d98aeafb
SHA512 e1a1f30eb811f3111b37e2edeebd89357446cff4bb628501c49cf69ae89684ab74527f8b9ecc0fd4ab1cceb2ab0cf6d8e4831f02c3811a3e0734b08c005afc6e
SSDEEP 24576:o47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYzvoKFLgYHJWwl24C15rDY:o47JUQjTirIhCnDHUPfF/BQKKYpWwl1T
TLSH
T13C65AE1EA3EC01E5E1BA927885154A1AEA71782E1F31CACF1270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 c049c2c570565f497e572cb81a878aa43e7d1b08f0d9030622d3330c13ab756b
MD5 aef696d75a1b91f538abfc54c2b50b9e
SHA1 5842afc89717b915a0e79f8612659f53b322f1a6
SHA512 7d18697450b23133deb869cabca0a74a70151d6f8a316ad7c42ff0ad5398cecb6761321e5c05a29f1dfebe531abd5a2d4e1e2b57ba8d3cce02dfdd7b4c958b46
SSDEEP 12288:ObsfuJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:VuvoKFLgYHJWwl24C15rDY
TLSH
T10455F10AE29802E8D56E5279CB965541F3337C2597E0C3CB92C0F53E1F76AD45EEA603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 a540bfb75dde2c2b9b1f5bcd3e6154776b7a237213598818d927d03f1685f5ea
MD5 b54537f6ab3e2650dc2742df6aa6923f
SHA1 0817f9bb3abd6169b4110b20b79b6e37ca71adf1
SHA512 9e442bf8e1f182a6ce4280348f50b26aee6f5ebae84cba4ca051fe607f88f955ae24914e9c57442e89530e0eaa02ad09ec39d0ee19b1fa1a3390b64dc620d166
SSDEEP 12288:hiddrU3fU/43mxHC+8CZ7xZL/FgOTz6F6UwEErWjDBfFRBL:hidhUPUAYzV5/FgGz6FD7+WjDB5
TLSH
T11F552840762BC78FC6A940325E32D6CCA7707D01FE05AE0773C9973F9476669BAE5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 8ce0d868f516fc4af4998f8767d1ead39c7b036c6a1b7c572fdb572c5cea4991
MD5 5a354f3a237be26102579785bc0fc822
SHA1 dae07fd92da449a8b79dae4214d7d00b5141fdc0
SHA512 840c4fc91df4a5da1f43e58bcc65ddce8f72bb2b803efbbc1a81d071784ef744c287e1d61d149ef1d7d33916bd8109a3842b5ad63f4cb37ada7e86ab067f5546
SSDEEP 12288:e2zfuqMv7/npq3F3mcf0SXHWUbeveQ5EOrwIsZb7gPUY0I:e2zlldVs2TbeveQfMFZHhYr
TLSH
T127551A40A5A7E35FCDFD5037063286CDABB45C06BB453B0573848A3C987797EB6E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 10f5d6897fc47b7d641603074cf0a7cfaf68ff4346895c90a68a75533282d25d
MD5 b88c526ab39a56e998037b113a7cc7e4
SHA1 083d97e8f321e8a8aea5bc1b05e805600eaab0e0
SHA512 36fe4aee92e228404f0ba2f87bbbf22fe33bf49b08b549c36f9615a4105f82afa4246f3a9dbc1c4668be863fe739d5715876f61bdd6cae9f9bb212af5e4a3df2
SSDEEP 12288:a07WJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:bWvoKFLgYHJWwl24C15rDY
TLSH
T13045230772EE84E4FF395AF469EA50128129AF195F8442D7F40176AF2872ED82F3D21D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 aedd589636383bcb11c6dca4bd75ff2ae8c4e56c66894de712c9df02e9718542
MD5 9100ff1e042d50eb2b8304db65f02477
SHA1 c67008a37cddbb8119f014f3e2a98910f064937e
SHA512 62a6adc121bef5cb5ea5ff84bdb97cc89c699fa4dee552ec8bc225b1650ff7cd8eefe1d30fb3cec80aaf01569de602a23ee6d4570f7b2b25c828350bd53d3afe
SSDEEP 24576:Bgb6bmBIi49WNNFpg1rSvFv7bYIvoKFLgYHJWwl24C15rDY:Bgb4mBIBhGFzQKKYpWwl1+NY
TLSH
T15F65AE1E22EC02F5E1FAD2B89DAA4417D6B278160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 2519e20847328d07b7a6380747bed650ac8b6ff1b26278fb80a32b99c86b403e
MD5 00007d73f40c6219ab19b2fa0cf10383
SHA1 3c34a0bb224ebe955b2950fe2269d3b9036812f0
SHA512 1c029117d9ce434fd29682b73f4d18d30a8f687c80ba1b946aec69f30fbf6e1652d93951b27b5430a53b43c7b2eae2bb94b2662c7ccde63ca31157b5e3bf1c27
SSDEEP 24576:QG88u8FpJqH1bzria7/mjvoKFLgYHJWwl24C15rDY:D7ZFPqVea7/QQKKYpWwl1+NY
TLSH
T1E485016576E501F0D47BD13889864663F6B2B8250364EFDF07A88B561F23BE50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 2f1e7becc31790ec8ddbb739b655346402d1964b1dcaf15b38d7310c1028daaf
MD5 47fedc9afd42892ca661498236f78e5a
SHA1 0fb8069ad5cb90153bebae2f4cf0ed7074cf1a37
SHA512 544bbf3c6e69dad2a0ca3269d0bdd9f32f00f1085322852669bf8768f26ea2e6aee61e98ee6110bc5066fa176968caa600d6f26adcbe14242444a5b9afa7ec0c
SSDEEP 12288:ZHvUrBFrEjwaQfJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:ZPUr+NQfvoKFLgYHJWwl24C15rDY
TLSH
T1E765F11F32ED18E4E77AE17D89828609E371B862175192CF02A1917F1E63EE87D3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4a8a3bfa0d9100d731c5db8b756eddb5d4ec5c53e78d1610ceb1298422408780
MD5 d683c76760c9fe801f293c12833b27a2
SHA1 30e3ebab68e4a3748d856ea17b62cf85a8db38de
SHA512 9fcd58ca2f74ca7086814f16647fcaa445463fcb74881478457660d852a031b673dbb999b86300da307fad950f71db8ad0f3d98e77c6c35498d51c98f83cb59c
SSDEEP 49152:kBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjPQKKYpWwl1+NY:HG05lO43bCKYpfg
TLSH
T13ED5CF6E62EC11F9D1BBD17CDAC6460BEBB23815032456CF02A486A91F27FF4667E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6651c81ccb96acdf2d6c732493ac6eaeb8d7435f4288b2799040663c350f375d
MD5 cd3e488a95218061d00cfc9e3d48738d
SHA1 9b06e7db9bfb77dcbba15323de62ed1569234ff8
SHA512 f9b7a76d4356404140c26fc5e1138226eb775212347b8f3355b3ad7f4a36285a9794ae57c544e8e93e9e4c2837a1d623c290d4a67b20c561a01713ce52c306a2
SSDEEP 24576:Pfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnxvoKFLgYHJWwl24C15rDY:3a5POZ3BJt2pasx2+mHQKKYpWwl1+NY
TLSH
T1B365BF5EA2FC01D5D579D17DC583861AE5B1382653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3fdd1e245a19d7e9c2206d944c5a195a62d20b8157ab036424a88eef86ab6e91
MD5 a597367b8c3605286119e3eace1ee3d8
SHA1 ecf22cebf4ba30b22642169ad9d0bc115cba5b13
SHA512 b89e4d2bc174be6c511ecb50ffaaff087c5b8799e25ee549c6415d26a571f6081e7fdc9f1610ef0f7bc7f8b856cab097a9c028e35cd7216873dbd8370ec832ee
SSDEEP 24576:lNcwHdjbyQ4nLC18lb/EOjowL7FkbvoKFLgYHJWwl24C15rDY:lNc/zEOVHFwQKKYpWwl1+NY
TLSH
T19F857B1622E901E4F5BBE1BE89779546FA71786913308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a14785b2db478c166424752bbc49bef5b4f5e4155cc1776c4e433ef22e1204a5
MD5 b34c8899b037a3d82debe19cabad8e42
SHA1 72f77531ef791e361a1f3389689b4093f2cb0514
SHA512 7ac6a38d3cc8c21e3948d82aa4e6a8adba31e5aaeac9d4345716fbc18e0dc8e703128e83dfb4fc529dd6fc31be43ba55ce11ed1acb24bf05d962aa9e5041b92e
SSDEEP 24576:TTkNvNnaFeYhJNtmZBm/voKFLgYHJWwl24C15rDY:TTMwBtOm/QKKYpWwl1+NY
TLSH
T16255AF2EB6F846E4D1FAC6B5CD238512E6727861173253CB9290C13F0E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 223c751bc6e11b4d71f20f801b05a872bd3d6646c3e5bbdb4e87ba1a3a063efd
MD5 612bbe8332534d72c07b864826ebe149
SHA1 61c03a72365a4b7f45d3d047222c86a980ea622b
SHA512 c04f30f39700eceacca046eab8c2415768386c1aaf5536f67f5bc4f7e3b72a2460357338cd385b4c82db3d6162d0e3094a38a29d83546afecb5a56d00cea2156
SSDEEP 24576:cD3FHshBIYQgAqvoKFLgYHJWwl24C15rDY:cDVHeBIAAqQKKYpWwl1+NY
TLSH
T1AE75E17EE69D04E4E57BD1BCDAA38506E37138A9032156DB029091BA1F6BEE43D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/404-70-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/404-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/404-43-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/404-62-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/700-131-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/700-122-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/700-129-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/700-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/700-123-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1036-16-0x0000000140000000-0x0000000140132000-memory.dmp

Download

memory/1036-0-0x0000000140000000-0x0000000140132000-memory.dmp

Download

memory/1036-1-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/1036-7-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/1036-9-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/1036-13-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/1180-97-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/1180-96-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1180-310-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/1180-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1180-103-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/1180-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2140-71-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2140-68-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2140-77-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2140-304-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2932-138-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2932-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2932-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2932-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3672-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3672-288-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3672-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3672-64-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4492-109-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4492-24-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/4492-18-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/4492-25-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/4492-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4528-110-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4528-117-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4528-111-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4528-309-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4540-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4540-307-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4540-325-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4540-85-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4540-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4540-91-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4544-306-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4544-81-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6044-313-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6044-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6044-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6044-140-0x00000000006A0000-0x0000000000700000-memory.dmp

Download