81eb8fef491a6d1ff67e9915e6afe66485f6309cf17782db690cb4212c51186d

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_1650f9ceb7af5bb963ff27e990ed8150_cobalt-strike_icedid_njrat_vidar.exe
Size 1.2MB
Sample260808-wt3a3abn4v
SHA256 81eb8fef491a6d1ff67e9915e6afe66485f6309cf17782db690cb4212c51186d
MD5 1650f9ceb7af5bb963ff27e990ed8150
SHA1 ca642c3833f2239de135cc3d9c9b8224ecdbb300
SHA512 c818ef67a6abcfac56e211889faa8053f19c36f97be5348426085352e04f77c520ba7f06bd2670114d637cd8de4cce915fa82785ece2e0d70f306c6e4229fbbf
SSDEEP 24576:PDIiukOiFOPfepJ1oeCtsO8e7zY/t/sBlDqgZQd6XKtiMJYiPU:DgAoeQJ6/snji6attJM
TLSH
T135459C4663EC42E4F1F3AA3899724546DBB2BC514B35C2CF0294566E1E73AD18D3AB33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5076	elevation_service.exe
2600	elevation_service.exe
2668	maintenanceservice.exe
3352	OSE.EXE
932	PerceptionSimulationService.exe
3444	perfhost.exe
1128	ReFsDedupSvc.exe
1236	SensorDataService.exe
2760	ssh-agent.exe
4620	AgentService.exe
1860	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_1650f9ceb7af5bb963ff27e990ed8150_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_1650f9ceb7af5bb963ff27e990ed8150_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\710dd73283806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_1650f9ceb7af5bb963ff27e990ed8150_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_1650f9ceb7af5bb963ff27e990ed8150_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_1650f9ceb7af5bb963ff27e990ed8150_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000276c5faf6127dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008936e8ae6127dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f54f4caf6127dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000768f74ae6127dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000679f51af6127dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045bc94f06127dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
2600	elevation_service.exe
2600	elevation_service.exe
2600	elevation_service.exe
2600	elevation_service.exe
2600	elevation_service.exe
2600	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4900	2026-08-08_1650f9ceb7af5bb963ff27e990ed8150_cobalt-strike_icedid_njrat_vidar.exe
Token: SeTakeOwnershipPrivilege	5076	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4620	AgentService.exe
Token: 33	1860	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeBackupPrivilege	1128	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1128	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1128	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1128	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1128	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1128	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1128	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1128	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1128	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1128	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5076	elevation_service.exe
Token: SeDebugPrivilege	2600	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4900	2026-08-08_1650f9ceb7af5bb963ff27e990ed8150_cobalt-strike_icedid_njrat_vidar.exe
4900	2026-08-08_1650f9ceb7af5bb963ff27e990ed8150_cobalt-strike_icedid_njrat_vidar.exe
4900	2026-08-08_1650f9ceb7af5bb963ff27e990ed8150_cobalt-strike_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 1456	1860	SearchIndexer.exe	101
PID 1860 wrote to memory of 2056	1860	SearchIndexer.exe	102
PID 1860 wrote to memory of 4548	1860	SearchIndexer.exe	103
PID 1860 wrote to memory of 4576	1860	SearchIndexer.exe	104
PID 1860 wrote to memory of 2740	1860	SearchIndexer.exe	106
PID 1860 wrote to memory of 572	1860	SearchIndexer.exe	107
PID 1860 wrote to memory of 3060	1860	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-08_1650f9ceb7af5bb963ff27e990ed8150_cobalt-strike_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_1650f9ceb7af5bb963ff27e990ed8150_cobalt-strike_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4900

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2668

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3352

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:932

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3444

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1128

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1236

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2760

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4620

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1456
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2056
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2768 2964 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4548
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4576
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2740
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2768 2964 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0cf50525615fa98c72d341e592c11eb34c9f7b194303246c54f108688af7100c
MD5 5902d5f892bdec4e95fed299556af233
SHA1 0d878e225da767826dbf52656c3e956f407601ba
SHA512 95a504cc82accf67ae93a3c99ec3c46fcd132b80c215cbbc789e0b92073a98ea31f1b4aaec743ed539eba3e73672327a3157f253c7a8fda7a0078e7978c9a43f
SSDEEP 49152:/b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnv/snji6attJM:93q6sjBsEnW6at
TLSH
T128D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 a292455fb7ff074dee7f3b172b0573d644034981363036c800557d3aa5e469e4
MD5 cc1d355872600afb3777f160b06a26af
SHA1 24805b64a0b187a269e6a23c2bcd7e49e8901045
SHA512 ed267d88e7f1e576a60edab140022acfd346a796bac6cb9eb6ef48c84b75bfa147dc89048c860268fd66e2b4db0fe1e290a67f7217de604039983f2a7f277131
SSDEEP 24576:1XYfDtczAat/sBlDqgZQd6XKtiMJYiPU:gtcB/snji6attJM
TLSH
T14785012977D108F9ED6B823DCDA28501EA7378544760F6CB03E4A9691F332D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 d81e96e80b09a5d44678664e963f8aa8ade6cf976f178996f6042226bb8ea783
MD5 46946b5181fa5c6534fa2271545862e0
SHA1 77579f795a773c2b152dfe3e821e9c5cd2797d43
SHA512 ce7c89f2956558cbf1b77771f3f435193a3056b4862962dbd5bd3d20f108d69d977c8f9963609440af156b90ac168660a289fb82931dab23c711fa030431e870
SSDEEP 24576:i0Le5ji0hmxLrMlt/sBlDqgZQd6XKtiMJYiPU:iPji0AJu/snji6attJM
TLSH
T110959E16F5B48335D073C0B9C5D2A68AED7230865B3089CB4286D77C7F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 49bb3c3ad90435e56b35392f95918457737a1ac470c01b772c783bcae8dc28e2
MD5 ddbfca2a02af4b04f7d80d0f60987188
SHA1 041f2911fb1441f8f00626a92089bd9c758a6c8c
SHA512 b8be709f595e13bff76322535a877835a170c6d21f394373ef7a1de3b04563304999ae135d7ef7e0543eb9d50f2d0162192b322f545412e587afff5701924cdc
SSDEEP 24576:fa7/ezSC6vUyD/aqgrvWn6q8wyu7t/sBlDqgZQd6XKtiMJYiPU:S/ezSC6vUzPveHjyi/snji6attJM
TLSH
T1F0755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c06d49cb125ccdbf898592c0eef703aec1b7b46ee90dbd47878947381315fb6b
MD5 1abfb77f4fe1722f92649bb44ae020c2
SHA1 8370b7b4609578a3465aef05bfdab67b6ea895ff
SHA512 fd5d789bb339b1774dbcea48e79e5721459d169153c94615367b1dffecf0852e86b79e523d780f7c78ed39ae1bc015c2517e642eb4a1c44115e19bb1afb782ef
SSDEEP 24576:iVbqPb88hv/l+Y2t/sBlDqgZQd6XKtiMJYiPU:iVO88hXl+5/snji6attJM
TLSH
T146559E66F5B48331D073C0BAC5D2AA9AEE3230415B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 c88d90a68fe6f31df682a4b1e8490c8358e6b87209d2d344b797bcb48ed465aa
MD5 278ec33e67686a63cecc65efefd70fad
SHA1 2d6f4f5bc09df8238ddc1bceb107bfe06e543aca
SHA512 0bdc49b650bdf7e5c336a5c7a64e3a505ed5a2e0c8988d61557f33bc28f76836ae5a477aee0647317bf359d1fb4705fcac4443efc76490339c946297393dd160
SSDEEP 12288:p9uGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:p9Bt/sBlDqgZQd6XKtiMJYiPU
TLSH
T1A965231F58C39096EBBF5A363EA97800B4733B1CAE49709785D2B59C5D3C01399BD227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 e53a83ce906b7a197b68c5a6fbed0115ca507d90d36d7f7fc8e105ffc20eebf3
MD5 2cef2f0fbaeea8f441a6eccf518953ab
SHA1 247bb9cce0a7be3e74585729f070434439c80737
SHA512 37b6f3c60e24aecd418548428e4260e0373f2d6957e34c2eb235fd43ec01b31cb32b483f8499f2df36b8dfc18e727223d7ed351d8806f8ea7ce1177ad0bb6779
SSDEEP 12288:TeBNUbTVO86UfGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:TJIUet/sBlDqgZQd6XKtiMJYiPU
TLSH
T15885CF3BAE28FCD2C27E8DB95A918600E77274304F52A3CBD165C20EDE275E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3f8c5ca2c07a662ebc20c761133b0c56538ef2e5e45de43b9f3c944d5e95b0ca
MD5 a3af940df894d60f966b7f951c4657d6
SHA1 353d27465ad8f3ed94710a0b10c9d7686b492024
SHA512 eebc5b9be6e60c758da2046dd0eefad84eb9e658b98b588f664d67ccbe1c54e4ea6698f0d723ae81c7fd12173ac45529a758cb609474a12c4fa25897ee84d6e8
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THB:pQvGAdlCEL8c/DRNw5ChEnW6at
TLSH
T19E266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 a42a5922f625288a3c41c9eb9c6251719a3e0ee8ca6255690ecad8f25658b992
MD5 fee985d8cff085accab0f87a5ee55b86
SHA1 95a8477f8764489d15c7f3e405936c3c537f4a81
SHA512 f8a722773fd45eab2253e4d2a9e5909e0989354217ce053b09c7c2586ba8db1507dae90d1e15e064f7ccbe1e7cfd77d269429998c55cd6a1aad127ea78861599
SSDEEP 12288:zAwSfxL/2Dc3DDLLmt0LDQewsAjBGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5+:sSewsAjkt/sBlDqgZQd6XKtiMJYiPU
TLSH
T11385E031FAB5E036C3BF0DB21B26D706543D7A204F5129C3E3E89A9D59341D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d55bd2776865b7e8ec5ffc69d073eea04440ddd370a0e340feb29eab8f7f3670
MD5 1988a7ddd42f268fa3d1e0a33a84d57c
SHA1 40dc83111c6f7ea819d06cf53082e3eb79aef6a7
SHA512 dbf0265d563cd091dd76bc2cdc71df9b20b785b2965d9391f86c9d03fa4f4237f00aac67124e6d5cf30b622b75e5538cc69086152998a7ac674ed177fbb97ffa
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHlnW9:sUEtQevvqc2W1cpV2tI32l
TLSH
T132474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 bf52071f2e53d2a0e914eba494a81b9101b650de7882f705880af8db67147e18
MD5 e3a26951eb7c9b45349379246c584a68
SHA1 28e6acd60998989c516c787ea037bb8a2c67910c
SHA512 3792a8769a2c7378159ccff714ee96290deef3bd0eb7a43072390737b4d9bd8b9e4b18f9f87662bd308f8b561dd62b07eb12e3d158e8abe1bf6672acc1f7ae8b
SSDEEP 49152:nCbRquA/m2yL5zTfFiV+XenmE3/z+/snji6attJM:woquVjnm1EnW6at
TLSH
T13CD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7b4e1d4baee5b17af49d2e54fa4b795edf988bccf760141d65558ee049e1aff9
MD5 773e2667c8949116ac6a151a93b06ae7
SHA1 37da0fab855edf8c3004f52df8007f6139baa193
SHA512 01554887b388e0aca08b3929ad0beb2cad832738c4710645bc538c75e2c8c39a1da059acac36c0673bb659d784832e25715293a9a29b3afda1274fb1967055ec
SSDEEP 24576:zAhGL3IFoiwtA5l7S53/t/sBlDqgZQd6XKtiMJYiPU:zAMUFoiq5l/snji6attJM
TLSH
T1F635AD81EBF955D4F5B3AAB89DB69170EA76BCA95E30D20F2150D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 2abe12f8aa6241c5d104a5c8a472ea91da0c52f94bcb17c83e8cecd1081cd121
MD5 2b9a80b3cd1fa99929c2caf4aa8f6ff7
SHA1 30ba793e4d07f9cd364442299f8400b4211e590d
SHA512 7e60e269f4e94a43acfdf1dfe8532774ae5933586d2c5fafb7c21ac6f320110da351667408cc19133004375a8887098d6123d8605403e293ea3262fb80f40574
SSDEEP 12288:4mw5HEjsChNfBFgl0WDm+C0Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNA1:1wumOWot/sBlDqgZQd6XKtiMJYiPU
TLSH
T13085014A36E50CF9EAA786398997D131F7F3B8052A25D71F03A0C65B5F37221AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 e112ec429466a5cc10e0d6a268e6a1c6c55911a4c25190d55cd7bbd6e2b455ce
MD5 b7525ecb0354d88901bd55b949bc26db
SHA1 b7c8c404b9b0855d5caf1979c719a30e52e4d7a1
SHA512 cd19cd5554c25c3a4dd8fa451c89f43b0906525e9d81a0c99500fc357971165cb60fdef890e7870691567827adf264e3d0783890bc8409306f7cee005997a369
SSDEEP 12288:AEZ1IyxGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:LZutt/sBlDqgZQd6XKtiMJYiPU
TLSH
T1F175121E32D160FAD2AB523D9DE56900E3B334596B3663CF12A192A92F375C25D3D332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0e7641872d05ae84cb134f45d2389f5cc6c3030b63b6f2b7cf5b9f0b25107659
MD5 091266c645d9e219cc9997de037c8e4e
SHA1 aae10a22af6ce55d52700a52874ad9e51c295c58
SHA512 d1866f9c78bb718092482f8bbdbcfd32cd5e1ebfda1572a58296719654801090ba932c35e7628791608ed9f2d5926464d2093d09057ad85d28e95be92a244c38
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UF:/QRQyi36YOcPbLvw2gAf+PN3YEnW6at
TLSH
T1D6667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 70183edea7f887a50f68f95f00f2aec0b6aa5984bb5191e9feae143103a3c389
MD5 dec46ddcfcedd9af234dc7d0b79ee5ab
SHA1 cd903c807f205d1a58ca498718677ceab1137a87
SHA512 d2d65a6a75e3539bae94c7eb4ecfd4ae945cd2767b6c741c46cc07f289afa71fd16ee67abee5f946e08eecbbebe7edc6667742226da9e660883c5b50155ded8b
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UF:9QRQyi36YOcPbLvw2gAf+PN3YEnW6at
TLSH
T1AD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 290be99a83a251ff8c9090ada37755e90852105dd619c942da19b9df5d9c542f
MD5 80c170762ba51d4e437272646f8467d7
SHA1 d8e8adf7ed9ae208e4b8f3d69ebdf716521447fb
SHA512 f872e900a16a6f5b85598738dad62f721f8866208d20a716f751c344e3d6510b25be9383a78f7ffaf896c469f72468c49c997466ad2e954d06961851ef914423
SSDEEP 24576:EwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0dt/sBlDqgZQd6XR:q68Qg55nhceWu7PNU3/u/snji6attJM
TLSH
T110B55A33B2F20099C44DE1769F4A972196D27C758FE0E3DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 cfa7188199106201943da6e397c32e29f3612df5425e3cd88d7fe38e766caff8
MD5 ceb45f475ef7af1f3c8a1f01f378efe1
SHA1 5277ed11cf5c5e2ef174de76768816c00b410680
SHA512 efbe40ba1317fefd284c65d1ab578f499b7138a6ea98b2ddfcebbaea84b8d8fb03b09bb0f32661f88748dcf14799c545014d4af20bbc26e84d62f021b430199a
SSDEEP 49152:J3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk993:Yy5112gYy5azzVvt69nLKnhZzEnW6at
TLSH
T13F167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cb8f518674f4637641eae3ec1ec7878d7ae755e14beece66fb6285b6becebd29
MD5 eeeb33570e9a0e4b7847349b1b383261
SHA1 d67812cab28d379aa0b8d7010349504be5b03c1a
SHA512 ec4c592652354b6165fdafdb8faba2cdc06deda08b7411a2d4d7f58dc41d58cb85abeb00573c061a2322c37e15edd77d5615e24314131177bba5e1c2b903f225
SSDEEP 49152:pB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl8/snji6attJM:/u6Jmdxd2d8EnW6at
TLSH
T10AD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f35c0a9d1b8d52aa1cc5490ea977b7f48e61f6627fa4006bf48bc465e9d1654b
MD5 4f9177e53da366e4362465cde5a46fda
SHA1 c88f5660d9d166c08a4d7571d355e935b80b4a69
SHA512 7dac44ff71d7e72d1949862693f25cf02e8798b667b56bd88eb6305c0da441f14dd5c73ea173a7c0f109f1b711fdc2051b60f7349518385758c9e96d03c64c90
SSDEEP 49152:/1hpsNoJpF1A63U44CwH7R4xU/snji6attJM:/mifPWR1EnW6at
TLSH
T149B5BE13F2D900E8D06ED17887569632EA72BC460B34B6DF0A90B7961F7BAE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0d63b15b8265c86ab617bea5a9fbbdb15ce27c293125224df44b55c47f03db9d
MD5 8c1f78a17093ab5cd7e723e6c98a2ef5
SHA1 655d16f71bca39ec9f9a3305c01c4449e4c942a3
SHA512 9af78e9fd0cc51ba356bc9af753a4a17bd1e9c5fd32d2d51f7faf767ea3e9a958616fcc48f1f3d922397ce1113cda505e1a092488c4766d39d92f93b9290e09b
SSDEEP 49152:LSuZQIY0Be2KcRVtOnks6NMHqf/snji6attJM:Z5dKii61fEnW6at
TLSH
T129C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f5cb1101acae1e7d4a5bb84d7a51c8cf2bf8090ba4bb2775c78d21af5811b349
MD5 f33188fb4e85706d6a91ef0340429976
SHA1 fb94104ec5e7f4f505e36b7d3d03c330d51496b3
SHA512 95804de3fcfe4cb55c4b40dd33bc4f01c699a906e4d29cc1cb83ff3d261dde75567fd9a27f56377cf7e3688555d3bb6c81448a3d1d45ca35435ce64ea8f5b73f
SSDEEP 49152:/htSn8EApI0fig3giDn0AP5wg/snji6attJM:uX2imphpEnW6at
TLSH
T1A495BE13F2D900E8D06ED178C7568632E962BC150B39B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 94e0b1908aceef304ae880c7899199844d650c34dfd1ecfcb7d3847076ad4bb2
MD5 1e5a4e01b14868a786b73e021d98c8b8
SHA1 530f90c19938fb70e8cc200dc1ee910a76e727ba
SHA512 3daa634a259f092d1d99109fd9f8bdcbd43d4280a618fd3f3342caec17371ee4dc3d0b0b4392930964b0f5f744a34581f654153fec3dc118ccd13498deb685a2
SSDEEP 12288:U2Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:UJt/sBlDqgZQd6XKtiMJYiPU
TLSH
T1A965231F68C3849BD76E5A762EA93400F473335CFE49309BA6CAB0586F3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 f2a85eeab0415da1ea5c06a155512d35d28cf74442993a4ba2d05f145e73270c
MD5 c4b19ff3c8b3f27531a5f32295a0757c
SHA1 3e5db86a7c0e963bc6a27177d938757028beaa1d
SHA512 13f91da31a5834d2495214b69bbe002d6115829a80241e55a301c37c75978341195ef16abc8d320bcda153de2779a07c2ddf8266ac0adc26b4268323582eed23
SSDEEP 12288:cdGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:cgt/sBlDqgZQd6XKtiMJYiPU
TLSH
T16165231F68C3849BD76E5A762EA93400F473331CFE49309BA6CAB0586E3D01319BD676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 69cf3f6c6541cde4c281e428f73e7368773ca1f1dd0a095f8d1048a62762afaf
MD5 cb1df8771d92bb9ca7157d40ed0f1461
SHA1 ff8bcd0ffb4ffaa1f749db7f3182fe036b78dfe2
SHA512 62c5a086899fcb3bb9a197da58040929a3ec5f1f878b43d7a86eeea2728205dd7db790cc9b94bf45fbbe300d08f2e8c2518e501cfe5ebccdbad59c01fe1f07f1
SSDEEP 12288:2HGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:2mt/sBlDqgZQd6XKtiMJYiPU
TLSH
T10965231F68C3849BD76E5A762EA93400F473335CFE4930DBA6CAB0586E3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 c73a23fa62854ac4198b21cbcf85bfc2f10948678e4e0234166cafb71262318c
MD5 95b5f0d9ec9e2b4fd1ec777584128671
SHA1 c9b9f9a188649a27073ff21e448029b4e559b654
SHA512 0646fc3a155e63c9bb377a09a23f8080f7973e387b9b6a94a33aea4dec04a833d2b2801ceb7ddb84c0aa4675194344be949cd08191cac8eaea223e4850c26d60
SSDEEP 12288:9VYGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Ht/sBlDqgZQd6XKtiMJYiPU
TLSH
T18665231F29C380D6DABBD63A5EA56400F2B33A5CEB2670DF96C1744C1E392525C7CB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 5c8162cb69b21826fc43f75df5f46f42e79c52fbebb13542107287fd2a397548
MD5 3bb6c8ce26930aa2ff4f9a02fac4e0d6
SHA1 0bcbdce83666f995744e890014ee4caa150b9c03
SHA512 9290d9e4ae0f0689d20a6b015fec90b090467c3e55547b898073dec167f1880de708747cf0fdf30d674abac02e4c81d72088b9b13daf3732889249b268048656
SSDEEP 12288:bQGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:bXt/sBlDqgZQd6XKtiMJYiPU
TLSH
T15065231F68C3849BD76E5A762EA93400F473335CFE4930DBA6CAB0586E3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 c49adb4adecec541d35a66f8fc2e5a62aa16a16a0fe36dddeb5e8812d8585549
MD5 cda11f46240932835b4bedce5e51d0db
SHA1 08665542bca096b17a5937ed196e8dc8b9caf52e
SHA512 cc511e0e19c9a9e9add3105f5841ef3735774445b5da5cf5e0785ceacff1d4a56171bc3555457abcad15d281d0af09bce8a99c0177f0d48694dee0edce83482d
SSDEEP 12288:spGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:sMt/sBlDqgZQd6XKtiMJYiPU
TLSH
T11B65231F68C3849BD76E5A762EA93400F473335CFE49309BA6C6B0586E3D01319BD67A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 c93a5083aa80d4b6b4800482a20701348d91d8b73403233cf2c3b0c00f29d152
MD5 982d1b728b2b022c1779924f82c4d7cd
SHA1 bbe981d860034451cf4722313a4b8d981e96a857
SHA512 55b1f8050a088b596396c991deb42af21ac6dae932308c4498862c9909458125270a7bb9f2be1bfae527e4a0949a0077c3ab06ab7300804935fe1a7b4e66732e
SSDEEP 12288:61Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:6Yt/sBlDqgZQd6XKtiMJYiPU
TLSH
T10A65231F68C3849BDB6E5A762EA97400F473335CFE49309BA6CAB0586F3D013196C676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 03404f8acfa9697705003c70c98cb22027457c0ef52fc61617906005d3e9120a
MD5 44f2e4b6b5f2a386f296fddd68dc277f
SHA1 5eeffc7eba52eb9a54420bc93a86c32ff2b4efaf
SHA512 82814feee685e0cd40c3b56b6e094ec6d13e5651c78ffbec479d3b43cc21e8b5142167c93bd775dfe8847fb2e2d4ce99374f70661476227f05dcced5000ee1f4
SSDEEP 24576:XZMbzFVSOAt/sBlDqgZQd6XKtiMJYiPU:XZMbzfG/snji6attJM
TLSH
T125850259B39118F8ED77823ECD659905E2B27C190B60C65F03E4366A1F373A11C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 bfa39018a3479cc137c68bdaf04b2941a0d7b16e6feef3123b825b4cf16f03a9
MD5 ca002b7444a6a8ec8d407749f2be8b28
SHA1 4f06c0bcf8b52de4afaf29951243513fcb500b00
SHA512 73646eb39dff4bb3ad7ae02349b0955b07dfa318507af2e369450da5b4c4749b9f69f455baff3e692246f548826128d3c77ddfe1257c9959b2485d9478f5df6f
SSDEEP 12288:HaGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:H9t/sBlDqgZQd6XKtiMJYiPU
TLSH
T13865231F68C3949BDB6E5A762EA93400F473335CFE4930DBA6CAB0586E3D013197C666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 8f703c88f9a19f0a3c91b3168d31ebb5908088661a296ae5a84c35043613317a
MD5 d24a4eda326a4ae63b143deeb6812bc0
SHA1 55401b45283c98511b88ac5d137e553ef2e4bb36
SHA512 ccdec3f6d2741526cb3aee9957d5097d1fda38a09119e6d0c23561dd8670a3738f1cfeda3eff6d958c475df4ad032d6dbf93c08fd323424815b8def4ca9347ef
SSDEEP 12288:CeGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:CRt/sBlDqgZQd6XKtiMJYiPU
TLSH
T10965231F68C3849BD76E5A762EA97400E473335CFE4930DBA6CAB0586F3D01319AC676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 38784c03f489e23c99f03b6957b271c0d4fd61fffbc812f1aab5fe5461a50bb5
MD5 4046c8dd0ff53ad63d05f65540501882
SHA1 2a354aad513a1a115ce852944df361e4108f9190
SHA512 729c58b75417189f1816526762a58e816d47c7a17e4e2fbd127a97c7c770cbb10e30e508c76f9923db91780d6a9796f16d878149d45f116d864ca06b68f39280
SSDEEP 12288:7yPz5L8xGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:2zy0t/sBlDqgZQd6XKtiMJYiPU
TLSH
T17B75120B72D230F9D27B92398DA21901F37274395B249AAF53E4567A2F372915D3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 3cbd479b06734287b38feede76bba8e56b3e81e864891e5eedf7519fcfeb3deb
MD5 356b5f41ee44e701f84b13e8f6b2cddd
SHA1 074a0d0b88ae0cf049a4bef5eac480e1258539ef
SHA512 eb1dd3f94346989bc7113b19fb5cea976eb6183f5fcfff8a62e3c28009f4537315f18707b3a88d05970a88c0882c862e45497ea690b6991087020edeb4b42b97
SSDEEP 12288:gaGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:g9t/sBlDqgZQd6XKtiMJYiPU
TLSH
T19765231F68C3849BD76E5A762EA93400F473335CFE4930DBA6CAB0586E3D013197D666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 9db8e9c28aba50ef7a0347be5833c313e9488d87c19dcf53a73b7f4043806b88
MD5 a419fb061bdfce223dffe93d573a195a
SHA1 ce31f96d04f12514d27acf388b7556ccfd376450
SHA512 07ba21c6787108373b7e4d3f886927368591c82f8d2c131c8f2e33ac8432513a97c172ff951a96dee3fc06f9bf7f6a1a41c772a543d9a088257e31656dd2a04b
SSDEEP 12288:eaGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:e9t/sBlDqgZQd6XKtiMJYiPU
TLSH
T14865231F68C3949BDB6E5A762EA93400F473335CFE4930DBA6CAB0586E3D013197C666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 408eb6eacda6800d34513e05c54c81b40e3328843cf52a7710753acb62e9c924
MD5 476501c911e37b69a1c3759e60819872
SHA1 43385bf31b1861f2caa0413ca446ff2bfe770365
SHA512 82c6f98ad7a326696bf66caf3713c62123601a8ffd6b8d03199ce7041a594b72a5a771e4498b432d9e824d003693b74cf5782f6db4bcd57849abb83ea17be581
SSDEEP 12288:4yPz5L8xGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Zzy0t/sBlDqgZQd6XKtiMJYiPU
TLSH
T13D75120B72D230F9D27B92398DA21901F37274395B249AEF53A4567A2F372915D3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 f48183f5827fb5183b76e55349dc4b35b3c3fcaa6e8029c447841ef22d8e09c7
MD5 31926a9f6dee51c7df6f504189465770
SHA1 c014a7dee52797ee19010849ca7b00265f821806
SHA512 9d01b3f093b307e743de072c54fcf1ec6fac8fca73635ce494d14a532aa3b8b11ad4d7505ea27300f6f0b35d2eb16328548e4203a60a69d42290960f388565b5
SSDEEP 24576:WTBaLl3z0zDWt/sBlDqgZQd6XKtiMJYiPU:WTcLljx/snji6attJM
TLSH
T1B58502A9B39018F8ED67823ECD659906D2B37C190B60C65F03E4366A5F373611C3DB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 e8df0fdbf34b71844fdacc1aaeb5013e8582c77db8b717b6882fe11710ae220e
MD5 aa6ed5816e985d5ec3a13b07c109d2b7
SHA1 2a5650fff2b632e534031a2f63eb93bac947b952
SHA512 39a9b797f2cd675be592c52fc3a143fab9617d2f260ccbd8d8ffa7cdb1b659331919242a1f7c2c4e9d017e457b5fe9f97368d75d0ac106eca9837b21e717a4e3
SSDEEP 24576:a3pd9CHKy7GZCt/sBlDqgZQd6XKtiMJYiPU:8pd9CHKyaG/snji6attJM
TLSH
T19095CF90F3E410E8F1B79A358D765501DAB67C9A5B31DA8F03A8661A1F336D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 05d14e4f668ee8c71270e4c70076ef39d47ed5087ec63671ac89847ad99919ba
MD5 f194202235b8f7ed0159c6a1dd9096fe
SHA1 0a7d3d74f01792c18db4469163776f43d4c8de2e
SHA512 63d57444a40d32ac44110fec809ecafb282c3e7ab84d56538554900943892888a0e252d362ea1e1ec713c4a7efda1c430e73c8e301f1d20bb59dec405e352206
SSDEEP 12288:hnGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:hGt/sBlDqgZQd6XKtiMJYiPU
TLSH
T18065231F68C3849BDB6E5A762E693400F473335CFE4930DBA6CAB0586E3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 f57dc533d4596f42e6e71307f8b6eceddcadec39c9dd4341888dcf597c5f99b2
MD5 96474675bf38c927854f8964408cf90f
SHA1 ea58db053cd2813b492b15133b82041ddbc64bc1
SHA512 cffe55d91c62da64ffcd04a1d3f3fef24e94c9a0ca53ed8918704214ee45c3effb5a0bc05ed1634b7dfc29cba8a909c729dd0ee0812ada3ee9326b869522dfb7
SSDEEP 12288:NRGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:NUt/sBlDqgZQd6XKtiMJYiPU
TLSH
T19965231F68C384DBDB6E5A762EA97500F473331CFE4A309BA6C6B0586E3D013197C666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 22c24004398f66d001071dc3b07f6103928aad2c211240ab4d12a0116c0e3ca5
MD5 f418c5dda1d887c4c7c8a2cbde017260
SHA1 2e9deb11f9d7e836bbe7a6201f360c1e54a03c73
SHA512 51ea40ebed4dd339758ef52ec2c037b0cd21e96e71706531c9dec74b318f966b5cb1ee985055b17336c362787897b7eee5c463f0ddcda9f013d24554ef294247
SSDEEP 12288:KsGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Kzt/sBlDqgZQd6XKtiMJYiPU
TLSH
T12465231F68C3849BD76E5A762EA93500F473335CFE4A30DBA6C6B0586E3D013197C666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 cfa6e77885937e57abd914518ab08612568385a21dec23b40889749d2c2b9575
MD5 944e4c5cba9095126127e1cc4f962818
SHA1 fc25b7283746e53082de8e1c685e4d93f420e996
SHA512 fe59a1af0943fc4ddcde6d8f4e2ad71e8d567e433849273a9e7ce3ea8664199680822dd1462ec5b78fc1cfedbeda951e10248264ea2bc77ea95426170db06321
SSDEEP 12288:AaGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:A9t/sBlDqgZQd6XKtiMJYiPU
TLSH
T12365231F68C3849BD76E5A762EA93400F473335CFE4A30DBA6CAB0586E3D013197D666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 15666aa2e04566aefa9db45e3c7b31926f4f90825304d2c8c668fdc8ba507b2d
MD5 9adb5a50658e991a16a5e268e2d27d66
SHA1 55646d721195abb0981ba9f949a08d922aa710b0
SHA512 73b3c414b66cb243056ded52d84c10fc8460d90a4a0a9d81ef570f31d0a68a9e9bed318e1bf853811c402acacd79aa947825cd6c56b55f1214ef00121ef13b9d
SSDEEP 12288:bnGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:bGt/sBlDqgZQd6XKtiMJYiPU
TLSH
T1BD65231F68C3849BD76E5A762EA93400F473335CFE49309BA6CAB0586E3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 025733fd79e205188169802185c875d69f83a6f5307e72913513e93ae4dea279
MD5 255f0746452a90fe4cd7f832a95445ad
SHA1 3ce196b6b784f80289ccf6655bd13eac63b355a3
SHA512 78100358ca4e7e24fd4de0aee997ec82df34af25845662b769c0423dbbe524d41e0a65d0c9faec8fdcb3cdae40e1e335f8566f28dfaa25385a6176883b5c6a4b
SSDEEP 12288:1yGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:1Vt/sBlDqgZQd6XKtiMJYiPU
TLSH
T1EE65231F68C384DBDB6E5A762EA93400E477335CFE4A309BA6C6B0586F3D013196D636
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 bba72c341a45abcd3b1857efde90dde95b289588084ade4439f142fa0a916906
MD5 b4fb6f59cff90e30a8b68c60ecfe0ab1
SHA1 2b9b0885ae3c7a0890cf85f37b19f5ea6b559954
SHA512 04426729bc7bd17544e555e7c6266f510dab499aa4fd6ad47908cfd8e4ef84f8051ab905a1b63dd8cfc96d1a122a22092666eb791f9c5450a3a3fda2f2981520
SSDEEP 12288:GQGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:GXt/sBlDqgZQd6XKtiMJYiPU
TLSH
T13365231F68C3849BD76E5A762EA93400F473335CFE49309BA6CAB0586F3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 20165c1e032ccf64bbad767d8ecf9834ad5b27ceb62953d280eb3e9596291198
MD5 6acc57e046d1bc8dcfc989fc7b1cfb2b
SHA1 a23f8872d3e545758ab3301aa7270e52cb93db31
SHA512 0a7cf712df8074b4c42402da6dccc9f640111f0f237be483ca0cb88ec16c4d828df80a374ea59284f34957acedcb4689672b0daa992f1d9d80cc962af644409b
SSDEEP 24576:ofwv2k9RX6wkyAIht/sBlDqgZQd6XKtiMJYiPU:eMnYIT/snji6attJM
TLSH
T19195DF2DEBD844E5E1B7923C99B7460AF6B178681B31D2CF029A53AD0E37ED05D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9c78b63d4bc4a3484070855828076bf4a240947c717e5be1eecc818db2de083f
MD5 f0eca72fd9884e7830b2a4a1b9150260
SHA1 a1fc6a2a7e4e1f8f7fae6c3e5513afd511471857
SHA512 7b810e5c5c780dbaf290986d8ddb462d5194dc7adb4f3946f75a9a9a278c7d3dc908fde9202fc496ec82e9d247ffc75730910462a1aebe75b0dac654c75e8a79
SSDEEP 49152:kYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0A/snji6attJM:TySzP4EnW6at
TLSH
T153066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4083156fd9c18e2d9baf62a10a7a04dbf545bb945b6c460e60364e9c9f69154b
MD5 e25eda9176459f27fba030724e7a63e0
SHA1 54d9abe6b69e51bb42e0308971eab424c7946503
SHA512 be94b0faea14e85ae5d12d22ba4c6fca390ecb5b88753619474a8d90eed6db0b47a5e44304fc83426847eb1bb57f5de8defdd1208c4841164f586b56360fc8ec
SSDEEP 24576:D47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYQt/sBlDqgZQd6XKtiMJYiPU:D47JUQjTirIhCnDHUPfF/w/snji6att+
TLSH
T13E65AE1EA3EC01E5E1BA927885154A1AEA71742D1F31DACF12B0837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 00758ce3f04eef3c90454492cc580b2a248030ff9e9ef8d28472e9b740df933d
MD5 c44b2ecebde595143c07bc6173853322
SHA1 18fd832ab71e8284c9a5f47344e50f3b3b33be30
SHA512 2e9624b1bd738cfa33f65beaac2d631ccbd15184f113e48cb2d9f1f89479fefaaff296147146156f3e35f0655aa1dc40901df401f63c59e232620f36775056d1
SSDEEP 12288:vVsfqGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:ktt/sBlDqgZQd6XKtiMJYiPU
TLSH
T1D275F11AD29542E9C16E627ACB565A00F3733C2897E1E3CB52C0F53E1F3A1915DEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 b7537292f38159e1f176e68d42a2dc72b3fbef0fa09ec6e1fbf4ff237b2a3a30
MD5 cec63cf621d6e875cd7009ba2ba9131a
SHA1 3bddfb0c1b8a2288f904a4929a865fbb45fe401e
SHA512 97908e9d6f8110635f255b23d4c387fd6ef06d8d14d386dbdeb9f8a1250028e11389d66a593857db7bff55ad4cd1747f6d6d3ea36a8c47f2101c746bdb613e46
SSDEEP 6144:1sBC2naIHT4R9yescbPotMxFWYcU3fUkDoDGaiILv3nb0KTGjgCzbBrPZfyOpl/S:SeqHU3fD1Ov3nbtGZBrPZfyOpl/Qe+5
TLSH
T1D3353810766BD75FC6AD40325E77C2CCAB707D41EE059B0372C8972FC576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 b1be3218ae30f09221764ea80a1ddadaadd7246e8f7a584ed6a4369a995838bb
MD5 d0ca4d472ec81eb6a2aab0aae7406591
SHA1 f2b5a74ade552a174313b847763842cecf77eae4
SHA512 a25be40809287da8304b4e95177d890660b558c82b3ae354cbe99f19f7d22ca6044d3babc93b915a9e1d96eeb02017f6b9f5bd826f6bf0374aa4400a97e7d00a
SSDEEP 12288:XEwoz+vcpkYEOBdk9IeyuH4t2OSyZq8v9ulpwNHpw3RpmC7m9Wx6pNOn:l0
TLSH
T11A65D7816437A38FD1FA6072076A5B4CA764EC06B7056F277388453AD82BB25B0FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 4a0b9ecf999ca2f9abd151541a04c1ab6d4bf27642b5496f0ea9b3c73c8776f7
MD5 88e854c987a2715c76d3e42e55e91159
SHA1 3e0bdd15a7f70f05d2913ccec8bf6747aa4b1efd
SHA512 baeff5346fa77d4952d7f83942a0f39daf45197782c7212459e0f3b7c37748943506c475ad229c741fff3bf6f2f5f0141d1f2e5ca499dcacd2fd155f30bedc82
SSDEEP 12288:HO7CGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:CFt/sBlDqgZQd6XKtiMJYiPU
TLSH
T16E65232F65C79897EABE5A7529AD7400B037332CAF0470D7E5C5B1986E3D0824DBC72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 73877d36de5c14d30e7ba7e272682f82b97c452789becfaa41e6491fcfd9915a
MD5 7bdbd3e2d97d1b4e7778122633fce612
SHA1 a5a14230c8ddcb69286af83aaf995a4059c2be22
SHA512 da2eb2aaf6ce45ccbb8228c909b6b6139d7dc729241767df0006a6d38c593ac46a6fee3e19d41d75b5b5a8f569f74bf8d9bcc9b1b1513c4d315db14d2e29241e
SSDEEP 24576:igb6bmBIi49WNNFpg1rSvFv7bY7t/sBlDqgZQd6XKtiMJYiPU:igb4mBIBhGFa/snji6attJM
TLSH
T19065AE1E22E802F5E1FAD2B89DAA4417D6B378160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 b63335511eeae038a5c7158c2ef66938217e8cdbe02fc86cfc50cfa8635d3786
MD5 3ee1a4da4a2f8b033d9d396a4cb141f4
SHA1 7844c72b0699364539dba0d6cd76081c3e746f3e
SHA512 0974f7b2198d5bd67d63a0a46798f497f4069096ec9e563345df0aab17f83b668cb85a4efd01f5aa5e775634b2ab152ae5b3c75713a26668dda83f8667774c55
SSDEEP 24576:cG88u8FpJqH1Nzria7/mAt/sBlDqgZQd6XKtiMJYiPU:f7ZFPqV0a7/5/snji6attJM
TLSH
T17B95012A76E101F1D47BD1388A864663F6B2B4251364FBDF07E88B551F236E10B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 3b33c96c9dd1581e764809cb530397107d9b23e61f825e390345fad4f85ef54e
MD5 ab67229e19774f4238eca6bd87261acb
SHA1 7a9112f99d59bc8544171521c0728e548c9ca521
SHA512 dcc08cae6357f3758eb9e40f45f8d6baec082038cf24f83a3a9ee9c2115c6968ab8b84fdab27e79386960e332a2e7f14b459d9ae22616b227f5a82d27ff5cbaf
SSDEEP 12288:+HvUrBFrEjwaQZGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:+PUr+NQct/sBlDqgZQd6XKtiMJYiPU
TLSH
T11985F12F22D918E5E67AE17D89828709F77274651712E2CF02D1817E4F279E8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5f2f90aab78f6d6ca0166af057d691fd21eb2f5bab46f67eb413bf0042c788de
MD5 68bdc7974dd0940779528639917310da
SHA1 197fed8c1d4ed3c79ecbb39637f3e011335d8043
SHA512 c7e18a21648d5c4d05d31bea89eac9ac2d9942615bd86d17bf9f7a772bf0bd2d4e89fc71e4759158a31b2ab729c009ec8cc2a95af5493fc5fd06fd48acaabab6
SSDEEP 49152:BBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjW/snji6attJM:iG05lO43bbEnW6at
TLSH
T1B5D5CF6E62EC11F9D1BBC17CDAC64A0BEBB23415032556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8d690d17b9a6678aca4b5bb0585164741141696134988964e87fc3da2c4fc41c
MD5 018d3ddd5939f72580d81a810b4c5b65
SHA1 d1878798ecdfb269b53fdb552b746b47684bb779
SHA512 f739810d7e9b2a5c7ed39b5517bee25fa16b0ae173e9a4b8ab0aa6b221b41db01236bde22a64ecec6de3dd18c28ba606ea5222248c79baf1f5c2a0a879eb2492
SSDEEP 24576:qfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn6t/sBlDqgZQd6XKtiMJYiPU:ia5POZ3BJt2pasx2+mu/snji6attJM
TLSH
T18665BF5EA6FC01D5D5B9D17DC583460AF5B2342553329ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7b6a5373bc2efac5deb7730a77496514acbbcf69acf3aeb33faebfae34241977
MD5 294b2b31026aa2b1728ebe5771bc2950
SHA1 e95b7be626117ddf52e89a4383996d42bfa23b3e
SHA512 47e1ff2212b92f1d4d65d4e29e92235f41c29acfbc2c2f667069650cb3cdbffef6363d8526215be27670dd27183872e15c381ffa9ce1d7ff3bb2bfbd8b4224f0
SSDEEP 24576:iNcwHdjbyQ4nLC18lb/EOjowL7FkIt/sBlDqgZQd6XKtiMJYiPU:iNc/zEOVHFZ/snji6attJM
TLSH
T1F5858C1A22E901E4F1BBE1BE89779546FA717869573086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e573de72e4a961c53b3bb1a90e19500e72c6069e9d8a81b4e92422221afa2cec
MD5 924b4051b7a9268aff49c0fd72becdc1
SHA1 0b768ae329866320d23b0e11d9e14f052ae324f5
SHA512 a033e7a959176700e28fa09ae395fcf41c807efeb36fe7c351e9fb8fa18c7621d1371d5faf216b1c0ea2663b06291271c0519f4ab542984034d58abc94f0c1da
SSDEEP 24576:qTkNvNnaFeYhJNtmZBmat/sBlDqgZQd6XKtiMJYiPU:qTMwBtOmg/snji6attJM
TLSH
T1E355AF2EBAF846E4D1FEC6B58D238512F6727461173292CB9390C13E0E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 654a224530bfe4ee9d4701311f998a57b45f884db5d474d3cb07b342b68a7de3
MD5 7464fbae8829c59603d95b340c03b84b
SHA1 e3f2f9966be16e5178bd4ad99e5c76718f84b39e
SHA512 88718848cb4e0de89cf50f04c968a5d4bafd539a58c236c47c01ba4fee92b449ca00b17bf9c8181bfe188757b61aaf660ae9de18ea834e8f9c396c4df0450e5d
SSDEEP 24576:BD3FHshBIYQgApt/sBlDqgZQd6XKtiMJYiPU:BDVHeBIAAL/snji6attJM
TLSH
T14A95E13EE69D04E4E57BD1BC9A638906E67234AC072265CB02D4D1B91F2BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/932-76-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/932-275-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/932-70-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/932-68-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/1128-84-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1128-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1128-323-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1128-83-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1128-305-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1128-90-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1236-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1236-96-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1236-308-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1236-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1236-102-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1236-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1860-311-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1860-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1860-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2600-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2600-136-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2600-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2600-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2668-43-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2668-55-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/2668-42-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/2668-49-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2668-53-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2760-114-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2760-307-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/2760-117-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/2760-108-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3352-223-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/3352-57-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/3352-64-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3352-58-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3444-80-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3444-290-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4620-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4620-121-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4620-127-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4620-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4620-131-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4900-1-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/4900-0-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/4900-9-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/4900-13-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/4900-15-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/5076-116-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5076-18-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5076-24-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5076-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5076-25-0x00000000007D0000-0x0000000000830000-memory.dmp

Download