89fabda39ebae445407701e749feb7229028881031dba859252d414c792bae2e

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_032f9c418d593c53492f1479561fd502_cobalt-strike_icedid_njrat_vidar.exe
Size 3.6MB
Sample260815-e2v4aaztaz
SHA256 89fabda39ebae445407701e749feb7229028881031dba859252d414c792bae2e
MD5 032f9c418d593c53492f1479561fd502
SHA1 23dd099b9bc40653b8f8e29fbb36e73ee526c0cd
SHA512 2d0ecb44dc3f7364ea1f4c048689ac0f3c567b6b5db5b6ad0f869c156099f585031857ae2bbbcfd2c6ed36fab492082311a87ec5efedaa268cfc8d2b4a3410b0
SSDEEP 49152:21d9nN/BGSAB/HKQc+YKUDmftcEZIOVLk1H95IE87ZxlorQvzLNiXicJFFRGNzj3:25GZPKUtG9xwxwQ77wRGpj3
TLSH
T102066E57A6E730E9C8A3D139D6129601E9F33FB203113BE711984D612F2BEE9067EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4552	elevation_service.exe
5312	elevation_service.exe
6948	maintenanceservice.exe
5024	OSE.EXE
3924	PerceptionSimulationService.exe
5236	perfhost.exe
828	ReFsDedupSvc.exe
3380	SensorDataService.exe
6604	ssh-agent.exe
6816	AgentService.exe
3816	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-15_032f9c418d593c53492f1479561fd502_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-15_032f9c418d593c53492f1479561fd502_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-15_032f9c418d593c53492f1479561fd502_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\23307126957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-15_032f9c418d593c53492f1479561fd502_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	OSE.EXE
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-15_032f9c418d593c53492f1479561fd502_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083c334536e2cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ff6ab936e2cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000ae4a23526e2cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000fc1c516e2cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4552	elevation_service.exe
4552	elevation_service.exe
4552	elevation_service.exe
4552	elevation_service.exe
4552	elevation_service.exe
4552	elevation_service.exe
4552	elevation_service.exe
5024	OSE.EXE
5024	OSE.EXE
5024	OSE.EXE
5024	OSE.EXE
5024	OSE.EXE
5024	OSE.EXE
5024	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4724	2026-08-15_032f9c418d593c53492f1479561fd502_cobalt-strike_icedid_njrat_vidar.exe
Token: SeTakeOwnershipPrivilege	4552	elevation_service.exe
Token: SeBackupPrivilege	828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	828	ReFsDedupSvc.exe
Token: SeBackupPrivilege	828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	828	ReFsDedupSvc.exe
Token: SeBackupPrivilege	828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	828	ReFsDedupSvc.exe
Token: SeBackupPrivilege	828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	828	ReFsDedupSvc.exe
Token: SeBackupPrivilege	828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	828	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6816	AgentService.exe
Token: 33	3816	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeDebugPrivilege	4552	elevation_service.exe
Token: SeDebugPrivilege	5024	OSE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 4624	3816	SearchIndexer.exe	103
PID 3816 wrote to memory of 6708	3816	SearchIndexer.exe	104
PID 3816 wrote to memory of 4840	3816	SearchIndexer.exe	105
PID 3816 wrote to memory of 4800	3816	SearchIndexer.exe	106
PID 3816 wrote to memory of 556	3816	SearchIndexer.exe	108
PID 3816 wrote to memory of 1068	3816	SearchIndexer.exe	109
PID 3816 wrote to memory of 4788	3816	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-15_032f9c418d593c53492f1479561fd502_cobalt-strike_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_032f9c418d593c53492f1479561fd502_cobalt-strike_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4724

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5312

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6948

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5024

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3924

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5236

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:828

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3380

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6604

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6816

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4624
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6708
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4840
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4800
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e5d9d9efdcab8a9a5a8807f08152047605d5791d639f820a652c428bd1450fd3
MD5 03e37b28ee0c0f500cf84f5c02f98821
SHA1 2136659f6b03ec7d3a65149e1857e48939e285b4
SHA512 072c733ef2516c8b0640a00c785ea65e7439cf22de33c74a03e0d910a4faedc91c282dcaa322afccf9a58476736cf49436340e034910e936cec4ebbcbc9b8a89
SSDEEP 49152:+b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnfLNiXicJFFRGNzj3:A3q6sjBI7wRGpj3
TLSH
T16CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 384db03bf6112e9c93ee6f0275142f3cc78c9a49d49428fffffab58389d0c4b0
MD5 75868e262a12fedf864483739f551d48
SHA1 27252de3288a7cddb1f385b3804c9d10ed1c06c8
SHA512 9d20dcfcc89b1b73c400ffa9ad590dafe067e77e0dcc7dea3961828ff71d33fb6232488376b36e3756eed53d3726c3d45ed8cd1bd1872a6a821de8e5929cb1b4
SSDEEP 24576:AXYfDtczAX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3tcaLNiXicJFFRGNzj3
TLSH
T18B05012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 5e44ee61d55674d31ce8cbaf7f0621a1b8d4e2c48fe3e6d45344a5b8e40fc5e9
MD5 a10fb8a0318b325f9f4bc235542ddc51
SHA1 487637d523263efc897ed9a1d23e06a67d559c26
SHA512 b204eff9b47d2e47202ce831a678b3ab51f245133caeabbd75a964d35201f8bbe7df91eb2dd381c1bdd196a0f769eeb8312ae7cdf06e4d6778efc174fed5be73
SSDEEP 24576:N0Le5ji0hmxxrMc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NPji0AjxLNiXicJFFRGNzj3
TLSH
T10E35AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7acd59e38624699cbb18b7a90fe341cad17252eca18b00e83e579a1cd6803617
MD5 cae684ce5c6bde310b7b6d4a42458599
SHA1 2fcc2695b32a3693ffd8f955370b7adb87f10506
SHA512 19ba035bcb28d375bd0b44a5945fd49b293b67a88452ec63c8f91a02c595c01d451cc72279a9d80e881b608f0b3c3d57144e46747b42e4b086db82a19107e679
SSDEEP 24576:Ra7/ezSC6vUyD/aqgrvWn6q8wyuq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Q/ezSC6vUzPveHjyNLNiXicJFFRGNzj3
TLSH
T166756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ea648b11ba908ed1513e44e69dc0e6a85f8a3774edbffa3e5803861ec2df469a
MD5 76a2607e89bddf616f07befde7ddfe66
SHA1 e462842f8f0cc9b18ab4dd0f1dc2dea0c5d68c22
SHA512 4b61bc9054d0f9a9d274239f140b1599c92ab9e4b07bf6bf02f0e0184604d7b095e45c426c77ad8e365f8596b2652a0262c6359b8ab817725a0e0cf9b377fa40
SSDEEP 24576:BVbqPb88hv/l+Yr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BVO88hXl+iLNiXicJFFRGNzj3
TLSH
T1E9559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 2df33403bd013dd4d99dc31338673a4db90f0371d730b13a960f0e82114562ef
MD5 97a0f1e54d8ca62e0819b9a20018db18
SHA1 27409b9640c6676d810302bd0436a2c0e7cef023
SHA512 36d70220cc8c4c1b0e339be32e98348c3aef163363a0c7407896f24c756d5b8545f84740498b99cf1d949a94087ad3b6916694530348da4c2126c9f12b912fc1
SSDEEP 12288:OL2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:OLA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CEC423D3468865B1FBFD003A867A5828B5845E2C8A555CE2D2543E5EE13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 9d0c57e1e8279a02511adfa7e51ec1d489d9f261157399339b6cc05e2cc981d5
MD5 79c3338d2efcd42abc5753dcc280661f
SHA1 9af496342097aea0fe6c036bc649def0122ce92d
SHA512 1a79ef1ed65ad4af07096cc35c8f96f708628fc7e7cb8eb7a9ca204d6a715af305635495956ba5ee0c6651b9ced4f67bfda3503787621299d1def70948219476
SSDEEP 24576:iJIUz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iJIUzLNiXicJFFRGNzj3
TLSH
T12905CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1044ea608ad5da2ecf8044005d1f89de99764f54cf4ab83ad3933ffcdd2ccb05
MD5 c7fa2174ca4814e6dc01d6b914abc0b2
SHA1 847dd03be9c23c36862a0e87ba0919badeb31680
SHA512 af630eb6fe50bd74fb74f9a6f0c27d3fd09b4a43b33d1616d3d7bf8b23d8385a14e210d4722a57895fc27d860e1a485ad623327580a367687a55d370e652acc0
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THX:ZQvGAdlCEL8c/DRNw5C67wRGpj3
TLSH
T1F7266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 a3bb3eed12035b33573e4c0968715db613f7f555eceb1278030b483813cda01b
MD5 4eb79077fc05663329f5af4d508125c3
SHA1 f62e2aa38d397e321fec76e4a31b1f7ba06bcfa5
SHA512 cd05dd1b3c6543494ad6f7d9e836cb700047f89299b043b5c995b28bcc248cf8b9466a03f22e2796ca77dff7c0fdeb55268aafbcd7048c42aaa41fc6f22c0f90
SSDEEP 24576:l0ewsAjB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eljBLNiXicJFFRGNzj3
TLSH
T11515E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7c9484eb67671e53a6808412f3c18074b0b9928529ccb19719562f89e45b787e
MD5 5ca270c8cacd7ce98028ad27538d5139
SHA1 e89108cbd0f3dcbbacc15040b13aa04bfad03fb6
SHA512 bd49c935511c6e996ebf772d079e14ffb647663218800e1298e1f5160c4d284a7349fe5ff3f39968a2219ca32d482145e2fe82ddaa9976a85a129722f9c4395e
SSDEEP 196608:SUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHNF9:SUEtQevvqc2W1cpV2tI32z9
TLSH
T14E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b0e9db839f8ed6ae5ba95f7508fef20ec10308a684b4d472ca5f7f51b0636edc
MD5 b30e77ea8b6481404e9a27724242fac5
SHA1 567403beaa77904547107d24e698c247305a17b6
SHA512 308b5d8cb06b6a5daa16e908c8eb3720dc7795352057f913e6fdc501178e20ff2acabd246471f9924deb25ab34fdc5c748cce6e408ce4da8947bfb7355c5c78c
SSDEEP 49152:UCbRquA/m2yL5zifFiV+XenmE3/zhLNiXicJFFRGNzj3:9oqHVjnm27wRGpj3
TLSH
T1B8D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1e1b6cefd9c86519cbb682073605488378afbb09552fd273684042d250f4f554
MD5 6fd1baad8185cc73e0a6c530a9d6d0fe
SHA1 20c67b595d70772d6fc2d85262831c08bf525b98
SHA512 5595fd14d2fa767f789dae7a5f1a2f88adc53723597f4d19d68d99c4d709dc9aacc58a629c09709c96a6524d9c5624aa041db9dafa599d4965a31be63936b2fd
SSDEEP 24576:VAhGL3IFoiwtA5l7S53W/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VAMUFoiq5GLNiXicJFFRGNzj3
TLSH
T100359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 41ac703486f88532616e2f94bf25dfe8855dd5a5f8045476baf021093f2e6494
MD5 efe67820b58b52ebf3b3c46b1f6c27ac
SHA1 cb949e37d65a78e9cdbeb460a607626951ab7fae
SHA512 b1fb9b1d0dde4e22db93da8657a5dd7515d40905a71d1531b3a450efbadf1c51ce84c1bfe64ee8ea44236031ad69119da9ea0d8354d8549133261d17bc6e257b
SSDEEP 24576:Dwu4OWt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DwvOSLNiXicJFFRGNzj3
TLSH
T19205F18632941CF9EABB413986578035F7F2BC152A21DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 22f39a7cc62dc56d3dcd67208d4419e0acc3db0cba56d5bf885636900bb34634
MD5 1e5581fd9de3e0f20ffe877957915279
SHA1 952e7b70cdb8e0e20c234d8f8837f5c7650690b8
SHA512 9615d53e0a5d21eacadf58780d2f9706caf703b63aa4d0955803f0b43962bff18323ff46713c38d05090706ef49576f9b6d73cea9ef3a5dd26cac956d3774952
SSDEEP 12288:SeZ1IyNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/ZuE/TwSfVcYG3K/cJHlnFR+IGNe8j3w
TLSH
T1F6E4129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 58c660929fdf40cc2794c330c4e0e4ee4cfa8347d4b8603d9cc023c44dcf8386
MD5 195bc7b3bcb19b7f7084d5eaa735cd5c
SHA1 d0d735a39c4acbda35746778dee6cdf2d5e60664
SHA512 3704a2d49423ced31ea7fd3d98095163add18d033707b43f6ceba01278e22fcda8fb6465169af91e8d5ca48e9aaa11cb72cb5aa45545bb96124f9ede75fb435b
SSDEEP 98304:5QRQyi36YOcPbLvw2gAf+PN3f7wRGpj3:wQyiKa/X+PNTF9
TLSH
T124667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c8f8d5397816c97c2dd809a6947af10e9d5b0e04e77feda8bd66e15dfc218b5f
MD5 754c58612eea70e39991861eba4eae65
SHA1 bb4e9d2d0ac24f3e7b3ecd8c25f3bc0fabc6a27f
SHA512 20a92036184aa868d095bf13b67acb532769a4d9c8ed329dadb5dcd59f84c3f9ce92e8284ddd6c42dd65695e391aa022eb92a5d0b9182fd8a55bb07e6e978cb4
SSDEEP 98304:mQRQyi36YOcPbLvw2gAf+PN3f7wRGpj3:NQyiKa/X+PNTF9
TLSH
T1A1667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 875963350cdad5a4dc1e9703d1b4ce5e201eaa62ad4222b81fc261f740e750d9
MD5 e0af6f6ac15bf50b44012eb374c86c36
SHA1 39071ac585ebba51137419d29a9a0def0904fc05
SHA512 1972b8733d4640bb70d5bea4fe97da0769d5b2f618770cc29b7c06d7a4448eec06e10498539f92fcecb4ecf90b4633670c9041d6c8dfc9ea48830e5ed858a8fa
SSDEEP 49152:P68Qg55nhceWu7PNU3/xLNiXicJFFRGNzj3:JthLRc/x7wRGpj3
TLSH
T1F0B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c32180fa9440d6cd5f31ae79723cd16566c08fd2299b868b9ec9ccc6fa094e1c
MD5 adff1859e8abe4765e5c9714bf7617ba
SHA1 c29d6c4a01bfebec2c971f4cd94df96f9eeaea6c
SHA512 69a29585eff840e5b4408189b3f8e5f0d210d72ed42420ab597936a8a14896094490ee3b1cd381f45b74319de015b3a06c470ce90bc82dcd2bb842b0b8c6ac29
SSDEEP 98304:hy5112gYy5azzVvt69nLKnhZA7wRGpj3:8LIHEWhCF9
TLSH
T19C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c6fcd5a76a619942e43ae9c87e9404ce53ae5eaff7cc9c2c1140bbe125187f74
MD5 563476cb8a0ef06bc29d0674689d3cc5
SHA1 18dec382778390094ed79b7a982806c581988a09
SHA512 cb627f852420d158b13795421bf077923abb78688976a89e9980596cac3472ea4065460df93a7ab2efff00c79f43588addbd1176df1e939b719c1d42ecae998e
SSDEEP 49152:0B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glMLNiXicJFFRGNzj3:uu6Jmdxd2dM7wRGpj3
TLSH
T1DAD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f716c11e215f90186fe8475997b1fa3bbcb98c57e165b146f9ef821f97455964
MD5 69ed75fc96c89d39395796039b7d23e0
SHA1 0fa62081e54b3cdb81c278ee21c370cdf188d9b1
SHA512 baca1df3536c200bd831e82e76dc4fc1faa7baa05c6dd470a5b008a96cea39cb97fa1baef7b4b2ef3cca186d99de3f790be9c940df1a355634fc78ed30067e95
SSDEEP 49152:y1hpsNoJpF1A63U44CwH7R4xTLNiXicJFFRGNzj3:ymifPWR27wRGpj3
TLSH
T198B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 041cc0c3b0510abda35c7d2e3a36c9118a958b9464c92b2094d9e0b504709e64
MD5 b53043d5139bbad0491354ec22780038
SHA1 a82c35e3006919615c1e979bed12d736a5933846
SHA512 780266861e4865236f4473bf6eef1ace8573ea107608cf1791d5e3f99651466c2ab33470a0e7235a03ecda9dd38c7e12d63db4d0a476430db495bae400ecb7c7
SSDEEP 49152:YSuZQIY0Be2KcRVtOnks6NMHqELNiXicJFFRGNzj3:C5dKii61E7wRGpj3
TLSH
T133C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 28eb7b117245ebfb8edaf88f5dd843398b04507b4c154a775f1115a18e58ad42
MD5 324cf57d4ab614d984ab12eb62ff288f
SHA1 3594571a7222a472cc248a54facf589aeed6d31b
SHA512 ee2fbb01097667311374f99d2d392bb5d639ba53f15e6bb383c9926bb5b4eb255b4a0903febaa7fd93b5eb688e894d5163fedf6fa07dbfe9d1deea2607aba1c8
SSDEEP 49152:ShtSn8EApI0fig3giDn0AP5wXLNiXicJFFRGNzj3:TX2imphy7wRGpj3
TLSH
T12995BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 847f6eb31ebcc0aa771ea882849fd1bed7037898cf2edcc036a8bb100d07a1b6
MD5 823aea89e3d67a5b26c77ed55b1b211f
SHA1 14dc367287163df68afc22fee440dab19cda49b5
SHA512 12fb8385366b65adb39591841050a08180833a84b3075d3e7f11296593b664dba0c94ecf8588529ef134b458a042dd7a6f4426d8c9083a75ebdc1b7d36937670
SSDEEP 12288:W+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:WI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T136C423D2558955B1EBFC003AC6754428F5882E2DDB5618E3E3483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 f986db5d662e2e18528dcee0e081bc5734a70dfd04746b25a124ee3da629f600
MD5 0d28d1af60e77fd85335f6e8095110ab
SHA1 341c4445499c374a7af02ad74f3a67e09efce2f5
SHA512 601d85a859e078bdc74e74635d5e5c01fcc663b3d448861f63d9100117edec5002778d949ae51282f8bb1b5dfbb7c29a02cabd515f45200b38a87a7aabf061a3
SSDEEP 12288:SZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EFC423D3548955B1E6FC003A86754428F5881E2DEB5658E3E3483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 40dffbcbd490358f31f2ab59c8ec458661f6e216f0dfec4673895f34c7a83ec0
MD5 ee42926577f6183d0201fe6946a99c8c
SHA1 63663763fac1580b08af0114db6c784af962a6af
SHA512 261907d424858f5e7fa6b78c34566e4f8c0ea5ba4b9f886bbc011de63e337eb967f3040ac6c5cf22a1ed0205246a44822bbd4b9998bb8d3d968bf9a45a7724c9
SSDEEP 12288:kviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T171C423D2558955B1E6FC003AC6764428F5881E2DEB5658E3E3483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 6cee212414d0f2711f7b64f7fad42ef0e3c03c89c8a64fcef6ce8c6112b47eaa
MD5 3b14625aa3e0341089998e4c980785c0
SHA1 e33bd3a84b010d8e51df04bf89549ee1ca677c8c
SHA512 87d1f0cc5e622a99b5e2468b136f741eb92aa0510edd678f8cabd3e504a943305b64f0b5686e05575d491a9a996ae642c9d2c9642729bc77f14fbd97d312bf06
SSDEEP 12288:EVMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:v/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T146D42392168901E1E9FD803DC6764424F2A47D6CD7325AEBD3003D1E5674FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 fcf4a4420b9745c916410e80bb00fc02172943ead65c21b5504870e6d60f2831
MD5 0247c7a31e6ac2c01d9b31a54a33d356
SHA1 48966f2e895ba52ee5e47ef5427a4c989c7bffb6
SHA512 07a3e9dde8aafa88b16452f00347005d7dbef0b68e3a1d3b929a64764e0b636845cf524e7867f8bb9d6bb5cc7affc9de8d9e5d6ef7564c4d89e87d7e21190147
SSDEEP 12288:BEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:BO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A5C423D3558955B1E6FC003AC6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 ee309463b01db00a3bf83e067b79bea2d396d45e01602c861f0faf14c9179e44
MD5 ea4b36410f56163080dbf8f867021ced
SHA1 87137a6845367a9d3c81a27941c8f16105ce2e0b
SHA512 9873c34d56176e4fdce15653404eb38e1203e7cc1ff01244de5704c267d306c7136c3ee64299db884c1e6090836fa18d093d965081706921d1dda48f7aa5fd65
SSDEEP 12288:uFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18FC423D2558955B1E6FC003A86754428F5882E2DEB5618E3E3483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 209b6905c821cb1ec2a5e02045d841bc5889df4f5298018ef1d3562ff71f1b04
MD5 3bbee52e0e8723c43ca1810fb7a8d150
SHA1 58597e6f8cbe15ab236da52681eaccd9f4cafe64
SHA512 785367bf7f9ba381f3683208b53736f8ab006c3a96c36c42db3bf53327155d0d9492d96f28785ff28bbf47f6ac9b424da117003acd033f748a1ec0bb8bc4baef
SSDEEP 12288:TRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Td/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T163C423D2558955B1EBFC003A86754428F5882E2DDB5658E3E3083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 4d336c4d4e8718b5ebaaff67b764a7ae0403bb1a90179af2945d22322c026ca4
MD5 dc76dcfce991063494264aa49d301e4a
SHA1 6df4cff124b5313cbbfcc29c1412e32e920b8a01
SHA512 ee7a20846b9ee94af4f28c1090896a3c5529bd67c1b31ceecbdc1213e179cc182348c3f80b6341d47a1a0944393d18bdf2d2796b5dcb0a721b7ffe22e6f567c8
SSDEEP 24576:vZMRzFVSOl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vZMRzfZLNiXicJFFRGNzj3
TLSH
T12E050295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 037dee1a0d809c38f7b44f8041305ea4f9be2ab5dd395adfd2ee93d52059b8e3
MD5 281c8f2c5b75c789cd1cf12fbbad62bd
SHA1 01260aaa4ee130e35b91cac4ffe0f6c1d7538e13
SHA512 d1fc4defe2ab4267737acd0e75099198d1f577c6758fe5dd84a51d659d3244413095fad4f8be833e5da0e0a1d62cdb16f7396cc7671f8c72e60b307702d14925
SSDEEP 12288:nyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B1C423D3558955B1EBFC003A86754428F5881E2DEB5658E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 2dccddf6fd80910a0e4d5311fcf103356cefd88440ac841f33105e3f7b0b3966
MD5 e54f40d5d4042c8af7b02888e8385fcb
SHA1 76cf277296d936ee792df4e9d239c5f07e295a0c
SHA512 f7bbd0024b2cfb7452f76c9fa6cc16ceb86d3ef744d52dbc0ea1d770f4271ceef522cc8d801aafd8fdfaa520bc505f447718dbce4bec4e58cec7e06eb9b67526
SSDEEP 12288:3miJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3Q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T145C423D3558955B1EABC003986754428F5882E2DEB5659E3E2083D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 e9da4b75a25ca5a7134aff3255668ef80f8ac5db601bffd621adfd8bfaa9b043
MD5 5bc0c08a5a05dd4e5508b4a6a3607013
SHA1 2c2fc280065182b7a71ac4a4318b5cf0dd3166ca
SHA512 0e187f2581a01716655b62a7fc0eab6481cff392552393a1fa8c4e93cce1fae8bf5affd08558a06b97dbf535af8862bd03cf716d4b09c321672e8e68dd2792ab
SSDEEP 12288:6yPz5L8NiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nzyR/TwSfVcYG3K/cJHlnFR+IGNe8j3w
TLSH
T132F40247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 56697e1074884e9357f28d6a223ee4795d9e686174fa47e9b747f17420316693
MD5 51278cba4841d64d67f2db3b2f635fe7
SHA1 6cf4720a52771026d3a98f76a895f711628a8226
SHA512 b6d34261d48327b57d122f7b9ec4fcebdc6415f1d45fc2985af9dc8a304795183aa82c0cfc5d6b522d06b613be9db694320003e8832380bd09acc925fea877a2
SSDEEP 12288:nyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1ACC423D3558955B1EBFC003986754428F5881E2DEB5658E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 49544b18d9e1e418b3c0b82cf7e459e0096f710c664d22b77bdff093f4684844
MD5 0f014e04838b158e3e6e6b3780694e1c
SHA1 c3b898cb3b274efc13e003fc981b671ad779e2df
SHA512 6e7cf9f89aab3833f5a272e2713e35782888d5df9fcd6547f605a6d790c11eb7400dbdc514aabdff4314044b12e873909556dac05629bf8fc79c8eadfb6a44ae
SSDEEP 12288:LyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:LU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F8C423D3558955B1EBFC003A86754428F5881E2DEB5658E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 df069238587ce79516b8b9a8f8f5a917b7f1b993eff382af12f1154eb47c6668
MD5 64241112f098b2703dd8c637aaca5c6a
SHA1 ddf77cf187c2107911a46227e03f617956804bfb
SHA512 236bd79c10815f9dbbde6d1970dcb7a386b83ced167420fe442670ecd5cfc177b65ed610fa15c72787ce492941e2b7bf17ce61eb091f2e75f11a30a6a0367be8
SSDEEP 12288:CyPz5L8NiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fzyR/TwSfVcYG3K/cJHlnFR+IGNe8j3w
TLSH
T172F40247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 39441c1e5cd2641245c75e5f56a2ea363facddedf82409dc45d7e64490200c21
MD5 441743cf5a200734f1a1a6e0168e6298
SHA1 0b48fa28128ddb9f19b5a747a1912cf962ea0adf
SHA512 f57b7cb3e6a991416eff08e7d1f1240669f48097f16534abbe1044af695230e67b8b377122b8378524d1c3d3aec4303c969a879ec528bdba5403eb609ea11c35
SSDEEP 24576:6TDaLl3z0zDL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6TuLljqLNiXicJFFRGNzj3
TLSH
T13B0502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 a6d742e3c91b6d21e36e9d89adf76b7d73328f2766e919052e7245f5282563f0
MD5 dde7127316f4dc2e0a42543ac27d1255
SHA1 430dc36536f2c86ba22a806c26804f93f1baa334
SHA512 96b939390825940d4e781628c537e6a8aa22d464cce4405f897d1afc9a8d3a445a1ee83b0d9620449cc84f0c5a49ca13436172d78d5ed92ee7813569ec5bfc53
SSDEEP 24576:D3vd9CHKy7GZ//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jvd9CHKyaZLNiXicJFFRGNzj3
TLSH
T1DC25CF90F3E414E4F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 fb50412f8da71221d16f1346c5102c63fad5459f6bbb7a16adeb34d898a91efe
MD5 e04ca06a37517d9ec565e7620502c744
SHA1 09e78d4e56e83a83cc6d2661f8cf2216e1f7f6c6
SHA512 b071b4c257773eccc8fbc28874cc3bebd3929cf40947ab8bfdbba8868f8cc9c315631503785ac7b5b2a227c7b4fd685933c82f2f2800150fa5e8f8a5739ab180
SSDEEP 12288:rPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:r7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T183C423D2558955B1E7FC003AC6764428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 efacb76a8d84432239098f6bc6d207116f010327962b4424bfedc1ebb714fb7f
MD5 d981cc0fad793ec06d7b8dd09a11669c
SHA1 cb94dfb19c3704d844a324ee42748cbe581cc5ef
SHA512 7df01e01543e37207250db29f9b027f453349bf187080b8432965de498d75b626582244a81d8b0dcb5dc7094a037bfb09eae5270862ef8c1e5aaf284ae0d4909
SSDEEP 12288:ctiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E1C423D2558955B1F6FC003A86764428F5882E2DDB5619E3E3483D1EA27CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 408e08221402c8b2354ea144a01cb011fce39e98c248af5ba88798bbf7c0c8f2
MD5 7b50ce7d1d12cc843bbcbd0342d0e3a5
SHA1 b026a247a4d4a362257103f48fa3fd2deabaca98
SHA512 d45c5943db05486a3c7efa73e812352201e191841d4a616c24f5cb3c0f5a878eae1e93248a64036d6daf30f446dc82a474717f3c047f161d5ddbcdb13d394260
SSDEEP 12288:6QiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6C/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T167C423D3548955B1EAFC003986754428F5882E2DEB5658E3E2483D1EE27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 d06086d3812ac94ec9f907160aced6cd40e5ae61684c0117599b8868645366fc
MD5 9379a94d48bf9f9da0ba2746846fd11d
SHA1 390402dee0b344df39f86621b35c162706dfb701
SHA512 98ed42e2b975e3b1ac53b0ae084730f4cfc0df31aa9b1b27a7bd184d460b3556d14961f7c769f3bba70a105017089dac9487e89ab84525a0697f124df682ec00
SSDEEP 12288:kyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CEC423D3548955B1EBFC003A86754428F5881E2DEB5658E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 c9016939b21c644e8e2f52b5ce0e08dea5f8ab8f7e5e6b3031e6f969686c10f8
MD5 ea6a304be4d384ebc1d2158884e4788c
SHA1 bb12d97f4b28c895fb11df24bbafc6e9da390a07
SHA512 43710eca4407e74bb807d4a9239aef144728e6c45a253afb59619ce2e3b6d7252ded37daf4534c695fe7f4f25b072d7a83b3db52cb7f9069a02bb6155df0dc04
SSDEEP 12288:OPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:O7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D0C423D2558955B1E6FC003AC6764428F5881E2DEB5658E3E3483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 8c7ed53063db08f46ea4d84efb5eaa9350e0fc51aae26dd148ddc005e40886d9
MD5 23998afad1de1c753a47d10b4bcbfc6d
SHA1 55a2c9452c8d337aed06871530a7e3b670f5fc3b
SHA512 6b159738e173902d39289f4aeb6f6c83bc7c5f9b1beb6822ff5a9c0ba89bf1939eb22eb8749ebb3d9e5b5d9dfbd963cddb8f0308c7e1a39dc887a1e4753e16fe
SSDEEP 12288:pKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D5C423D2558955B1EAFC003AC6754428F5881E2DEB5659E3E3083D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 de809b435d915bf8d40a6785632377db23b1cf6bcf008766b5c0c8cd4a16ba08
MD5 cf349ea245d6cb9227bd2f8205406e53
SHA1 2a6bc01cc6a5d0d9a881cad50c246e262bb5677d
SHA512 eb627d877e5006065629c2b1ba2e7e9e39d5065f899a6f1685144cfb20be5a11868b8fbd16eff8bfa55e8879e8fa62684f7b938dd73489d4915fa2758a5e77b5
SSDEEP 12288:GEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:GO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17EC423D2558955B1E6FC003AC6764428F5881E2DEB5618E3E2483D1EE27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 f48d0d3739eb59a4c4ac42fb8d9f622d3d939053a1ff178096bcf9b1cbee104b
MD5 c8f8e4f96d1f1ee144e474497bdc15e3
SHA1 d1c51798810f1ed2ce8412bc85635f58c6a2159a
SHA512 7b0b10b497b965364db66295d0d6c6fdf20a9dec05780a9800de84771bb24a962a35842610a18c24511ac07d0d58c6da7f19b82a365520aa23f93884dd88a482
SSDEEP 24576:NfwvUk9RX6wkyAIg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fMnYIgLNiXicJFFRGNzj3
TLSH
T15135DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 68be8141c69c45f9761a25de3b3321db289e23c081e86927d5d4ae3460f5fb4d
MD5 8739f70d5d504140975f1ef42b309f39
SHA1 0bda6cf08223707f6c44cd799c8df4c9fdfb93a7
SHA512 bdc770eee69ec36fd0abf114008fedfa583c6b7b74a408fbe426b6ea8b3b60ba99e7bce7fe44c2479f3b9b8a17ec30ed9420da59ece2417aa525e884559b4ad9
SSDEEP 49152:6YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK03LNiXicJFFRGN:BySzP/7wRGpj3
TLSH
T116066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c1f28d1233af790c49655421355147ff166132b004596bf14579c0c53905643f
MD5 ee43fab3f0d3cdff8c21a2779b4daea6
SHA1 3fb859446e6ac9bf4af395024544dfa686e771a0
SHA512 7e98cd0ac7439506fb418edacb096b39839e889d835822098900dec775d66b052cd7605bbcf25224bcc9cd5e1b4dbdeb09b112a734bc103e73a2f64aca56a79a
SSDEEP 24576:W47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:W47JUQjTirIhCnDHUPfF/HLNiXicJFFS
TLSH
T1BE65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 89b05d3bb4e519329e6bde4e468b694af321584a6fbb5db83fd02ca8e7948fe2
MD5 9a4384079ef5949bf5ac6947227c68bf
SHA1 bcea8e60cf7e024422d62b5030cd24f433ae0c2e
SHA512 0ce94172d67bd1da1091060ef65a2123a132a32543198d9113df7632947d2770e4803d0a861c957f1c4de2f21089bf1fd61ff42952b1c977aa13470c411c66e6
SSDEEP 12288:WbsfCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9E/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T179E4F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 aca1c5e1c5e889dee216c0fe850ef1161a40ab1d3e1b9024dfc24cb92cd5801c
MD5 0fa0c0f55e10c37f34e7b4ea5815777c
SHA1 8a7036b0f64b21f521b2625d24ab638a76ca4e34
SHA512 b339b2ec1be56dfc3b5e1c05cffaed209642579f07910746b58c879625acb65ef4d3149db9893f21895d92e7eb64139c28e352f45ef871646a9d5778be60e252
SSDEEP 12288:2OB6KU3fxHVblCMmS3gSjhd4TcFQ3+axtG5Fz:2O4KUPRCXK34TcFg+axCF
TLSH
T164353951766AD75FC5A940321E32C1CCAB707D01EE05AB0373C99B3FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 1f10dd1b0f32f1ad879c1b412fd2df4f81e1e8dee0bd01ec1e0e0b1723c2c546
MD5 5e85337174baffd39512f0760662f31e
SHA1 6a23989d5c2c99a44cc385ff4b85717bcecf2ed1
SHA512 a9d551ffa65645858005e651b7584e7e71694798b1691b1e08166418c66a73bfc294e568b546e02a8958ff3b8e439532a2595e44ec2026d0b65bdd568f3db3dc
SSDEEP 6144:vE7xJMyBSmcox2WoyovbfhI1wEJRAYPptMxCHAxWdPptMxCWZX5S6BCekCjK+OKq:gcmcoEBEjAtme5tO3
TLSH
T10E75EA81A537A3CFC0FB607107265B4CA7A4EC46B7056F227388457AD86B726B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 eead6af1c7c8994f594c2524886f41eec7520d9cc24e943cca9991ae9220c822
MD5 4f0bacbbfb12ae8c6a962efcda71dd3c
SHA1 237de42526c0b41c62a665044b4679c310438211
SHA512 287057e5084f755885fa6251fc5f304c63226a0aa9f4207f30434c2f66cbb4c92ceae17197685ea13ba0fa253abf21ff46fc2d52cda1c89432bc3eac9a52caf1
SSDEEP 12288:Qz7aiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:O8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DAD423A3568C59A1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0a381189441af839cac612d2690748fce55fae8e6e61692369c06b6ca0c799b0
MD5 b4cc5431d3d9c12e4e55d1a49d551ad1
SHA1 4401a77ccadddd9ab8b8d99ccb0c9e079466f880
SHA512 d74651e30bdc495dac431cdb5c9904b20560eefc4955f55b71bd67ac262f7dd503c0e026fbe94969ceab8bf9e1351b7558b4b757141b5dd290b9e42938789f47
SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bYq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Lgb4mBIBhGF1LNiXicJFFRGNzj3
TLSH
T14365AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 b200400a67f2c8dba04207a456783d7fb64eb46dfba61b56d286856a28c95e83
MD5 9880b084f7916850f7a4b655f852e20b
SHA1 55ae7598499ec1c8f30ad9801af0d03cc6ce1fd9
SHA512 f0231530cd1af23585324aa83995e53889d3367e851ba954fcfc93a59304a75ec160094801dc9f28d77414a7d8eabd7f44234b898a37c820014b42766f27eb5d
SSDEEP 24576:ZG88u8FpJqH1bzria7/ml/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:M7ZFPqVea7/iLNiXicJFFRGNzj3
TLSH
T1C935F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 069e4c4e7166961491489eb442802fa49a90a935d2fe0d630eff16d458dbbe5c
MD5 195551df9c129c4f10d44629216ade52
SHA1 2865446f225140c5046773e47cc3cc8559d34295
SHA512 07a597c8b7781a5283df75d2a759ed8c9e4c6a7aedb45702784dcb1ebbaa3816d9f1db3a04daa92674e4c730a82624f4a6d865abad41b36c4c02b5e0f87337d8
SSDEEP 49152:6BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjJLNiXicJFFRGNzj3:lG05lO43bY7wRGpj3
TLSH
T1B2D5C06E62EC11F5D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 689226f2bf2d2276452763707585c40cfb3327413687a88cf30f87732ae02c13
MD5 d628ceddc87f1de26f39847fcd33d999
SHA1 e6228f198ffb7147a06d480526b13e07a28ccf69
SHA512 a6b7d7a75f9567a149b50d3a2e8a24cbed0e16e29f17e28983f52c2b2944cdb6000d02df91ba016881a88424d777ea30ddc4f3f806eb80a0feb6d24cad8643d2
SSDEEP 24576:jfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn3/TwSfVcYG3K/cJHlnFR+IGNe8jg:ba5POZ3BJt2pasx2+mxLNiXicJFFRGNf
TLSH
T16B65BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e59020f344e43a82b8538443bb045b0401f52077fe9f7fcfdbb6018264ef033b
MD5 6dfa4de5b2e6261b277f5ee42fae4b7e
SHA1 8d5f58a3504ef8f27215b0081f0565317ef3c9a6
SHA512 61a0ac463012329428318c2bad0c987e01b8474b9f5d7c16a3612e6b476f31eb53064ed3d4c5bbbf16c6830bd0a7dc1673108110625fdaa674f94d8427d0d7c6
SSDEEP 24576:YNcwHdjbyQ4nLC18lb/EOjowL7FkN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YNc/zEOVHFCLNiXicJFFRGNzj3
TLSH
T14E858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e55e73048876cbb2e864ed4fe5fb5c1b33f69a1279affaae522d718b749cc793
MD5 1668bab72b1e893f8d2ec2a88a30bab7
SHA1 14384069d34132fe979607ab9d3e83288e9d338f
SHA512 b0980efbbbfd3ceddb71aae235694578ba7ceeb715ba5c67cfcdf9bf1d23f6de7fb5c79b0f33f293cded1043efc9c97ae44d56865a19520fca4bc29de54e9df5
SSDEEP 24576:tTkNvNnaFeYhJNtmZBmw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tTMwBtOmwLNiXicJFFRGNzj3
TLSH
T17555AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 23b248872c5e8ebcc3e12b282370666d29165acf134dd81e7d4d3888fec2f38e
MD5 904ea58fe6805b611e18447ee06c095d
SHA1 e382c2540e5d774a57c956084c3f46d1d3fe11b3
SHA512 f52572f6e8f1755ebd5f86613c8a6cb57788c02661311deec20b3b4d133d69a0c0e2cf73dd154625a1266543101171dd7449516da321c6af3d6669b80e02863c
SSDEEP 24576:tPUr+NQZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tJQZLNiXicJFFRGNzj3
TLSH
T12705F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 e9a4bcb9863a7871b9b0c104db36c807423c2500e48c99c21e71fb6f0e455086
MD5 9c72f6c0d6f9bdf50751c0b5c8adc0c5
SHA1 7f43db4cab0fc027c40d956168965636e4e3d019
SHA512 7709bfd1dee1c52ffc30d0e88bfe906079bf228a13ebf0ea5fed459afc6cd2b1a627a7cd70bbce829be7085ae0b4912406d306a8a9ee3ab3420151bfc9975287
SSDEEP 24576:zD3FHshBIYQgAo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zDVHeBIAAoLNiXicJFFRGNzj3
TLSH
T1B825E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/828-90-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/828-331-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/828-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/828-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/828-84-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/828-83-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3380-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3380-316-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3380-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3380-96-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3380-103-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3816-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3816-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3816-147-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3816-153-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3924-61-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3924-69-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/3924-297-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3924-63-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4552-14-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4552-21-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4552-22-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4552-95-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4552-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4724-30-0x0000000140000000-0x00000001403AD000-memory.dmp

Download

memory/4724-9-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4724-1-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4724-0-0x0000000140000000-0x00000001403AD000-memory.dmp

Download

memory/5024-50-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5024-57-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5024-280-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5024-51-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5236-79-0x00000000008E0000-0x0000000000946000-memory.dmp

Download

memory/5236-74-0x00000000008E0000-0x0000000000946000-memory.dmp

Download

memory/5236-312-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5236-73-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5312-145-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5312-116-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5312-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6604-118-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/6604-108-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6604-124-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/6604-318-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6816-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6816-140-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/6816-136-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/6816-130-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/6816-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6948-48-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/6948-35-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/6948-34-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/6948-46-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/6948-42-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/6948-41-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download