c9f918328ee7bc3dee2e6a1a569a8dd2d2786b7925bf0442a53194775a09bb41

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_89b9c74989d620dabbc8ec0fff80b470_icedid_njrat_vidar.exe
Size 4.6MB
Sample260820-pgewnswgmf
SHA256 c9f918328ee7bc3dee2e6a1a569a8dd2d2786b7925bf0442a53194775a09bb41
MD5 89b9c74989d620dabbc8ec0fff80b470
SHA1 93fa8111664cd0ac815263e5273966b5ec0b910d
SHA512 a506c89537c365485a0f8a974b99e4085bb3233fd3f133edf860555673b359e79eb79bf746c5a58637f76b8e085c4b728a1465d5f585de2d654d755657c946a8
SSDEEP 49152:YdRba8fD8qinfMSKJXIUQREV1QOTu1U5ai2wzYo5UC9RhuCTFKlaxV5dgbTNgFIa:T/IJsiCwsop7cTKUf
TLSH
T17F266C656BF880F5E1A7E134897AC9B2F77678020D71EB5F0251CA1F2F33A904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3136	elevation_service.exe
1428	elevation_service.exe
5792	maintenanceservice.exe
4352	OSE.EXE
5744	PerceptionSimulationService.exe
1688	perfhost.exe
3560	ReFsDedupSvc.exe
5528	SensorDataService.exe
2300	ssh-agent.exe
4104	AgentService.exe
3048	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_89b9c74989d620dabbc8ec0fff80b470_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\37a5b21763f1d8f.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_89b9c74989d620dabbc8ec0fff80b470_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-20_89b9c74989d620dabbc8ec0fff80b470_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-20_89b9c74989d620dabbc8ec0fff80b470_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-20_89b9c74989d620dabbc8ec0fff80b470_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-20_89b9c74989d620dabbc8ec0fff80b470_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e36181a9e30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b4f0801b9e30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c1e077599e30dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000232ac6599e30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fee3b7189e30dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb082e199e30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9da4e179e30dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3136	elevation_service.exe
3136	elevation_service.exe
3136	elevation_service.exe
3136	elevation_service.exe
3136	elevation_service.exe
3136	elevation_service.exe
3136	elevation_service.exe
1428	elevation_service.exe
1428	elevation_service.exe
1428	elevation_service.exe
1428	elevation_service.exe
1428	elevation_service.exe
1428	elevation_service.exe
1428	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4280	2026-08-20_89b9c74989d620dabbc8ec0fff80b470_icedid_njrat_vidar.exe
Token: SeTakeOwnershipPrivilege	3136	elevation_service.exe
Token: SeBackupPrivilege	3560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3560	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4104	AgentService.exe
Token: 33	3048	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeDebugPrivilege	3136	elevation_service.exe
Token: SeDebugPrivilege	1428	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4280	2026-08-20_89b9c74989d620dabbc8ec0fff80b470_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 5404	3048	SearchIndexer.exe	99
PID 3048 wrote to memory of 4040	3048	SearchIndexer.exe	100
PID 3048 wrote to memory of 2164	3048	SearchIndexer.exe	102
PID 3048 wrote to memory of 5252	3048	SearchIndexer.exe	103
PID 3048 wrote to memory of 1928	3048	SearchIndexer.exe	105
PID 3048 wrote to memory of 808	3048	SearchIndexer.exe	106
PID 3048 wrote to memory of 3288	3048	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-20_89b9c74989d620dabbc8ec0fff80b470_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_89b9c74989d620dabbc8ec0fff80b470_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4280

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1428

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5792

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4352

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5744

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1688

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3560

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5528

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2300

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4104

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5404
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4040
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2164
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2604 2600 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5252
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1928
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2604 2600 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:808
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1937aa8ef11145f083056e75685227a90e49a9f7ad8a9bb5c55fb78997c5c4f1
MD5 1a22c42207718b2d69eea2387cb176de
SHA1 568fc40c8fb7a846ca5e488ce310b8002c24ed5b
SHA512 e0468ce0d18a10e36b2b1fc1ec34e20e826864b55b6ed92d1c3c6c1ba253eaab54c2d3da548459ddbc32993a4db803125edab504c57fab0b0ea34c071ab09b2c
SSDEEP 49152:1b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnmgFIDRRAubt5M:L3q6sjBcUf
TLSH
T189D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 abb256b06ac7639b4efb092716f883a2fbaa7d56b92b1cc6d2d7fc1251dd5535
MD5 9f45c6e9a141a8caad6f782d690e8f24
SHA1 ffe09fb9ca2c923f1a4119f630c22bdd2cf1c153
SHA512 0848b6e5b96adf4f64a3df34d5db37c8298836401d33da98158376ae9c8e4d7436e47e91431771a9498544d405f8c42b93663f86faae47e5eb4f54d1d2ee7048
SSDEEP 24576:VXYfDtczAFVg9N9JMlDlfjRiVuVsWt5MJMs:AtcUgFIDRRAubt5M
TLSH
T1C185F12873D509F9EC678279C9B28601DB33785547A0E78B03F089665F732D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 8b4600cf2ef752a683a25d4836fda76dc7552925ac4503ed06644c9326daea9f
MD5 ab57c4d58f6655a9442c24c636c64728
SHA1 6ca9ffd033613d0df000179931d41614ba59f62d
SHA512 21759f6a5ebc638e3250675b4187eb51a1bc1789bdb742c6e7c20c6290b2985d3e3e6ab3c1ec0f45a593f5836df5c6e6d3eef108bc5cfddba9f3d95f8dc0890b
SSDEEP 24576:T0Le5ji0hmx7rMiVg9N9JMlDlfjRiVuVsWt5MJMs:TPji0A55gFIDRRAubt5M
TLSH
T10D959E26F6748375D073C0B9C5D2A68EEE72308617308ACB4296C77C7E676E6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 81622ff1e83c53b511b9b1b6e003ba1b8d26816433f3ba13a8184e5c76086b8e
MD5 de81d0c641a53526d7f44a46334239c8
SHA1 55510b1ba62a43261b3d307086a0b11ee09a16b9
SHA512 c36c94bbfa0cad5f3445a133586a6a2e04d896d698a8e33c2a75102cb1c192c58799430ed798a676dd2f27171b4e3936c9e07c479e6b0dcd8c00881d3d5db400
SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWn6q8wyuEVg9N9JMlDlfjRiVuVsWt5MJMs:8/ezSC6vUzPveHjydgFIDRRAubt5M
TLSH
T1BA755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a2de49f590cd0d39c6c233bcbb3fff4b60a1367b0cde0e9e221288624a3e2671
MD5 901374dd8d7225fb3d44240f23030af9
SHA1 7f43bc5cfc8cbc902b0dd083d97bdf5db25a1ff9
SHA512 fabc73a02376d2da3017ac9a1e359d4e5f3e4ca109201e10fa36508c23c1b205a7aa4f3398a78c6d5e34eaf4371d41637ed6d53b7b78c3620dffddbce9140859
SSDEEP 24576:TVbqPb88hv/l+YRVg9N9JMlDlfjRiVuVsWt5MJMs:TVO88hXl+cgFIDRRAubt5M
TLSH
T10E559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 ca0fb338141e8b90d18635b763e2f2ff1ffc63afbfcf5c580dcd7e3345a6d054
MD5 9946c477de000ce89c78b341b99c9dcc
SHA1 923882ead0a18f582243663b7c549a496a49a226
SHA512 b0a8d9bdf9df78cf6c9e1a42dd97c4f391e89dce66aa0eae3b1374677c2e565b97ecc9ed698ce9e824ecd1e6f52e2497ed72a3ee6a129daf6adea93b92717dc2
SSDEEP 12288:r9tIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:r9uVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1F76523AA7645A5F6C65B82B1CA735389CF226F5835C58547C2B019D1C9FC1A2EC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 b3ed6115f2954d5158dd192edde41d5346226a3f417f66b6854d19bc8d91b3f5
MD5 b2db9fff0f6faa4eb0f6edc9678c1713
SHA1 cbd7850f02211e3ca0a9ca3d264b7844bd9274f4
SHA512 9359a7b9c2596a726cfbff6dac0e05b2c55dd1201703a54972f03410f543f0575e6b7f0ee82961ff5fec2b564cebe09f284905b099eaa99899321c9df9addf8e
SSDEEP 12288:FeBNUbTVO86USIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:FJIUZVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T15685CF7BAE28FCE2C27E8DB99A918340D77278304B5293CBD174824EDE235E15D7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d2749968ef6e9007a5d9c8e70321cb5b60b315d1671ec53453519f74b1cecb22
MD5 2624c9c023da41a11e149e1dc6270403
SHA1 1fdfe71cd36a4cd533fa1ccfce4fcd6a500c5bdb
SHA512 bac2598edc73bb3093baccaf2b6f09be148f6e94261d9aaf3b7c82f5fe1cc0b014feac713bc4669bebaa2ace332cd24bd1881d1c6e65b16ef253946259de8583
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THo:TQvGAdlCEL8c/DRNw5CJUf
TLSH
T17E267C656BF880F5E0A7E174C97A86B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 65f0a12f3272add53532acae827c935ac0a1a63edc353696834c57dbd883859b
MD5 2bf9a21322b1aa50e1b92ea1547cad93
SHA1 f56989d54c5220ce3498df8e7339f21f1d2901f6
SHA512 82a1bbab577f9310a651b6a09b34e5f8101bf89c5727e4dae3b63fa4a4c4ea20552a799fa7a6afe95414fd2eef8d948ef591fa95bae31fafbf27f7ecac786298
SSDEEP 24576:4SewsAj7Vg9N9JMlDlfjRiVuVsWt5MJMs:PljpgFIDRRAubt5M
TLSH
T19485E031FA74E036C27B0DB25B36C706583D7A204B911AC3E3B84E9E99742D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c22882ca2364fea600197fe0e69a221a43602eb64f99be61fc8141f3e6bf50ab
MD5 3dd9b95c1784f579188b01b4e356abe0
SHA1 543b274a6cbe13722253d298a86053784397fa72
SHA512 c716bb9d7824660871cd9cc8c18d6406193f9653dc240c5b126529d0fb98010b06b00e71da426486d7d424934c7361429f7b8fdb9c7f6bc1d99ec10c346b5097
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHGUf:sUEtQevvqc2W1cpV2tI32GUf
TLSH
T175474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8d97ef4f2c303cbea20780320f45ff17a33880a9ae7c61d5ae4f0ef5b5701478
MD5 fdcd0f8fed39a932146850ebda17fb23
SHA1 a9281467b261739ce59b54beec74211be8bb6d49
SHA512 63123a64e0d9b6a4bdef3504180f1f894b3e1e993f18a594009a355c6e736473b5ee848bcc0d9d108d65fa91ba06dad74972c750fa37b42ffbcb6ea1ca05f71f
SSDEEP 49152:fCbRquA/m2yL5zQfFiV+XenmE3/zJgFIDRRAubt5M:4oqtVjnmVUf
TLSH
T16ED58D1976B8C2E4D1F6C37886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 40ba535d08fada08a3404acc510d8c6428843c169e376235bcba142e3cda9634
MD5 a463fabdb069e488ebe6b5bddc30b2e8
SHA1 aa5fb208bd05b20e92c21cae45d8181c7ddb5a6c
SHA512 228b8bf5e8a85e55d821b8f74f2960e9691e78b446f6e8bfa623dad5d1ea69dadf0291a7d7d578bba8b8f74c874c255494effaa58e6bb64eb972c167b6d139e2
SSDEEP 24576:wAhGL3IFoiwtA5l7S53YVg9N9JMlDlfjRiVuVsWt5MJMs:wAMUFoiq54gFIDRRAubt5M
TLSH
T11935AE81E7F955D4F5B3AAB899B68171EA76BCA95E31C20F2160C11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 3b0e58c2364b66b3a3b29efcc99b74b66dbf5f36ebaadc0cea9a59c7d632c84a
MD5 7ca45868014ccd489717c5dd3982013b
SHA1 93392f1de05acf70d17b9c87af7d41924769446f
SHA512 75de3a092ca8cadd62b12a4e5d2f65538906e43ff6b6fed87579852179ca0ca4a567b7b9696766f1a232e1a3558f48317a7a1b18d27b4819abf888ad263a4df7
SSDEEP 24576:6wuWOWPVg9N9JMlDlfjRiVuVsWt5MJMs:6wZOsgFIDRRAubt5M
TLSH
T11885F14A32A40CF9E9678239C653C136EBB3B8053A61C71F4370C65B5F77261AD2EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 4717710765fc7a51cc883e680850806ee9e7be0d519f62a07ba0b8226c642f1b
MD5 b5a7e4162b8cd14c91aa29640845b5b2
SHA1 94f0e54b2f2a02cb1c20831006c5756074f07dd0
SHA512 f6c962e25360e2cd880009dfbc90b9731ef51d7e1695dba9b9c0897e3e3dd03fc56d62e89ba5cfbe885918bc63dc8c1e5139d878fc9e8e4337838f0f28e2c15c
SSDEEP 12288:b0Z1IyIIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:gZuKVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1777512AA32D460F6D1A78278C9F24345CB72785633B283CF427006A65FB66D25D3E763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b50f3b0ee371541d9e3763479f6b8d3bd29f18e7c53c3af1accb4467dede74f2
MD5 a9e568c18eb243f16ef676e72b52f872
SHA1 d3ade0b692382549648461c4e26accf42624a65f
SHA512 17ed747753bc065951e1432cc272683359ec788b6319e52b11d39f15a551fafd9ff97b8df30ab84db1f2b5912c2561f25fe64a10846788f1ffc8893c4cf5f35e
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UE:0QRQyi36YOcPbLvw2gAf+PN3AUf
TLSH
T1F6667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 56a9e57be191269396f0825401d680fa08fee2270a527a300bdae34c77c7af9c
MD5 fcd45a1e149455421ddb73734d301ef8
SHA1 e37e695dc820abe66a11451256bcdd9e5c70f596
SHA512 51056b1158a3094817b8d73d895787db591c4804cc059d9054652863645ab6dc3f8e7977c169d9819fe8b9ec9e0835aa6ba2f2d915ab11fa57a0f274cbc9b7c2
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UE:EQRQyi36YOcPbLvw2gAf+PN3AUf
TLSH
T18E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1b95761793cbb64ba368955694a5deef79b8afaa9dff57de6f8ecd6cd557a719
MD5 50e7e40a046ed303fb3bdf68ce55538e
SHA1 d9e887524a5ed30e11c8971fc10515933eeefb58
SHA512 9f1cfdcfae8690b32c41c2b4f28115874e967687e2ab4ce83e6f619b2bed8f68b0d24a3536d5e104227b21e11635d0b3373e8e1591d93df45f0b1803371d9d56
SSDEEP 49152:H68Qg55nhceWu7PNU3/5gFIDRRAubt5M:xthLRc/+Uf
TLSH
T1B1B54933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ca9425faab2ae9388905f2157d5f9f74aa577de22eeb70ed5143beb4e5729667
MD5 237405a13082f0a5e64bbf807ca18553
SHA1 561727e7d99d0f03e8ab49cfb693f5bd31445b48
SHA512 c23c2dfbbaaff6725b84b45dcbed45fd243690e101a6dc3cf011da4a15ec2218ce4c72f4537fb8d58ec3b811616d5ab9157884382e454c55c667b9961621e7b6
SSDEEP 49152:y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99W:Ty5112gYy5azzVvt69nLKnhZTUf
TLSH
T1AD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4d1f3802f54b9ba358d4c6ec5e0290a237133233929591789c08ff3f58e123b6
MD5 a77f434819ad4594f0f20bfd5ff50f61
SHA1 626a4ff04e22f22456b5744f247c9667d27403dc
SHA512 89e8feb327a7314d6d6c90521eb983f1cb530694372eaa1595fd3ae8c6c84abb3a8a39b16eeea16a758e625530856f385712c933a9b9101bc3e38006c160ed3e
SSDEEP 49152:zB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glIgFIDRRAubt5M:Fu6Jmdxd2dVUf
TLSH
T1A2D5AE13F1DA01E8D06ED078974A9233EA62BC490B35B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 68a2dc93baebd4d6de456164b2e4a57886fd663869ff5288fa130c52cc455481
MD5 a716f42011a95c36d7f25069084f1363
SHA1 863fafd1dbe16c65954452cb66a2ff6740672d26
SHA512 be057a10c93c9a0ba943dca45fd7bce619a6b1cb52e066f04b424d063d5a64db1501e6709a47c4093fc50002974645b9b9bd64bcce0a019254552e1defbfa760
SSDEEP 49152:a1hpsNoJpF1A63U44CwH7R4xDgFIDRRAubt5M:amifPWRVUf
TLSH
T1A5B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BAE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f8dc018aadc45006167e35ecea8f2eda87e19b80f82618d7c0334797128f4b40
MD5 cb14fe9246ccfe9033bf86eb7d18a46e
SHA1 32310c8eb4a06b6e9a671d17f3f55fcda8a925a0
SHA512 c1b3e3b702fb410f1314a0c43a633bf92d154caa4cc4a37f19b5ac02ddf6b9b4db0508a6af54b3ed5789ded7ecb718fa7caf1d23d2fcf85eabdfaa851d71afee
SSDEEP 49152:WSuZQIY0Be2KcRVtOnks6NMHqWgFIDRRAubt5M:45dKii61XUf
TLSH
T14AC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c45d5038f75d9c93405a863c4a353ccca4c67929bd94635d6487d60ceb706aeb
MD5 6bdb54566f9b69a2f3310637fa626696
SHA1 173e985be41103eb76a3e9a0d3ffd426c8db17bb
SHA512 f943637632ce3896479e1e51d802d40bea6061c39c182a95337f4e8c4ffd71f278bafcdcdec925cf95948c7199d9d6c4302113c9cbd9e7c5568dd01a5981dbcd
SSDEEP 49152:yhtSn8EApI0fig3giDn0AP5wfgFIDRRAubt5M:zX2imphBUf
TLSH
T18795BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 746d8fd67cb8a5e6eee2184275d6673c5f54e3e17be53bae3f4efdd31b9babdd
MD5 02cfcc103ec5f4c68905f5e50df2caa0
SHA1 bee17d7e61bb5bb5f56da7beb993cfe344a4f346
SHA512 606aeab6c95dd4e6e3024c148721f3f9ced0ca57ed565becae40c0e7b69f2cc82da5b86bc56a342d5f653a20f99349726158f127d9f82dfa44c139c418b61e1e
SSDEEP 12288:slIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:s2Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1286523AE758695F7C507C2B1CA735389CF262B5E72C68147D2B00591DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 5d49d93197214dd658496fd5d58302de50cd2805f3fb184c6da9c9ecffd02929
MD5 4a0ba4039de09b8182fd1cbcf0bd3f83
SHA1 4dc884238838c5a1e65fb4a6a789ea62241b440a
SHA512 75a1c1b1f9ee8ff457ae48691f082130e6e6dcef14c813d2221501194def878e7629cb70d7dbd94033cca723694564501ac0bca5d20f437ebc2c819b75e83096
SSDEEP 12288:mMIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:mHVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1556523AA758655F7C10BC2B1CA735389CF266B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 804876af0b04975fe4c98db825e0a8aa7165006130455eb4f55dce43fd0a9b52
MD5 380dec8b8040538adaf882995cc9a6b0
SHA1 768cca22aa36f172b3610b2d4a206e3293969990
SHA512 8d98adbbbd5ceffeb19346f0b7964e04bc660d10112dc8df5f31bff195abf5b619022a816f49e1c75bf0e2ca96a7ac16b28740e1ec9e756b3fe9a8e4a7f8a809
SSDEEP 12288:VKIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:VhVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1B26523AE758695F7C10BC2B1CA735389CF261B5E76D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 e7e002964756b9dea7a3365df64796c8ac038d0916b62639bcb171b461cd89c5
MD5 06675459daf7ba2a29b0a29ad643d5cb
SHA1 2e1d82310a3a6d184b85862fc3c9a8004c78f775
SHA512 dd5e4f20353330fffbca5d35d069341f774044b5b3d87d8fdea9271cdde97e71d677425d43caa1bb9e7ec536ff4bc079274f50e9755e415f36c533958f472f93
SSDEEP 12288:OVDIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:bVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1C865236A369651F7C457C2B1C9734345CB727E5973A2828FD27009968EF43A1AC2AFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 4e72e4f6e885888c03d50487b69f90e1ce955304fbcfe36004423119fb58b350
MD5 105ef1478eabf6d710d5405a132622b9
SHA1 c4a66800a563268acc021d84885b7e970c611540
SHA512 45c063b9c143bd0ac4c16862cf44f2e4871a74267fa1962bc2974c0516c0b2047ef0436c65bc95cf881b2ccf6b2a707bb9cec2f2985a656e028f882dfdb32ec5
SSDEEP 12288:1rIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:1wVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T15E6523AA758655F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A1AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 ec0bfa74e18ca504f00a858bdf157bd9475d9e01cf031c872a4f707cb2cbd91d
MD5 43e164c0175d7fd04ced288b8eae6ec0
SHA1 f680f081a52d8923e3fce19d0ad35fe644595423
SHA512 16d9df481070e19179daa6dda94ca5e5552674c6b6ef074d8aea781dc9a6bff8dbee205b9d43fe629883d391db12148d094c94740ec07a8338b800a07fc2823b
SSDEEP 12288:qQIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:qDVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1B16523AA758655F7C11BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 ecb93679228605579926744fb1fc682a9308e999404191745de72be784472312
MD5 682f8846fe82f16ec8f0119f591fe8ab
SHA1 131daaefcac6b303e97580faf953dac9dbd04e18
SHA512 5250cf5261b23ba1218bb5973aeb135e60ccc301cdd334417a173b638c238cdcf9b61c1b38bcd5a711f36ddf4fb731ac7f43ecc75783dcfdb2b44e0329245c80
SSDEEP 12288:VUIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:VfVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1AF6523AE758655F7C11BC2B1CA725389CF262B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 7c29e3d1e4c3d8d828075da5b9543b1309b98b9b9953d97b3fda6725f2164937
MD5 64f5312435b6085e8b4825c19338b3b4
SHA1 293ab8b227944797f6ab627d5f6f1d62622edb5c
SHA512 e06807bcdefa5b1ad45f8978e78817585c3496e1029d32f6a8b8e8052fb04eab7a10c304fd092241e2448a434dd2061dfe594f87c651951f1575237705ddba79
SSDEEP 24576:kZMrzFVSOnVg9N9JMlDlfjRiVuVsWt5MJMs:kZMrzfhgFIDRRAubt5M
TLSH
T1078501A9739018F9DC67823EC9228906C7B27C5A17A0C61F03B436675F773A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 aba7de66070c56961bde63d690549a785f2927c9401e5f5715e25ee1cf1a96cc
MD5 17aa9d716aad6d18915e34cf12eb5909
SHA1 4ccd16714bb4b5d8f16b8958133dec2b12f09d9c
SHA512 39d41ed0acefdd0d22181348cb4cf4397b13970882a560e22a933582fe137054c30d110490d12a3d5d7e9322b0c6a12ff341e73639d40a530d272ba06010eccc
SSDEEP 12288:whIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:w6Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1C06523AE758655F7C51B82B1CA735389CF266B5E72C68147D2B00491DAFC1A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 c167df4e75320bd30d4113c6e2462ec92e7aac5ff2542c8811523012ac45fb58
MD5 d14b294b1e59a9597e2b86472b9e6ceb
SHA1 792449d961721d5359318878e1c107251e435be2
SHA512 b48145b395405a26cdeed5018b16653ebe6d2f7b233e419b438c3acd5c3fc73fc9270bdc73951c3e29067943f053ec091ec34913b5b9faa0bf354bf164a82a00
SSDEEP 12288:W9IV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:WeVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1646523AE758655F7C51BC2B1CA735389CF266B5E72C68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 4a9a4c3fba2d5704c78844122366442e724cc7118667d8b1548cef082fd34fb0
MD5 768283c7eadc22fb31450c353002ba31
SHA1 d2e2b28fcfa516009668ff16700ad8ce9ea218c4
SHA512 150a117f6ff11c5a865c5134876a6118bfc75e49cde8b5d3ffb55c3123f7b2e503d9b7df3958b5526d2d81e026383be6081f67afc6e51532a2a4f03bf38e3211
SSDEEP 12288:uyPz5L8IIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:zzyrVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1E775125B73A130F9C1378275C9621A02E772783617608A9F53B006B65F772E1AD3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 00a6b458e5ac8d133842b9749eba4d3f1bb1bd2ca9da09d7df6a8734c50abbeb
MD5 8dec0eaf5a98e92abb090a702a114726
SHA1 be35da7b08174e44738eafc93e3b075140fbf552
SHA512 605e8a38b421bc30b4a410e834ae74d5690950d51ef5a4bd2e0203d4d429c516b4e05c116dc01b4f8240f88a2568098fecc5b03a7baef3a0560fb893cfff4cd7
SSDEEP 12288:GhIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:G6Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T14A6523AE758655F7C51BC2B1CA735389CF262B5E72D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 b83cc58142ad32ad005ed9a8df155f3dcd0a28445e84ce189560f0d87db25338
MD5 c70e97a1743123390e6d7e0c749c9957
SHA1 faa981388d0554d72ca9216fccaa0b0acb5a90ab
SHA512 009e94f781fd538519cb85a10d7577babeb91d5a3e6de083e6a973f30cf20652fbdd615862c5e9faa2559cc2cd6018ff32190e0a5d17f71c0d347e035bb2a93f
SSDEEP 12288:dhIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:d6Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1D46523AE758655F7C51B82B1CA735389CF262B5E72D68147D2B00491DEF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 c1802c358f70ca374728de19bd31abd751de39d795a3678dc720326a5687f9cf
MD5 d145541c6894a08804e2f5c388e758b9
SHA1 051287884367fbeb979209e7420e11f8eff2a860
SHA512 4e9bcceebc788fab7782279a3f40dcf9a2cfb5e5982965a5ec9367cebcb71c6b2db138353574fe6fff2bee2a3866b8752a81272827f5f971498ff52e69be6c1c
SSDEEP 12288:kyPz5L8IIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:9zyrVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T13975125B73A130F9C1378275C9621A02E772783617608A9F53B006B65F772E1AD3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 8144893d15dbe0dc3a0209471c9fc25179efc7b25c183a6779b7f4431d796df5
MD5 474ce59c2d9002b2c36589160c6a3a8a
SHA1 6b3238f329c209956bf205470dce84eab98e4b96
SHA512 cabb4b67cd9fd9a4776f6da5ee5b97efe2f308700482cca6adfab00d09aeeb96dd12fdecf98a7cda8b9373a1208a63f13e36f3f510418e3d0e2f8e1944f7ed8d
SSDEEP 24576:rTxaLl3z0zDxVg9N9JMlDlfjRiVuVsWt5MJMs:rTsLljEgFIDRRAubt5M
TLSH
T1E38501A9B39018F9DC67813ACD628906C7B27C5A17A0C61F03B436675F733A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 9c4a50980804027be817065376377677a6da709681cd19e06359fca78e82e10d
MD5 7a703ba73a502a29e24825551d63469a
SHA1 9e702e7ed8783c4a1ec151bc4b74cf6d2a9621da
SHA512 980d5de760a79a0525963414d93d64230a3b861c83b10bc42f17ac98acba9ae66b1f4c81a461da11d93b0539dd4385cf112e67eb75c3a2993b29d7abead4285f
SSDEEP 24576:j3Zd9CHKy7GZNVg9N9JMlDlfjRiVuVsWt5MJMs:DZd9CHKyahgFIDRRAubt5M
TLSH
T1F295CF90F3E414E9F0B7DA35C9725602CA767C9A1B71DA8F03A4265A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 e7c1155daedcc8baab7fa4d3afcfca7498529790a526dcd0fad25b486e5faa26
MD5 7c950f647f8c80d1bbad41f20ae4b464
SHA1 cd5ef0886d8e3ff799af45b98722780aac572f8f
SHA512 10daac30de5bb1ba8a7a544648bd878890c14ae728bbbb1536d008c7113dc646617dc13b416f2c7723145a35d4f50cc8936c29363c9544dc80abe074e8089514
SSDEEP 12288:sqIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:sBVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1736523AA758655F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 5130f1489f803faad8afcde3e512fd8d9363d0b874c8fa24cfd005cb25b13f1e
MD5 aea6eea6983bc52d670089d17d38e55f
SHA1 746666dc1609bd86e2a5af96150f0697ddde4a85
SHA512 72e97e066841ba5efcfbd92ffee5622944791072eff5bc9d205be85d040b16caf38f9f81ff777fb22d3f585e6217b43d9d8f62bb25746535a7d9abcb9f8b0969
SSDEEP 12288:LoIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:LLVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1006523AD759655F7C11BC2B1CA734385CF262B5E76D68147E2B008919AFC1A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 4e763876ddd7d3f117aa4ddecade3c4fe4b2afd6aa800ceae5194c49ab0d9446
MD5 5a274a5b5ac378d5b16e325874253542
SHA1 1beae44bba2fca33c492e3f890a1f6b78215bb9a
SHA512 6db83c6af5508b92913f8543d0de7f0595aa030b76976cc9e80780aa2d2fb69d81919dbf611509271ddb4cfaee0d8b261ab1734a3be9330eb88f1e096dc84f0a
SSDEEP 12288:OvIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:OcVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1956523AE758655F7C51BC2B1CA735389CF262B5E72C68147D2B00491DAFC1A2AC0FAC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 b49b735b25029b42ee2f3f406c31b2ea79bf6de5a5f74cc6a50d3ec2b25042e1
MD5 fc0e1f2d3a16519ca9507b8ebc38c4c0
SHA1 316d2742e051a6381f60aa69cebc345945769cdb
SHA512 de6d4ccca46735d39e53ff56e362e8c41fc65eb80108e42d68347c152af75d0f49ee553f6d5f09c084d1b6a7fd722e225510fff15af3615b59d1f072210d1afe
SSDEEP 12288:ZhIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:Z6Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T11E6523AE758655F7C51BC2B1CA735389CF262B5E76C68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 3e61820c984a00e53f25cdaf73d459b01b3c0c41d2ee67d441cb29419b104c90
MD5 ae26ad04c54ab23b71572c2cf2abdb1e
SHA1 20db4978b4707b5c6b0d039df653adb5d2e5df78
SHA512 dbafe51c0207ca74f55c49e6266dda7633c8718639b69c090fb421da4fedec0ee982e7368b7ca1aff9d5b46c93db41fa067261da4a8e53bb4726c7854ce7e083
SSDEEP 12288:1qIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:1BVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T16A6523AE754695F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 5e99b04eb145b4a72e8643e44fcc3438c3b7e4508fb115e904a9a15d5a5d449e
MD5 e43d52cc28d51767321f7ae9a3d77624
SHA1 bf0f2cc9bcf6c25e61409e66237b0797b547f04d
SHA512 a066bf1ac6d4502a55834b34ce92842dd44222fa389f303d5d2a22e9d581498e7f5c7e68df332b08fdb9d95b48fe9a7bcc372a13251e52e180d0e3e3442d16d3
SSDEEP 12288:OJIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:OyVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1386523AE758655F7C51BC2B1CA734385CF262B5E72C68147D2B00991DAF81A2A80FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 31b81c40ebc1c000571e9ce1bf67708ec5c0dadc578889e7a65454ebf8c237d6
MD5 7b0b47887ad065e575dba2d57ea7881b
SHA1 210efedd97dfd6d14215db8e9ac2286ce20a6dea
SHA512 3d47f81e1ea48e7455196c2df22ac34dd587c9e1c21f768f3b99f226a02881e9922344ec6a13d70ad5f8ec097530ae2a1018cca5e3f047ac2a1c43adee37b437
SSDEEP 12288:UrIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:UwVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T18A6523AE758655F7C50BC2B1CA735389CF262B5E76C68147D2B00491DAF81A2AC1FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 e704e87123cd01c6ae1e5d02cba5b23d535a5d6deb792eb4a13c4476ffd9bc5d
MD5 b4d32e17abbcd2767b693a0c526f9776
SHA1 98ffa339a4fc8776158de36b9c106fa5f06ca8e0
SHA512 7455cde710d0c8feb29984643c7258fdb24dc20896b9a901474d8ed1d2c61d914b9521ed756ee0d9516a14f4f06d630c48a35ab1512b32ec88aff3e825931b5b
SSDEEP 24576:efwv2k9RX6wkyAIOVg9N9JMlDlfjRiVuVsWt5MJMs:EMnYIKgFIDRRAubt5M
TLSH
T1B095DF29EBD844E5E177923CC9B3460AF6B178591B71C2CF02AA53AD0E37ED06D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5c92b7b14a681796c85e4a272c1681bd4d212310539a397ebc342b4dbeabd68b
MD5 16bce592850cb3035bacd3869f39b4a6
SHA1 81aa828fff0987c484de7b25ac4f899d303f8fad
SHA512 5aefa205c4fe4290de79fcf781564ec00bee893ad78bc72e2304d039709a8fa8d014874b9c6f223aa262efd317f7bbb3ea25cb7acf4f7b7b744c7faab9f57651
SSDEEP 49152:0YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0/gFIDRRAubt5M:DySzPgUf
TLSH
T1F0066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 47cfba643027a80006122e4e69ad39cf7d7fdc852a787dbebc622db2a065ca72
MD5 8cb84f0eb5540f53300d21124c877fd4
SHA1 33a29e022c4c296e624bdfa586c9ad8fddcd8223
SHA512 57332c7a2820efe18ff8a2e921d7efd60ec9002c7f24eb8bec0b3d2e3d5ba5048f7adc18747ebc89827f72c91a0339e7c6b69a26baf7f0629a23e8ebe48ddf03
SSDEEP 24576:Q47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYXVg9N9JMlDlfjRiVuVsWt5MJMs:Q47JUQjTirIhCnDHUPfF/vgFIDRRAubE
TLSH
T10865AE1EA3EC01E5E1BAC27885154A5AEA71742E2B31CACF1270437D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 ca06558140b0d2c72ff4c92dcffe23605fc0e36997babd27a680d8f49bcc3527
MD5 5c07e5aa91d725266648c2f5e0f73f5d
SHA1 51e63de38db540c305de7757313635b7eff5eb2d
SHA512 7b712b2fe3aae6bf368d812485a2387f2349bee39abc8fb0c3e6b730103eade27a8d3bffb807b6e80b5a1781c9c7a2cb51bafa343a611e27a0d0e4dcb3eb25f5
SSDEEP 12288:8VsfRIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:lKVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T13575F15AE29402E9C06E9275C7624641F7333C2593E1D3CB92E0F57E1FB92909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 aef2b7a708fc04b105ab76068e92f5ce8195fb1a1b72c6ec7dd0a466556c166a
MD5 6b68afbb569eb1e7888e7d547a525929
SHA1 5c5ec5f80f068e6fc5deaabf6cc744804b4606ef
SHA512 82199eb1b360ec1628b47b39ecf37a2bb13cb1fa8e4a57a0c2388cbcf63419d8ee89ac1d95dea2b8c4167ee68fbcd93198d6b5588398facde3c6535956f4c853
SSDEEP 12288:c5DRoU3fv0VByPbp0Kv6g0Q9NwVaySmYiBlF:mDqUPSS0463Q9NwQySJiF
TLSH
T1B7352810766AD75FC6A980325E32D5CCA7707D01FE44AF0373C8873F9576669BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 11371794cc560a7d8ed6ab397054a88db89be24edd25823253aeb7f482b05565
MD5 a8f4f04b11b5c4577f3afd86c7e777ef
SHA1 8012ab379e3383fcc66046e966fed0450039cf8a
SHA512 e57c4776b9e0d48a70bebdef32ca41df6955b1e58f740e65df29d2f7455104245968dea01729e7a31add7b3e56eeb94dd27bcc1f064312aba15d83d724f9ccf7
SSDEEP 6144:gYw8Qlv/v4E8M5tetUtGt92JPjXiKRfMytMxPYXYLEd0nBWenMITwenisrBhWrAL:o/mAQv35uA6X5r
TLSH
T10B750A816537E28FC1F76072072A5B4CA768EC46B7455F26B3C8453AD82BB21A4FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 8da70d281b44f204c776e7d5b066b927e205c854c0706563d951fb48d56caf0c
MD5 f6c4a2883ad623a037639b0ef81e5941
SHA1 ea1e7cd81681b533ba9213eec01c7c445d9aee64
SHA512 7b1cc4115e344fa240a669202c484616abf4c176f0ee5639f42e95cb1146aa14fadeefb14f77f3d7d5b66b1791b0a9bb87da63eadce1b98eb6c3cd574ffcf4ae
SSDEEP 12288:R+75IV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:ECVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T17765237A768999E7D46B92B0C97383058B2B7B693BC181C7E17005D199F81D1AC3BBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 00b48f3fa0d8d1963db1b5a796763f99306b831dcbe20c9f698d9e0d47bc9106
MD5 0b8cab154c56885ffa86d3539cef2d50
SHA1 d0dee088dbe4abfe2ce8e1c852813633b88702ea
SHA512 b029616c6896c6c9635dd415575e5e2616132d346e13f5e67e02aa1ddcf8396269789270780c89db8831f80bf293fce8ef79b3809c368cd6189358708d3c2cf7
SSDEEP 24576:9gb6bmBIi49WNNFpg1rSvFv7bYEVg9N9JMlDlfjRiVuVsWt5MJMs:9gb4mBIBhGFFgFIDRRAubt5M
TLSH
T12F659E1E22EC02F5E0FAD2B8CDA64417D6B278161732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 92bff5425aa464611b93a280169091aa43b46924f4bd063bf8886279330aacd6
MD5 40c7cc28a0fff591b1611f4cb6b0563c
SHA1 b31dd2a50ab69f71f78403648779b4ae948613be
SHA512 be587e567bc1ab7a103c814c0e62ebf69d083de920b74bb65d3268cc9f6b0ef0a4c846db02cd05b2e0380722e5a4630c1ee92eb320bafbf68a93fa2cf3f5cc93
SSDEEP 24576:LG88u8FpJqH19zria7/mnVg9N9JMlDlfjRiVuVsWt5MJMs:K7ZFPqVka7/cgFIDRRAubt5M
TLSH
T17F95F16576E101F1D47BD138CA924663F6B2B4251364EBDF07A88A511F23AE14B3FF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 2c2d8f35fee16205bf8edfc0b124c83a8b722821966828d62159aa6e7ec26998
MD5 c6bcfa0e5b2b84bab7b65b4fe1889204
SHA1 44cd49a18813bf8ed1c219ae8824cd2ba34cc6af
SHA512 806c55d6f741cefe9cc53d3689c815f96c6d5f2e3af1f21bf14431448952e0789a3aa714c734af28eb6e5581715daec48253c80bd2c973ee01cdd6f5f619797f
SSDEEP 24576:yPUr+NQzVg9N9JMlDlfjRiVuVsWt5MJMs:yJQhgFIDRRAubt5M
TLSH
T1A785F12F32A918E5E676E17DC9824309E77274621352D2CF02E0417E4F67AE8BC3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 cf04b6d13b3aa09bb513119557cf445555d013028940eca3749d8448eb8789e4
MD5 2366138c7432bcf1b3edbd6a42a24841
SHA1 844cd6e2a1568a19dcc6decea87f31bd7693b1e3
SHA512 099677a76ee4b011fc18eddcba9b7268772999fb2584cbde470a723e1394a48285fff6a5fe8185c6c84574aed8070149a2e0224d132b2ba58bb3a42c07a45d92
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxgFIDRRAubt5M:WG05lO43brUf
TLSH
T103D5CF6E62EC11F9D1BBD17CCAC6460BEBB23415033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a477b111f210d3822596c6366f2eba877c0489a0e48442da2f13e5a39e142033
MD5 e9349d3dbf67ac0293a0ccfcdaa3820b
SHA1 d02d68d7cbcd0d4fd345da2811d5f36babf32695
SHA512 102c96084f1b1e003a6d18abe8cb9fd68720ddbd7e56b89a5139c2d091bc4d765ceecc903d71b888aeddffb8ef119e1dd18ace80e3c9c90521d6100723e98bad
SSDEEP 24576:efa5POZ3dpuWVM50JicR2hG0lasx2+47eidnlVg9N9JMlDlfjRiVuVsWt5MJMs:Ga5POZ3BJt2pasx2+m5gFIDRRAubt5M
TLSH
T17165BF5EA6FC01D5D5B9D17DC583460AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 820f3d8cd880c8d027bd3312c6e7e973a9b82bb911a5ffa0df60af98b44ace4a
MD5 44c5c2a7d2f797d9611c93f3381c1329
SHA1 97780369a388ec051c43e346c17d67b12544fd06
SHA512 d9aefe7805df00cc0714c368f1f59843856b1df907d8094f301edf15552f4ce838da4e00d9cfa9556eb98c7db7f35cd38969da9725cefac10334958757be810a
SSDEEP 24576:6NcwHdjbyQ4nLC18lb/EOjowL7FkvVg9N9JMlDlfjRiVuVsWt5MJMs:6Nc/zEOVHF8gFIDRRAubt5M
TLSH
T168858C2623E901E4F5BBE1BE89779546FA717869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 960ecf4270f07ad622aabd0c6fe935993c9cd0d9b22d23346f1fcf0842f86637
MD5 6236b54f2a814a27534134d0424dfc3d
SHA1 5cc99388fa17298b755ae55df8bd864d01c920af
SHA512 0ef44dbb01fefce9b6955955f37856329d7f514d556bed678aa831399890b1af37926747b26c03093a1139ed8cac25ed683398a88aacc0375a2147b08f9ddfeb
SSDEEP 24576:BTkNvNnaFeYhJNtmZBm0Vg9N9JMlDlfjRiVuVsWt5MJMs:BTMwBtOm0gFIDRRAubt5M
TLSH
T17E55AF6EB6B806E4D1FEC6B4CD238512EA727461173293CB5290C13F4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 340878d37f75bb40522d7615c465baa69a8ee8248365d50f9c8de4248670c5fc
MD5 2fbef75f19cb5bf73c24c13562a54929
SHA1 3e0901b785d5bf8e66c1b3892c35b4bbe8cccad6
SHA512 314d32da52ce41f0e26e4a23d905705ae7ba63774330f3cb0ab9852df152076654123f775d67e904e508caf7967cc881a23c8c3eccc780542ab1c1bfb64d9a9b
SSDEEP 24576:FD3FHshBIYQgAWVg9N9JMlDlfjRiVuVsWt5MJMs:FDVHeBIAASgFIDRRAubt5M
TLSH
T1DB95E07EE69C04E5D57BC1BCCA638606E77138A9032256CB02D081B65F6BEE46D3EF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1428-137-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1428-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1428-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1428-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1688-82-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1688-299-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1688-88-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/1688-83-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/2300-125-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2300-119-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2300-316-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2300-117-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/3048-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3048-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3048-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3048-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3136-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3136-116-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3136-27-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3136-19-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3560-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3560-331-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3560-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3560-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3560-93-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3560-99-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4104-131-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4104-138-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4104-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4104-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4104-140-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4280-16-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4280-17-0x0000000140000000-0x00000001404A7000-memory.dmp

Download

memory/4280-8-0x0000000140000000-0x00000001404A7000-memory.dmp

Download

memory/4280-2-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4280-7-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4352-65-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4352-56-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4352-242-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4352-57-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5528-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5528-318-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5528-111-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5528-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5528-105-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5528-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5744-78-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5744-70-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5744-283-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5744-72-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5792-63-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/5792-68-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5792-45-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/5792-51-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/5792-44-0x0000000140000000-0x00000001401B5000-memory.dmp

Download