a131240f167ae1aa80b9084ff54fdb34c259b8825e09d5cbf1966f8feac42aa1

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_6910b4e1a53967b1050877d9d004897f_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 5.6MB
Sample260821-e3dwdsgm3y
SHA256 a131240f167ae1aa80b9084ff54fdb34c259b8825e09d5cbf1966f8feac42aa1
MD5 6910b4e1a53967b1050877d9d004897f
SHA1 17173ea0d635017cd35740fa175fb743f46509e0
SHA512 6be88144fbc39c8d61883562f7013be190cabe25e90a1f6339f0a7e5848574631bd0065f7b4e8a037fba6c59f8c0faefcba990de4f5e5402ffa8418c21377ae9
SSDEEP 98304:kUzcvAAAz1/0YVGDzXZTKvzruaI6HMaJTtGb77wRGpj3:XNAMLVGDzpTK+aI6HMaJTtGb/F9
TLSH
T123467D4652F940EAE4BBD1788E7AD532FBB27C520530A34F06A0DB5B1F37A605E2D721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
1580	elevation_service.exe
1836	elevation_service.exe
4544	OSE.EXE
4712	PerceptionSimulationService.exe
4428	perfhost.exe
1192	ReFsDedupSvc.exe
2952	SensorDataService.exe
1076	ssh-agent.exe
880	AgentService.exe
2232	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-21_6910b4e1a53967b1050877d9d004897f_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-21_6910b4e1a53967b1050877d9d004897f_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\941e93908f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-21_6910b4e1a53967b1050877d9d004897f_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-21_6910b4e1a53967b1050877d9d004897f_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-21_6910b4e1a53967b1050877d9d004897f_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040f639b32531dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa2fdd712531dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d105f5722531dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000007db3d6732531dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000747cc3762531dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005fa103732531dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1580	elevation_service.exe
1580	elevation_service.exe
1580	elevation_service.exe
1580	elevation_service.exe
1580	elevation_service.exe
1580	elevation_service.exe
1580	elevation_service.exe
1836	elevation_service.exe
1836	elevation_service.exe
1836	elevation_service.exe
1836	elevation_service.exe
1836	elevation_service.exe
1836	elevation_service.exe
1836	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3340	2026-08-21_6910b4e1a53967b1050877d9d004897f_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	1580	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	880	AgentService.exe
Token: SeBackupPrivilege	1192	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1192	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1192	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1192	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1192	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1192	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1192	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1192	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1192	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1192	ReFsDedupSvc.exe
Token: 33	2232	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2232	SearchIndexer.exe
Token: SeDebugPrivilege	1580	elevation_service.exe
Token: SeDebugPrivilege	1836	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3340	2026-08-21_6910b4e1a53967b1050877d9d004897f_cobalt-strike_icedid_njrat_satacom_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 5756	2232	SearchIndexer.exe	99
PID 2232 wrote to memory of 5780	2232	SearchIndexer.exe	100
PID 2232 wrote to memory of 4844	2232	SearchIndexer.exe	101
PID 2232 wrote to memory of 3748	2232	SearchIndexer.exe	102
PID 2232 wrote to memory of 1940	2232	SearchIndexer.exe	104
PID 2232 wrote to memory of 4764	2232	SearchIndexer.exe	105
PID 2232 wrote to memory of 5628	2232	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-21_6910b4e1a53967b1050877d9d004897f_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_6910b4e1a53967b1050877d9d004897f_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3340

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1836

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4544

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4712

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4428

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1192

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2952

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1076

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:880

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5756
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4844
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3748
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1940
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4764
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3e60a8fbe90f86e6315861ca3b642ce328b019b8f29fac89b49160be964a1538
MD5 02a22971209729d1e75f4170d3307d50
SHA1 a81c63b863f62481e4a97070463efc47d2dc51b1
SHA512 61bab08e86b57d45b31019a563bb2a7a6a21ec681c547f896013c19bdf71188e8f082e9ca1f0baf18a747c39ea655d25a422b3b63603bbb77ff296fb3a57741b
SSDEEP 49152:3b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnILNiXicJFFRGNzj3:l3q6mjBb7wRGpj3
TLSH
T115D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 679fccee37ec840aa1121ccfed5a6d7b7c90b1488ee6fc02214495a4c886cb48
MD5 458d0835cff8b5e10deea5193b40b430
SHA1 700e070910871a9c59064d2c58009f9a945ddc0b
SHA512 1c4925c417d5589e0a4fb204722cde2f23cc96678cf0f63e0564db0db1b622af15e3ab881731648d2f244aead4376f13e60fcd3e22f0f193c19e00c87203a375
SSDEEP 24576:VXYfDtczAn/TwSfVcYG3K/cJHlnFR+IGNe8j3Izp/TwSfVcYG3K/cJHlnFR+IGNY:AtcOLNiXicJFFRGNzj3gLNiXicJFFRGN
TLSH
T1AB65126563C408F9EDBB403DC9B28410F6627C588760EAD703A4692A5F37BD98F3DB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 820KB
SHA256 c0350f6faccaedd3ff109807fff3113f1f100d05fbeaeeb11dceaf36c129e829
MD5 1f77be786ab8319b6d9d9af22a28f7a0
SHA1 b4aebacc29ddbe8260e0a2ea6f12bcd008ac3730
SHA512 4583a990f0cfd9a28c0f45f0cca7b12af5f7db619f298b890ab238213a8d1c87bbed8574b5596119eae2a4b2021a63cb90892029f7f27bb9dbf7251f2464c3ab
SSDEEP 24576:GXYfDtczAn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ltcOLNiXicJFFRGNzj3
TLSH
T14605012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 f2a1f8a6bd2da18f95d1db9a5900d5293d75bfd24d388138c6da015e6eb3286d
MD5 4923ec9ae46279546508b750e9e252dc
SHA1 c35b98a199cc3054b282910ba6333549472b9143
SHA512 aab8178003616b86556a961220a61a0a9a30a58d890554c9cc74aff6ebdb98bcfd72bedbb65fde3348b64fa71ccb1bcf29544b6d226f72157c0490411f1dfc93
SSDEEP 24576:f0Le5ji0hmxhrMk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fPji0Az5LNiXicJFFRGNzj3
TLSH
T163859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8785da6b6e439bb72c083d7784e719d7333ba361c28f07de69d904ad15c813c4
MD5 50558b197bbccbf8a7bfcda93ad67850
SHA1 2b63032561de5d5dcd2b9485b4faef4cc5e9a205
SHA512 e455cf9613be19b52b33a2dbe1a5fcca5bc439f1f43a1b6c34bf1550737afc2a5d3e809811e4c5a2eeff440efd36c9c51d24201703037407ec2d0ca2ef16c889
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWj6q8wyuC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3/ezSC6vUzPv+HjydLNiXicJFFRGNzj3
TLSH
T18A756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e4aaa63b46227429bc3fe2be4eac194b7a98ca0bb7e8e99da42af9ae025c0d8a
MD5 3487288139b8023d4c4ab641eea4668a
SHA1 d0ed30dd2dfbfe3252a73faaf0db4673568342a5
SHA512 61363850ce15fa843f616de08569cc135781d3ff32b9859fb724af09a03fc41b9220d5e9047581185ea44d101f788fd2db089ae49a52344a1979699d325f27f0
SSDEEP 24576:bVbqPb88hv/l+Bz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bVO88hXl+ZLNiXicJFFRGNzj3
TLSH
T144559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c5e62618eb44ba899a623feed3d6c0997f6b8955f15430cd66a4794b40799cb8
MD5 794d6c41df26c0a56a9203d539510348
SHA1 7bcf8ba004b878b9af87efc02ac568434f980e03
SHA512 77806abcb00252617c9dda067939b81893ca4d430f9d479ba615fa0b66b29e5b683de74eaaaca81162d3f83447e3119fa6e3c8abdf45249bb36cbb9b16e49433
SSDEEP 24576:5Gw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fLNiXicJFFRGNzj3
TLSH
T1945523D3468855B1FBFD003A867A5828B5845E2CCA695DE2D2543E5E913CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 b98543efd89459a3322518c626afdd6e7ae7b4cd9db4a04791a4f0de013afb13
MD5 a2e185a9cd6945e99e2ba59296a42c56
SHA1 f4e979dbea49599eee6666821d19a4bc2833ab5a
SHA512 0a25fd664f914d239967b6b5780a2e90f2f3995201fa30c8fadb90dd0579af06ef992b10a0eeea4d853324b57b8481d9c739bca7ba83818a676266bc946d7b76
SSDEEP 24576:jJIUL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jJIULLNiXicJFFRGNzj3
TLSH
T1CF75CF7BAE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1cd294154918c86fc322a95dbb9b7f5068f593f751611c4b4acd1591b51c35cd
MD5 4fbbcb24a7c0c59a57b17579e4b105bf
SHA1 d74e6079b97efe2ab08f3720364ddd49f6d0fba1
SHA512 c7ab81d6bc85e471af6abc33223baa66d9280f1cdbd6400f096d7b79e37b32e75f540daf7bb04be7c57c114e675f838ebec469816ae0e20327449dd0952b4647
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THv:CQvGAdlCEL8c/WRNw5CS7wRGpj3
TLSH
T162266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 e378319013aa7e1a6945548e7190785cf8b3d8acc86862718a5803c7164085aa
MD5 54ddbb079e6ab0e45d7923e7813b73af
SHA1 13abf7da3f2b016886030746ceffa6334d6cd3a7
SHA512 8eff6b2344c4c48e3a5e3d3f747a646ce0c5b510400fefb36db7a90816a8e9afc240c2de59c58f2701f988a54b3e83ba12daf81729dbc670949ca92a8c94b9ec
SSDEEP 24576:RfewsAjJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NljJLNiXicJFFRGNzj3
TLSH
T14C75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 161148a16bec4fc81e9b3185049000ee4ff691f3490c21f749bc1c1dd03853af
MD5 ffcce1020b93406d7c66feffe9e023cf
SHA1 11a75c1e89fc7a0eeba492e19f791422e46a111c
SHA512 77ac796153aa64bdcf7783aa76863e66e15877926d33dd9bbdc13751d2759115073400af272189fedc7641052db4014caec3b6a16fd7bfd05b21a7acf9be2972
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHVF9:7UEtQevvqc2W1cpV20I32L9
TLSH
T1AD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 726c627b6e2c59b3d000fb6e61095e4a9928d8631e6c75db0d1cb765adb979fa
MD5 332fd4bff6b9ebc946c3dd8d54b29db7
SHA1 0804b227885b3db98fbcf5b1468ffb45d4b9b5ad
SHA512 be93c6c2736c49b101a2a1b860a319a0162962f16eb0a5ae6a63c9ba4c20c7a6d51e6cb9b1c8bb9188c3643390d5ed6309d89d674acfda7959d7ec83886a5f0b
SSDEEP 49152:1CbRquA/m2yL5zLfFiV+XenmE3/zpLNiXicJFFRGNzj3:ioq2Vjnm27wRGpj3
TLSH
T1FAD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 602fe63117b7487fb077d638cddd9b107804c1fc43c1c62cc1a848b0ac0c594c
MD5 8d60e475c6fccea0c0bcf92ac96b6b7c
SHA1 fa3487ef6438e7c50257c2fe17fb9b0419bbe4b8
SHA512 a99b52a62f0ba22c12911d77f2fb67079fd2cb59bfbb1f6b7e0fcd810adfec38e03733d15e20106793b1cb04d8bc8036f6a21f5aa098a12066495f06645440ef
SSDEEP 24576:lAhGL6IFoiwtA5l7S53W/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lAM5Foiq5GLNiXicJFFRGNzj3
TLSH
T1FE359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 a1902a189902e0693be4e2eec2ae8b4eb0ae701c89f23da3a768e127ef5fcc47
MD5 79f50f985b69e62283fa36dc17f30a90
SHA1 f9395c86caeb85aefbd7b9c36e5a3b0318cec97c
SHA512 281269b326b98d77e66a25cff2898cdf70b66aa63fee892353469ad01b03d8cd42fcf654cde0c0f98487f02b9164d5a4fad38aea2e6be620a0a287e645282caf
SSDEEP 24576:hwuROW9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hwSO6LNiXicJFFRGNzj3
TLSH
T1D465F18632940CF9EABA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 59739fdc7f10d3d06548f51dea9e2a7f6b95438f25b3dba2d7ed0fae98490c34
MD5 35204014c95403309b171dbbea071ee9
SHA1 c28ed54b57b1c7219307eeefadb6f0dfe2bb6c9a
SHA512 32c858b89cc40032822a423184db66f9f31f1a643f8a597bccf2f430511fdfe263218a1d96e3e7d2b7b513e8dd93cdaae4f391eec4b85dd4f4ddff6a035b7552
SSDEEP 24576:eZuc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ILNiXicJFFRGNzj3
TLSH
T1CD55129622C820F5E6BB413DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 22f2a4c5405abbfb1df8bd097f44140e26c2e9896cb73ea3a952789c2cf256b7
MD5 2e30594d58b31e8d553ca078649af9a2
SHA1 309890e9ce240b50d7fef24747a9266e67f65bb5
SHA512 98e9ada2efc20c87fdf36f49f4315773ae98b9ada2bfe42b42150bc0cbc7ea45f844533e9fabd1e5b4a3b73e191406ee4cbe5a9f7d87aa84b7d73a38a2744b17
SSDEEP 98304:kQRQyi36YOcPDLvw2gAf+PN3f7wRGpj3:rQyiKanX+PNTF9
TLSH
T1BF667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d719b25710fca75ea967ba9600d38c620398bb03f9762c1a3dabe6c26447967c
MD5 d7b5832d605d2b58b1d655216e92bc3d
SHA1 cb105fe5ccb081b5b14e68428aea8d7901758218
SHA512 e4926c0d3db8d9cb78ee396c085560984a894113a9ae594711bf4149168a11871a5440d641e31bbf6bdd910dae0fc6684a48a5cf3ad67c999fc45e511e95461f
SSDEEP 98304:RQRQyi36YOcPDLvw2gAf+PN3f7wRGpj3:IQyiKanX+PNTF9
TLSH
T122667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 66fda3d41ab80dff736161c88f4af0847b787e87b9634a1f62c9c554084ae397
MD5 77acfb7324f12299335c363798910873
SHA1 3012d751605592e606627feef3d369ff78e61574
SHA512 19d35256cdf609c64e1159015e666588bf18fe95890d26abbf00a4e5b9b3465dbe0cfead139bd93c68cdcd5a8d32cad2eecb469ec072b371df989bb6a0981285
SSDEEP 49152:g68Qg55nhkeWu7PNU3/5LNiXicJFFRGNzj3:athTRc/57wRGpj3
TLSH
T1D1B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1ddb150ccdf63b2c5c6079200d6c4db785b52506ba8e2f55d584008e3c658508
MD5 37f19de4ea8550df5a145d5ddf847108
SHA1 b5aecdeb70f358fc93f95a53dea6a7d7c47caac2
SHA512 9e1a9055c20fbd38a2082ddfdbfa235aedb37ec9788ed39861ad825c570a21d2a22a7bb2921c6dec29e19ce4935f3ff10338c43e4e32fa53badb094de27e5938
SSDEEP 98304:0y5112gYy5azzVvU69nLKnhZw7wRGpj3:1LIHRWhSF9
TLSH
T1F9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2e0dc2a8c6b1cfe2149ac3738f5eae6d7bab32d18ae715178ca65d2c0786db8e
MD5 de3707a513321031cc4f929182cc942f
SHA1 07feb4b590fdaaa770b7b48da422b7ed35125147
SHA512 4edeaf67e1b3054cfbbb9c9cd1226abdbfb136ad7441da835b120a6d37a0596dbbb88e545acc145dee25e88846ac90cc204df210262f7618e61eaa390d1cf608
SSDEEP 49152:LB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glXLNiXicJFFRGNzj3:du6JmIxd2dX7wRGpj3
TLSH
T1D2D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 93806a8e5bdb9da2352a4f9face409ff26737d11d306c0e665eb0940d8825b65
MD5 65bf7960f5a14f16b5f595d76e4b0d73
SHA1 913f6506efee7dbc18d22c72509b9ed30eb92a5e
SHA512 9d9a45c3e1e7a50976b1120469796156d8d137f6969e5bbfd8f2103bb5f11f51c56d55fe869dfa38f146cc7da5e2fbd087200725031a8675ed1f0cab41a89438
SSDEEP 49152:51hpsNoJpF1A67U44CwH7R4xrLNiXicJFFRGNzj3:5mifPqR27wRGpj3
TLSH
T150B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cb467445e73ab9120418ca65941d890ae7315ea5df675baccf116e941d0137de
MD5 5aa9ab64fa83b8744f31dc1460c350cd
SHA1 d091b848c20b69120ad5dee081054a5db83bb0e4
SHA512 b0a8b7dcf4481f40a5bd26661ef76dc40260f99636f173e8ee16f67281cf3a359bb596cfe2f2f959b01b3f13b5fc9de4fd3fa53716947fc66370bb2a7363c2fb
SSDEEP 49152:KSuZQIY0Be2KkRVtOnks6NMHqcLNiXicJFFRGNzj3:U5dKqi61c7wRGpj3
TLSH
T1E4C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f824dd3bf0396e2439e5a323350315679f47edaa759c051a535c504f2331b997
MD5 e4c1ea18d2d572a0d6d07d89d93b37b1
SHA1 b4b0d1c6cd9277e34bd4d981680fc2a5038ab861
SHA512 ceee2d0e02bf6a6c5642770d439873fcbf4c2ffdc07b3e24245d724b5b5078889c8086fab4298d137e44c65bf4548e114515d04bbea813b17b8a137fcf166671
SSDEEP 49152:ahtSn8EApI0figjgiDn0AP5wnLNiXicJFFRGNzj3:bX2iWpha7wRGpj3
TLSH
T1C295BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4262fddb575985663343377b6783da1adc552b2bd583c210a9183fa707c4c691
MD5 a1820953ed84ada873da6f9e97b9888b
SHA1 883e50c4631a1e6aad68e5183c0ceda88af8a482
SHA512 1a3bcc44ecb322ce69452096a0c3e2b888507b848c4ee27c257e08b5303d94964182f4c31a6e7a31711da7f4389a8da09d3b43c0a352c372d3c69bf74c8504ae
SSDEEP 12288:teiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:to/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1895523D3558955B1EAFC003AC6755428F5881E2DEB5618E3E3483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 2d1e046885c4d1b1bc782b1f828d0ab43905254f40d2b89c1abc8a2abc7c8602
MD5 2a17dac31834e32bd6ef4a974cc6d646
SHA1 c50f8560423d4b83f12f18200e39c9e86d5c0d70
SHA512 94d0ddfb93d02baf4e24e62d9edf685bda80f28f68dbc3d5b04e0dd1686b7c7e165d142aaaf822c69aeb5203a3537804d9ca5f4d0fa1691b1596b09a48828f56
SSDEEP 12288:u5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ul/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F45523D3558955B1EABC003A86755428F5881E2DEB5618E3E2483D1EE23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d8e4f21294da68550e465976850ef2aae1e12097707af239d4632bc831c89694
MD5 6b6f35da7cc399cd028e9861a5d600ea
SHA1 a9cf7703c8d5029b73bbd6bc4538bac851c40860
SHA512 1872b436d335dbd7c9d49537af05da2dcd66375cd239c3a39e552e15a04510a97d31adf5ccb89ad0842cf4d8584eaaf52b3e169d817e2bb3f374331deea5617f
SSDEEP 12288:BXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Bj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1115523D2558955B1E6FC003A86764428F5881E2DEB5658E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 79e94fc81dc90ef36416a0f38831b0f1397d2605ec20430e525edc0a3330bb99
MD5 8019e9e81d86e1417eb1dc0aa3ee7533
SHA1 3c8d6476d700c7aa50772452d0c8e8a3b2a2fdd0
SHA512 fb9489ac942eec4a5c09507356512de8610b6b47f7e47066fd27a26206ba422c1d4fb47ac17dd75ef0fbd2301d3dcd016b41802adb60ed7f77e118020de2f9ed
SSDEEP 12288:QVMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:r/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AD552392168901E1E9FD803DC6764424F2A47D6CDB325AEBD3003D1E5674FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 73c7b0d54a413604fc18342ba7292fb1360d446d79ff79e69668d8cc2d216f3c
MD5 86ba69ee6b21b69b15ada14000423eb2
SHA1 2887c75c7606015a56546c9006433e72341defdf
SHA512 e0a24f78d0b14175a2daccf1ca4ed6d51199f97667907d78562f73c535f759d8d586a0fb88866bd268500cdc99e845f1853b1e4f65c9c5b801055f5404d1b519
SSDEEP 12288:IUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:I+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E35523D3558955B1E6BC003AC6764428F5881E2DEB5618E3E2483D1EA27CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d06f88270360e0c09b4edf303ce6a937e297ef1b55bbb4ea1a797d5fccb14159
MD5 9490aef4f5507014bf25129cc2ec863b
SHA1 bd19f892a097945d849954a6bf8bc6e29671db0d
SHA512 59a7f273392a915d701f9d82fd2a2e2d39ff02ee070481548f314d3a6a12ad7be9b1fe9eff24e7f6ccb5bbfdd65c0474d773bd6ac32ed8454bfa4235a877f86b
SSDEEP 12288:jdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1105523D3548955B1EABC003AC6754428F5881E2DEB5619E3E2483D1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a9691c044c02da75de50d82b7a4e7ecb14306692bb9f53ab74be9482ccd83ea5
MD5 4c5d8e4f99dd7cd3be4dd13bedc6a558
SHA1 4b1dc09e4dc34f63cd7beff69e294bce30d9aa1b
SHA512 0faecfded114d461941356870a9df2ecb516a31758dfdac9952ba994c1b623002e1a8d7661c9435330b60964f7d60d92a0ab7054a3b4b49811d54d81590cb9b0
SSDEEP 12288:pBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1305523D3548955B1EABC003986354428F5882E2DEB5659E3E3483D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 526b0c3030ade903eab400c2ab4848955c1d6e33db4c5b8ee85da8907b44af2f
MD5 52dff8efa9af840dfb227b9f1d72d340
SHA1 e467f1f700e057a8521f5fe16f1fe7359473f999
SHA512 bf9c57f2ca8d79e7a4762b49d3a46dbc305fb15122794e4e505d52e0b3bd402da280bdf3a9aea9fddbb5a9c2b3711d0976034c1ca5b6b18b33509eee39d3aafe
SSDEEP 24576:kZM3zFVSOF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kZM3zfRLNiXicJFFRGNzj3
TLSH
T17D750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 3d0e861adcb8d12e2e2afd155dcec5233b3890db4d12e342d1b7f5f48ffd0ed1
MD5 065ea3de76bfe2949c09e1b88c0fe2fc
SHA1 b5f5acb057daae34b0ed70d74910d7d73b80a1eb
SHA512 7566a11b7e64f0830e252e6b939b3c9eb43b0785766d3700edd2db367b2107d3e1a3f399f6a458bcaba15456bd2b13e0251fe269c38034d13f01f242a0817aef
SSDEEP 12288:PqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ps/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1115523D3558955B1EAFC003A86754428F5881E2DEB5619E3E2483D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 fe7cf966e8bbba8e7a0d545c69ad0111198dd1be25a16a112ecfab50d36a0d76
MD5 31136c6c08a76fc20eac05cb0da25255
SHA1 7524dc32f1c81eaf5a8c3b0a441fa7f00e6883bd
SHA512 7e0e742de66b69e7e22ebe8512010799b62e0ddab0f585d2f5cefe2857d6ca90031cfc7be14045289b5181685c0ada34ec3ceed66f9529e998a59a049f8fdeb0
SSDEEP 12288:62iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6A/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F15523D3548955B1EABC003986754428F5881E2DEB5659E3E3483E1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 ae86904ca19e0ed7cb24ea75c8d2188475e162d14f8965a390e7b5e52a32f07b
MD5 eb61b03a3947656e20ffd335605c94c8
SHA1 41d3ef1a3720379dd848b6a333da2ab011a3d9a2
SHA512 3603a81bf055abd9313cf0f4fc332b1a0828bf975965bfc4c10fc3f50925221ba769024c860e2a4d5f2eeb01b690c48302f24fbae8cdc676e78cf5b9cf2b729e
SSDEEP 24576:KzyZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KaLNiXicJFFRGNzj3
TLSH
T19E650147629530F9D17A8139C9621911F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f08670c8020a7ac85abdb1ba9b737a576be48d8e5876e1887e069ae1959e7666
MD5 395d30c6383e4d52be672f13206542b1
SHA1 13b5fcc8283eb2309925b7b0d64018ce2776bddc
SHA512 469ecdd427e503c6bb0149df49c2a80eafacf38676e9e4d28ac2ab11f6fdbab9bc55b93c16ed60145a874041f004dd4ef056daa10f0b96be05f28419c7969963
SSDEEP 12288:RqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Rs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F45523D3548955B1EAFC003AC6754428F5881E2DEB5659E3E2483D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 dc75c63341dcdd8c9c0da9b6bd7a153b4b8401e80a1818ed637bcc379944688f
MD5 0d2235e187f3f55d5f19f10f74ae844d
SHA1 bf94ee55ced9bc37d2650185e5d22a151d914f83
SHA512 cefd99f9ff4a31f97322e4dc1535050ccd24b4da9f5af50a035769ea4810c693bb87f97d1b1ac9e16767cdeedc1b9f61b4e36292e88c3053b2dae3b71088fe54
SSDEEP 12288:RqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Rs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1315523D3548955B1EAFC003A86754428F5881E2DEB5659E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 4f323674f670f6406d5df4733ac43b145eb677ab2050355ad806d094cd42f8a9
MD5 8dbddf52c12c7ef4f7da05ea19481f9f
SHA1 112a757793778e11e5930228a53812326e5f28b2
SHA512 0490eb3200a5b2e3ecdbd32ffbb6d6fcdcf5f9d81a9f7ed0166d6eca63ac0ff4ab9ce807dfd3279572535cba7d2e2d39bbd249a00278f251553e3319fe3bd9c2
SSDEEP 24576:szyZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:saLNiXicJFFRGNzj3
TLSH
T163650147629530F9D17A8139C9621911F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 a5f5051a363d3c5f757b865ce2d62e59315286f080124d93ee83cdd4a6e151b5
MD5 f0f7d31990b402b1cb7a5b098d484bc7
SHA1 4857453a1c1591ce2f138e596c2eaa60a8c650b0
SHA512 1188c6406e69a34081143de78cfe31be22a682b1b4119de7dcc6ec6b627101a4dc0e547d8bc5bdbb414fca478c42ae5315423a9025dd40e7c50dd4871acc45c4
SSDEEP 24576:9T8aLl3z0zDT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9T7LljCLNiXicJFFRGNzj3
TLSH
T10B7502A5B39018F4EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 2acd85826d4d53885f2c039605b86cf3cfe7685c97cf9c7644f8ba83b61c6b45
MD5 15f2b37eba4a39983d669f2012ff571c
SHA1 359cad567babd9b8aae8f2ca588b17b87430fe5c
SHA512 b660a4082e1c86671005e1fcab03fbd38aa9c161b149d2859bd9eac263d5e106ff83bbb74ea299c0a605943a8a3ea891ef4561217dbb2fa6489cc688b0890d15
SSDEEP 24576:W3rd9CHKy7GZ//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4rd9CHKyaRLNiXicJFFRGNzj3
TLSH
T12685CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 50c2b00851f3ef4032059bf2dd541716ec40b0426b24458fc5351c44f421c189
MD5 797961c8e58f2ec062e6020421f58e76
SHA1 baf1d3d6ac529ba7b83c76dc46cee4743e246ea2
SHA512 7e0fad9bb9be2e8ffdbfd525aa34f13bbdb3635392ba8d1acaf49164b374369e4315de28e1bbc077b6780116a899a59e2085885dd7348e44e47851247cb9a645
SSDEEP 12288:r3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A15523D2548955B1EAFC003AC6754428F5881E2DEB5658E3E2483D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 52577130ff3f25355b9373789a51f02ea5456ec6a2048dabaf858f0041fb199c
MD5 18ef9a549b1fb59bc84fc03afb3f8686
SHA1 053c4bdddc7230e64c23352d4e5b4bef1c00fd95
SHA512 6f8d61683d992df6fda80137f646425fbc2bceaf88117cb151d888916b0d18b2f8f8cfa286ce609e38cf1231dbf8bb7ddcbead2ecd7fb6228c9bcabed9192c84
SSDEEP 12288:sViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:s5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B95523D2558955B1F6BC003A86794428F5882E2DDB6619E3E3443D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 19c19b8fe1ae1d69a70d7c440a69d30c568588ef07952fd777c7da78d619d8cc
MD5 82747eacffeb6c7351e60b0f4defd35a
SHA1 8f6d4a280ca0f269e72fefe2e3be07d0fa8ed0c9
SHA512 e7f2ff5baf1b50e2557670734c0d2c1f17c84cf616caafcffaf01e6768b05edd84730bceeff379fe91af26e9b1116069bc02830ac4bc87a5864ba6b9105462ed
SSDEEP 12288:SYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Sq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17A5523D3548955B1EAFC003986754428F5882E2DEB5659E3E2483D1EE23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ebc2a94963d6b9941cf65146035e3de82324f465195f623e8d3e1a335d53e43b
MD5 6eac340d6d54570b43df9277c1b0f9f9
SHA1 eaee2b056adf02137d956110114379329bcadcf4
SHA512 470401ab786315f85f9ab39ae203d647621220e78580964da07a9fc2809976b4672eee2af8c4a521405b1fef87a4b7c991d0b2aebe9aa4fcbec6349b4be5f573
SSDEEP 12288:DqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ds/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1065523D3548955B1EAFC003A86754428F5881E2DEB5659E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 637333a9a088581a02e5bfa49f1c4e2b7106cff62cc5788692642d69bef1b547
MD5 a37d54e8589ddc1a1a4cdff7ee75001a
SHA1 4073ce1ad3b0b203eb64b40c54dff5dbf0992bf7
SHA512 f10cde3322a25cc67417fe64a77a46ba2bd7fe7108f965ad70ead079bf5f2a608685c1280dba4dd027f7a53dd7ac5a69df917d381dca26919ea76b2867e260d1
SSDEEP 12288:/3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/D/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1615523D3558955B1EABC003AC6754428F5881E2DEB5658E3E2483D1EE23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 3e90f0e0d8e4fe1719e203859864fe19fd6fc47c292bbd8b36e540b2fea66e93
MD5 4bd69cfb1239c67e48d6e1fdc238459b
SHA1 9d47d5a1ac7adc70c7b32f92bff9da69da59621d
SHA512 7d96ce6aa7caa24983a78818f97ca87dc3f96469da96791bf259306bd875259ebb2f9db62a7b3f608426d1ac30fb741a3719c90987c2edac765777a97843d48d
SSDEEP 12288:PyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:PU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1405523D2558955B1EABC003AC6754428F5881E2DEB5659E3E2443E1EE23CFEBCF38436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 8fd13517d30b33a8b33eb01d488c5f4dc9f4907ea31595025b2945f58c74f4a5
MD5 1fe03c2a0c7c64a1f39dac564012cb9d
SHA1 4f19eddfe06d429f5ec40676a97fab522a684571
SHA512 8e05a06590a899dec894e8b1ae66d537c88de97f9e70a1ff05bb7ea27de784824e8b34970d8b7c8fbb3b01700a6ca5c18369ba39b18d35b4e6bc918518842929
SSDEEP 12288:wUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:w+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E75523D2548955B1EAFC0039C6764428F5881E2DEB5659E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 5a600083662c222bb7f13657ac4350e4375bdb1a09b21e37583f16b0d9503633
MD5 ad2aa607ad368a4f3a2311142b90efb1
SHA1 84f968cc436eb4161e9bdeb9cd9cd7af53e4f098
SHA512 832e3f3c8df4535b0a97166a78381a3e1650d03e6510a8f4b8db7793c139d4a38b268b6094fbd0ed7d076b993b461dcf49a77037a8f50331bfe433e96fe5aeab
SSDEEP 24576:Lfwvzk9RX6wkyAIQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eMnYIQLNiXicJFFRGNzj3
TLSH
T16C85D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 88c5e31b91b61aafe126c7fe9bdbb380378fa921e94a48b63293d9235340d720
MD5 aae4ef90a233d69d50a5bedb16c4a253
SHA1 ef6314ac7d0e34079f3accaeecfc7cfa9b088ddf
SHA512 6dcca1d49c5a770722fd816ac5ad0960f04482a2f6badc56eb8cfef79828fed775ad4b722da672c94e6f458b0de08688413f49663b32b9082b2e5dd8267053b4
SSDEEP 49152:JYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0HLNiXicJFFRGN:AySzP/7wRGpj3
TLSH
T1E8066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 bdb5ec0faca70c0dccc91d1184fb934f679af5527702c07559f4e8d24186197e
MD5 e945de3561e5fad63ddf08a8c2ae3ab4
SHA1 e65481c89cf4e3bc0d760509c45684cfbae80753
SHA512 35d47baef1a5c0972f4d62480fa336787a35f26305d8fe71baee0542009c53cce193de7510789ecc33062596bf7b6f802f58fdc92a27ca1bedf4fc3cbc976a8c
SSDEEP 24576:v47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:v47JUQjqirIhCnDHUPfF/XLNiXicJFFS
TLSH
T16F65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 871100c3e72b64b83adc64af16f37ace3cc331efeb5d16c0d248c0a85291eda6
MD5 6c66eae4727c9e5f88f6644df9d36f7e
SHA1 29a7854a62d8625c4f679c781b13cdfd2b71d02a
SHA512 aab872f9b28d4fb216c8a037a81e4140049ef9cb143c807a3520a7200f1457b1de52d607e6b6a22acd7e80ebca827ae82b3497e6d5bb9a34a4cfb208687d0033
SSDEEP 12288:upsf6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A965F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 1b55c1f1f7af61561adb82ac2fb2e8add7b725dca709df6ebeafbb00d8c66d27
MD5 d6d60cffe05fbe4e4ac67984664677e1
SHA1 c2eaf99e73a6e53ceca3f9d15a2a9e13d7347781
SHA512 632097559902fa430e0d13ef347ba9d4ed6d53d33595d198d7b986590af24864e1443352ee86ebcee2f54ca0ae426e25b11f3aca2f364fe9ef0ce70c397a2e54
SSDEEP 6144:bsBC2naQg6k5f3zW3bjSmotMxXiA7U3fck39Jf0kpZHMI1WUyBpyJa9oDJJDcYye:kw0PU3fP9zpd2UyBwxJ5y5e77NWfS8kV
TLSH
T1C43529407666C74FC66D40325E32D2CCABB07D11EE456F1773C88B3F9576A58BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 70a8ff92bc529caedd652273db6c52fda2b38249dd96b7181f1c8dcdcc6dae51
MD5 8addc4210691d4e28b0c0098e309ef76
SHA1 6885ec8a9fec16bfc5d0a6f6af8b71f39293ce67
SHA512 7559d200564439414f9f7dbf5b1b1d28755465824b9d0d40e074871c7635669cdfcb5b598968bbe0b9f8cfb20ce054cf06e4aa54cb8636ba63ea63d3733d4c37
SSDEEP 12288:lxBjTaq4ITVqPUBvhcZzHKOn+mVvlFqZZdqqKJIO/5NulQX8FWE8F8bE7HzLaSL:505LL
TLSH
T16B65F9406537E28FD1B6603207265B8C7BA4EC12B7096F26B3C8453AD86BF15A5F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 d9f4a5eeac55412a530d3d173e0530940456a699d63f5e5be92285dac5a0c0bd
MD5 b02f99cc132d1708be8004157f25dc28
SHA1 eb901fda3567562baad6ff7f54a939c3f2bcf176
SHA512 e8d0103503a299983bca41df1a735a1ce4d6a7fca99b1c5baa1bb225afebba0b8f10a94d8d4d7d19ce3e06555dcc5ba2a63be4055a313b70ed0453935496ebc0
SSDEEP 12288:1F7CiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E3552393468C59A1FAFD0039867A9434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f8444401be2b0be9868b08da5c79940febcc1e2882f60baad4724f2c78cc6fb1
MD5 7818d7f2ce2ffd65306403b3850706eb
SHA1 5f1d7f3b395005a37e924b1badc4e83f60efd33f
SHA512 a88d9f5d2c92d4936dfa89c92e2d158c7efc250acad04f13e22974c0e1a2971704949f32378848acad798d6854314a7bc2eae3889b1537fd6317dc36cf880f83
SSDEEP 24576:bgb6bmBIi49WNNFpg1rSvFv7bYC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bgb4mBIBhGFVLNiXicJFFRGNzj3
TLSH
T19765AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 f0d9be806c7ba64879a8915c64e37cdd1befe2ba007fdd744f841d9526215f65
MD5 14586efe5b9d6e2a1cf7d04c18f7759f
SHA1 00f438abeafeb9b663cf7203768116573a00f24c
SHA512 fc6397664220a7bf83e7a7a789fa29e977df89c89110e4defcac163934fda2be60cc44ae03bb2d8b1c98efc74b4ec08887816c1e6f09961e921d5e807b8a181e
SSDEEP 24576:bG88u8FpJqH1vzria7/mF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:67ZFPqVya7/KLNiXicJFFRGNzj3
TLSH
T13785F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 63c5677aad25b14d54805a25f92113cfa4291284b4860e28aa909c616266969b
MD5 e7b9cf0114c59b66c581d1c8ee5ace38
SHA1 6c62486513338cb375774a8c2663ab84fadf2d92
SHA512 f96b763848817dade24b89d9ccd1bddcc06959be441a72893b1f539dcd8eae8794073798dcf5d908bcd2f16444b344ff6faedf7d1ceb7c8b65e81f15bdfa8f60
SSDEEP 24576:0PUr+NQR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0JQRLNiXicJFFRGNzj3
TLSH
T1EB65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 312a862a070243f38f1a69a2457cf0d930fdef6ddd97a1a6552ff98481fafa7b
MD5 963e74580b769c976a0010b26ca106bd
SHA1 c1d132ad75a8531341e11f39d9e19868efafdbfe
SHA512 792ca137c0c2d6c779fb6c33f8db56bc70676ddd0be3101b7bf1d64318fe7ef551765204bc73de33a02935d91b820428ac7363297c78ec3e4fd435b3f4ea57b8
SSDEEP 49152:hBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjBLNiXicJFFRGNzj3:CG05lO43b47wRGpj3
TLSH
T155D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9eceab8d490b44c7601ee30fa36e5b763f67da22d7a3e94cfdc43b5694a59c12
MD5 2edd189fb9e78f7c26c5335b859d5792
SHA1 1cc9041b310365a69f40fc2187d29ed75db43243
SHA512 91190c0e4b65affb01cea8ca7a085acc5499732570372bc3db690229ba3f18d782a8eb946611458d21dd5ff2be49e8b1664c3a0a8219ed1c395d5b9aff9795f0
SSDEEP 24576:dfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnH/TwSfVcYG3K/cJHlnFR+IGNe8jg:ta5POZ3lJt2pasx2+m5LNiXicJFFRGNf
TLSH
T1E765BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 64f7b4dae301d72186405b451c721b63d90b8c935478a6ef8d892daf1ff4c307
MD5 bd97ba211ad5677e2cfbe51a14182d3e
SHA1 041ab3296775104229bc7269a37e73143f6c6b61
SHA512 e4ae87ec972520e55d79a373a0f25c3041e709f86a2feb4c2632abcafa331ef78823bf5c70cad7ca88f5f7f8ee2d4f7f121c6c52c29f67f5a41216cf51b6a96d
SSDEEP 24576:eNcwHdjbyQ4nLC18lb/EOjowL7Fkd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eNc/zEOVHFqLNiXicJFFRGNzj3
TLSH
T1E6858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 07db7a33ec8b8c7a6a0284eb5de3548f47d9be2b6cfb7bbc4ab98ef13584ab43
MD5 f942be37f8869442e1cddec514bb8fe8
SHA1 ee6b014b1ca2c50f444cc96dd6f804316a0b6505
SHA512 ceb866df36ec96dcebccc21adae990af2ed29ca7e6707d66a0d8295b455a5026798047ef171b73efdf3b7ac9e9cb60d9fc640abfacd9186dc02ef3f9d55e9e06
SSDEEP 24576:QzkNvNnaFeYhJNtmZBmj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QzMwBtOmjLNiXicJFFRGNzj3
TLSH
T19F55AF6EB6A846E4D1FEC675CD238512F6727861073292CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 41e85691334b658fc698f3bbd971be3ca0919ca6f2e1604f4510636406c371e5
MD5 b0d79a64b5f3f784347d35aa0191594c
SHA1 3fd40e967fd635c10531d44ce9472df2138705c8
SHA512 9588c59cbd086e9ec480349d6fb160c27c9289e8304c023dfc9feb94094e41a46af7df5174bd94566be602c36e50a7a7f8e5db4f277024a1b84fec89c9e6262d
SSDEEP 24576:gD3FHshBIYQgAI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gDVHeBIAAILNiXicJFFRGNzj3
TLSH
T18975E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/880-123-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/880-117-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/880-116-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/880-125-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/880-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1076-301-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1076-102-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1076-104-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1076-110-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1192-85-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1192-299-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1192-317-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1192-319-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1192-78-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1192-79-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1580-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1580-15-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1580-23-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1580-115-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1836-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1836-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1836-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1836-132-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2232-133-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2232-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2232-134-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2232-305-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2952-300-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2952-90-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2952-97-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2952-91-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2952-302-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2952-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3340-41-0x0000000140000000-0x0000000140597000-memory.dmp

Download

memory/3340-0-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3340-9-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3340-6-0x0000000140000000-0x0000000140597000-memory.dmp

Download

memory/3340-38-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4428-69-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/4428-298-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4428-68-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4428-74-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/4544-46-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4544-45-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4544-261-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4544-52-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4712-56-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4712-283-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4712-64-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4712-58-0x00000000006B0000-0x0000000000710000-memory.dmp

Download