5d3fc9c97de84dbe6ab00c2c20541d26b0508f47acab97a3be6acab048f96982

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 03:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_a7cb4baf2ad31edafd2bfdaecbd0dabe_icedid_njrat_vidar.exe
Size 4.6MB
Sample260823-dl7ayascmg
SHA256 5d3fc9c97de84dbe6ab00c2c20541d26b0508f47acab97a3be6acab048f96982
MD5 a7cb4baf2ad31edafd2bfdaecbd0dabe
SHA1 b2df09461c6cd5ac8686f43e86d9451da169946c
SHA512 faa0be4e043af7355996b363b99c30bbe5c08145e4e133bf133619d30ae17d7093bd36480bd7119d5d93219597a135b31474c180016f271e1de208d909d6d067
SSDEEP 49152:1dRba8fD8qinfMSKJXIUQREV1QOTu1U5ai2wzYo5UC9RhuCTFKlaxV5dgbTggFIa:S/IJsiCwsop7cTtUf
TLSH
T146266C656BF880F5E1A7E134897AC9B2F77678020D71EB5F0251CA1F2F33A904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
4776	elevation_service.exe
5368	elevation_service.exe
5568	OSE.EXE
3756	PerceptionSimulationService.exe
3608	perfhost.exe
4488	ReFsDedupSvc.exe
3536	SensorDataService.exe
2400	ssh-agent.exe
1576	AgentService.exe
2504	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-22_a7cb4baf2ad31edafd2bfdaecbd0dabe_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-22_a7cb4baf2ad31edafd2bfdaecbd0dabe_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-22_a7cb4baf2ad31edafd2bfdaecbd0dabe_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-22_a7cb4baf2ad31edafd2bfdaecbd0dabe_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a2ad423dc618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-22_a7cb4baf2ad31edafd2bfdaecbd0dabe_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6b5bb7cac32dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000eb8b7cac32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a24573c0ac32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f988e37cac32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000379de67eac32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb496fc0ac32dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4776	elevation_service.exe
4776	elevation_service.exe
4776	elevation_service.exe
4776	elevation_service.exe
4776	elevation_service.exe
4776	elevation_service.exe
4776	elevation_service.exe
5368	elevation_service.exe
5368	elevation_service.exe
5368	elevation_service.exe
5368	elevation_service.exe
5368	elevation_service.exe
5368	elevation_service.exe
5368	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4560	2026-08-22_a7cb4baf2ad31edafd2bfdaecbd0dabe_icedid_njrat_vidar.exe
Token: SeTakeOwnershipPrivilege	4776	elevation_service.exe
Token: SeBackupPrivilege	4488	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4488	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4488	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4488	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4488	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4488	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4488	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4488	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4488	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4488	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1576	AgentService.exe
Token: 33	2504	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2504	SearchIndexer.exe
Token: SeDebugPrivilege	4776	elevation_service.exe
Token: SeDebugPrivilege	5368	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4560	2026-08-22_a7cb4baf2ad31edafd2bfdaecbd0dabe_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 5104	2504	SearchIndexer.exe	99
PID 2504 wrote to memory of 2712	2504	SearchIndexer.exe	100
PID 2504 wrote to memory of 4924	2504	SearchIndexer.exe	101
PID 2504 wrote to memory of 4616	2504	SearchIndexer.exe	102
PID 2504 wrote to memory of 2212	2504	SearchIndexer.exe	104
PID 2504 wrote to memory of 5124	2504	SearchIndexer.exe	105
PID 2504 wrote to memory of 2684	2504	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-22_a7cb4baf2ad31edafd2bfdaecbd0dabe_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_a7cb4baf2ad31edafd2bfdaecbd0dabe_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5368

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5568

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3756

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3608

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4488

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3536

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2400

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5104
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2712
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4924
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4616
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2212
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5124
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f955b5041d839a258179a56674aa5422e6851f13baf31582559e82f71e673e2e
MD5 2d7b37c1cb3c7bad98d69643cc04ca5c
SHA1 5c86fb81abcb0d15a36888627f87c97a2e5c1316
SHA512 197de4d47ae9ae9174805609a15e08f7e0600129482c35453d104c0d834b57c7772a23f3d824a1e970b97f4aec01b2f452b3e7282e0c62d51848714a1bc6f596
SSDEEP 49152:pb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn4gFIDRRAubt5M:/3q6sjBqUf
TLSH
T10FD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 337ab2a6dcc33e1ffb57289e486b24421402ef0f38c12190da15e785e373a341
MD5 0c5492152d2179b7c554b8bcfb6f75d7
SHA1 3ac344c9d949fca67cfc1aaf81896e3cd0300ea7
SHA512 0b0eb974433b038b5e3e1ecb3914975e479bd5b7bb26c42b5de8e08885ed00daaa51f90df87ce80db9106feb9d84e75d356fe5ea8a33f24717efc18421de36da
SSDEEP 24576:kXYfDtczArVg9N9JMlDlfjRiVuVsWt5MJMs:DtcOgFIDRRAubt5M
TLSH
T1E585F12873D509F9EC678279C9B28501EB33785547A0E78B03F089665F732D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 004f64c18b6dd0c5213844c29f5423b36ec6d7ecbb93a34dd3276a12115c764c
MD5 40543405f0231a5dd4c51cc029adc5c8
SHA1 66aa26a9f2d61a31f37504d8c653b3c1fd9d04f3
SHA512 35212f3cea5ed6ad404332fe4881cbf2535aa6e393458f5b3b64c6289887c209051a79030efbb399419eb19c7adbdd6c0358e0b022a3a215657c2853f3883887
SSDEEP 24576:90Le5ji0hmx7rMHVg9N9JMlDlfjRiVuVsWt5MJMs:9Pji0A5igFIDRRAubt5M
TLSH
T1AD959E26F6748375D073C0B9C5D2A68EEE72308617308ACB4296C77C7E676E6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e6b8c7a4a32434720200b59c62480868464b312cf8ce519126de099fb1dd681d
MD5 ae0f1748ca1f674de4fca0341a925f18
SHA1 0842bb4e681274196c7c72584f737477d866359d
SHA512 740461e531bf7421f05093d8eb068688ae56593a6516201fd36334a693264b54535ae3a17d48fb1b8909e8d277f62b7cbebf233712d60d9f6d8e272c72e7664c
SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWn6q8wyuRVg9N9JMlDlfjRiVuVsWt5MJMs:w/ezSC6vUzPveHjyOgFIDRRAubt5M
TLSH
T1E0755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f88fda648a3f74b0dd8d3fae7b422b938174dccf5906db6f6f17644a29888a6c
MD5 71275a3d04727a034b624ce01abc54ca
SHA1 9ce02ba04c73baac7f12481a3ac815dec5269675
SHA512 32cd7cfeab2012665e0a16347b05ed6d7c77b01fa21e151848397bf7c8a6a07312d89e71d4132cafd7c919fbeb7085ddd5bf395bb64d3c36022044e3a4d6234f
SSDEEP 24576:/VbqPb88hv/l+YkVg9N9JMlDlfjRiVuVsWt5MJMs:/VO88hXl+jgFIDRRAubt5M
TLSH
T116559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 dcb58051302447a5ed7df41b53310064b1e2c913437c76a3437d55a9b30cd269
MD5 75be34369c75fa61bb90b705e99da7a9
SHA1 8a689a76058ee50d1cf960aa736f6e030d370534
SHA512 7ad03437119a4855b8d7a10c748e0a94630494bcd38cca608251ed681bdf362a470563f9a87221a444e0f51df5ddaee8c0afccc3bb1780680c59ee14ab389bcf
SSDEEP 12288:99xV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:99LVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1CA6523AA7645A5F6C65B82B1CA73538ACF226F5835C58547C2B019D1C9FC1A2EC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 5b957f993fb532f0e83bb9ac6d868b029b3bd33b9677201f9cba18433be3f514
MD5 046393a78723646d3798e714adc26623
SHA1 c645bf1c81163e0316eed785cce4549dff679b5a
SHA512 fabf46a021d2da581f1ca451b337f97f82548da64b3f3549255738a6e01bb80a79bed6fbce678b0bbac12a29aff4e7d1eff1643995a73cebcea723a45584451f
SSDEEP 12288:peBNUbTVO86UQV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:pJIUcVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T12A85CF3BAE28FCE2C27E8DB99A918340D77278304B5293CBD174824EDE235E15D7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6f9a4f97a4147d3299a9beee8eda45c2a6ed12509a4c61bf5f4c4a3ef2fa9271
MD5 05da494a294818972af0fbe6efbac929
SHA1 6e86398b204ce22153f02073a7d1196985c14d30
SHA512 b8e96d7a4356dc3bae9207bdbb2a6ad36222e516a2989cdb19d6fb8323e031dd1fd6a573d49f6cd6f4ae8202a1784829b6531d90b029e31bb558cd8012b1bdbb
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THz:3QvGAdlCEL8c/DRNw5C8Uf
TLSH
T144267C656BF880F5E0A7E174C97A86B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 cdbeaf0708a48f56e8ec95f823a6f38a9d5c44788452add470ffbd1e0be50b4b
MD5 3c0760a0bc4c9a293777ba2e7679eed0
SHA1 1124cf5886ca1c0d7a0d12f3477bda3179fc46da
SHA512 c6fc046a5c80059f18537c479825476b83e80e7f560cb2191d6ba35100cb0673c16a591006e5996beacbdc7108fec67932fa0417333772bb2a6245f98bda472e
SSDEEP 24576:nSewsAjWVg9N9JMlDlfjRiVuVsWt5MJMs:SljSgFIDRRAubt5M
TLSH
T14B85E031FA74E036C27B0DB25B36C706583D7A204B911AC3E3B84E9E99742D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 35e20ed6830e2315d7d1b67bc4b58591be6e79cd08567af64700171e09592323
MD5 a95035e83bf32e09ebc1ca8d89d14a1a
SHA1 b83a369c39b47d0f9748b3b98d6a0024a0e463a0
SHA512 2cd52c10ed026ee27516914cf26d72adafff3ff62221c5ba7ea57b1a0c02186f483b2e44a33494c47c4b6e6fd546b644985640e85160b4461027bc7af359e1a4
SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHDUf:iUEtQevvqc2W1cpV2tI32DUf
TLSH
T14A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cd37fbc5044be1d75f6b4b45d819e3c3405cf535daad40a0853e32af9779287a
MD5 35f4d8320cb988a0e1b194de69ea4131
SHA1 0b66808e340b43b7a3602463e721ad43e596d607
SHA512 ff393bbda2117ca19414f6d039383a5713cefb5da8e7ee7901c4f7b9a8cc5e4693a419b78ebaa48b471d53737594fc9d672c9cd71be6fe28a173f661d97caa16
SSDEEP 49152:0CbRquA/m2yL5zQfFiV+XenmE3/zygFIDRRAubt5M:doqtVjnmwUf
TLSH
T181D58D1976B8C2E4D1F6C37886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 35e22c7cc7923cbdd23043eadce60d198b8d56196b34457053696b8dcd70937e
MD5 aee8843a4e54953f240009cc5644843d
SHA1 b79635082d545f83e36615bb3fab21795d30cf39
SHA512 739019e1ca8f7ca1dce7c2829690c068e8a0b971f37c51ad248ea49abcb430ee78bd22fc4850ae2587a4ac285575c34d17948e93ae7bcae1b19773cea403fdbf
SSDEEP 24576:nAhGL3IFoiwtA5l7S53dVg9N9JMlDlfjRiVuVsWt5MJMs:nAMUFoiq5HgFIDRRAubt5M
TLSH
T15E35AE81E7F955D4F5B3AAB899B68171EA76BCA95E31C20F2160C11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 11344f4a9758fdef77e9c5aed2e655cf98558276363bd7a704466e457106c280
MD5 017f5ce349e6eafa8461d25db442d427
SHA1 21adc544a73b5a1b0335fac50e76c533e83d48ff
SHA512 d25ebadfaf3945072708d9d3eb5b7584c1376c04629fdc98b6a48113639b974cb14a789223a28beba162bedce688c01c4e8ff031d312ec80f2b55f551855200f
SSDEEP 24576:jwuWOWCVg9N9JMlDlfjRiVuVsWt5MJMs:jwZOzgFIDRRAubt5M
TLSH
T13785F14A32A40CF9E9678239C653C136EBB3B8053A61C71F4370C65B5F77261AD2EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 83a41c4984fe728caa24e4a87558322ab8e13e3db5cc0f0cb8bd802d0fe0080f
MD5 f4e5b4e41df8fc9cad8168ec1d07f0fa
SHA1 e5dfe894e2af2c41eb0d28e9187eb2862a1cbba0
SHA512 0e59cb3355f631e6c2d2e0b243524921a3c5e4bef08a21c3ce050c53466959fbd8f4be2861a02f774cf4a76f8c890692ae04695aae922517681fe6df7523105f
SSDEEP 12288:s0Z1IyWV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:vZu/Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1597512AA32D460FAD1A78278C9F24345CB72785633B283CF427006A55FB66D25D3E763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c754fa564ca57ea3726fd7ba2e398e0703fd0ba843aded7e3785202a4c06de19
MD5 ed963add4d2d6a219cfce1396fe23b3c
SHA1 a53fb18a70d5d773405276f9db52beb4ef526071
SHA512 53cf3bc6a3af43ad574d3344b4597bd5148e5aab03d1e2e12b65cbed8f4b7540cb938405f4ed7ec3e82049c627a12a826f8979e95bd7cdd201d825da281d1ad5
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Un:sQRQyi36YOcPbLvw2gAf+PN3lUf
TLSH
T1E1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c7f83ec7c5a475506ee6b3fd2a352029c4089ba8889d1d37239219ac431c84dd
MD5 59ab775a5b9e4c742251455bba8415c3
SHA1 937add62711b85a9c1e9fdb94d0856a4a4d785ee
SHA512 5699b65ba084fbc1b2f6c6bb319d0e1c0d8c7b3deedcba299f1fc6b8f3db639f3bad801c3d3066780f335955bbff339fb7ba6da8fab3ff34f36da0ec0c98bb2a
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Un:XQRQyi36YOcPbLvw2gAf+PN3lUf
TLSH
T197667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 04063070181597222aa375767c06d1761b6ebc7aa5f9deadc035340bf4ec8faf
MD5 7e344cad1984056033decde6c3f5bda0
SHA1 ec177300019c3cb403f40fdbb933c501b0ca0f2f
SHA512 3508be5112967fa8364368e1024743c745e6cdc1290749125b0bb34bb60a1a43abfe991b5a201530bbf12d37eaa8ac2092a491cc393fb5795829e9293280714b
SSDEEP 49152:U68Qg55nhceWu7PNU3/igFIDRRAubt5M:+thLRc/rUf
TLSH
T1A6B54933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4c455933877b4559128b3fd8264ccd563a04d475b7c5ab74ec5108c037de1f93
MD5 e77a4d053931455b59cc3265870e9785
SHA1 30f0bd5440592c8cee990ce7114b38b7f5d0e0ab
SHA512 27787f2ad4a7e11d14a2a946ab7980f84b61a50d4297841f238f60aa39c73e634dbae278f64f4368121fbf1ed770772a4c9b1bd9033afcf5d590d810ebf49ec1
SSDEEP 49152:+3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99R:/y5112gYy5azzVvt69nLKnhZ+Uf
TLSH
T118167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b43c5dffca77be21d61054e3c563354a1d9e20ac69e51bbf269bec930ae25ea4
MD5 f2b887baeeb3b77d1451316851330480
SHA1 582013a9955c009967f86ee42efe73d0a4fb8a52
SHA512 3caac2c2959a436affa1c3372a646b435c0ac101907a3a7cc485b10ba41c55a7eae1e089d7a250858ed756af4d2f277007b38f29529d385d2ffd6ada53251894
SSDEEP 49152:fB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glpgFIDRRAubt5M:hu6Jmdxd2dOUf
TLSH
T1DFD5AD13F1DA01E8D06ED078974A9233EA62BC490B35B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b0235913f05150fc672ee59b3a6b8f16f98290dc3370523c76cb2b2331cae142
MD5 7b60df097443edb5bab47a937fece8e2
SHA1 23ee8e0bb79231f4986d10309a25dcba27764614
SHA512 71f7bb168bee3e990439332ddfa758ece935d6899249e787475975eb480c03ef9177ce8695f42d158e98f44b379d906bae0dbd2aecd72c82ac9355161f26775b
SSDEEP 49152:C1hpsNoJpF1A63U44CwH7R4xcgFIDRRAubt5M:CmifPWRwUf
TLSH
T115B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BAE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 981f9bdca737d437d5c7e8baf5279f4a79eb7c2d6dcacb71d4d92591246221cc
MD5 02c23f05268a99cf8e7e3fe1c918f2e5
SHA1 cd5b15c5e6e2b22bdc295dc17c1a235d107fc971
SHA512 8028c0bec59351b5bc49d93f7b491a4c92a5b7a485b12679167a1514cc52772a2abbcaa6e04afb8ea16ef4df5bbec152e053db7793650fe01915ac16636eee25
SSDEEP 49152:sSuZQIY0Be2KcRVtOnks6NMHqtgFIDRRAubt5M:O5dKii61qUf
TLSH
T1FDC5BE13F2E940E8E0BED674C7669232EA72BC464B34A6DF064072551E77EE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 bad28484e9cfa42ea5698b5adcd1e1719b23c7f022ecc6b7a07bd7188a204248
MD5 23b135f6125ea6908249c061ed31673a
SHA1 1f482b3aaf33b41de14c6d6b888b23fdc096f24a
SHA512 1ea457ad6e71bc81bc5f6a0c28eaa7152ee39618fa04e39f5aa4317a32b53b29f4c7cd371b7adcb60127d931a7132d89c79df6b4aa6eb2caa2f05e3f01404ced
SSDEEP 49152:NhtSn8EApI0fig3giDn0AP5wggFIDRRAubt5M:cX2imphkUf
TLSH
T10995BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 610e74895c2e151b72a42e2033403d109cdfb95307ace7f755b86f48c0f50911
MD5 cfec062fa602ec9292826ecfb121e2fe
SHA1 05564602b8235dfb301b84d2572a4dfb95bf931a
SHA512 f210a6f9d3eec5b9423f55dc417b9f3990845751fd776232a4c914d8dac86f9cffe1b635dea81625fce7dce8c104ec9b18907235ef6bf1b6b45576f302658343
SSDEEP 12288:85V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:8DVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1446523AE758695F7C507C2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 c968a292a8927a5eb74d5221d8d0fde0d65abf369869c9c8939ed4863831d29e
MD5 0bff62bbd5c1908c115d0535552dd483
SHA1 3f819c2b15b6c0b53f3d909c77a2dbb1d4d4fb5b
SHA512 7ec30b4f29291e98f53f77c1d476c7ced778d1eca01e05e75e1fc6d3d5035c01611ef10d9f3f90cc22cb56ef517cc16b0ac6a5dbaf7abd4c25f96f8dcb6ceeca
SSDEEP 12288:byV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:bqVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1566523AA758655F7C50BC2B1CA735389CF226B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 8d341462a6ea210be6c6bf62f5def87045b628be852fbc509f9323617614bfdc
MD5 8cf7c4449fcfe52d2dc4bce4f21f1199
SHA1 a2d0f987eb7214518f6447d139761c4311beadd9
SHA512 2ca6cb174fca8669d82940b79adcf34b33fb481ad7fc3c92fa81b5576b4ab49d251d1406cf398ad79de1a7bd3f3d5018f3316c23c2e2506c9410eb50ea36e314
SSDEEP 12288:04V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:00Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1176523AA758695F7C50BC2B1CA735389CF221B5E76C68147D2B00491DAF81A2AC1FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 aa65cd0c1f646c7c9f20d76197cb057149a7c8968e030867ec17d16a29b5edcc
MD5 fc7e54672689aaeb35313a325fcba65c
SHA1 25667fbed76b1327f6774c3cc65c289e1fba16de
SHA512 b3d33cedf4e4ab1a3039b115213080a9444228e9751111de9b54598db50c4ac28c2045eaeaa892f915f664930078e0e393cb76a4cf9060b9bdc21cd55e91dbb4
SSDEEP 12288:FVPV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:9Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1B765236A369651F7C457C2B1C9734345CB727E5973A2828FD27009958EF42A1AC2EFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 063d8ea77bd3c0477f3e8b8eb1b71aa68da9535f409f2e9f1593c8cb05dba7aa
MD5 701942477b364d0fe705f3e9e798c2f6
SHA1 da92c831eabd5e84a5debb55089dcd1cc0955667
SHA512 2b4a99ae49783a45c11a7bc41d971853731fa6ad7e19bace6bf1fc7ac11ccefd0ed4214e38a1d21188d5c961dbf88702d6b09eb2443a646bb093c97e5aaf1503
SSDEEP 12288:qnV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:qFVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1E36523AA758695F7C50BC2B1CA735389CF261B5E76C68147D2B00491DAF81A2AC1FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 2935b79887615920a06d30528c328126473b437e2d24eae442c6269629994fae
MD5 7afe60f88d990d3b43d6809748d557cf
SHA1 b926c2f08f9f88ac09d02dfc00de0a15e01d59a2
SHA512 4f90393de3385cf5c0bf2a8ffe9cd2ee4a5bf1365c46be7159ce9802e33e6c3eb151a95bb50292e1e0d82859e2e0aad9b86580192bb39ce459755c606d433492
SSDEEP 12288:cOV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:cuVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1886523AA758655F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 4df23c25df6653296eb594d9246c10f9b867032be3cd49e960dbc57b00ac7994
MD5 ffbcf0e80ac9e4b5f15bb7f43a3f8077
SHA1 b22c80c756c29d10182bf13c0eb94cac9e8f71ce
SHA512 30ab5f773f729fd82877345cafaf8eb28615cdae724061b6611e31e631edd9ce5d24704c51607f306e680da3d540f72ec98558ba7d9fb8174d3c04c907830948
SSDEEP 12288:pqV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:pSVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1DF6523AA758655F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 b698652a01842cb0a0da5478b3153b3251707c85008ca68effd291e61b5646c1
MD5 117d4c2b7c4fe1e3cc6becadc726bbbf
SHA1 a29f5527db1c0c4125c1ca126f9eb94b8a44e2cc
SHA512 9b3a28fb9f542e39b574df750a65ee765722cd95efb9ac725447053975b7db7b23111754a298757bdf474fe6ee39211ef6c3a0a78b0d07ca8cf9a6e1ffe70dab
SSDEEP 24576:KZMrzFVSOKVg9N9JMlDlfjRiVuVsWt5MJMs:KZMrzfagFIDRRAubt5M
TLSH
T11C8501A9739018F9DC67823EC9628906C7B27C5A17A0C60F03F436665F773A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 ee1486ecdce81c6470c941595d8d89e7aa9567b32f9426f3cc35aa0f11c01768
MD5 490d46ff69ccd6566235ca551ca035ce
SHA1 465e30ee9578ede8ed0e1a6bb702e46bffb38f3e
SHA512 e76bec4c9116cdcc5c3cdbf63f0bd17b357ff0bc98f86eda552939d9a590597b9a8e22c82200b8424b4689c4b9f85588c33cc9524b54bb562e69534729e5b2a9
SSDEEP 12288:XdV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:XvVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1CE6523AE754655F7C51BC2B1CA735389CF266B5E72C68147D2B00891DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 244fe497b9593685eaaf038660ef1ab0c70de1f083bcc979019b768ea697ac60
MD5 3273ba242e62ee14030e84bc8cf581df
SHA1 58e75c917563ebaa611469ec3868920b87b32531
SHA512 b6d3e3f36f9f2d95bce76f60a0f00a2de88447a18a78e1a3648f0c10d7cd91de9f3c794c748879db3b0cf0576d5bbbc50f7cfcd6be0a6d151fc0876864d6f7ed
SSDEEP 12288:mBV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:m7Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1B26523AE754655F7C51B82B1CA735389CF265B5E72C68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 0d256fbd07d9785896d36317dd904b7b10a9ad94b0a7309ca5c0d6276982c3dd
MD5 99831842eb92ff039bf8526e0390e729
SHA1 0513a4f99d1e8582b8636d6b7fdb291765b471e4
SHA512 942e3a5ffec2780d99b6c3bd9bad5f8f5c6c22c381a77530d52380eb024cac59a3c0590158d3d2e17271c69bfa7422ba6af73912998a4f7bd99341aa097f2fc4
SSDEEP 12288:/yPz5L8WV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:yzyGVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1EA75125B73A130F9D1378274C9621A02E772783617608A9F53B006B65F772E1AD3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 972b9e4933076993aa02f8d82653342199dfbbfa38d8b353a8c85067b6270f50
MD5 130766d2d03a0b2450e676a8c82abdb5
SHA1 3579ffb2776297d03c06c3772f06af14c9c1df3a
SHA512 fa0be8593397e03081300c09d9ce0d295d1ac2a3ca10d1aac17900e9e2319d7bf3e70879df74d86f355c64f2a56850de4b5142f8988d7bd6a3accc168217337d
SSDEEP 12288:4dV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:4vVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1856523AE758655F7C51B82B1CA735389CF266B5E72C68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 7601c2123fe784a2eb6d4955e30edf14cf60c0269e779da7cf2a3c11b429085c
MD5 efa5afc2a682e69d04dcd8477e0b8de9
SHA1 62ebd04de5e66c92551ce6d4fe3a00dfac344f02
SHA512 be647dfb1acbc94fbdb8b3aa260dbf1a41b2e16ba8e0ae85faa4d0a98479f5d5a531a12eb9e814a6cb13935c00bf04a505758dfb96248696cfe198db808e7c21
SSDEEP 12288:4dV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:4vVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1576523AE758655F7C51B82B1CA735389CF266B5E72C68147D2B00491DEF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 789d565cd6c97b0d590bc4e5f59756479c200fe8eacd7216c833971f4151f828
MD5 277b01455b2f97e07dde3a46c922e949
SHA1 4d3c312de96c413ce901a7cdee2a428b0be1e337
SHA512 0af5f178e125dff568565cb795c8a378936a0cc3a4a83c5b6fa9bc9e80d42c9a1c28105755a7341ab127925a85fea73ff42ed2d64b6c48c5f361fe09e327771a
SSDEEP 12288:kyPz5L8WV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:9zyGVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T14975125B73A130F9D1378274C9621A02E772783617608A9F53B006B66F772E19D3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 c6f4d772c55a6a60af805d50f2bd8e4aca6ff625e752b733a6be56f2551b6ae2
MD5 e84b2728bd579b7a9813f275f23424c9
SHA1 24372c19ccb48bf982c9f5f92b8d9a04d133cf66
SHA512 aec8cc3fc830e8faf1cf106e639617ad44bb1a433fe555a5005cfda81b352f3257289f9494b93e1d6534b4cb55243a570c8e4cba836510110f4505c78ccba0e4
SSDEEP 24576:aTxaLl3z0zDEVg9N9JMlDlfjRiVuVsWt5MJMs:aTsLljbgFIDRRAubt5M
TLSH
T16E8501A9B39018F9DC67813ACD628906C7B27C5A17A0C61F03B436665F733A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 bcfd5b3b2bed8abcccec6aa6c5f7aff719018a32383ef6790d9637509e2cece9
MD5 444a02a83304979d6a90545579a6496c
SHA1 70a72a63b229567461aa75bb1054df1cee273edc
SHA512 6b09a590cc093adb56d6ec38edd0e57d70965db82b0732ed8a1715228585b8d1542fe9fbe1588998f6d353875977b07dc1d267968f141a5e4e96404d6d0b0b91
SSDEEP 24576:23Zd9CHKy7GZIVg9N9JMlDlfjRiVuVsWt5MJMs:YZd9CHKyaagFIDRRAubt5M
TLSH
T1CB95CF90F3E414E9F0B7DA35C9725602DA767C9A1B71CA8F03A4265A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 463d95f287d247a24db1d9a89154092b00aded97838d11f27f4643ddb39e7061
MD5 93153ccc159686853abf10282c384b62
SHA1 68d4c1a492d4db9220112044d54f60d9712c8780
SHA512 3371cb10e7305ecbe1481cf37f5e74b61f390da9081f0444a982801bf45ea12901c516f3ec60d75e4e07aae7ac1d787d9673a7af17b1435d16339328fd8530ed
SSDEEP 12288:aYV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:aUVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1F86523AA754695F7C50BC2B1CA735389CF221B5E76C68147D2B00491DAF81A1AC1FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 bc68408bbe1ae5a6bc644446cb85dc783e835f81b0e1625b2a8d96749bcff41d
MD5 91ab8547b93eb99c132cf6b8f5d540fa
SHA1 f9952bf82afa7efde9cf40b9e3a9f89bcb7d606d
SHA512 3b596874225419d1265c1f0c32933e88ad805687f6659dafc3de47843041565f6cede72abacaeba2237ce9420a18bb0201a56baf6c95f8a89efbb05d17082e1a
SSDEEP 12288:M2V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:MmVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1E56523AA759695F7C51BC2B1CA734385CF262B5D72D68147D2B00891DAFC1A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 9cf26531a82365638c45cf4f3256c81615efcfe6d8fdd4fbc9f34f7734a753e4
MD5 cd2bb28e99729cb1f0dc910a87475b1e
SHA1 855ee4727baa98dab8e73982217e68b0ee1e875a
SHA512 6d2cb794e2be3de76e416978af0a1c1026c9caaffd2b6cff6ef799d5cca13b635dece0e6ad43dcd4e3c2c3d8ff61c1de1680f6b7e164bd636144962847c3394f
SSDEEP 12288:AzV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:A5Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1C06523AA758655F7C51BC2B1CA735389CF262B5E72C68147D2B00491DEFC1A2A81FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 6041935ccabb336ab888fcd814d6d397dd5971c6229e0c603cb0ea45a584ddd3
MD5 59ac0f5db5703de4072fdf2b9a9e0fbd
SHA1 84488933b9ab0f2999ebd95bbbc8d62cc822b7de
SHA512 c59097021da1ff53358a38a3fc27d5ac8c2d802da3d04a7ef4fbf7464e1a3620e6d09cbbcc6a3289c26f94edf2ab2e9950b0e1bc85694928fa4b5ab1741a9a9c
SSDEEP 12288:pdV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:pvVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1716523AE754655F7C50BC2B1CA735389CF262B5E76C68147D2B00891DAFC1A2A80FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 a99923a872c893382b4b1944c662e4cf0c47264a45120063ad24d700d0d37e41
MD5 20ccd4dd3e7452077e34cde9585bc5cc
SHA1 3b60200143a2eab858e6c6a86fdf7909bb1de718
SHA512 25f2b335330d6dd709caf759f49adce1279ca0c27dbad4c01462b81b9514d357bcc4ebebf9fea831effdb68010802a20a11f078af653f76a8afb3883a0abf7aa
SSDEEP 12288:HYV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:HUVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1CF6523AA754695F7C50BC2B1CA735389CF262B5E76C68147D2B00491DAF81A2AC1FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 23a1b77cfdf491186eb04bce0150ab6297c9b2ca6fb239bb9cbfc19639f544d0
MD5 0b77592b3ba657d5d859efaa91161dea
SHA1 bc43db3565041b1c105125982c49ef9cca565032
SHA512 8911e8300cb299bf7860a67d01dbe6f3bd46a7fd94866f09b1bb7389ac5cce0e2df17f42621c869b48f3b34cc18fa733c6920a28f9028c4d78b69ddd374d9a28
SSDEEP 12288:vVV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:vXVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1816523AE758655F7C50BC2B1CA735385CF262B5E72C68147D2B00991DAF81A2A80FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 e40c6c77ec693f2d4b4ed0e2e8b6d64f968f68a2f06d9d6ff76560862e21d0f6
MD5 1e56efd3e20479f4a49b55a0db00902c
SHA1 2361e7f92c6943eb8aa451f98163441c8a26939c
SHA512 60494a579d25aa2400b842d830c4d5e5d0b813c0e3a5deba841c6372b3cb11cd34150cfa8e22c6276d1135004f91266f55957aec9b54a7109d2ef30f53023b08
SSDEEP 12288:enV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:eFVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T12E6523AA758695F7C50BC2B1CA735389CF262B5E76C68147D2B00491DAF81A1AC1FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 b5c61fd6a1b94c5d0db9653010ac1d2a0e59b1f7899dcad860d0dc1df849b653
MD5 ff42aa415b23f4b05f4003b7f3a5db19
SHA1 4a64df4624e3bc357c57810cbe66b27c535017f1
SHA512 7f7b1e4b1c9d754fa9a8b6c8d511200e8977fe1cb5dc0cf89f680facde8a5f8f4f8dbfe81ecd8e262f15259a8dc52c57a1c037d75fb7146dc22de54267ed5703
SSDEEP 12288:MgV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:MMVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1F76523AE758655F7C51BC2B1CA735385CF262B5E72C68147D2B00991DAF81A2A80FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 2f0af5666cfa06db0e69c018abc88eceff72950e006609001dd041a760fc7c0b
MD5 f6866f4d3c528386bbfb5871d2e61c87
SHA1 fd559c43c44b76d189de0f342a60f2c981d45de2
SHA512 5d6acfe2107cdf0617309a0d948269cb2f9a67642738659fb38d4f8eb4dd9fefb630f267ef8e3b0530e267125eb81b630a40ace5724a26e655ad4c450744dcfd
SSDEEP 24576:sfwv2k9RX6wkyAIrVg9N9JMlDlfjRiVuVsWt5MJMs:6MnYIZgFIDRRAubt5M
TLSH
T1A695DF29EBD844E5E177923CC9B3460AF6B178591B71C2CF02AA53AD0E37ED06D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3e7381d77fa6ce4d99e1ce2064a211f80ed5bbeba28419c4675cb6ff251c0f6a
MD5 aa7ba0fa4575a501e9606ff3ca2f5a46
SHA1 436ef51f1bd0eff58b2bcfa6a5d9e943daffe8dc
SHA512 1c005c90606bae20915ce56bb805e0cf6e8a83663f2dbcf50259dffbd438b4399788fe837f8f216562e3a30293588b1c23531cde43bd26b6cf149f54790e4151
SSDEEP 49152:qYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0AgFIDRRAubt5M:RySzPFUf
TLSH
T1E6066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b883ddaac1f72cec59798ce09cdf731ded1eb3dd48325b7dc29b36835c9d85e8
MD5 3307d58103a4169ed79c4d0818c41cb5
SHA1 2d7f8b168fdc62a8b191a94342609702a87e6dad
SHA512 5e8ddc2566bed622b564d1a019cd74b95f197bab1336c6a75a4e04e198807213a38a825c6464462a9979c2b20d302644a8b841b9ac451a886450c6df63cfd649
SSDEEP 24576:/47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY6Vg9N9JMlDlfjRiVuVsWt5MJMs:/47JUQjTirIhCnDHUPfF/wgFIDRRAubE
TLSH
T15D65AE1EA3EC01E5E1BAC27885154A5AEA71742E2B31CACF1270437D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 845aa5424bd1d7ff5ea8040db7df063fec2f662a4dfc7b3bd15ef3e51ac122fc
MD5 935e502139f500817f07f5086e75239d
SHA1 419699497c421d1e05a3baa22e184a73c53331ce
SHA512 35957305a5ef3320e0af6b6c11d86754f9cb1b2ec044dc5349bdec9826da95a8923d9b2ad06753f483b2bbf23e627c962723663d9dc831f7e2d1f8bcd7dd0df8
SSDEEP 12288:rVsfNV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:w/Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1B275F15AE29402E9C06E9275CB524641F7333C2593E1D3CB92E0F57E1FB92909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 920KB
SHA256 c3262106fef3d9e205ede9215ca8be46359b17cd430b62cefba796967c853864
MD5 d4c6bac62c04c322d12e318f2fdd2e69
SHA1 fb06c4743af750fc3a16a0df92cba634999d546c
SHA512 ffb5563cabc02875f88d41ac0da8bf91c52e2a9321eaf788e257f7b4e9492d76b49d963b571054e62263fda733bf0f3df5cf4594d08102affab863d34db6780e
SSDEEP 6144:tQsBC2nau7grEFaCgRZotMxnXfnU3fpkGlTAXVbMcVD4qIHIBMaAkPGmcWPfiwJL:thyzLU3fMMcVD4paAkVcYfimFogVn
TLSH
T1C4151850762AD75FC6A940321E33C2CCAB707D41EE059B0772C84B2FC57666DBAF6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 342KB
SHA256 2c3e6344c7257ef1bcde80f7909acf7d7772263238a051e636891fe72aa24c84
MD5 2e9428cea938ba4509f4b0b324e708e4
SHA1 67116ac1c9066741eaf716e18d4b8c8e3252a024
SHA512 eb30511df2915a253abdc9945d0db2571e3b716c08bd1b76e3d5d6e32156aedc898f67bbe549e4e936a563f7e8687c4587379fdf398497238d7049e501127700
SSDEEP 1536:RskjSIXhMIY1Tkku+jN/sSBSoKOe/iKOQTiKOaYiKOSC2:RRjvXhhYKe7Q2C2
TLSH
T13A74A611B758B32DC0B2807B8870D5ABAB7DB423CF2392023BD51D99D8F22967676F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 9f3ed8d0685b9e272db6045dd7e4d845b26bd06a271e77fc110d22c2103909c0
MD5 6c1bffe2ac9dd8a86a4d29d71ec1bd8a
SHA1 a56213ba4a8f7c876aaf124a39a5b6a90d104748
SHA512 4055327eb291e3cfca37d8feedfc4349ce368e42759c2bbb945671b5083de945a8523df277da622c5203d2111277edfe310b7d5b655b8af1f8b89a4973e3c84f
SSDEEP 12288:J+7FV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:MnVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T10265237A768999F6D46B92B0C97383058B2B7B693B8181C7E17005D199F81D1AC3BFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5379a8563cc0fd198507e037fab9ea642e61382dfb4804e324c4271f5a60618f
MD5 6d1657569efa88a5361e211df2d38c09
SHA1 3f67edfc910361898567c115fedab1541113f957
SHA512 c3ccddae1d44a6719a5c4b248f2b238421e2571537185a80649111f24145b0ffea4df64c2a08baa990aa188e38b14ec1932af16c8c82e3858905d752441caf46
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bYRVg9N9JMlDlfjRiVuVsWt5MJMs:xgb4mBIBhGFGgFIDRRAubt5M
TLSH
T1A565AE1E22EC02F5E0FAD2B8CDA64417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 51f6dc84001fee35e5dda06a393972e5c2e528e4f61969ed87df97387edb7c83
MD5 f527cef814ede32ac4be77989e3a42bb
SHA1 616318556b180e352725295e63b1bb83f54b3788
SHA512 625631e013da7b0bd87c6479ec5f3130fd481de41139a89698b81039741c2a6fbabd8b5664f6a9b4697af9b61f7ef1d3d991b514bd39b7775d7b24aa3784a093
SSDEEP 24576:VG88u8FpJqH19zria7/mKVg9N9JMlDlfjRiVuVsWt5MJMs:Y7ZFPqVka7/jgFIDRRAubt5M
TLSH
T1CC95F16576E101F1D47BD138CA924663F6B2B8251364EBDF07A88A511F23AE14B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 164bca13044ba83eea8b20f3407fea9982d5b71b37f99f55d59ac5b6ff099325
MD5 94d9a2d5d92a290d1e74b48d7dd6d9c6
SHA1 09d7cbae9bd2e51d2310a7112f420675eb2b1ee8
SHA512 d3e2a8769428fbdba85ddca17865fce4ce3d116f31bf2a11b1ff0cbc8db9c282566add6d1f8c84bcee60d30d19b5a6aa5fdccdcc64e7e576bef92c910015f447
SSDEEP 49152:sBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjqgFIDRRAubt5M:PG05lO43bmUf
TLSH
T164D5CF6E62EC11F9D1BBD17CCAC6460BEBB23415033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 980018f7936f9ee9fbafbd992940340279e52ef23efc9ec565fdd83b4984a5bc
MD5 519d0cab63ffd8d6cbf0d736c117f1d5
SHA1 c4596e5d1c36b44ff5c5da19b261f715496738f0
SHA512 ce5069a53ba413441b376752f923be5e388cf96b11707b14663e04ad57aa0d7d5c89d17809b846b6b4c33dfae17debb2157b512b7bd2cc062420824e05872ccb
SSDEEP 24576:Ffa5POZ3dpuWVM50JicR2hG0lasx2+47eidnQVg9N9JMlDlfjRiVuVsWt5MJMs:Fa5POZ3BJt2pasx2+migFIDRRAubt5M
TLSH
T10865BF5EA6FC01D5D5B9D17DC583460AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6e79acd5abca516a1a1139e1ad0c6ebc0ce5cbfb0f5aa19a0cf1209b9b9647e5
MD5 b1728d0b49f6376e2698482203d4af4e
SHA1 d332d3d2eebfc4b910179023a34292535d4694af
SHA512 b45c798b21b3cbf8f874a0fe14b767825b62073a3edf182e685feaabb91fa4f3e5110bf64b6530687621e87cf4a5f305bda2813336e0acca4dca9e4b1523da19
SSDEEP 24576:fNcwHdjbyQ4nLC18lb/EOjowL7FkiVg9N9JMlDlfjRiVuVsWt5MJMs:fNc/zEOVHFDgFIDRRAubt5M
TLSH
T17D858C2623E901E4F5BBE1BE89779546FA717869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0d2bbc0af1f5a175de8f3f403e1fa0bcb02d31665ab56472551225984b51c10e
MD5 d0409b170e50d5bdeb874140b71da30f
SHA1 2d05b6ed585a300d83d444d30013bf4229731e8c
SHA512 8ad392a65abee4fefd237bbbb8cbef54749cc0fed115dd4ebe5276b6f6dfdbddc4bcb2fd7f06911a771a71412eb738c8915760e1f33373a53a46f6eed79516b1
SSDEEP 24576:jTkNvNnaFeYhJNtmZBmXVg9N9JMlDlfjRiVuVsWt5MJMs:jTMwBtOmFgFIDRRAubt5M
TLSH
T15355AF6EB6B806E4D1FEC6B4CD238512EA727461173293CB5290C13F4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 f86043f75d104ead4eb7393d8e440f1dd28cc04a722a0da830be2022029fabd1
MD5 ff0828c72359db5b55e84daaffa184f6
SHA1 83e20e8b4f647b2e1cc82fdeeaadd9485249cc70
SHA512 be024657b2797ce5f3efcb9d46a88c540dbd297b1fa847f51a304c872a04a06b12fd7669a80bd87b9203e393b975b5ce09261dceb179a3452078256144df61e4
SSDEEP 24576:PPUr+NQeVg9N9JMlDlfjRiVuVsWt5MJMs:PJQagFIDRRAubt5M
TLSH
T1AB85E12F32A918E5E676E17DC9824709E77274621352D2CF02E0417E4F67AE8BC3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 6ec23896c9e369106b1429346dc3bb9b851651b0236c6e789477b819a5192a4b
MD5 241d4c387d8f7e63ea3e2fedbacef55e
SHA1 9071b591f8613c0a742463e2ef179933b3a23eda
SHA512 856c292685b85f8d6339423198fce4bcf76d2240d1e34ad91fb4dbe3ac7233ae2f845560dc9ea40ebae213f857efc4d7f796c8de40a19be7d3d5ec6e7a52eff9
SSDEEP 24576:lD3FHshBIYQgAjVg9N9JMlDlfjRiVuVsWt5MJMs:lDVHeBIAARgFIDRRAubt5M
TLSH
T15E95E17EE69C04E5D57BC1BCCA638606E77138A9032256CB02D081B65F6BEE46D3EF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1576-114-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1576-124-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/1576-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1576-121-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/1576-115-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2400-109-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2400-300-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2400-103-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2400-101-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2504-306-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2504-138-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2504-132-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2504-131-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3536-299-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3536-90-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3536-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3536-304-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/3536-302-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3536-301-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/3536-89-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3536-96-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3608-67-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3608-68-0x0000000000A60000-0x0000000000AC7000-memory.dmp

Download

memory/3608-73-0x0000000000A60000-0x0000000000AC7000-memory.dmp

Download

memory/3608-297-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3756-293-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3756-63-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3756-55-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3756-57-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4488-328-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4488-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4488-84-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4488-78-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4488-77-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4488-298-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4560-7-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/4560-0-0x0000000140000000-0x00000001404A7000-memory.dmp

Download

memory/4560-1-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/4560-8-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/4560-40-0x0000000140000000-0x00000001404A7000-memory.dmp

Download

memory/4560-39-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/4616-325-0x0000025669970000-0x0000025669B3A000-memory.dmp

Download

memory/4776-16-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/4776-113-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4776-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4776-21-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5368-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5368-160-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5368-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5368-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5568-44-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5568-45-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/5568-51-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/5568-268-0x0000000140000000-0x00000001401AF000-memory.dmp

Download