a0f2c894d3fb82a1aa5fbd23086c5441c0cee5a63ce373e27c3cd3c6d6a3d396

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_7449f4c925c27eec86dd3dca8ce94509_cobalt-strike_icedid_njrat_stealc_vidar.exe
Size 12.4MB
Sample260908-22xy7shp21
SHA256 a0f2c894d3fb82a1aa5fbd23086c5441c0cee5a63ce373e27c3cd3c6d6a3d396
MD5 7449f4c925c27eec86dd3dca8ce94509
SHA1 1422109d907a1b4ec969544c0645b41ebb20c15d
SHA512 b0755d5f7c8bba8634b8d402aa83a45c84fc8398b2c91c2cc8bbec1e38194d00c47b52145793d54fa97881d85c48394990b7683a7e6233ba0b4672ccb4deecdd
SSDEEP 196608:Ht3mhWYx91dk/2NI4qt+ogz9welT9j8hojDIg9Cbk/VMawx:HNmhWYvKcI4qYo+xDPu
TLSH
T15AD67D4A62E901D4E0A6E078DE1AC50BD7B2BC10033587DF007A7B5B9F37AE25D76267
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1416	elevation_service.exe
4636	elevation_service.exe
2560	maintenanceservice.exe
4324	OSE.EXE
1204	PerceptionSimulationService.exe
3868	perfhost.exe
2932	ReFsDedupSvc.exe
1104	SensorDataService.exe
4104	ssh-agent.exe
1372	AgentService.exe
5608	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-07_7449f4c925c27eec86dd3dca8ce94509_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-07_7449f4c925c27eec86dd3dca8ce94509_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-07_7449f4c925c27eec86dd3dca8ce94509_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\68b4c3255387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-07_7449f4c925c27eec86dd3dca8ce94509_cobalt-strike_icedid_njrat_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-07_7449f4c925c27eec86dd3dca8ce94509_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-07_7449f4c925c27eec86dd3dca8ce94509_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-07_7449f4c925c27eec86dd3dca8ce94509_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d321df90e63fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c040c390e63fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001bd3d990e63fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000aa640292e63fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000051c0ef92e63fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1416	elevation_service.exe
1416	elevation_service.exe
1416	elevation_service.exe
1416	elevation_service.exe
1416	elevation_service.exe
1416	elevation_service.exe
1416	elevation_service.exe
4636	elevation_service.exe
4636	elevation_service.exe
4636	elevation_service.exe
4636	elevation_service.exe
4636	elevation_service.exe
4636	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4832	2026-09-07_7449f4c925c27eec86dd3dca8ce94509_cobalt-strike_icedid_njrat_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	1416	elevation_service.exe
Token: SeBackupPrivilege	2932	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2932	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2932	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2932	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2932	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2932	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2932	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2932	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2932	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2932	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1372	AgentService.exe
Token: 33	5608	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5608	SearchIndexer.exe
Token: SeDebugPrivilege	1416	elevation_service.exe
Token: SeDebugPrivilege	4636	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4832	2026-09-07_7449f4c925c27eec86dd3dca8ce94509_cobalt-strike_icedid_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5608 wrote to memory of 4264	5608	SearchIndexer.exe	103
PID 5608 wrote to memory of 5800	5608	SearchIndexer.exe	104
PID 5608 wrote to memory of 3188	5608	SearchIndexer.exe	105
PID 5608 wrote to memory of 4596	5608	SearchIndexer.exe	106
PID 5608 wrote to memory of 4696	5608	SearchIndexer.exe	108
PID 5608 wrote to memory of 5412	5608	SearchIndexer.exe	109
PID 5608 wrote to memory of 3184	5608	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-07_7449f4c925c27eec86dd3dca8ce94509_cobalt-strike_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_7449f4c925c27eec86dd3dca8ce94509_cobalt-strike_icedid_njrat_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4832

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4636

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2560

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4324

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1204

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3868

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1104

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4104

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1372

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5608
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4264
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5800
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3056 2944 904 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3188
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3036 3028 904 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4596
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4696
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3036 3028 904 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5412
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3056 2944 904 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 36e9f0ff1baa939ae93cfea75fb49811bdd0c0f1a1f60a96e28260befb53ace8
MD5 8fb5c2b71d714c08b0167ae9ae7e99f9
SHA1 9cd7d45c8bee1a67be8723684f8589a2ce975f2f
SHA512 0ee95339f0c1a0f2ab803fb7f860b1bbd3b6eb4ed20bd3fec0640f93d64464c3ffc5f4585bd6b334e868b9d7e5c6098753a113d25e7ec5ea5b5bf486c77188fa
SSDEEP 49152:db+632BuPkFKRrdE6ohdstBhuXjfS4LWxn6rXNY2zFiJ7IQsgmNO:j3q6mjBDXNeJ71szO
TLSH
T1B6D58D03F2DA00E9E06AD178D7469132E9A2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 5827af0ced54bdf84d9946a12207ed7fbbc9600bf445a1faee8528ead87d8210
MD5 5bcaf230c9b0ba223cd3730498d4c898
SHA1 67d98d8dd8c4e1591e7f449ba6268e0791700fff
SHA512 72dd96048ac0b0d46ae577580432f2b534c94d32c4151e012eb1c80734cbdcbfee857f4103141dd19bfa71026766b40440c3f15f9e4c6ddd0e8944b5e385427a
SSDEEP 24576:FXYfDtczATrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:QtcgrXNY2zFiJ7IQsgmNO
TLSH
T10F750168B7D108F9EDA7823DC9A28501E6337C554760FBCB03A49A691F233D45E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 2a90c28a6f86360b608257ff00754a95c918bd18571feac0d5a50e99ee17b1f3
MD5 83badd2312cd4ce84664f732f7ba5e1b
SHA1 42b765249caf84ecb268addee9412cacca501ce6
SHA512 4e7931c7807634237f1e5e82cf8bf5b8cae8ae8a0d8d22e6703f07c0345dfa9debe0afef6a7281a548738ef01c59794547b73912a075a697847c56caa317efc2
SSDEEP 24576:70Le5ji0hmxNrMGrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:7Pji0AHZrXNY2zFiJ7IQsgmNO
TLSH
T15B95AE65F6748331D073C0B9C5D2A68AE97130865B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3b5420aa2a1df7a03df61a9c3d02d90602a60eb4781bcfd9dfad238da3a40680
MD5 2aed83c06d54acd4ee1f9232f1e22423
SHA1 7260a9c23794523bde2c481ca2053cfccadd1970
SHA512 d4ee3aba37d82c4aa8bc853fdbf25cca5420c8668d8c9cba8ec2881f6b740cd1d8a132f684d7f9ee9b70fcd4d0688e8d6419e026a6f5d6d2c15a7a57ecf869c9
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWj6q8wyusrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLZ:G/ezSC6vUzPv+HjyFrXNY2zFiJ7IQsgD
TLSH
T152756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c24ba3fdb861d4a31e50c9eca095eec90ea4c5d04e95fc3d35da871ca6a40209
MD5 b95d0c90f4ee48ea948e2a83ad595bb2
SHA1 f578408d30d2602312a7864c8f67818826e2c7d9
SHA512 3f74021ef7fa899003d8841ca1b27be9cdb5cdc60bca25bf23d04c4cbb5fb07cd28f37023e077bf46cfc15774c4262517c277903bd3d8e24619eb2728fa9ee48
SSDEEP 24576:JVbqPb88hv/l+BbrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:JVO88hXl+5rXNY2zFiJ7IQsgmNO
TLSH
T11B55AE66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 928c1e178e90d1831dd8bfe791335235cddb70ae003580eb61d6ac74a4779221
MD5 4630088ad071fce87de604a63c9393b0
SHA1 8159517022a4eb3e05ec2646909151cfe90a8378
SHA512 1ad74d5efc59b3b937a7d9f407723e6e73ccd87387b5e9169e9512c41e2351b9ccd5e5d7e973d5756e1e18588e5e7c1928fc2351a53cd1a8eaeea713f626b977
SSDEEP 24576:tz6rZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:YrXNY2zFiJ7IQsgmNO
TLSH
T1755523ECCA4708A5FAEB0B33EA3B2780B5613C159D447C871E637BAC413C652A67D653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 99481fe776573af321819ee046f22e6f1cae71bf8b9bf0b70d41677cd5b17781
MD5 3fbecdb65920019bcc0e34fd0a754df9
SHA1 de0fadf1101027f48d74413bdd97c391c4b57ec4
SHA512 3fdc334f45ed53027d20a0c8bb21eac7ddd52f7f04a3372a8d253177786240942a7b2427fbd6a5bb65c0ba6e266660d55cce2f1bd79b38dcbafa90fe9dcb2a67
SSDEEP 24576:vJIUjrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:vJIUjrXNY2zFiJ7IQsgmNO
TLSH
T1C675CF7BEE28ECE2C27A8D795A518700E77278304F52A3CBD165830EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ca49fd79f58b7fffe96ff1ef2cfd563254305eb5d1b1e0a1377e39c84935a300
MD5 cf999733ceda17f32f8642e29b1c51df
SHA1 968b6664687d7669b42739ec8fcba409a1028258
SHA512 b799154f40dde7dea4351fc0d28e3509b32fba808069130494c5f47d7c10c3f7014895260cdd8eff2d72a7466fc6326608ef3545340968fd417d0d9c8a08af75
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THu:pQvGAdlCEL8c/WRNw5CgXNeJ71szO
TLSH
T18E267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 25a2d70969094ffd2863b06a02df6da37096bf45fd75a04c9cf615848f2c4de4
MD5 c2714880b71f3683fae67ff350386d16
SHA1 60ed6e09bf4c37afbd6e274882e51a37257b87db
SHA512 c1f5b602db5ac09400e8d7016cc0026a5ee2e3a46f5dab020c02dfdee9ba1a30909bab068576e5f3ef9ab8ad4b113c740cc3b5392b65a9646b273c3685993474
SSDEEP 24576:BTewsAjJrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:ZljJrXNY2zFiJ7IQsgmNO
TLSH
T1A675E071FE75E436C6BB0DB21B36C706683D79204F5129C3E3A89E9D49342D2237AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 da894367175bcdd12c5393d6920c9c1e281137414756d8f48d028dade71af382
MD5 68b0689903a70c12edb0149b1aaa6336
SHA1 748939df94daaca5c8a261f087e04bafd698bb48
SHA512 8782b8703128556d470d9774fe77d59a568cf3d88b2a74553c42b927e69c06199a63a2c347d46eb24e540572bf85ba07bbf5663d47ea7d8a18e5d58901625761
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH1wx:9UEtQevvqc2W1cpV20I321u
TLSH
T1C1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 548eb8767525d34a2347b9c147657740baaae0900d67e75f2432d57a4ca3a7ec
MD5 13e606daaac719d9979d5f51ecdaa303
SHA1 bc608e5d5812551d4114cac4fab5cc3a0b82601e
SHA512 a20fcf8cd1f124252a1238b690966a8f5eb34ab825f5ddcfc83f31a2fa140de699d179d9c2bd03dee538cae560af070d653a442ce1a7cee13e77afbf9eb6a6d5
SSDEEP 49152:ECbRquA/m2yL5zTfFiV+XenmE3/zprXNY2zFiJ7IQsgmNO:NoquVjnmkXNeJ71szO
TLSH
T1F8D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a1fb4e364f6171216354f9902854a46fbf2a6b3e75cad1258fa70fe2c8de4612
MD5 c1decd1025be75c4c4822ae6cc531156
SHA1 6226b09c3556b0341ebba95b37e1f5527f875e79
SHA512 55d9f82e5f677322b92b8f2aea06e9e63d65778d4f9921038b9cebf340d6e710aa7c8e3999817e79ba11124263d0144cadd686b9809e0d014be2a223cf33a7db
SSDEEP 24576:gAhGL6IFoiwtA5l7S534rZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:gAM5Foiq5IrXNY2zFiJ7IQsgmNO
TLSH
T184359D80EBF945D4F5F3AA7899B69170EA76BCA65E31D20F2150D21F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 a47eb01b3295c171c1323501bdeb2a74b114550e700630b8651d3dda51f69aa2
MD5 eb3c05299806d834e7b80856be9b406b
SHA1 cf4c9b5f4b8f7b7d844c0cd9e67483b2e1095cf0
SHA512 4cb7624c7d0ad4faded59d3d94f061cb3f5936523ab80e75f5e89d5b42a948a89d2d2ece617de7a51deb7e1beb1843e82465161158d1d52f4b79effb789513c2
SSDEEP 24576:jwuNOWlrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:jwGO0rXNY2zFiJ7IQsgmNO
TLSH
T10175F18976A50CF9E9A78239C5578131F7B2BC022A21DB1F1760C65B5F37361AE3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 23f3c6dea3dbe9d0c2307740d4be708de2a6f067f347f523d411939b9a5345e4
MD5 e0408ca890adedd03bd1b21f3d2c1434
SHA1 4c7f923949d07252895f63384a491a7a768224bb
SHA512 447ee5cf199df47126fa53dc89487787bd07e76eca782a58e381f95c4b577f3faf5aa284b8abcee6d713fad02a111f79b9524eebbd468bd2de9fa580ab58354c
SSDEEP 24576:kZuOrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:orXNY2zFiJ7IQsgmNO
TLSH
T1AD6512DD27D620F9E1E7423AC9B61640E3723C12673253CF1A2257A91F32AD25E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 73fd7efc8650c1007c93e3f0cdd3a030aceeec5bafd710c66dbb3687a2acf8d7
MD5 bd286735471a9b39f4eb370d0443ea47
SHA1 eec4ecb9b4c152e6b966e4e8712b03262ee401db
SHA512 674fd1cb5fe2d7a3123639256796ed52d9d19b005c64a975014237a4a052172acfec7505672fa4cbfb928fd22a59fbdd9d4145edecc6d0f2e1313dab91d99d3b
SSDEEP 98304:aQRQyi36YOcPDLvw2gAf+PN3zXNeJ71szO:RQyiKanX+PNTwx
TLSH
T120667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9df28251eb829ebc4004442e26d94585d6ab6578a59efe3e3d5d45885396bd5a
MD5 e9d7b69302065ecd619867121f07f8c6
SHA1 10f3ecf07bfbddd1005d598ceced62347a0263a4
SHA512 2174afd3f09c4d98b0f1729f0274a929355c81c62699796fc59cb42008238dbb0e31fa0deb507c8aee81d8c7774d4c10c836e63513634ee3f209219b1aabbb40
SSDEEP 98304:yQRQyi36YOcPDLvw2gAf+PN3zXNeJ71szO:pQyiKanX+PNTwx
TLSH
T137667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 65f75f29faee57bd615644a61530eda3ee213fbeb32542041c8f51204ed76ab8
MD5 7ec060fb422064b08e401f40bfe1d002
SHA1 559e1480b53b00706f9fc3a606548a7541539547
SHA512 dee1278c147a82ec6ed08c9ee337810fc5970525799b919eac2785fe3a8056e293e8d48497a51037f21df256488cef934ebbcdd0810da7977b85cdd2fdd8cb60
SSDEEP 49152:T68Qg55nhkeWu7PNU3/ZrXNY2zFiJ7IQsgmNO:NthTRc/JXNeJ71szO
TLSH
T17FB55A33B2F200A9C44DE1769F4A972196D27C758FE0E3DB851172161BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 837a17d8a6790e8e88116ad6fb78d8bc537b4d1832aa417808947425d2da10a3
MD5 a708c742e9e8aeb2158a8d0c9fea6f15
SHA1 026f05b68c5e417bcec4545e389bf82593ffd258
SHA512 75dd906d685db0f20ac857a0d95f6f1af094caffb9e3630703dd6e5bd9e7135bfddafe37a956e7bc305814ab3d3c43bd185e8690bca90b49d42a1657176c5ffe
SSDEEP 98304:Oy5112gYy5azzVvU69nLKnhZqXNeJ71szO:/LIHRWhGwx
TLSH
T123167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 69fa87bdc71deb1680a2abc52910a989a37c788978bbfedd8a62d94a6211e866
MD5 909c563425ce1cab606e3ebe3b63e00f
SHA1 14a836840926b57efe049f341b52de56858c1c6b
SHA512 8af73985ab2a2f41a6cf197a65a36e4affbf4432023336f50b771ef4b678664701e8021b34f1b816b1d3fe5da50916e94ef8a2584ff2abe52d14c9acf3f4671b
SSDEEP 49152:7B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gljrXNY2zFiJ7IQsgmNO:tu6JmIxd2d/XNeJ71szO
TLSH
T1BBD59D13F1DA01E8D06ED578974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e2a98e802a7994a41f44f0db3839ea292011fb04db554addf211925b462ed0dd
MD5 70d96d7bc050adabb1cfe7e8c0a27c9b
SHA1 98033455409bdef0063e02d5051e35881197563b
SHA512 bc0ecd0030d4d1baa961d20bc6f9cd718b80c22751f10b06b6aeca2cf5fbac9872a09f037bba3fa1b8df30af5f55fbcf85e1b719257a3d956e39e7f415707a2c
SSDEEP 49152:81hpsNoJpF1A67U44CwH7R4xDrXNY2zFiJ7IQsgmNO:8mifPqRkXNeJ71szO
TLSH
T1B7B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 256d4ed69c0bef2a0e15d0ddfd41bab866a0baf915fc098852070b88a931edc1
MD5 2d455bd93efdcc9bc2ddbb006e2b5efa
SHA1 8811519a5c513ee92b1a53913c02e6cbc42bac01
SHA512 ea9f07b4966c72fcf2f8ea13ff03a4cb072a1b1d7e7300369087b4f3bcd73414354c94f0c4f85a09026e9bd9049fa59f5f9aad82826743cba70601810abcea5c
SSDEEP 49152:USuZQIY0Be2KkRVtOnks6NMHqOrXNY2zFiJ7IQsgmNO:G5dKqi61GXNeJ71szO
TLSH
T1A3C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fecb6564f51fbd4d162e59d6c0b61514b2ba8aadc632305a3d247c79a3e7fdf3
MD5 9f74813d9d1db89494bd2846c17d80d3
SHA1 22898c909dd27057d8f9d47353aa987c93d62d2e
SHA512 25fe330e365bb565ce0433762f6ba416bac0e6abf92e01e42d12cc34d9966954916a2582cb37cf68925eff9a846a3cb7e6761edc59a703f62377ce77382e05ed
SSDEEP 49152:ehtSn8EApI0figjgiDn0AP5wXrXNY2zFiJ7IQsgmNO:/X2iWphoXNeJ71szO
TLSH
T18895BE13F2D900E8D05ED178C7568632E962BC160B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 3f7ff051932aceeff24a8261d66f36789fdf80822a6c61c95321b50ede596b80
MD5 cfa2d673ac2c34ee61807356cf57605a
SHA1 3f5c18ac9a9315ef6c068ccbc02632fbb15976c3
SHA512 fb8282c21f1d413de5219fdfad52e8042347445e368a58b2bc7d617859d6cb4bed0a903d5e0079ce3d2fbb8a7b08bfefaec4afbe1175984cc32b1d7deed36f9f
SSDEEP 24576:vCrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:qrXNY2zFiJ7IQsgmNO
TLSH
T1025523ECDD4709A5E9D74B33DA272380B4653C0ABE4538D73F2777284638662263DA93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 9503f59995ca533beb1b685738751c2e2ea7fea4895ad1b88b8b2b1e474dd24f
MD5 9fe3e693bf33e6d91c926385187a877d
SHA1 d1bfa5d0ce8ac920bc23489557c808d9b927ea79
SHA512 c27b133509fcb9d387b1c801fbae8d6e248a41550c77850705e2af2e167e2a040a983b994ec6c73c7639ace972387b138acc05cda13c80159efbf9056bc2034e
SSDEEP 24576:R9rZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:frXNY2zFiJ7IQsgmNO
TLSH
T1855523ECDD4709A5E5D64B33DA272380B4653C0ABE4178D73F6777284238662263DA93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 7bf907a5e7bddf8409fab0f4cd92f09fc2ee8024d28a0890c8af6903b9a7fd79
MD5 2b2f9b0b8673be4af8d998ef1de58bb4
SHA1 1aca3f72549410bce42c752f9540ec06abeb3855
SHA512 45a5f1bd64c34ee981556a509d35425dc3a68cd23d4546133083d3b263514c9c422c4bff7711db1fb399b6bec0325a4249add9812eff985c21c10bf48cde85ef
SSDEEP 24576:crrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:orXNY2zFiJ7IQsgmNO
TLSH
T1315523ECDD4709A6E5D64B33DA272380F4653C0ABE4538D73F6777284228662273DA93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 588e6f58345318afd5612e1d025fe6ad5351b0785d0e5c9ce6e176f4ba1445c9
MD5 3186fed6a89fe845e40a1d191838ae53
SHA1 ee896328c4a64ae7cf0e3378e9562463fcfe4364
SHA512 fb5dc070ce44b152cc8d23a2bfa59c45c9ef51f168115cd9e113019d48bdf0ff226789efb9d22fddc83bd5e1781a97129d814c316bef70a8a623dd4cbde5c119
SSDEEP 24576:yrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:yrXNY2zFiJ7IQsgmNO
TLSH
T1945523EDAB5704E5E8E7C736C9372240F2B13C55AB2169DF6F122A580E343916A38F53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 e7ce084da8bec06c5cf6c7979abb7d97bbcf09ab06edaf0d2197e87381aae0cc
MD5 4e724b465263663a463c7a387318db07
SHA1 ade173bee3df048fbf374d383e9311c9ab6b5a0e
SHA512 c8cec13a1e54362dd411b5a5d060d29e51626b70702eb4f6d39f5e64f52e89b732b899242e440307eebfdf0daae622a1bcacd8cb6d68c8eedb148080c043293b
SSDEEP 24576:EwrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:hrXNY2zFiJ7IQsgmNO
TLSH
T1B15523ECDD4709A5E5D64B33DA272380B4653C0ABE4638D73F6777284238662273DA93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 a339254b2d4d3e69ed337705034109aabe1052dd0d4d909fe2a8b0547f8fb31e
MD5 39b34b86e5f73dc41d23b10d25e010f3
SHA1 ef58418f293e58e23fc0b8e24cfa46525cf6493b
SHA512 8483a4e57d78d8ed8a7b7edba2f0fdd844cf757218ff06af22d7fd01a99facec57d842d495c9d3553e7d8e4f7521827658717a2d8bb7789899b646b271ff079e
SSDEEP 24576:QRrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:srXNY2zFiJ7IQsgmNO
TLSH
T1605523ECDD4709A5E5D74B33DA272380B4653C0ABE4578D72F2777284238662263DAA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 19c9baf651cc3c72c83bd0ceb25d9520130bed86577f934e25a100f715720fcc
MD5 77f79d9228f93d0f9c8ae81d325d0b06
SHA1 3a61449f911c797f9f0aa8abbfcedc387dcfe77c
SHA512 e6594224d008531c47d153ba0b7917666bec4f230ccf3e2a27c8f69fd3fe7718f204c773ff3dbf3a820b19f378803f13208e80aa2d969ee4a2f78f04f1a1f113
SSDEEP 24576:i1rZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:QrXNY2zFiJ7IQsgmNO
TLSH
T1C55523ECDD430DA5E5D74B33DA272380B4653C0AAE4578D73F2777684238662263DAA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 6fa1adb223be19fada896e9f0d7556ec0ec6d444f0192779eb468d1231ca1bd3
MD5 d662eaa974a28f6cc8bcea6be9825d09
SHA1 c8d9a0b6f6cca0a3be8b97d5a6ea5b4876410978
SHA512 d5a91dbd18782f94cb82af2c6a421f2a9e369fb9992db114746d5cd5188a5aa4461ce582873b3ad49f52a1fe881b91e6567319bbe2e3b3b3211898319df11e8e
SSDEEP 24576:vZM7zFVSOdrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:vZM7zfBrXNY2zFiJ7IQsgmNO
TLSH
T16E7502D8B3510CF4ECA7823EC9265905E6B27C1A0B60C65F17A4366A5F333A11D3EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 4631465eb1e6dd3717f691ac5571b5585cc9d392bbd9e439069c95cfd6eec67b
MD5 58495d9ee15920b94f99eafae8373045
SHA1 b02e6fcd3440aa8c1c43780f1f1a20d90d2d42b8
SHA512 f9711c3db144d3dea3ed95d4f8935192f523f20e922790a62dbcf71e4592545a7ca89ae77f364ace3e6f6d136c542ae566ff64a296b2368d4291be38a6e2250a
SSDEEP 24576:b+rZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:KrXNY2zFiJ7IQsgmNO
TLSH
T1E85523ECDD4708A5E9D64B33DA272380F4653C0ABE4278D72F6777284238652273DA93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 d0fb82d9bc63acee0b05612ad45a21279ea589b1c330decea42c1c61fa3a63be
MD5 cafa95b081dc33b711e69f5d66360970
SHA1 c782b9fd135af396354799dad9d8ce6de295663e
SHA512 79b97e0eedf4d23d5288e8265f2eb81e66f6708dfe32856f88eb3e077a20116471dbb4bfa8630e25a675f02abbe3bd371ac1f3d7c6fbbd4da6a2c55da264d927
SSDEEP 24576:GqrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:RrXNY2zFiJ7IQsgmNO
TLSH
T19F5523ECDD4709A5E5D74B33DA272380B4653C0ABE4578D72F2777284238652263DAA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 564d1483f0ae80b226bc08ab5f8b832849b9bf5e2fac5fd6d854945fee8a45ba
MD5 7e2f6c7fdcf98654a95ea756b9f1c6f4
SHA1 79fba380e51c1a45b58bcb9e0e383e0d4f1943c0
SHA512 da599b3c21d538f1d1dfe4d843c1fc375d1ccdcd29728d9089b4da0b76645df0c8cb12a82e7cd232990c6a2994ab4d199405d79aed2c98b06f30c8e307177132
SSDEEP 24576:2zy5rZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:2UrXNY2zFiJ7IQsgmNO
TLSH
T15265129BB7A220F9D1778235C8621A01F3727C364B209EAF1760177A1F277915E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 12d1c4681928bd8713d13448b7706b9f8ffebfb1810c3417bd6f299b64550d30
MD5 5afba1daace6077fd4514177fa6ae570
SHA1 f8e086ba67d3b55fa3b78feab77b8e82b5e03990
SHA512 8d8d021d2ef46a2355d18d6e164cf16cb85a98905aa35f9847b2600fab9cc66086e611888485fc90fe4041839ec76b0bb62413646da63e1af44aa922b0167db3
SSDEEP 24576:5+rZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:UrXNY2zFiJ7IQsgmNO
TLSH
T1495523ECDD4709A5E9D74B33DA272380F4653C0ABE4678C72F6777284238652263DA93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 d32ce44f0297e97f113dde192fde4ff0b9d6aae2a192c394ccf1a1d431214b4d
MD5 cb4bc07eb65c84b8c79ef747a0abaae4
SHA1 91e65ec559b3edbe750755c81cc45707b87b1196
SHA512 a04124da7847af86f0e63dff399015a47de9ec79b55874aa251d1d2580939e4106897198d1f50ccac0540f1e9fddaa12bd7ff0087e134e0e0b0ddcafbd686edc
SSDEEP 24576:e+rZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:ZrXNY2zFiJ7IQsgmNO
TLSH
T19E5523ECDD4708A5E9D74B33DA272380B4653C0ABE4178C72F6777284238652273DA93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 cc0ddda1af5b8c0677eb23e4969b90d0fb15cc8f19874bde1f175fc400a65356
MD5 97308f9e379a3e21e89b0cafa2042c44
SHA1 bf2d000d787db608d5e5fb38129a36d42d437f44
SHA512 012a9a700d7dfbeb406857d80803a4a3cbcc49b2583566b6c3b43326cd5a226f36f2f66069ddb321b0fd270144e74a342b68bbe1fca6c5ed121c923359abbce8
SSDEEP 24576:vzy5rZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:vUrXNY2zFiJ7IQsgmNO
TLSH
T1E665129BB7A220F9D1778235C8621A01F3727C364B209EAF1760177A1F277915E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 676b06877e5fdad1434353809381a1130c6f91245b0c50c4c0ef8fddc1412fb6
MD5 a09597dea247f29d72ff2be93871c862
SHA1 2ea5004e5d2d3a914ea11563bbb1de9c21d40ff6
SHA512 0e1b73245105c065159bf8e84ff54789877ee037add7fa349dc7d31c3536d938b75d518a61fecd538a8c0cd20a183a02d4e84419ef2009d7309f61eb749a5bb2
SSDEEP 24576:5TwaLl3z0zD7rZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:5TXLljsrXNY2zFiJ7IQsgmNO
TLSH
T1AE7502E8B3510CF8ECA7823ECD264905D6B27C1A0B60C65F17A5366A5F333A11D3DB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 77be26891a3c270eb2fe2ac70a6a43fdac63257c8a81203daab18b8ff901e218
MD5 7088b562af34022a00f28acd75c40674
SHA1 6792db56ab7c469ead1a0fbfc906c36d47c1a7fc
SHA512 0538044b3228c49176871c637500b8306139bb73c9b73a5e5082bbfe86c9dada32e4df0c1d715455659077657195e7a79e704a6e33bb2494c8f07f3d1c77a9b6
SSDEEP 24576:B3Sd9CHKy7GZ/rZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:xSd9CHKyaBrXNY2zFiJ7IQsgmNO
TLSH
T10885CF90F3E414E8F0B78A35C9765501DAB67C5A5B21DE8F03A4265A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 a8959993c099062d0f476263c1040029f90a1ae267883611980b63746250e4f5
MD5 250d963a80221b04e55a94878f5c8cf6
SHA1 ff8b1f4042f4f679b474ca4c37f609a3945b6bda
SHA512 16c42c15d7a803faa2d62f496bc6dc9a5dd2c82aa72fae8a7f1a45331c6fe7013eab54553afdd2565f13fa820b1c4e057d0746944eed2ce4535cf6bc26590793
SSDEEP 24576:rLrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:vrXNY2zFiJ7IQsgmNO
TLSH
T1EC5523ECDD4709A5E9D64B33DA272380F4653C0ABE4538D73F6777284228662273DA93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 cbda175379db9a2a7b69c511910645e07d980dd778f267815a788e766b998870
MD5 aadde79fd58453fa716ae41dd26505ab
SHA1 7fe23ae0e3eab57e524bdabcfe36d358e4280869
SHA512 dd87023e64b27b071769f7eded0d992152a1df8e7e98cf32b4571f6c1f1c871ef8edc4834269b8dafdc9ba187036c53b631fc4fdfcea3d891e4aa3750ab43205
SSDEEP 24576:DZrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:VrXNY2zFiJ7IQsgmNO
TLSH
T17B5523ECDD4309B5E5DB4B33DA2B2380B4653C0AAE4578D73F6776284238652263DA63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 c6ad65689ab3c561497cd77bc19d2897435242dd94c5d8d54f62bed511f34b2a
MD5 a9afe6d32eeecf7043261c10ec08ebb4
SHA1 b1ea32dadae9eaf2d8ea2d88971d689f24aebeaf
SHA512 adc37fc8bec786eac433e7f3fe8b2be2c7672905c2c7cfd1fa651a56105bc1e0ec4fdda8addde889623f8a4aa727191fab3a6617edff0a9442ea7a7672ca123b
SSDEEP 24576:wErZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:RrXNY2zFiJ7IQsgmNO
TLSH
T1815523ECDD470DA5E9D64B33DA272380B4653C0ABE4278C73F5777284638662263DA93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 b742a79a962ce3d041d32f27d662b573104ee7023030791b1d9c98282d8d4cac
MD5 5c9f7918ebd77dfe55521cf25a250b6d
SHA1 930f4382896122b9815f07baa02b663e09d7bcac
SHA512 d938f9b06ebc4c559f5fb278bf07f7c5287c6d4ddf2ce95d8c9a3fa031c37b070dfd3dcedd9917945dbb1ffac8d4d942abadc9fdcee43bdf8529c12ffc529016
SSDEEP 24576:N+rZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:QrXNY2zFiJ7IQsgmNO
TLSH
T19B5523ECDD4709A5E9D64B33DA272380B4653C0ABE4278C73F6777284238652263DA93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 fa1f489442b9628b0c9e4fd4eaaf76fa70fff9706506d6a0845dd25e88fd6eb1
MD5 cbb8f7557f108ac22b893d76e9451696
SHA1 945c6668d1536a93533cb68ef938a1554aa434b4
SHA512 646e23ff3a2e93c573a52a5c04dc9b7f4aefccecf967d0e5f14780f8f48d4909b48ab3c677b5327159c08294f84da3b4b102e2c4159789fbea83b3b4e2528442
SSDEEP 24576:nLrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:LrXNY2zFiJ7IQsgmNO
TLSH
T1BA5523ECDD4709A5E9D64B33DA272380B4653C0ABE4538D73F6777284238662273DA93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 3387f9adf631dbcc7c42c850662100fbcca27b760aa43a405945a024c626c5b8
MD5 21617f1576dd0e20a0d6969f404628ec
SHA1 21ca37f20338cb4e7937139039c903e9b1fb5009
SHA512 bc9ad4e1d9047499eced1bf0a83d70f497d47f721a97c5bbd4cbc9ba6694f5759f1acd9646fa7cd4408a63000ef896b9dd9b647cd82b22a92c06554bafdc1724
SSDEEP 24576:dWrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:IrXNY2zFiJ7IQsgmNO
TLSH
T13A5523ECDD4709A5E9D64B33DA272380B4653C0ABE4678D72F2777284238662263DA53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 726d7e1bd4ab27daadc44f8277ece75ac2d70d2699b95959b321a3c8fe4f3420
MD5 7d4776333f9ccec7c41e511302b286fb
SHA1 473bc7ef782e99ca04e633f73961957c5d481a43
SHA512 5d6202b4a9230da196057dd9724ab56bdfa26b6c73136b75bcce978c337c62c825a7869d3559d4542664a07d9d581cf5249c47a09c413f27687dd7f262b55a24
SSDEEP 24576:GwrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:PrXNY2zFiJ7IQsgmNO
TLSH
T1635523ECDD4709A5E9D64B33DA272380F4653C0ABE4538D73F6777284228662273DA93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 c46c1e9c0556833e41874951157a732c54d22f2a43f8bb6597646025232dde41
MD5 aa10a6718cfa664e56328edfcbed89f9
SHA1 85c82db7997e25ed2fe84ae3203b725367cc8a75
SHA512 8369c5801df6fe08b50cc4c13d93147c13fa6815b5149024505574a80837337cdb2a42a7f13519ca1c9c7113bc830bd5fd807fcdf95f82bf26d57bae7ebeb7b4
SSDEEP 24576:Rfwvfk9RX6wkyAIarZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:kMnYIarXNY2zFiJ7IQsgmNO
TLSH
T1B785DF2DEBD804E5E1B7923C99B7460AF2B178591B31C6CF025A53AD0E37ED06E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1ba967b2caf73ca2aff531e840513bf67d9071bc26f587f53278a4fac57ab6da
MD5 9549c84b5178fb7be8de2261f12346ff
SHA1 56ed635e7eacf044868775ccad166b01a199c05e
SHA512 de41b2af78009c2c2388eaa49f730d1c281ffee3501932b25fde4afa139a07a4f0cf59c52d397bb435408c374460f8c478f268344e90b6d196bbb997cffb4e0a
SSDEEP 49152:5YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK03rXNY2zFiJ7Iq:wySzPTXNeJ71szO
TLSH
T1DA066C96A16801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 865725d4633e7e1094aeb2a40d163a891e26f5a40bb4676baa86b3dd4aaebb96
MD5 1ddb5900becdb3632442b02ee1c896a7
SHA1 0a735c767ce2f76d305bfd5a1e707f40d42071b7
SHA512 5af7970470d772dde3896684a9645ba39d02d6d887f2494160ccc442e046d57f2893995c77272194fecbee592009ff80a407e9f16eaea974add0045943b809f5
SSDEEP 24576:v47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYNrZBNuX2Mwjgi18FW6/2q7vz30PYsq:v47JUQjqirIhCnDHUPfF/nrXNY2zFiJP
TLSH
T13E65AE1DA3EC01E5E1BA827885154A5AEA71782E1F31DACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 d7a86609824530e0103dd43d90f93c8ddca2cf445e3478eaeedc78d467979dae
MD5 c00a2f775fb541f2525968e3f6b4f81d
SHA1 e6310a4f5de0e97fc4e5e75d9efb4c28015434a3
SHA512 6eb0bdcce81d7c7cd1052ad471d37392171538dde397bc9f4f257f965a6990746809e4276b480bf5a737f59952a7337fc18b5d32c3d8aef9ee5ad6a226ee7b04
SSDEEP 24576:/OrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:WrXNY2zFiJ7IQsgmNO
TLSH
T1B865F199D29502E8D0AE5236CB565640B3333C2597E1E3CB26D1F63E0F396915EFAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 2f110bd9613e492d776bbe4c524cd4df45a52680e4177c9b952193b32e888388
MD5 ffe10925760c4d95a82f93fa6ee4b332
SHA1 4cebc950287c04a1b079c5a059353edfbe752b4d
SHA512 48a65002fa05f997c3a4d3435afa26a0db612a6a6d12b1059f4b2f89577c6f1b43a27530f36636de9dbcecc03c5b2fed7e129ef51a7749e0a9dc7cf057a7c697
SSDEEP 12288:XqvPMU3fhZ/4j+DwGQx7IL+4nOHmSne14fb/M/sW45:XqvEUPH/4qsGQhItncmRifb/MZ45
TLSH
T1654518417667D79FC6A980325E36D6CCA7707C01EE046F0373C9873F9876669BAE1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 cc4625f56ae31cb10be37b4be8ddfdaaeeb5064550cacf50004529ebcc6caed0
MD5 4dc86a90e3739edab058055b85e9ad1f
SHA1 47a1d39309f899e4b7647259764f5bb81da39893
SHA512 99b9f5c79d8b40558ab8942ab09031ebd2d53e55bfa32494bfa53ff49a44b1b1ab2d23e51dd95efb4e70279214b57392f3460e23e83510b6c702e36a0081f1dd
SSDEEP 12288:7yK9LRaWykY/LJCnel+Wa/iQ0Q/dRlqjmGvmoTux6Mr0:7yK9RIt2cJa/iQ0QrSmgkb0
TLSH
T179554940A5B7E35FC9FE9033523296CDAB745C06BB453F0173848A38986797EB5E2392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 a57e57f3457a467e866245ec63f31cc4d59ec1fb39a82e7ba75ac7446d941ea7
MD5 87564a8fca32f053ac7e358c724ff496
SHA1 67e7829168670731bf17308d23a0dff7eec9636c
SHA512 ffc6a91fc9b1080263a83582c3168de552c6e178ac4776f9adb9e02695be9cbf6895bf390ad667b0e78429d2b44157451a88b26681c39db0052361eff487f419
SSDEEP 24576:KmrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:KmrXNY2zFiJ7IQsgmNO
TLSH
T1C05523ECDB4B0D65F8FA4B32D52B2200B51A3C159F00A8C77E1377985538AD26E79B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0d2d5927d33a6fa729079287e72c4cde50b7f11d2767eedda0fabdb5da75a441
MD5 8deb9c9899b2a4aa3618177fbe1281d6
SHA1 a986fd0d120be9e247c4522a2d618cb0063843ac
SHA512 84eec4aad7c978db72ebc061ff824c5ae0e02f1d7b7a837b87b41f627ec9566a8cc35bd88ebfcaae9cebee3687827a5c9706a91f2b2a8f2cce363bce439d69e5
SSDEEP 24576:sgb6bmBIi49WNNFpg1rSvFv7bYsrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:sgb4mBIBhGFNrXNY2zFiJ7IQsgmNO
TLSH
T14E65AE1E22E802F5E0FAD2B8DDAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 d67ed06479c397ded1c9a2eb5b717bd808e0b5a88dd113daaec702d3bbe27f7e
MD5 45bf7f9dd1754635de9a12983bfd0e16
SHA1 891d58f7ba628f386c2beaf3772e620efd8b027f
SHA512 6e04989b946acb1ee8230651c52f7bcca3f4f140b8e355fc0e8d8c71e3ac6d3060ad905427e198e586a38ceb11e3fa41a19858e43419bdbe2abae60590c07812
SSDEEP 24576:1G88u8FpJqH1Tzria7/mdrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:47ZFPqVma7/krXNY2zFiJ7IQsgmNO
TLSH
T11095F165B6E101F0D47BD138C9464663F6B2B8251364EFDF0BA88B551F23AE10B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 2bb8277803c1afde6fa723a66dbfbe868582886dac59b78210df857f9d703b2f
MD5 7b2ffd491d13e754a5b4af2a89d85368
SHA1 b6d031adfb756e2c1a01d991ae4cda3f48cb2f33
SHA512 c598405e211d692d291ea15ceb83b37035f69c2b474599ff00bdb38e938730376351d70a83c10762af6b8bebb38fb16b509702d9cef0d44d593c6f3fb0190609
SSDEEP 24576:EPUr+NQBrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:EJQBrXNY2zFiJ7IQsgmNO
TLSH
T1D575F16E62A91CE5E676E13DC9424709F77178621712A2CF02E1817E0F27EE8BD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c29008cade641e1dda5c727c4a989eca7929febbd39d23c3e1fd0785c96cda6c
MD5 c6c7404c030b8bcd8ea51c3c05eb5646
SHA1 a4e5b429afc469968ba75e0d669f2d72eef3564a
SHA512 eb4d232e0b6e5be5a7c9704b58f5c1756aa163d2db9b61b340dc7a259be22b1edcb0488e4787ccf311beb7437ad78613b16d90f1e7ceb6e856df607370813293
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjRrXNY2zFiJ7IQsgmo:nG05lO43bSXNeJ71szO
TLSH
T1BCD5CF6E62EC11F9D1BBC17CDAC6460BEBB23815032556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 232e09c693a2b33d147e198620708beb750641b243d313fb52b1f2ef92889a08
MD5 fd4fc7d78b68cb61a5690feba464bdce
SHA1 29f15497b21a28c06397798a53aab5e289a8c49a
SHA512 b3eb9b02f695698f046b46e0ce891f3d0d65d1b066067ba0136f29a2042a3187a67d373f9865209e87372fd9eee19d3d3d51a0ff739b37fa281f4c1cea8b8457
SSDEEP 24576:Pfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn3rZBNuX2Mwjgi18FW6/2q7vz30PS:3a5POZ3lJt2pasx2+mZrXNY2zFiJ7IQ9
TLSH
T12B65BF5EA6FC01D5D5B9D17DC583460AF5B1342253329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 78bef1387d3e439a93b6b5af62cf3ae90e140e42f88e1fd908fc997b8854d84a
MD5 5c34bd2874a337c3bbf3846cf169bddb
SHA1 253e6098ba86b5167fad391e37c65bcd7f393d37
SHA512 668e7ae1a7ff7121107a0b89e4cff3c83fafa98dbb0692ccb5ff7e06198ddf8b42802a2be5dc319fa8211c6d34dccf2aebfa8faa3066f1ea52be1df1107662aa
SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7FkFrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYt:RNc/zEOVHFErXNY2zFiJ7IQsgmNO
TLSH
T1D1857B6622E901E4F5BBE1BE89779546FA71786513308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9352405f80816022ce80d096498b989e5c91a494f9ca205085bdac2b23c9948a
MD5 880f8701a838db98986b393f52ba0079
SHA1 4f26cc796c0feb8c37364377645f7fc4d5594e47
SHA512 3e22ab1dd4fcd6d8e37843e37743f6f1ec55e9f6381e74f81ca874fb5caca3d022050f08d4545c6e2b2d3c05ce32708401c52c5ec4710eacc63e7f7be561884b
SSDEEP 24576:SzkNvNnaFeYhJNtmZBmXrZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:SzMwBtOmXrXNY2zFiJ7IQsgmNO
TLSH
T17B55AF6EBAB806E4D1FEC675CD238512F6727861173292CB5390C13E0E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 b8707768f6cb0d012da1d726ddf6025058bfccd758b4ee9198dda58fd519c3fe
MD5 e93df74c7d062ff145746461677b4351
SHA1 20323c90d812f5a89e36ea913e8127cde59a9952
SHA512 8b794ec31cd3878f431e3105c9a8cdebd1b0debc14ef683cfa11854ed60c9571acee6a80a35807cf7c2651c280a3064546cb5456c7c155815bbe080f40e9c7d1
SSDEEP 24576:gD3FHshBIYQgAirZBNuX2Mwjgi18FW6/2q7vz30PYsKVmECYLyO:gDVHeBIAAirXNY2zFiJ7IQsgmNO
TLSH
T1B485E17DEA9D04E4E57BC27CDA634A06E77138A9032265CB069491B91F2BEE43D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1104-99-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1104-105-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1104-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1104-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1104-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1104-311-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1204-79-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1204-71-0x0000000140000000-0x0000000140186000-memory.dmp

Download

memory/1204-73-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1204-305-0x0000000140000000-0x0000000140186000-memory.dmp

Download

memory/1372-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1372-131-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1372-125-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1372-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1372-133-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1416-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1416-23-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1416-24-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1416-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1416-17-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2560-54-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/2560-46-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/2560-67-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/2560-70-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/2560-47-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/2932-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2932-87-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2932-93-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2932-326-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2932-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2932-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3868-83-0x0000000000400000-0x0000000000552000-memory.dmp

Download

memory/3868-307-0x0000000000400000-0x0000000000552000-memory.dmp

Download

memory/4104-310-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4104-112-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4104-113-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4104-119-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4324-63-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4324-57-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4324-286-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4324-56-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4636-37-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4636-123-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4636-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4636-29-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4636-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4832-45-0x0000000140000000-0x0000000140C80000-memory.dmp

Download

memory/4832-0-0x00000000021D0000-0x0000000002230000-memory.dmp

Download

memory/4832-13-0x0000000140000000-0x0000000140C80000-memory.dmp

Download

memory/4832-6-0x00000000021D0000-0x0000000002230000-memory.dmp

Download

memory/5608-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5608-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5608-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5608-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download