109e9fa70da1a675a5d3debebfee4c5964e4c25e071ad0fbf46b3192fe00922c

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 2.6MB
Sample260916-2bcwcaweke
SHA256 109e9fa70da1a675a5d3debebfee4c5964e4c25e071ad0fbf46b3192fe00922c
MD5 3cc48b7d006ba336d052437be84f21a9
SHA1 951ed8199a63c1cc85add9b8cff225f979ac54ea
SHA512 43423a7dc5e2c8c318758634a99a5bf940a5896c977026123dbddb9423e9296b7246a87fdafb7de0142e61086f490f6a8a11f17d52194e14561488a1b0231a68
SSDEEP 24576:FS4jiYlFAuBhvn/+r1DkVslkRHncZEM047gr1:RPX9Bh3q6VslBEM0mM1
TLSH
T116C5015473A80CF8E9B7C13DC8A28606E6767C115B30C79F17712A5B5F336A0AD3AB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1320	elevation_service.exe
3920	elevation_service.exe
3944	maintenanceservice.exe
3776	OSE.EXE
2084	PerceptionSimulationService.exe
4916	perfhost.exe
456	ReFsDedupSvc.exe
3476	SensorDataService.exe
5612	ssh-agent.exe
5204	AgentService.exe
2520	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\55b2c29df1788cf2.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106906\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b8c54662a46dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab4d51272a46dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b19f33662a46dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1320	elevation_service.exe
1320	elevation_service.exe
1320	elevation_service.exe
1320	elevation_service.exe
1320	elevation_service.exe
1320	elevation_service.exe
1320	elevation_service.exe
3920	elevation_service.exe
3920	elevation_service.exe
3920	elevation_service.exe
3920	elevation_service.exe
3920	elevation_service.exe
3920	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2504	2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeBackupPrivilege	456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	456	ReFsDedupSvc.exe
Token: SeBackupPrivilege	456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	456	ReFsDedupSvc.exe
Token: SeBackupPrivilege	456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	456	ReFsDedupSvc.exe
Token: SeBackupPrivilege	456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	456	ReFsDedupSvc.exe
Token: SeBackupPrivilege	456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	456	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5204	AgentService.exe
Token: 33	2520	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2520	SearchIndexer.exe
Token: SeDebugPrivilege	1320	elevation_service.exe
Token: SeDebugPrivilege	3920	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 4832	2520	SearchIndexer.exe	98
PID 2520 wrote to memory of 1216	2520	SearchIndexer.exe	99
PID 2520 wrote to memory of 4376	2520	SearchIndexer.exe	100
PID 2520 wrote to memory of 1332	2520	SearchIndexer.exe	101
PID 2520 wrote to memory of 5076	2520	SearchIndexer.exe	103
PID 2520 wrote to memory of 2664	2520	SearchIndexer.exe	104
PID 2520 wrote to memory of 3320	2520	SearchIndexer.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_3cc48b7d006ba336d052437be84f21a9_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2504

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3920

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3944

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3776

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2084

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4916

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:456

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3476

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5612

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5204

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4832
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1216
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 2824 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1332
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5076
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2664
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 2824 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 69741fbf19812ba4eef2c0d9f0f20396a8fe6fdc7de5064567a68f5845bbf6a6
MD5 3100b65ba05a02e64175a133d27f223b
SHA1 2c8b55ac4ac2d81d075ca28563a24ec6e84143cd
SHA512 6b10511392d601ce606759a845a0e9c6e9bedd3f0e3a4aea129d355c76c6280fd0567e6965ee91b193e10419dfd7a8f85af9dc8a3320425df77b40c70ec286a2
SSDEEP 49152:hb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnEVslBEM0mM1:n3q6tjBjSlBEM0
TLSH
T1F3D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 b2c89421efee18d5dfd4ae6f066507de7ad547648d98518d6a45ed5d03411359
MD5 215aa119ef0937ca9a393f2e18586bab
SHA1 bef5850ba272b78bc25b63995fe39f2aa144fbc9
SHA512 b0e8eab22fbfdb51bb3386a64ad6821c69844156807bec7628a27b7c54a84ae070c6c5e184f99134b215daa4d04fbcbdb6a6f573dc5f18b2ba2c24bfbaa383f7
SSDEEP 12288:p1XLsswWkxy2lRq2czAt9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:nXYfDtczA3VslkRHncZEM047gr1
TLSH
T10885F12473A408F9DDAB823CC9A28505EA73BC5547A0E7DB03E499351F336D45E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 cd2b1741e96df48834cf6495a7253fb5cdba89073b679473ee9dd4cfa62c9af1
MD5 0475b630948b031aff9d3e8b4630351e
SHA1 3cff40d536aa64720a0a365957c754dbeb524566
SHA512 b4a1fc8d534f50686c13382513055468fe51805d2c2baf459ef0b27baaf73d54c2ec376a1d734afced97ae0f48b1af97bcac65933e9be191482c2dca3d225124
SSDEEP 24576:p0Le5ji0hmxtrMsVslkRHncZEM047gr1:pPji0A7lVslBEM0mM1
TLSH
T1D9959E16F5788335D073C0B9C5D2A68EED7130865B308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 63783858bb5d2466181b3318e6dc6517b8e559eec9431059ea225984f51894e2
MD5 2c57e8ee95c893c4b11cefce8327a0a0
SHA1 70af184ddd588b7c86916309a12b4825c6e3112a
SHA512 c12fa3beed0a810dd3742c8f347b2088a76ccb884630125341dfadcd359c5771ec1b2df062c16b48fe8d34072ac8c9e728d1e30d92a7f708b95e2e5ab3afb2c7
SSDEEP 24576:9a7/ezSC6vUyDZaqgrvWx6q8wyu2VslkRHncZEM047gr1:0/ezSC6vURPvMHjypVslBEM0mM1
TLSH
T19C755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1dddd980785809e498174e6619daaacb8c27c7065857b7e001d42d033dc27671
MD5 db19f2bdd49d5a587b649a8bde1a7825
SHA1 84a0d6c7e7cf2ebe654722ddab47dfe153db5e4f
SHA512 45c2c322fe15b122dbcab82911b90eac6e821920760d54dede2737346ca376bb0e51ce6b2eb272fc6ddec8569d994b9807e60bfaecbdc2d4c075689e12a3592a
SSDEEP 24576:VVbqPb88hv/lV7zVslkRHncZEM047gr1:VVO88hXlVvVslBEM0mM1
TLSH
T1FC55AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 4de4732b7f28c5a3b08c484e2905433885bd388f4c9d0c5e649dd246c1a295ae
MD5 72d18ab3a69369b755ee557ae47c1631
SHA1 ce18d2d658c481a618270f2de980407c0b9e52d2
SHA512 220031c6cd546d4dc37bca17fc95fbe172ff9afe32ed8acb4ba08c9de159f5a98fcebbe2519dd36d1b2fa811c0200772c218f0a059c11f301901d339a60e020c
SSDEEP 12288:h0o9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:h04VslkRHncZEM047gr1
TLSH
T12D652311213C80E5D6FF82309979590AE86CCE24B8F145C3BBB5BF3E49799A2C571E83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 79f7951655cf22fac9991896a5059634f58cbeb791cb93e39990c0ff86b5cdf9
MD5 ce0502a17b6dcb7fea341c6d2ccc71d2
SHA1 23b1a9ec17e1d8bd38a53a374f03f8cd619dd885
SHA512 547e86f0efad44e01c0a675435f8cff1dd92f6de69cd60cf6a94ebc373ff764977412590f28f9976aaea0598d52727e87f5a1ef8627459682b246748a24c4d28
SSDEEP 12288:keBNUbTVO86Ux9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:kJIU7VslkRHncZEM047gr1
TLSH
T18885CF37AE38FCD2C27E8D785A918640E77678304B6293CBE175820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bc52117fdba9f401f7054954d8b71e2af07f87268cf6353b2ff3b6aedaf377dd
MD5 3468e01e89d676e07476ec4e72ebbcee
SHA1 02014b411f26a0250901fc6de04dd8cb6db6c07b
SHA512 e0f8d0036e2190890e8b2605037c9ae7e0ae88318806912bc42ae57e68aa4ab1f6cf2bf3cf5cef6719a1c595b873a30472eac67d7ce08716b07e1fba12f2cd53
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THh:XQvGAdlCEL8c/pRNw5CGSlBEM0
TLSH
T10A266C656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 f2c07b840f6a1dd18d9d6764676edb63a35c9962e55094e5b56f2479a9deb486
MD5 c7eed18078962a70fe511bc63f72f654
SHA1 bcf789468c65a5a53e3ef1f75763fef87c17e9cd
SHA512 5fba80f8485b058a3614cc4f042976c94bb5bfa548b5c5f9dd9120f7397756d0fb2e1c07adeb5cebd6dacc4dc02f161d9486a93c6b76248b560dd4efbad9ec84
SSDEEP 12288:1AwSfxL/2Dc3DDLLmt0LDQewsAjf9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:W2ewsAj1VslkRHncZEM047gr1
TLSH
T12985E031FA74D036C6BF0DB21B36C706547CA9204BA11AC3E3E89E9E59742D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 190c06a67f4f2c6bbe9fc7cb6e674f910abfd09195efafb2300fda3dd6ec697e
MD5 30c2449ae98b9b0fd7d660624a6e9c35
SHA1 3a2a1bf3faf4ce5d4dc8b9a12ca3112a53b30965
SHA512 1ec6b95e69929d00cf8e098070fe23bb5d4a601cc482aa2c9db6f511e710ce44183d75fb8aad1dcd02bc48f6c2030bb392eab5c8d9e2c8257dbcf63e16d714d7
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHk:rUEtQevvqc2W1cpV29I32
TLSH
T112474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a55db3e095143241cd9d4921745df341ad0c0b027bb7153993b18ae060d36e8b
MD5 ced2fb3f8aa4164dbc4b83bbee8f1550
SHA1 2ee77ea161fcb0cc79a226cc69fca0bc92e8b772
SHA512 b6088db5133130fa6a05520b99c6d02463cfa1607ece099d29bccd52512c9b7e7d4bfecf94fd36c3d81ff6151eb8b6de7aa0bdabfd7ec6fdac15579599e002db
SSDEEP 49152:bCbRquA/m2yL5zifFiV+XenmE3/zVVslBEM0mM1:EoqHVjnmqSlBEM0
TLSH
T1C1D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6d88762047c4566937cfe16c8d5f2f574d854101cb94672e736afce900e16738
MD5 2d96debe3fd9b130ebf3cfc1721814b8
SHA1 4baf8043b899877abf10a2fd50fa814c54054dad
SHA512 8f5794f4f7de9c02f0310b794f96e732488c89b636db95fc6a74cf8b22dd4e3bf7a3683fd7246eb834e3e7b8a3ae02eb15bde4a657ca568f0ac9ff51471b0559
SSDEEP 24576:HAhGLmIFoiwtA5l7S53KVslkRHncZEM047gr1:HAM1Foiq56VslBEM0mM1
TLSH
T18F359D81E7F945D4F5B3AA7899B68171EA76BCA65E31C20F2160D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 7513cbfd5c9a024b80c6db1625f392e9def9e3c2202e7b9b2196058d7c559dc0
MD5 ac8f19d530fe3ea494ca33db8d71719d
SHA1 2d67a2379468e4cbae93506952ca5e42b7ea9dee
SHA512 61f84f5272156e174923d4ffe540bfd8d5f1ca9f4b7d9b8169ee710fb3e9e27965919a8ffd49bb5f7d03ed8a90815206ff9b70bbd2b5ef3495c5fdd9da4bdf11
SSDEEP 12288:Ymw5HEjsChNQBFgl0WDm+CK9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:VwulOWJVslkRHncZEM047gr1
TLSH
T12E85F14232A80CF9E9A78238C557C536F7F2BC112A71C71F1760CA6B5F37261AD29B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 eff69a4c4e2a4360f6f5313e5674c3dc50bb115165454d7a8ba7ec440b0bd976
MD5 fe56ea6c40827178e4020bffef6e2281
SHA1 4e3df524af342fcbcfc389c15194c66c0911d980
SHA512 0a4539c1d3c9e68354b79da472ff4a05f18d1e0119098b11c9b828a35bbb33fbd07796dbe272d15e6f631d89dd7b1cc83576cf33b4fe46ef6fee2be15a0e51c4
SSDEEP 12288:UdZ1Iyv9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:KZuUVslkRHncZEM047gr1
TLSH
T10575125132B860F9D1FB8238C9F54609E775BC22277243CF26654A2A1F33AD25D39B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e6b157c61bb7196860d46deea7d404afffd385abf4d3d5ba3f09e8de73535aea
MD5 c86c7e146bbdd22b231cd34430fabfac
SHA1 3a2b616ec129c9caefa90481b6b78f174f985a43
SHA512 000daca7320f1095ab31f631329c1fe1308ed3a4bff1946ad40bfba696ca1356acfa9f6708a358c3447a787d3cbc7b49dd9db29fd0949a70dac0e1942fdd28fe
SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23U9:KQRQyi36YOcPuLvw2gAf+PN3fSlBEM0
TLSH
T1D7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0f768c64183f6fc69f0d78705f0c17e2551e5ec8db2892b8030a656616064781
MD5 3d97da408065edc5a73efbb4fcd8cc45
SHA1 359dd9655137e7c9e896176819c0df9c27397b0d
SHA512 a7376af21470d7d758f24cf6ebd4da627c11c99f1323cea17489bc502329988fa42be2b8f08c891f8232cb2b1eeca03c07d836d01e672d8ff78b587f951a7a84
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23U9:MQRQyi36YOcPuLvw2gAf+PN3fSlBEM0
TLSH
T17E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9b5c702f5e535a26da28c77b5c6db2162e77b35a7d161c58d4239efc9154c7ec
MD5 c94c172903a64531e6751fafc43b4095
SHA1 39701ae07ca11fab9798b529cd1d0662c39c9527
SHA512 987dda99f1e9fae6c3f725de650a4118247a41a0dccc3039eb80a1d7da34f4a5f2277dbf197f38320608b0022096822575acd49ca102836345dc4850d05d2647
SSDEEP 24576:RwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0EVslkRHncZEM04k:968Qg55nhxeWu7PNU3/lVslBEM0mM1
TLSH
T1A3B55933B2F600A9C44DE1769F4A872196D17C758FE0E3DB8511721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 da1c36a5190de5e1d6d591da7d951b6e1f2accc41ee6a6cfcab228eae9bdbd9d
MD5 3b9fdaef5b1afd5b2b46e274cb34fa88
SHA1 f994a5a62d6053670b56062742361d50989e5ec9
SHA512 45141d448fb51f7f6504f75bfd99ac5af5b6cf83fd964e5b1de61d75b9f57c9f36eda94ac1b2a2a510ff578166461993171e02a0dacc57906b8757a189ef5a5f
SSDEEP 49152:13aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99D:0y5112gYy5azzVvD69nLKnhZ4SlBEM0
TLSH
T1E3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e3910ce96153a16509f429b00724d5823a8918b1db77f98935506b003445a1a0
MD5 4b5a7f36d65d23173185bb27f9844ba0
SHA1 bf85a2596c7d134d16a7f3af455d6e77451291e9
SHA512 471b2e203df07cad652edc2f3ecb6afb64777e95539b591f167364a6a4c22ede01932350e12b64d49be02986241504089b8907457036c8e4c707083574369846
SSDEEP 49152:aB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glnVslBEM0mM1:Iu6JmQxd2dnSlBEM0
TLSH
T130D59D13F1DA01E8D06ED078974A9233EA62BC490B35B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 544be374cf22ac3e694514dd24c4fdb122aeddf8e630bb6b8786b0c85e22e42a
MD5 bfcbaa849ece4c9136dfce1a8f84ac1f
SHA1 bbfedb24abd3135ae3e58ec23a5cfc84781f37e5
SHA512 d0e91041e4259d2b915791c91deeea890dbace8981cf949dfa602972999060599536f937ed656e58a052e9841166489ea77dffa433e4d1df7f102dbb8f367800
SSDEEP 49152:G1hpsNoJpF1A6yU44CwH7R4xbVslBEM0mM1:GmifPVRqSlBEM0
TLSH
T1A0B5BE13F29900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d011eca54b4c41f9c0256474a6420967ed0c27f452b150e2e8b5bc07e11f451d
MD5 711a92127ecf7535810d1491e3fbc44d
SHA1 e060f7f3c50719d78cec504295b510f3bfea5ae0
SHA512 ecd447827a9d2421aa55af122a17f6a558d1f7602f8aa5e10073e60cc64ab7354260160689c2a4c7790630db780fa4e7513fe74fdcf590d1bca98b8f022e34cf
SSDEEP 49152:JSuZQIY0Be2KIRVtOnks6NMHqUVslBEM0mM1:H5dKOi61USlBEM0
TLSH
T195C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 acd54d96daf19daa118743682625286d3e7f5292c2a9145a9da1c99d7d80a8b1
MD5 98b605bf33e6511a4100111ffcbe2d18
SHA1 4af120dc1b52a9f7cbcec0c33063b3bb487790b4
SHA512 11721739da496267d1da525d036b410ad9275643befc1f49f1629891671438e0296749fcbbf89a0c81cdd7450661b59119e7a7a449529291453527bdbd620595
SSDEEP 49152:qhtSn8EApI0figGgiDn0AP5w3VslBEM0mM1:LX2i/ph+SlBEM0
TLSH
T18995BE13F2D900E8D06ED178C7468632E962BC160B35A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 03ee4f569414025ed68b0030fbaa1dc84a9dfe0fd0ad72e43ded7abd68b13a5c
MD5 25a8037cf5994435099436004782da51
SHA1 f32917eadbe0c7a0845acd0b4cc79d3457f6c96a
SHA512 927d45cce621271968fbaad8780f8dc480dfe403800242ab411de5c87854c35dc0b83243de30c184cfade29de6b045f2d3c7933d0d8893db7b073aafe751ad3a
SSDEEP 12288:KQ9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:KAVslkRHncZEM047gr1
TLSH
T176652311303D80E5C5FEC3308935164DE86C8E25B9F241C7BB6A6E394ABADE25534ED3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 ee1d18a5fecb7f348023044d53d939b44718b2bf174dec1e4fde6c5d741f7921
MD5 e6317c5ea414479af163dc9bff9a045f
SHA1 f7e98ae2db842a8810bac463ddde56589b019ee3
SHA512 71911d84a3ca5f84ad6846a7307734f388c6bd079fe5dcf3edf29c0b60d4e6c03b4f4e142da1dbcb9492a07097b55e39fb59f9350c2b507156bdcfd3461ee421
SSDEEP 12288:L79VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:LhVslkRHncZEM047gr1
TLSH
T120652311303D80D5C5FEC2308935564DE86C8E25B9F241C7BBAAAE395ABADA24534ED3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 90bcb0dba7f0e5f993f103396cb1ed94660e8655c38ffed4beb191d1a3a11197
MD5 048d427f09d5eaa454ad0f4b4b0a587d
SHA1 df0e1290ea7a55289d0396de2441e758ab39ebca
SHA512 a8120a3e794c4d6a2c3dbba2c4e54673906a724560321596e22ba0a5eeef4b932cfed76f7b1c66f2df40f2a9396315069501434d666606864de8fa2b555185d4
SSDEEP 12288:I59VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:IjVslkRHncZEM047gr1
TLSH
T101652311303D80D5C5FEC2308935164DE87C8E25B9F241C7BBAAAE395ABADE24535ED3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 09a25350abe395a4f2eb46e3b1ee5c35492fb2de21eed74ea3b99a21a3de24b5
MD5 a3e8090de56fd3c468e2a2cc2e0941cc
SHA1 88b9af8a20463f97f18ea68d32920965ad88cfb5
SHA512 c56f4606e26314178ce40f42a962b3695e442ef492d0921a467da4cc6a41fa054b5894d2c388fefd3c443ddce193e02e54560f4b3f5dcd28b59c8ffe8955327d
SSDEEP 12288:LVu9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:EVslkRHncZEM047gr1
TLSH
T157652311313D40D5C8FBC234C975520AE5BCBD25B6B242DFBB611E2A0EB6AE19934F93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 1a2e86624f7a3429e7a0eee1ef72952f9844492ac8d6ad9b85a96d300f0d4cf5
MD5 90334ea0b5cb74bbe437105a2546eccc
SHA1 14df47755427584507a555993286a68cef1d49bc
SHA512 bde4b8d7591181a6d919b9218aaffa38b78f4f61bce531993b3e8e44d55d06a6f562b951eb4229bfad4fa90f6f4054e3d5a1eeca12a3cc71e6a45caceb9db7af
SSDEEP 12288:Km9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:KiVslkRHncZEM047gr1
TLSH
T179652311303D80D5C5FEC2308935164DE86C8E25B9F241D7BBAAAE394ABADF24535ED3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 717f8642b81f4061f41ac0ea41a120cbeae6dcf59a6239e2a2927158defb20b2
MD5 0800a9a8f2bc1daad0da98cfe62db962
SHA1 f30283a80ff905d3e02dcfab0870866520deefc5
SHA512 e5aaaa00013b8897e2cd27b80e720d2b249698d795b53f9588d31e815757621427cbc77610d0358dc356949b02afb962e7d38498f2d5f9324073156e05057f30
SSDEEP 12288:5H9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:5dVslkRHncZEM047gr1
TLSH
T14B652311303D80E5C5FEC2308935164DE86CCE25B9F241D7BB6AAE395ABADB24534ED3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 fc50d0f202fafbe433f53622d808bf84ce26ab017dc39e412d04e08c2e9bf7f0
MD5 cef21cb2eb68f02a8ac193c4c4b94ad1
SHA1 66ab2f55b858e57ddca0cf7af9038f8ec7da83f5
SHA512 8025b9d835eb8dae383e82cd5a00c1b30a1b1c22724cb47c2de41b95913c1cd247f3a5f6822a7d896701951b48aa9081bb4968b4b73de153bf34d860d7fa3b5f
SSDEEP 12288:6z9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:65VslkRHncZEM047gr1
TLSH
T16B652311303D80E5C5FEC2308934564DE86C8E25B9F241C7BB6AAE395BBADB25534ED3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 f3a985bbdc673aa31b621ec400ae3e0938143c956650f637fca174c4e875610d
MD5 f926739048197918de22a60d08d3f959
SHA1 56a5f140c7da0a01cf4dbc6c5b0f55ed7234a81b
SHA512 f4c47b53ee87d2d395a4449708a9be8c52554115082b5cd9ca37f2c9f7ec4a32adaa6dd562cc8488572a77237759e555489a1a5595f72143fb7debd0d06a4820
SSDEEP 12288:eiZwbPzzFEoS2cPvyb9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:BZM7zFVSOBVslkRHncZEM047gr1
TLSH
T18785F191736408F8DCA7823DC9258906D6B2BC191BB0C65F17B4362A5F733A11D3EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 18fa5f14592e4ae2fd8652bddc6f30972ce61f5c33b0927d07abe9ef603d1086
MD5 b9737bedeb38ce04554054ae1ae2cb16
SHA1 10c62354c245d5081338a5034b802b5583648ce1
SHA512 05600a7a6dccbe6bb925a6ba140257523fd9294f2acf6f006241bc4d74e1d27299f74bd3a23263d13c560e2a44d71db6642bae8d40115d6b396827c388dc2fc5
SSDEEP 12288:1E9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:1kVslkRHncZEM047gr1
TLSH
T1D3652311303D80E5C5FE82308935564DE87CCE25B9F241C7BBAA6E395A7ADB24534ED3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 fa2fd62719f9ed48dbb2a5be6c53f0f667c132092bbed580cb9a915197e86bc7
MD5 33fab95f5ee76e340c836a4beb3359f9
SHA1 a1b8aa1e03089c40091a0a0af826812040e4f89e
SHA512 8e585b1796d64749deb47ef01390b2a761c2e8aeb8a59ca16cc908592e71499e3b81393421a1a9f567b14d79e02cbfc083477487d2ebfe1100061f26a54c27ea
SSDEEP 12288:/49VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:/IVslkRHncZEM047gr1
TLSH
T199652311303D80E5C5FE82308935564DE87CCE25B9F241C7BB6AAE395ABADB24534ED3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 e54d5f7d0ce933fbc49309d9c36c0e5ecd476345c3865f99837c6d397939cb01
MD5 505556bd20389a4d64a91a88cb9c3578
SHA1 6b6dcf6c8ec286a974faf9e2a389f9f901802d5f
SHA512 e162bbcfd279166d26fc7c7b64675bda998c094d7cdb195b1a3f504e412a38b8633f2cea5f0c11c87ad1309e25d70e65d1e8ccbbc6b1fff05bb8b33a0bf42722
SSDEEP 12288:iyPz5L8v9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:/zyFVslkRHncZEM047gr1
TLSH
T1DB750203327520F9D1BB8234C8621A06F775BC3257718A9F67A4473A1F376E19E3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 5af879d14b1caa829a4937703fd2e83d3c39734e0a7e374db08c621dfb4ed3ff
MD5 8025ba3b058f142d25d7cd137a6a2b8d
SHA1 f6df5d7a67b8c14166d42b793795778a42cb4134
SHA512 a88e7527cc16b697eaa54e3418da3dec35064d818a8ef66573a5cbee176ed66abf6abc04ee48cf5110963b81acf66f66f29075f27ce8fb57eb6031cabc5b2edc
SSDEEP 12288:vE9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:vkVslkRHncZEM047gr1
TLSH
T16F652311303D80D5C5FE82308935164DE87CCE26B9F241C7BBAAAE395A7ADB24535ED3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 f86d8e64ccc6821ff8ad10c38e878d0fd756eb314fda09323982a5ba2a10bed7
MD5 d40b83bd7bc02f4f33c3bfc57247668f
SHA1 f116bd135835dbea893962f71417413bf2b10ffb
SHA512 c8f6409807ef22cd9ef285e97d3867f7af2ab24c2c37951404a0e1fb8cb4388085867828cd7dd24705364009969cad43b4b60c73552a50840028a406274bc9af
SSDEEP 12288:xE9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:xkVslkRHncZEM047gr1
TLSH
T1A9652311303D80E5C5FE82308935164DE87CCE25B9F241C7BBAAAE395A7ADB24534ED3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 b8a0bb49e3c8ac2a3a23e91d7f37f7fc86d24c7bc68ca203b781fdb7e4e0a64a
MD5 7fa040f1f37c9a0c8df11afc2f7f67aa
SHA1 d1829dc857723d27c5af2c4309f83d9afef582e7
SHA512 3ae4decfe5cc9282387199b5aa656601de0a810eff183a15154debd7dae47ec6fe9dcca7b006b73438ebad0393423104b6b2e526e4606e7578ea215ce4b71f12
SSDEEP 12288:5yPz5L8v9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:4zyFVslkRHncZEM047gr1
TLSH
T18D750203327520F9D1BB8234C8621A06F775BC3257718A9F67A4473A1F376E19E3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 9c9049f6847d905317585fe8565c50f15f2a812fb75e659527a42123ee7e63f5
MD5 9568f543f821c6e28b5162aac11e4596
SHA1 ee2b4d45f8716d547f071e8c10fa73aa0b35ca06
SHA512 7ffa3af662a099165c4a5aca373f80dd73cd926dd7632cf600a0340f7f0782b206ddd3ddcef40377f3b1eef99ae8ea16973c277f6d9f458de409fde7c7c46aaa
SSDEEP 12288:tCd9hWYoaLHF3z0z04PDvhp9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:4TQaLl3z0zDTVslkRHncZEM047gr1
TLSH
T16B850191736408F8DCA7823EC9258906D6B2BC2A17B0C65F17B4362A5F333A15D3DF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 9125ab2095bc40e7268f008a72161533ec23a25acfc6f75064fe7c1405b5d78a
MD5 4c0d459e6c419b02e1c333535a09de19
SHA1 56cff32614bb56dcf112a72ddeb0b526f283e618
SHA512 17e17ff37697b2e14ceb7c82f67df0f2ebe3aaa9c2aca8c16ea4a782ddaafb241dac440ecf4b42162f595dc89233c1c3e3e7696f0828a4ec01f004e90cc074c5
SSDEEP 12288:hi4e7aRdTfgwCHKy7GLbbdIvC9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:h3/d9CHKy7GZ/VslkRHncZEM047gr1
TLSH
T1F595CF90F3E810E8F0B7DA35C9764511DAB67C5A1B71CA8F13A4661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 3476c60301bebcd4ad1489043fd727d6ab7c760eb6ba86ba9024c1fe1141e006
MD5 8448e5ea74f60869717f6969e5ce729a
SHA1 431e43407aa143b1843fdf652537c7a5de84edb2
SHA512 aa38449e8d3007f297ddbb296279ab85fd5235093034d09c3a70973e46b81c35e2dd1d84a2134dbab329b264eb88e2ec925a6d77b3aee9594c1b5abcf36d44aa
SSDEEP 12288:uZ9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:uDVslkRHncZEM047gr1
TLSH
T1BE652311303D80D5C5FE82308939164DE87C8E25B9F241C7BBAA6E394ABADF25535ED3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 b72b604f4d36083635fafc8a4f12fd016aed757bf14adceaef65e52f6533274c
MD5 6a638aa90b6be439425b700da6878a46
SHA1 58927d2678cca856b79c66dee7ff9a6c6092256f
SHA512 e74e974ca3235427741fc639b3997d9a169c00a6bffcd5fd6391e94aef18b10cff4b3e8c7c935443b3f39fe572e49ba63033effb06a15cd7ba543614a1c84282
SSDEEP 12288:WP9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:WlVslkRHncZEM047gr1
TLSH
T1B5652311303C80E5D5FEC3308979564DE86C8E25B9F241D7BBA66D394BBADA28530ED3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 972e83fd13fa0a10158a95dcc3e124afd1260f738085ef4a3f049fcbf6f198b4
MD5 ad54744fa2782414f02af91fb2a69220
SHA1 d47eebfb638d21adb8529109171a9915b09d51a6
SHA512 054bc5941d267872635b27cc1192ce5da7d5568ffa7861adafa7bb6fb5ebf6cf09e3c6584d619bb56cf7e9175f0df818509a17ac92f145564735f066c5408a73
SSDEEP 12288:8C9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:8OVslkRHncZEM047gr1
TLSH
T17B652311303D80E5C5FEC2308935564DE86CCE25B9F241C7BBAA6E395ABADB24534ED3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 f7de2e18d115a1f5e50789110e4f40c9e9eb453f14ac70be878fc0747ca5387c
MD5 0074936f1a612e0d4a950d19d8bc6048
SHA1 251de754d19d83cd3f0166e55020ab68bd790a97
SHA512 21391d64c6e6251b1f21d30713f2649ab5e9e747517973f4001553597af7e4831f0c8395e79836f6e727be214d8de3afdd6d8b0458a5799f7538d7e109b18f53
SSDEEP 12288:lE9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:lkVslkRHncZEM047gr1
TLSH
T1CF652311303D80E5C5FE82308939564DE86CCE25B9F241C7FBAA6E395A7ADB24534ED3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 6356d668869a9c4a85358f7ede5c844482d57e0dfdd320f52936a691a974094c
MD5 d1bfe614dd52da2fc776e7bc80888e69
SHA1 c26f55261747673003d7a368b16bd19017081410
SHA512 6e860af98b3a8dfc1278cf837d908527e458305ee72fcb7efdf5f6851fee724076d27691d7e86bb600777610913b15845217c4fd33f82848d95129546d8f98e2
SSDEEP 12288:jZ9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:jDVslkRHncZEM047gr1
TLSH
T1AF652311303D80D5C5FE82308935164DE87C8E26B9F241C7BBAA6E395ABADB24535ED3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 ad0502c65f47fd5d50e1e57233a29931dc8716558f05ab9775a0a3ce70f084e9
MD5 bffb127740f12c5e305407236ac2f754
SHA1 9f7829098a048de8db5101c84c3773b040b5d968
SHA512 69093fb3749d63803cca8432287e55d2a294d1ec715eb964608a6149e497daca0e8764c8700f824fc770d8f8d434a303bc617ffdd7e39d065d32da41283e60e5
SSDEEP 12288:189VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:1cVslkRHncZEM047gr1
TLSH
T124652311303D80D5C5FEC23089395649E86C8E25B9F341C7BB6AAE394BBADA24534ED3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 8e91fd6c492f80394c7e45de04330dff5c740c1be5445a0a546dc803f0505f06
MD5 40242df864852ea25a0251a38643feee
SHA1 6640d48778f8e6a2f6bf8f2e551e6f024e4ab5eb
SHA512 8ad1868368f3fd45e6fb2ddef610916c90d7d2c83842d099a6f5d828ad913ba0153661c834137bd0e388c063aad48524f18b8bad53684ace6359cbf31fdeaf84
SSDEEP 12288:Cm9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:CiVslkRHncZEM047gr1
TLSH
T1E9652311303D80D5C5FEC2308935164DE87C8E25B9F241C7BBAA6E395ABADB25534ED3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 615f1694492fd4417659c433db9ff86d3ab64f5f56c856213b228b0200723c53
MD5 19eec77aab72f45b12e22a14bf525260
SHA1 7505fdcddd701596f49fbbe9e6030c6adb2b409b
SHA512 5b9925f3391ddb43d25003f691acd053693bcf450755a47630da9233960b11257624f256cee45b3769a647487ca80d00751dcc99afa34cf1e8ede7b70db1946a
SSDEEP 12288:bB9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:bLVslkRHncZEM047gr1
TLSH
T1FE652311303D80D5C5FEC23089395649E86C8E25B9F341C7BB6AAE394B7ADB24535ED3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 550b8696c003f1c38310dcfd6cf3d70a7b1da2b80e5e34f094c6313feac01772
MD5 3c01e080c5a2c34141cb7e5b1e53d300
SHA1 cdfec9e0b56a9b32d5f58c8552a591b96ac8478d
SHA512 a2cd9318d492f92288230a90150425256501ea29378f532354b5f91705419ae95a3daf4157788f6b944c643733cdcb90016b83a3276f7ecd9499cb4f20c26ca0
SSDEEP 24576:PfwvUk9RX6wkyAIYVslkRHncZEM047gr1:RMnYIYVslBEM0mM1
TLSH
T17195D029EBDC44E5E1B7923C89B7460AF6B178291B31C2CF129A536D0E37ED05E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b4a2ce0a723e84bee7c71af0ab3528db1f92b957757d51255e7aa032bc19541b
MD5 a3a5e8e5816b940c49662580a48e01c9
SHA1 ebbcf65aa852b507a3d461a06e305dc30e8c9384
SHA512 191bc2512365e8e0b536d0cd6c094bfa166d88ca249c6b408238dc369b13883e4ac18334a2f5584456e1a89a411e0b6d6a37b7618505ebea96a86fecabff2352
SSDEEP 49152:hYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0XVslBEM0mM1:PySzP/SlBEM0
TLSH
T138066C96A16801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7427e817c3c1e41d1aef500a4edcdcc666c48637e72216c052f35a3e07e814da
MD5 8b18e9b6dbb58675ec35f1bf7f033d7a
SHA1 f313e2a9a01bc0ca6dbc3e4020804035566582cd
SHA512 02b7d4c841047c41d78d38bc5e86d95234ba0a0c886dd31541805b963564ce8fd6c0218d8c2e190925d85cf8771e5e1cc793e92a67449e49964f5b2b412f4f0a
SSDEEP 24576:x47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYRVslkRHncZEM047gr1:x47JUQjairIhCnDHUPfF/nVslBEM0mM1
TLSH
T1A5659E1DA3EC01E5E1BA923885154A5AEA71782E1F31CACF2270837D6F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 66c6e3cd57b278a06a16221cb99a5451a579feb36ef08ccd65da239fb35b566c
MD5 5ed04582c8b8effd18828b80aa11c281
SHA1 8e7a41a37c87c129c2b3be218fb237c3dafc63d2
SHA512 f1b50416f92d2ce398b13d93d013bff5d6fa1c454e5c24fb0200bec8092ac3f2f38278892f4b8a0b5a8edddf07bf26e125f2084a4641a561ffc5f0abac1709b4
SSDEEP 12288:8qsf09VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:YUVslkRHncZEM047gr1
TLSH
T1EF75F015E26841E8C0AEA234CB564A45F3377C2597E183CB67D0F93E0F7A6909DE9B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 9ac0577cb527ec05b950d1472df0a444afbc528974c3f9f298680cb5dfa12bed
MD5 fa5c4cb51022c5dc91d222537e716fc7
SHA1 250e3485083e719f37a0db64b0c67beb7da41b01
SHA512 519dae94cd14030c1059eac80c8b673f6c59931b0b54d1c9003302ca5a0a9d1895f87a0fd17e164a291ce2f05d2bc9f32764a1603fe6c8c9428f216bf44f744b
SSDEEP 12288:1N7s9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:/MVslkRHncZEM047gr1
TLSH
T14A652321313C8495D4FE9230493A9619F82DEE34AFB180C3FB656B2A5979DE18D70F87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 90f76dd1a53a54a1c00cbfecf1676d378cb4a50dd464864893ec42a88e6087f2
MD5 bb126324b5c2c5a2095679a2042c4bd4
SHA1 0966a72132ae85b95b3fea549fecf12239dff079
SHA512 cb1c6a479b5a2b194b8e9298fcf83862e4f8b75e124f83fb672ace870fd378c58c99c318c0db0e09315f4ef3f886747544b4dddc676b518ba78d9d23d8721e67
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bY2VslkRHncZEM047gr1:mgb4mBIBhGFRVslBEM0mM1
TLSH
T155659E1E22EC02F5E0FAD2B89DAA4417D6B278161731D2DF1251423D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 9030da684c67f1d446369e1edafd5b308eaa35996e9732ed629121a15df030bb
MD5 8959d092e631c551a3317a009aa908ab
SHA1 d393141eae8a9b8d8255abe98c536f650f59f6ab
SHA512 6d084d7436610fa654fa12d61fa2b0ae9ec462b7a20702b6a2bb992b8da985758506334eee1485671ea64a7731beb940f08d824b6a6c9e23a79f07243856efe5
SSDEEP 24576:CG88u8FpJqH1pzria7/mBVslkRHncZEM047gr1:Z7ZFPqVga7/uVslBEM0mM1
TLSH
T19595F16176E401F0D4BBD13889864667F6B2B8251364EBDF07A88B551F33AE14B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 7596293e052dbb7ac39811eeb8885a1a8ce6fa0e179606a59360db596a3d1c37
MD5 19176994b2bbbceb68b9537a87cd8212
SHA1 9d98315251abde2a39337d9edd37912d296c82f5
SHA512 009f5457123b39242e5f10b3f6143bddd2f284bf8d4adeb3ac88373a93fc73a9a6479a4ebadaf6b278f16831a24c8c19eb5cccd6a67010b11624694962772545
SSDEEP 12288:xHvUrBFrEjwaQX9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:xPUr+NQtVslkRHncZEM047gr1
TLSH
T17D85E12B22AC18E5E67AE13C8946470DF771B862175292CF02E1817E4F77EE4BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ba2fce78c15caae9d551d15fd779b96f1a432da98a27878bf63b4f4f4ff63aff
MD5 e72e390f56409d59e79beff7e0c71662
SHA1 5b0ee0e25e30401a8d6fe742372a254bcd02972a
SHA512 230376b318462544f4e83b97730cb240dfa5037a463a1f832c04e52869ffe9e0bae5ea1937bf5252d73d5a5d82b4aaf865dd13592cefb12a733fc9ac95e0d564
SSDEEP 49152:ZBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjdVslBEM0mM1:6G05lO43bQSlBEM0
TLSH
T103D5CF6A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0cae68a5e480c2291fb09cedf3daabe8088078d27788e01d1b27d44b18cbc58e
MD5 2e8a7e58369b78054b60d726fe13ceae
SHA1 3cd483dd9a321707a2f9561ee090218eccbaf9cf
SHA512 59eb55c4a58aab8af9af02267b8b4cb7266dd2298d9a9dfc25d8831df095b9d99cc346b05c53fb190b7ceb9f5f9e7a51e2e7be4a81031789bf7d33bfe85daa03
SSDEEP 24576:Efa5POZ3dpuWVM50JicR2hG0lasx2+47eidnXVslkRHncZEM047gr1:ca5POZ3hJt2pasx2+mlVslBEM0mM1
TLSH
T13165BF5EA6FC00D5D5B9D17DC583461AF5B1342253329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9f8ae17982d6eff281ce0ba5093243339cb8dc88d2e5f8f89c33b4e81b2829e9
MD5 b5cbdecb19a94025613f5d8e5b556210
SHA1 93e725b45b3e940169c7f6dbdded1f770f4db0ac
SHA512 9c35542ee7d4353d6a1cbf6922796693f353274a7a786c05d2a41469d4f21784b595f4c151552b68d2e59d0d8cde5788d08ee6a4392a6cd920883dc5fbab8fd5
SSDEEP 24576:wNcwHdjbyQ4nLC18lb/EOjowL7FkpVslkRHncZEM047gr1:wNc/zEOVHFOVslBEM0mM1
TLSH
T108858B2622E901E4F5BBE1BE89779546FAB17865133086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d7ee03c7fdd1195e5d83ae0d8911147ae58dfe5b067384e876b15e2aa4822be5
MD5 a1480d74a4a5c3094daba51c34155448
SHA1 db397b6cfa840562889d2b37aa6f4dc18964c2f7
SHA512 66afd2a59a41a0bf11a8687ff280646688971110a95f2844afcc595664d52d252b0dc84b43d63c48283ea75b55cb5dbf9c48a0657e4dcf623ab0ac906a7f9710
SSDEEP 24576:N3kNvNnaFeYhJNtmZBmLVslkRHncZEM047gr1:N3MwBtOmLVslBEM0mM1
TLSH
T10655AF2EB6B846E4D1FEC674CD238512EA727861173293CB5390C13E0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 2e6d5dbe3542ffea31a3c1c7f35f03ba9af9eac829ed7565ead0037abd495fb7
MD5 e34f69d5b24602798d53a2b5771e2a96
SHA1 89adda52a72ec3a7cef0d63d43ae9c704b229214
SHA512 8396aba69b59f9329730f311fa4741b2a080f9f6f868f8d4fe96e3458ff44f3d2c6b5b658090f6b4ecfd498db9ca3aa8debb3ba3dfb9931ea14642ec78041354
SSDEEP 12288:fQcMxWDXN1Dp/fshBItT1IQgAw9VshXPsRJCknA7ZlImKM0C/nvjfor3JC2X:nD3FHshBIYQgAgVslkRHncZEM047gr1
TLSH
T12E95E13DE66C04E4D57BC27CCA638A06E77138A9033256CB16D481BA1F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/456-382-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/456-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/456-94-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/456-381-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/456-88-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/456-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1320-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1320-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1320-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1320-16-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1332-371-0x00000235689F0000-0x0000023568BBA000-memory.dmp

Download

memory/2084-66-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2084-294-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2084-64-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2084-72-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2504-316-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/2504-326-0x0000000140000000-0x00000001402AC000-memory.dmp

Download

memory/2504-76-0x0000000140000000-0x00000001402AC000-memory.dmp

Download

memory/2504-9-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/2504-0-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/2504-6-0x0000000140000000-0x00000001402AC000-memory.dmp

Download

memory/2520-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2520-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2520-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2520-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3476-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3476-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3476-313-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3476-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3476-106-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3776-54-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3776-268-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3776-53-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3776-60-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3920-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3920-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3920-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3920-121-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3944-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3944-51-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3944-38-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3944-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3944-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4916-83-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/4916-77-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4916-78-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/4916-308-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5204-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5204-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5204-133-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5204-127-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5204-138-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5612-122-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5612-312-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5612-114-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5612-112-0x0000000140000000-0x000000014021E000-memory.dmp

Download