69d22f10039c1534e4495b5f125eec9f996b2ddb2ae2c99cb9b727895e328e63

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 18:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-08_2895e449eba5b160c5b4a1537e6ad27d_coinminer_icedid_njrat_vidar.exe
Size 2.3MB
Sample261009-xcghpsdf77
SHA256 69d22f10039c1534e4495b5f125eec9f996b2ddb2ae2c99cb9b727895e328e63
MD5 2895e449eba5b160c5b4a1537e6ad27d
SHA1 b0f6b44351007c5ed57345ab1b698889ccdaac41
SHA512 2c4ea6b244163320bc2f56387b4eb0f6e220570c3dba0ef94e782e4f6ad59b08384c288f0fb76630d205129fcaffd8b9cfec24eeeb722c5cb507245ca9c1c95a
SSDEEP 49152:SR/gNy7gdyzDLET9ZniLNuX22c1QTkk0MMv98/e7m6n4IeoXw:2/gNxd7XT25Y/eKITN
TLSH
T181B5BF4A765841E8D177C13DCA569A86E6B17C061F20A7DF13A837DE2F336E05A3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2476	elevation_service.exe
3720	elevation_service.exe
1532	maintenanceservice.exe
1696	OSE.EXE
2900	PerceptionSimulationService.exe
3596	perfhost.exe
5600	ReFsDedupSvc.exe
1300	SensorDataService.exe
4996	ssh-agent.exe
2972	AgentService.exe
3000	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-08_2895e449eba5b160c5b4a1537e6ad27d_coinminer_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-08_2895e449eba5b160c5b4a1537e6ad27d_coinminer_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-08_2895e449eba5b160c5b4a1537e6ad27d_coinminer_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-08_2895e449eba5b160c5b4a1537e6ad27d_coinminer_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\be49e4963a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-08_2895e449eba5b160c5b4a1537e6ad27d_coinminer_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005beec8391e58dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f48cb7f71d58dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d8570f61d58dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e590a7f81d58dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000768ce6f71d58dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e8b28fa1d58dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2476	elevation_service.exe
2476	elevation_service.exe
2476	elevation_service.exe
2476	elevation_service.exe
2476	elevation_service.exe
2476	elevation_service.exe
2476	elevation_service.exe
3720	elevation_service.exe
3720	elevation_service.exe
3720	elevation_service.exe
3720	elevation_service.exe
3720	elevation_service.exe
3720	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5304	2026-10-08_2895e449eba5b160c5b4a1537e6ad27d_coinminer_icedid_njrat_vidar.exe
Token: SeTakeOwnershipPrivilege	2476	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	2972	AgentService.exe
Token: 33	3000	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3000	SearchIndexer.exe
Token: SeBackupPrivilege	5600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5600	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5600	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5600	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5600	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5600	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2476	elevation_service.exe
Token: SeDebugPrivilege	3720	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5304 wrote to memory of 2472	5304	2026-10-08_2895e449eba5b160c5b4a1537e6ad27d_coinminer_icedid_njrat_vidar.exe	90
PID 3000 wrote to memory of 2656	3000	SearchIndexer.exe	101
PID 3000 wrote to memory of 3340	3000	SearchIndexer.exe	102
PID 3000 wrote to memory of 5204	3000	SearchIndexer.exe	103
PID 3000 wrote to memory of 5996	3000	SearchIndexer.exe	104
PID 3000 wrote to memory of 5740	3000	SearchIndexer.exe	108
PID 3000 wrote to memory of 4520	3000	SearchIndexer.exe	109
PID 3000 wrote to memory of 5448	3000	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-08_2895e449eba5b160c5b4a1537e6ad27d_coinminer_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-08_2895e449eba5b160c5b4a1537e6ad27d_coinminer_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5304
- C:\Windows\system32\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s C:\Windows\system32\SogouTSF.ime
  2⤵
  PID:2472

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3720

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1532

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1696

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2900

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3596

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5600

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1300

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4996

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2972

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2656
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3340
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 2960 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5204
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1888 2948 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5996
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5740
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 2960 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1888 2948 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 95271ace9115afa8adf1c972fade9235cf71bc3821d62fd3fce7a713d42c6f28
MD5 6f777e57f40d6f4f86a95e65154c36d5
SHA1 0e522c23010345c98a1325aa89cb956459ffc8e6
SHA512 e85a5e4d240e94c24382e89ebf02d34852754370f53537c7ed5c50f321c12302ad27360da412a7d2c8ff2a09356208d4df1c58319bab37eb7354a8edbd1c3018
SSDEEP 49152:5b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnp98/e7m6n4IeoXw:P3q6HjBv/eKITN
TLSH
T18ED59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 1f8ca0e7245b4b727fcf55d7c63bf165fd57544c85db516ad378f1a1e730034f
MD5 b6f27f242d629179f4adc385186110e1
SHA1 db95dc46d421a568ee09d6bd7273196e7f1b1759
SHA512 a1b741cd7f57827e7c104204cf6739716151c471bd37771e72d691f1bffd5377cc98298d0649c08c4dcf1ee3fd75b2d0dac8dcd8b0742174e6f1fa373e909f5d
SSDEEP 24576:GXYfDtczA198/1E7wr6MgTSoYNU3eMFZNsihZ+:ltcs98/e7m6n4IeoXw
TLSH
T13C050168A3E509F9ED6B823CC8A19516E772B8814760E79B03F496251F333C85D3EF91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 3419c7f2bfa23943663f51a6fb7f5f6e6136e81644a58bccc812a09c88d03595
MD5 9d6b58f71b3fdfc7e48123a40172299f
SHA1 14686c3a4015918bebb1fbf642c0d3d9ac478770
SHA512 4a9d35e5ad6c3713929dc1acdfac1c167844d1e5b782d5d76523f9d7f3a5fcbef7e7b0f7cef83d3f5d28107037bfe3e15d2a4c3b6bfc823c16b139f961044dc9
SSDEEP 24576:j0Le5ji0hmxirMy98/1E7wr6MgTSoYNU3eMFZNsihZ+:jPji0Acb98/e7m6n4IeoXw
TLSH
T15B35AE66F6748331D073C0B9C5D2A69EE97130825B308ACB4296D77C3E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9e8d4c73f1f6a46bc814c862a4e0e695d6406d2685739eecfa429b7c5a932cc9
MD5 00422c25f672fd344cce66b7a9e148ab
SHA1 cd9119c2b4bd8cbc5dcc91ef0dc26608a4fa2d93
SHA512 c3225cb01166cd8a893944a7ac98243f34061867e3c1bbf339edf58b0ae69a4170417927d758108869e6f5250e53e421ee74307a6cc530206124544711f7da1b
SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWE6q8wyuc98/1E7wr6MgTSoYNU3eMFZNsihZ+:O/ezSC6vUzPvxHjy398/e7m6n4IeoXw
TLSH
T198756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 60c7bb122ae8d2b32168f58d75eb818c7550ee754658011d43efa0332ea6e714
MD5 a6cf8d9dee9cd8f82abea3748c421fba
SHA1 fb1751092c273e800a0a1f958e9e35300c8216b7
SHA512 b824a73d44b2b03f0f7c84715901c1ccc7549c319b976613c5d498845e3baa9937b0d6810f494f094d681ffab483dfbe677d328a78fed0d0cf7709eae82e1c6c
SSDEEP 24576:OVbqPb88hv/l+6Z98/1E7wr6MgTSoYNU3eMFZNsihZ+:OVO88hXl++98/e7m6n4IeoXw
TLSH
T14C559E66F5748331D073C0BAC4D2AA9AEE7234425B31CACB0246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 e38a25ebb54705c4f90e77b02cc58754317f27f85fac07f8ef888d379aa5699a
MD5 8df5272103a6740ee061a4250457e5ac
SHA1 faa4ab27cda62bce89cb592958d79dc83ed6c885
SHA512 852e2400f15ef4e88da56457e9a02eea0923a42cfd98f6aff03b9cb7005e410a814fc7e425d9654f76d3db0c75d9cf0d3f5193ec40be764b572f61ee4bc31f6b
SSDEEP 12288:BRdAaQUrDz1EKIwr6o1r3s1lzSoYNtEvckeJy31Z/VsDO7S/u70HT++:BR298/1E7wr6MgTSoYNU3eMFZNsihZ+
TLSH
T147C423E6C6291E13D76DA67470E4787B92A0EDC09D29D63B83F0B35258352CC98D0F8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 ffd0f4e8cde03fda210de32a9ffa109c206580b155b1ae64859f06cf2b7ae250
MD5 798cd26788a222ea9c8e5fffacbaee52
SHA1 39885b52d66bfe555d6f4e33a77737557bb306e1
SHA512 4b1abd07a669e9b9bef345ac6de4313a4deac7de13761db29ee26141de95b6ac279b8c0549ca6906da084a5fb9515ec823446b1405d1517b33b5dfe6aeaa60d2
SSDEEP 24576:2JIUB98/1E7wr6MgTSoYNU3eMFZNsihZ+:2JIUB98/e7m6n4IeoXw
TLSH
T14805CF7BEE28FCD2C27E9DB856918600D77278704B22A3CBD275830E9E235D45D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0fb2dd327931a3868d1eb0598ee0a3d6d8bac2e822e9ab6af62b4940e3981174
MD5 9a028210cafd852c2e40bf05fa1eaf5a
SHA1 f1e59239225be8a63a3b8e04c0d1b16dd68c5942
SHA512 3c5201b2c45ee3169369ec350a585e4d29f5590569a60dd19690eef4cc6112a69642663044fa6da60945ddeebdb3b0094e9011b3e6e9fd1e9aad940a58503d77
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THg:jQvGAdlCEL8c/yRNw5CR/eKITN
TLSH
T152267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 459f73500f928b78dd74be96a9fce86e77450ddd33dd8eccfbb2c891c83d2a4e
MD5 0f7298179b4d5b211999a80b0d12edfd
SHA1 a2f1926da39d7c009ad78bbbbfde35bc8de22d23
SHA512 65cd3e3dce743d62932142306b2c22c9daaa19f6d0645cd388c2b2d615accdab5456b8a5294908c2460ad74f0e1a29c7872a09120132b7bb541ec24c2a714c3a
SSDEEP 24576:sdewsAjL98/1E7wr6MgTSoYNU3eMFZNsihZ+:0ljL98/e7m6n4IeoXw
TLSH
T1E015E031FA74E432C27F0DB62B26D716546CB9604F611AC3E3F89A9E59302C22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b555789561a46d72ee37f3ee767f927582078f82536c172f699796fa4198233c
MD5 64fa8d321abba0add338da016c9a6775
SHA1 52a473948e7d4c3e7d6ff4ccf2d3fe543d7c8cc5
SHA512 ea5c058e963b5ed16a7cadff2d537deab1deff105962131bb38d80bd63bd4e0d08eb95a07bdc9053f33c7e397c79dee3dc5a68e48d0c48f2de10addb92afda4b
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHW/daN:MUEtQevvqc2W1cpV2EI32W/k
TLSH
T1A1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 de0678981d755e2f66e000eb92539b870cd58f49c8dcd6bf764c1aaf31c4a363
MD5 32d0d5e05db7bdd47c5f6ed2cb02dc71
SHA1 9050b0fe524e155e44348dcfa9377bf21a37f533
SHA512 e9371189caf2949c40b76bca8c007b58439126ca57d7f30a3e7bef8b32465301404134ea843061c777e2796adfd6792a3a7bb7d7e8e577c49b2f4b5ae731e28e
SSDEEP 49152:KCbRquA/m2yL5zQfFiV+XenmE3/zr98/e7m6n4IeoXw:/oqtVjnmV/eKITN
TLSH
T18FD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 28321fb1b226d677aef4a33cc50f4aaaca4d0ebeed4c179167b0d45d43661a43
MD5 9d7b6c6d1230d1aa9e31c55b586a96ad
SHA1 de9f6e329e762cf11f511cdd694ec5e8a04fb13a
SHA512 5fd717cb76b4b30185da718ec1fb34e08d58003c6a469d565bc748443f88e1c7d12afb98853f11e7e0b0a082e8c7bd01cd2f9ab7150bc8d16dc794d0d7d4822b
SSDEEP 24576:0AhGLJIFoiwtA5l7S53I98/1E7wr6MgTSoYNU3eMFZNsihZ+:0AMyFoiq5Y98/e7m6n4IeoXw
TLSH
T10E35AE81E7F955D4F5B3AAB899B69171EA76BCA55E31C20F1260D20F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 cf1339361a4a20545272fcaf864c66cf8b9ebf7bb09dfe38ac93e11c69f8f8a9
MD5 d0b97128a3af7f583ce306d6909cd744
SHA1 1d901a0615bd21e1a42c75226e74d193652bc7c9
SHA512 30e73dc416091b4e08446ee13cd0b1195f3afe47eb8762f6a6ac8aeaa21bcf714ae8bf6d28566d1bbc429028378061526d6a5ff88a13158e930dc21e3fb6b75d
SSDEEP 24576:LwuoOWX98/1E7wr6MgTSoYNU3eMFZNsihZ+:LwDOE98/e7m6n4IeoXw
TLSH
T10B05F18676A40CF9E96792388597D136F7F2B8012A25D72F03B0C75B6F37351AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 422d4f56f569d446eee6d15f87365b0d0ca51bd3c12300a499053576e4fa0433
MD5 76e78182e75b34ec9baa865b71806ca4
SHA1 a54ec7e6ed2bef7ec687e5d6bcac75f8bd6e43c9
SHA512 462c12fb4499305986ece3ec54b4ec7a8e1f26f828eaa5c5e01ba77fb3f494fc41a55d7aa50c873776d066974c4ad5d56384bfab7affa37ec4a2be1d0c52a612
SSDEEP 12288:rBZ1IyqAaQUrDz1EKIwr6o1r3s1lzSoYNtEvckeJy31Z/VsDO7S/u70HT++:FZua98/1E7wr6MgTSoYNU3eMFZNsihZ+
TLSH
T1A4E412DA23A425B6D26B927CD8E1661BD3B1B892673583DF03B453561F33AC91C34F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cff8a3a9fcd0d8b11abf20d86831255b86612b4cb65cd0073e0beb68a9d307eb
MD5 fc7e441fafcc7ef24804969b9db065ba
SHA1 43ba155e5ca4f658cceaf3c16ed9e54a982d9698
SHA512 50a17838bc41ec2993cd953daf496616750e3728f4348ced4ae5077acb0147eb9be17c5c8e868e07d88c9596c39d7b46c97562205a18701323f920fe2ca339e0
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uk:4QRQyi36YOcPQLvw2gAf+PN3Y/eKITN
TLSH
T159667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 dd20d22c24235ca604cff4353752ef25b7e420d937f595266cc96f40b0f81396
MD5 73fe8b4f0eb1acc32cfc0c13f771dfdf
SHA1 9ead0e05a870f5cfa4d5a144a9ae8e063bf53bda
SHA512 333217269aab6eb5af96a19c59155c9208148b65546c5b60227205ce44ce79975df8a1cb5121c63c3ac838447009e83f196cb69a58c94bea3d2d707f4212c44c
SSDEEP 98304:JQRQyi36YOcPQLvw2gAf+PN3Y/eKITNe:gQyiKayX+PNo/daNe
TLSH
T113667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b749f4284656264b901a3ca52bc5c13ef0bcd6df1390eec823fe709b2ac9d8f0
MD5 6c075a2627842eee2a5e5e07167d5ed6
SHA1 5508eac9d4eb14fffbce3cd8be9b4214a38a0189
SHA512 42da13d155895af13e52358dc233a1537953515313eaec03afce391bd57d731565fecdf0ddbc1c3ec0509492a7ce039214b9702e5793b239fe22bbd38a0cb4bb
SSDEEP 49152:W68Qg55nhheWu7PNU3/b98/e7m6n4IeoXw:0thWRc/O/eKITN
TLSH
T1E8B54933B2F600A9C44DE1769F4A973196D17C758FE0E3DB825172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0aa133fc3fc889020439051e36b237abaa69ca40c3978daba7b0b0e8f126e9cd
MD5 c426468e334ea2c7f403d3aeeba297ad
SHA1 88d87f45decf2e9db68ec1b0ec1bde9188c66543
SHA512 d531cee026f8cc95eb6ee75096ea49452f1023ef52067918f4b8cb7bd8066645223507b97d30a27b71e9cce897bef9f2303c221f5c37df6bb513fc8007ccdc76
SSDEEP 49152:W3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk996:Hy5112gYy5azzVvL69nLKnhZb/eKITN
TLSH
T198167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 da5e37705df2166612007cab3955a80cc9afb8e1eddb87d5945610f99ca2f6d6
MD5 7f6eb79725ef55cb780a5ebcf1a1c1f1
SHA1 32a0e7b38b34c5c1dc9c50eb271665e32ab9b262
SHA512 447410bb21a577a5e88f6758c9c84ac5eb15685ac0a3bb5b85c09caf6b112589efe57cbfb782118054cf385ad3c33e1348b74db6b297152a9e7cabb17e36b22e
SSDEEP 49152:sB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl+98/e7m6n4IeoXw:mu6JmVxd2dD/eKITN
TLSH
T113D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6f706f326fb3a33c96ed77375166f722ab8eece4752f4af0fa9ba62bf70889a7
MD5 8ca64ffb4c2bcac7e500d1f1e8452f6c
SHA1 12807b496ade5522bcf2891337ec2aa59e24e2b5
SHA512 b8f6791b24214c55bd2467bfa32ea346d5e02d4e0cd1a564f36f981ff849fd03f13b86073f8cb30abc4cfd9355b5b0232377d1f621e5d8bd8961c8502f11835f
SSDEEP 49152:h1hpsNoJpF1A6UU44CwH7R4xh98/e7m6n4IeoXw:hmifPbRV/eKITN
TLSH
T1B7B5BE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8185ad4f20d069468d916b54a227243412adcfe2ce96d5c45f7035f97a1a5793
MD5 c9af9299301e0623c51b566ed4fbdcfa
SHA1 3e73e1919bca716e7668f399f4994bc9d519cb1f
SHA512 3e62f4d9aa7bc5f756a3dd417ec97e448d641e68388cbe4065cef5632092fe1e1b171ac9ce380c7375381a2e2e152900736b47d707353c2e54514d0a3b3973f9
SSDEEP 49152:eSuZQIY0Be2KRRVtOnks6NMHqa98/e7m6n4IeoXw:w5dKTi613/eKITN
TLSH
T1A6C5BE13F2E901E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 62589ab24308b3e72efccac14136485d10e4b6671ac0e7ac8fa750a946d71504
MD5 101c8ab8386c552005152a5acc834b49
SHA1 579d4b6d78a9a3aa468910aed8c48d2464a3524d
SHA512 99939c1512f4be3419331967aed2b7e2a0217cfdcc96e6f34ac17a0b28ed5f040f394b1782a39b3e47713f79b9abb5be23233dfa47348158157e7fe3259cee10
SSDEEP 49152:yhtSn8EApI0figngiDn0AP5w198/e7m6n4IeoXw:zX2iyphJ/eKITN
TLSH
T14D95BE13F2D901E8D05ED178C7468632EA62BC050B39A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 57ba9c4d7cd966ae179cce61b0fd1b1759559502d43d1efe07b17e5001e0918d
MD5 14544ed79e9846b88bd38dc034dadf94
SHA1 ec4d569bcb6455422c1fc32308c7b1a595502519
SHA512 4dcce105aed7eb3685f68752eb578a1ddb8f1389e015345dc04819d1a8869c0fcdb1602fd141e9fc36362eefa0b7fddffa02398a9e1fd6f1ca031a1a323d0d4d
SSDEEP 12288:uVAaQUrDz1EKIwr6o1r3s1lzSoYNtEvckeJy31Z/VsDO7S/u70HT++:u+98/1E7wr6MgTSoYNU3eMFZNsihZ+
TLSH
T145C423E6C53A0F17D61C96B470D4757FD2A4A9C1AE3A927B43F4B30269762CC2890FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 8548dbca40468e656a63473e6abcbda7bfd33f529e3d3f17f196a24678674281
MD5 ba50463dfd1532be5e6bae53fd209270
SHA1 09d76de9b7410d4a0d8e871d10eb2aa32f594606
SHA512 df3ee78ea73c0dbf421a321bbdc0f6d170920275f87a20c646dab68d157cb126858b2d3cec0573e1684d878ef945790cc7850cd43c5289892f83ee17bf32463c
SSDEEP 12288:wWAaQUrDz1EKIwr6o1r3s1lzSoYNtEvckeJy31Z/VsDO7S/u70HT++:wv98/1E7wr6MgTSoYNU3eMFZNsihZ+
TLSH
T169C423E6C53A0F17D61C96B47094757FD2A4E981AD3AD27B43F4B30269762CC2890FCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 dfb0b1c3e361a14db333fb3e4686e882d9addbed2983353f621391c476e39d68
MD5 9c1c52a02321aeddd98ffd6e2c12f842
SHA1 67131cb8d4f1553c6f1ecafcf2d5e29a8559d13b
SHA512 d443ce174b949117bf6492ebd2074913da5f620d83322c011f38c4d56b512e2a89a6ac7d5329309b89d13eac289ac5fe22355998207405581053ded8aaf790df
SSDEEP 12288:j4AaQUrDz1EKIwr6o1r3s1lzSoYNtEvckeJy31Z/VsDO7S/u70HT++:jp98/1E7wr6MgTSoYNU3eMFZNsihZ+
TLSH
T17DC423E6C53A0F17D61C96B47094757BD2A4A9C1BE3AD27B83F4B30169762CC2890FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 7e0a2cd4c0f26c5dfe4da18374a91fb0da151b83da64c4c7c1a7162adb250d55
MD5 80deecbd67c7ecdcadf5b2048ec4901b
SHA1 36ce43fc1962b5137f36c6b4cadeadaa536156db
SHA512 b1d19f840e3cc1cf124fbff0599e9bff99a16d9aacd72f7b26e18e73d9d6918695e2a3d6a79ccad94b0b3521b02e970dbcae7db1dc7f081c34d6822f3b5554ba
SSDEEP 12288:gV/AaQUrDz1EKIwr6o1r3s1lzSoYNtEvckeJy31Z/VsDO7S/u70HT++:R98/1E7wr6MgTSoYNU3eMFZNsihZ+
TLSH
T19AD423E6963A0A92D569D274D4A1757BE3B0FCC1AB36D3BF43B062421D723CC2860F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 adcbb982eb0d7f4121d59d593f54f86e7092b4c15cf376ff38f97c48e00de548
MD5 b87f41e3ddcdfb9f9dc5b948bf54410a
SHA1 335517801f56df51de85ed6bc77b2a28d8b6bd06
SHA512 67324d1d5ff0b92f21acb954485a86cd0f5d68675a7f07b1897df6a3207867e61243c5169e19340b304f8882156c39b3ac25502654447b8ac1044ed1bc94b5a9
SSDEEP 12288:WHAaQUrDz1EKIwr6o1r3s1lzSoYNtEvckeJy31Z/VsDO7S/u70HT++:Wg98/1E7wr6MgTSoYNU3eMFZNsihZ+
TLSH
T1EFC423E6C53A0F17D61C96B47094757BD2A4A9C1BD2A927B83F8B30169762CC2890FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 7181b82bcb96aab26c371b5df7de13245e2095d5a8c68a33c1baad4ce7e23457
MD5 40474be14ff6288136c763198256ebb8
SHA1 a809302b515a2e5eefd2be53c075cca3daca2ca0
SHA512 4697877f0efed84a34a22fc713b29360d85ab3621ada5ac0308b0a698eaea1c28cef8d296193d009be464a162aa0d35f3f0dd422b1b8238d018f3eb2838da011
SSDEEP 12288:+SAaQUrDz1EKIwr6o1r3s1lzSoYNtEvckeJy31Z/VsDO7S/u70HT++:+T98/1E7wr6MgTSoYNU3eMFZNsihZ+
TLSH
T15CC423E6C53A0F17D61CA6757090757FD2A4A9C1AD2AD27B43F4B30269762CC2890FCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 7266e6340c4ca445dc0b6b90c133728b1bbdade1636050aef15b569ba5c6c1e7
MD5 56372486bcb0b8c8ff9dbed318f3cd38
SHA1 7b0fb3e4a4ba6e23f7c115d7b91f9f2d99a417df
SHA512 e81500193fb626bc59f5b78129a3eef5e54a43a7a88a10122fade37ba137d6f43bf6c1c6535a7f02bda729781a6a950682664fd437c61a0ecc8231299fd72453
SSDEEP 12288:1eAaQUrDz1EKIwr6o1r3s1lzSoYNtEvckeJy31Z/VsDO7S/u70HT++:1n98/1E7wr6MgTSoYNU3eMFZNsihZ+
TLSH
T15CC423E6C53A0F17D61C92B47094757FD2A4A9C1AD39D27B83F4B30269762CC2890FCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 015711acf2e83c8427b5ef339413d23c2c8f15bf0e157a8ac3d8e703c07bc92e
MD5 51dadb9dd674bb1d06b96b708d372074
SHA1 9ab8989639f07c3171de162fc3b5d4c26c78aa6d
SHA512 0efb31ef020f79c96841aa8483020c94ca940e3d32fd31dd52c3727e32c60a754bc79684c5fdf068f1ea3728e35dccc321c47f3a1dcff523f18ed2c7d1e5c5aa
SSDEEP 24576:SZMSzFVSOP98/1E7wr6MgTSoYNU3eMFZNsihZ+:SZMSzfD98/e7m6n4IeoXw
TLSH
T14505F1A5B36018F9EC67823EC8659916D2B2BC5A4B70C61F03F436665F333911C2DF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 c2cf30c6fb9968c7dbde7afb97fb108caba8d359d4706b3ac7b537dcb0bf40e4
MD5 3e72ea589fc13fa8c90af62a3da3bef4
SHA1 23551c9a1de4b2484609410b2c5f80642c863188
SHA512 edb6f251cfbc1cc8395fea4c2ceedddfbdc06658b7ade82a1967a7fdc0b7cd74ae34f88d8e0e8ce46503cbd02241210d7e656a5a4f1eae670a23f2d105b66922
SSDEEP 12288:k5AaQUrDz1EKIwr6o1r3s1lzSoYNtEvckeJy31Z/VsDO7S/u70HT++:kK98/1E7wr6MgTSoYNU3eMFZNsihZ+
TLSH
T1C3C423E6C53A0F17D61C96B47094757FD2A4A9C1BE2AD27B83F8B30169366CC1890FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 4074eb958ec18506315facb46a4aa618a18d668039a7de7d5781a398a5aafd58
MD5 e75a3b92765e0a5c1727436e7c086eec
SHA1 63befd566005a6c0b29b4849bd95e59bf3d9b098
SHA512 7f2e134278f95928abffbc91ba9118831cccd5173b37724439e324e31c1ee70bf087e5892e7561ba9c8cb13862a5d696bcbbfb5bfa4d8065f337562d0c80d4ce
SSDEEP 12288:uNAaQUrDz1EKIwr6o1r3s1lzSoYNtEvckeJy31Z/VsDO7S/u70HT++:um98/1E7wr6MgTSoYNU3eMFZNsihZ+
TLSH
T1A2C423E6C53A0F17D61C92747094757FD2A4E9C1BD2AD27B83F4B30269766CC1880F9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 c39765d02ab45a9ce7e5a4a098565d2fa580c4cbe2b2a9f90971f35c96122751
MD5 ffaa29e0feaf44820402e6a2e0ae94d9
SHA1 58085c780a81ef289924d446a726e428149a782d
SHA512 7aeaadca0ba753903bbc60c608603f90a0d173cd0c7962a75e0bf5b64b24854fc510c4c98c2a8f27faf3ea7647acd5ca703d18b6ea5f7f8b881f737f498d304f
SSDEEP 12288:HyPz5L8qAaQUrDz1EKIwr6o1r3s1lzSoYNtEvckeJy31Z/VsDO7S/u70HT++:qzy798/1E7wr6MgTSoYNU3eMFZNsihZ+
TLSH
T157F41297636531F9D13A9238C8A12A17F371B8725B348AAF03B453762E332D45D7AF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 30b5e2e83c8b167ecd85fb381829a428b08ad0c74b353e34f79af2faf22308a1
MD5 8e8ce43fd39b9eb3345703aaad60dbf4
SHA1 29fa0e2b675ea2abba2d5117d2becf149b53ed8f
SHA512 511ce0347d98a6a3c8385f6daba2b6796637b7d3ea09a8ce8057e775a8f0550ee9d600812d87a801af1b6df71fc02d28b201c87716d66522abb65ae2b1ccf410
SSDEEP 12288:v5AaQUrDz1EKIwr6o1r3s1lzSoYNtEvckeJy31Z/VsDO7S/u70HT++:vK98/1E7wr6MgTSoYNU3eMFZNsihZ+
TLSH
T1F3C423E6C53A0F17D61C96B47094757FD2A4E9C1B92AD27B83F8B30169366CC2890FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 2b2730f7c880f5cc1b9b39eb84963fcc1985f0ef3d46c0fb8e4ee24934fb6c94
MD5 28557d28cf4ff9ace05648a96450ed9e
SHA1 61acc3a4314f79768960dea20f34ea836b6bc8d2
SHA512 cf9fb9a49a976be468187e2b261f8791e76451cdf8784ad85f3a49298f57ac70d575e76501599057290c569855f8f0fc27a40f6ebd057c1f32bc22fcc850b1e7
SSDEEP 12288:A5AaQUrDz1EKIwr6o1r3s1lzSoYNtEvckeJy31Z/VsDO7S/u70HT++:AK98/1E7wr6MgTSoYNU3eMFZNsihZ+
TLSH
T168C423E6C53A0F17D61C96B47094757FD2A4A9C1BD2AD27B83F8B30169362CC2890FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 535e933c48100f08e2572eea01a39b2fd90f95bc9894f83893077a0fd0653700
MD5 0394d5d57874bb76eaec71c00b06ef11
SHA1 3f5694b1ea2e17abcf746a956578a0ff348311fe
SHA512 bd9447e90c5b95c7d1e6d5eb9ec589b8d342a579496ee0c2e0f0f9ce3a3599a32e396ac60ad058945ad80ca59a34e9e5286880c81b8c3d67e63eefc4f68081ba
SSDEEP 12288:6yPz5L8qAaQUrDz1EKIwr6o1r3s1lzSoYNtEvckeJy31Z/VsDO7S/u70HT++:nzy798/1E7wr6MgTSoYNU3eMFZNsihZ+
TLSH
T1BAF41297636531F9D13A9238C8A12A16F371B8725B348BAF03B453762E332D45D7AF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 3c6298ef7a9e0a26521207f3bc8222d3fe1e53cf52c8e81b8c48b9937d38882f
MD5 ea17b0533190f546bfb60a1a0eca271a
SHA1 99fbc9ff48547fd1443a524f9080b6313e90c365
SHA512 ebfc2cd10d4da0de2382c5f72af57ef155ecd859086afedfc62363b21c37e72c905a3f53b598d4b79f0c170f99605aecafcdd27cb2c17a14d0c693f0c7450b00
SSDEEP 24576:sTHaLl3z0zD598/1E7wr6MgTSoYNU3eMFZNsihZ+:sT6Lljc98/e7m6n4IeoXw
TLSH
T1CC05F1A5B3601CF9DD67823EC8659916D2B2BC5A4B30C62F03F436665F333911C29F9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 1dd6e934dccbac4767c02562a2bf4335f2289f617dea677383f6248dc3d1b4c0
MD5 b81f2510a632e0da0466a14eb6c06a34
SHA1 fba58ee8871e607c4f0ec46bbed2701e6f6d88ec
SHA512 353d2e1906f1a1badb6525298d63a16e93f40eb50466f8bf720eff58eb58ce9ca7966ae43cf512b5a90df494f591691fb333b7fe012b5e2693fa4cc36901b8b3
SSDEEP 24576:537d9CHKy7GZd98/1E7wr6MgTSoYNU3eMFZNsihZ+:J7d9CHKyaD98/e7m6n4IeoXw
TLSH
T19525CF90F3E414E9F1B7DA3588765512DAB67C9A1B31CA8F03A4661A1F337D18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 d89973a910c5c31855a2838a8da0686c7fc2d507ca1139b684aab852c4bf488e
MD5 35f40ecf6dbf8ad47287fd9a98034331
SHA1 5b40567ef7eebeca90f8e02c5316339dbdac312f
SHA512 b8898cb7924432fcb3a774f119767216f82a3014ff5e70528bd7edb4cc05337ac64ac18316a635bf179d75b657eab41cd751ed6ea3e1928751bd42495e863ee0
SSDEEP 12288:gYAaQUrDz1EKIwr6o1r3s1lzSoYNtEvckeJy31Z/VsDO7S/u70HT++:gJ98/1E7wr6MgTSoYNU3eMFZNsihZ+
TLSH
T10AC423E6C93A0F17D61C96B47094757FD2A4A9C1BD2AD27B83F4B30169762CC2890FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 d8639742da89d563a8a7012d2823886aa6b38a0ac9bfc78d2b950d7ca93df9dd
MD5 6710dc9ce68520d218a0d4ff6c0d28e8
SHA1 651aada4ea39b99898437d46cbd16b399187ce91
SHA512 2b6cf84af1373ea78d2c010647cc2318d38683b9e71061fc3d21e118ad6b5ad84233fad48d5f883c3826f5fce3bbbda072636becf2be66767051196a4e8683cd
SSDEEP 12288:JKAaQUrDz1EKIwr6o1r3s1lzSoYNtEvckeJy31Z/VsDO7S/u70HT++:Jb98/1E7wr6MgTSoYNU3eMFZNsihZ+
TLSH
T180C423E5C53A0F27D61C92B570E4757BD2A4A9C1AD3AC27B83F4B30259766CC1890F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 2f1e9c48eb817103ceba5f44970ba0adfeb799077cf0fca35c9c82d267d9683a
MD5 a7ad9889dccd493ffe1b9a21bd36ebac
SHA1 0f7ec7134e233326c83c55884ebedc66b7935b43
SHA512 1feaeff482214f40882719cd03e6c9dc7cab4c7c270d4c664fc3072d9380c6f9d7af346f05b6e5d2db17236c95f5b264cdfc4963dbcc1e8b9621a0b40ebe7294
SSDEEP 12288:rTAaQUrDz1EKIwr6o1r3s1lzSoYNtEvckeJy31Z/VsDO7S/u70HT++:rU98/1E7wr6MgTSoYNU3eMFZNsihZ+
TLSH
T1F7C423E6C53A0F17D61C96B47090757FD2A4A9C1BD2AD27B83F4B30169766CC2890FCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 ba1cc0bb7aad7dbf7e31e8d741e38b683838f6eb6076a9892d5623a5d7104f8a
MD5 311f54f3aff1e6f6518cbbc91e1ebba3
SHA1 74dfeb0fd4c22aee9b19eabb20d377010efa2d1f
SHA512 f9dfd2cb8a912c7714a184626955a7dd5f5d4fe5eb8da84b0ef75ee86c43088375f4b5b77a8b252c1674bddb452ccd252f290ebbde8fd14fea2a4fbb4acd3dcc
SSDEEP 12288:+5AaQUrDz1EKIwr6o1r3s1lzSoYNtEvckeJy31Z/VsDO7S/u70HT++:+K98/1E7wr6MgTSoYNU3eMFZNsihZ+
TLSH
T1A6C423E6C53A0F17D61C96B57094757FD2A4A9C1BD2AD27B83F8B30169362CC1890FCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 f979818ab74b6aacc1422f55919f56c6cc3acbab9be4bbc74ad11b330dcd2206
MD5 d23e1f89ccb600de50dca3c962778f8d
SHA1 11b6a6fdd0f7651641ad3d5efe943c2f3c098a5f
SHA512 6047891923697c03959012d7ce08c4c5c242b23d4bbee5c3fa330855b712774b053b579443d5f308d1dcf5db9594dd76a55775499db52058a980c349fc5eb935
SSDEEP 12288:MYAaQUrDz1EKIwr6o1r3s1lzSoYNtEvckeJy31Z/VsDO7S/u70HT++:MJ98/1E7wr6MgTSoYNU3eMFZNsihZ+
TLSH
T1D0C423E6C53A0F17D61C96B57090757BD2A4A9C1BD3AD27B83F8B30169762CC2890FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 830605ab7751d9f5d906c3a6681e5b2a2763961240376e2513c80feef8a3f9da
MD5 1c76ba5ab6d12f59b3484d2c834b70e9
SHA1 b49d285dc24bbd3dd41a2acbf7fdc4822dd9bdb7
SHA512 da8f56c8b4fe243997af5f4a7c95f37c65bba471002bb9252c22affb0a163c0d77b9ee2bf287466c11e078196bf8943243c96a75a4916dcf9a7f9d04e2d1ceb1
SSDEEP 12288:RBAaQUrDz1EKIwr6o1r3s1lzSoYNtEvckeJy31Z/VsDO7S/u70HT++:RC98/1E7wr6MgTSoYNU3eMFZNsihZ+
TLSH
T135C423E6C93A0F17C61C96B570D4757BD2A4E9C1B93AD27B83F5B30269762CC1480F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 ed7a50c39e0b19fa3676649be9772ebe1d8990c36c827e9284b63303c89799d5
MD5 804365c6ca475b73774eabfbdb9c3607
SHA1 a6ae4da709d3fbcbee1209664386bfcb6d3ea55a
SHA512 df250034fcd91562603a88481cc2f8021494f38fc2d46d8d8866f0fa323e686d4ef9fa90bf89b62cf7898f5dc22ef59ecd39289436b2aef88d450c5f92b63367
SSDEEP 12288:2HAaQUrDz1EKIwr6o1r3s1lzSoYNtEvckeJy31Z/VsDO7S/u70HT++:2g98/1E7wr6MgTSoYNU3eMFZNsihZ+
TLSH
T1BDC423E6C93A0F17D61C96B47094757FD2A4A9C1BD2AD27B83F4B30169762CC2890FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 f0919a0a29345615ccff14ea7f50653b0ee3102d8ccd4f255e2ad23c7b7c42aa
MD5 3645eb956cb69e7ac6e7961b741b2bc6
SHA1 833e250eae2844c33b800cc115071a02e45f7434
SHA512 25cca652b242a49af6353741d64d030839deff7d3e27224918fc273002c231fef61bd43391424a0d208ec6abbe15d89e13e574a1b98a657124a45752ca679261
SSDEEP 24576:jfwvok9RX6wkyAIW98/1E7wr6MgTSoYNU3eMFZNsihZ+:FMnYIW98/e7m6n4IeoXw
TLSH
T18835D029EBDC08E5E177923C99B7460AF6B178591B31C2CF02AA536D0E37ED45D39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a14da624b47f01331704ce4f42e15153b394eeb58b0e0ccdf3d1cbcbf5d90730
MD5 15812bd582ddfb7046a14ea89448557b
SHA1 9213a7dce37fbc3ea7c252be5a179444962dff7c
SHA512 bf92c0644a66b1dbd15f69132c17d2b419b7ee937df911182d86f8fd8f8bff4946aa164c5cf77a2d316198615fbef78bcdacb5a05fc5cc1c672a18f7913a217f
SSDEEP 49152:sYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0V98/e7m6n4IeJ:SySzP4/eKITN
TLSH
T10D067C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1f240995d888e11c5d129a71c0c1c765064533ada0f540376f35eec9d23fe4f2
MD5 48d73512612b36a3e58227c62b664bc5
SHA1 2747ea482c8640328f6af6ad104332cd861f9704
SHA512 00fdd1c55181120760b75bf6ea207ddc79b9b3c417acd43f1583bd2c80cdd39eea97d7ff6d512c41a49dfa93d401082fd8cf7c85bf07ed25a26606b17c56c2c3
SSDEEP 24576:j47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY/98/1E7wr6MgTSoYNU3eMFZNsihZ+:j47JUQj1irIhCnDHUPfF/F98/e7m6n49
TLSH
T19365AE1EA3EC01E5E1BA927885155A1AEA71742E1F31CACF12B0837D6F23ED45E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 c2debde644421d9f263ae0afe0a88b3e9b9ff4dec0cbfbf9f1d86e15a326b7bc
MD5 f9de92be1fd59f29b17df201622ebe1b
SHA1 a0665b6381ea50fe586178783811076d5880f688
SHA512 c24db5fe961a6b336e7940d07c774e9dee39628dc62e83108c32ef41fcbe5d0a75e8246f8e36e65a71bdea5ff2acf4381f712ec2fd96d280d93321a7223f4f5d
SSDEEP 12288:rNsfJAaQUrDz1EKIwr6o1r3s1lzSoYNtEvckeJy31Z/VsDO7S/u70HT++:oa98/1E7wr6MgTSoYNU3eMFZNsihZ+
TLSH
T12AE4F05AC26802E9C06EA279C7916A56B3737C5197E1D3CB43E0F23E1F366845CE9B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 1c3b983469cbf03ab52eb5e9c74d3decf3222108dcc38ee6a0c30715ce26da4e
MD5 cb50f7d3c8fa157fa666094fb30001d9
SHA1 c214a4ba0472744d7936891725ca4501088fd962
SHA512 8c797d9d1b423053c4b8f94e39283678acc38cd4eda0c26e5530c640e47c11e56d105c4701effa53c206b8451a6c9f04b5ced600a5d7a991484e8353a9cbdc1a
SSDEEP 12288:CcKrbBqGkDuSF0qzPXyriFzU/9ONr20AaRM/rcZwE72GDLb:CPbfU0equlCONZAaRM/rs7ND
TLSH
T1AA5539107666CB4FC66940321E73C5CCAB707D45FE05AF0373C98B3F9576A58BAA2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 161b31d036bfc48444ab56f1aa0b8b2b8a9bccf980ecca59dabeee479e6e75fd
MD5 911c981f8598e46e7e26217b7f27e63e
SHA1 43cc7d665f1d7253b16f175e76fbe58b09f56cf1
SHA512 904d3c2a19b3f4a891a470398f748795e9f4fd0862f31f1211f1ea1bba9182a30465caa3c3f0bbe8fe46968f4d46d5fd74435046027d2b9b22f009eacbe7f72d
SSDEEP 3:OlH/lvWKTYXkr2EcAb3b/tlA3mCllltq3mCllltGlslslslslslsl6Q9lt:KUKTYXzAbL18mCtSmCtEEEEEEE1
TLSH
T1228192D48F400A32E2AA2032083963880728E085F98183FB410D39624D362884C26A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 acb1aaad42afa125333a89e010c8ce8726cdddf22a06ff6e98ba01104fa84ed8
MD5 9892abf3f5ff78e33cd54ec78a3ebf28
SHA1 bffe983a9a831130977dbf114208d712735f8b9b
SHA512 bac3df57bc4d87e76ced5d909ab03d276b2f643bc7f64321c346c3489f276c2265a396319525914fc4f6e7ae49f2581db8574cc3ceeb9bf3b1af302bc68f06ea
SSDEEP 12288:fjwI5VeVrO00rr6CxxEmz98fjeEnGlzRvCTlrz:fjwIUrNwy298fKKGhwd
TLSH
T1C5751B406136E78FC1BA503203369B8DA7B4EC16B7096F26B38D457DD86AB45B0F97C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 57dbc3a546bfece55d7a44b8cf5e6d2f78a7e6f9effd178b80b1d4a6c9e23248
MD5 747554cdd526fda7aa47036b6288417d
SHA1 af1c6337f96607bec876cd0d5c6d7ce00e60ea54
SHA512 806a67180cf95d9eaccf08ab4848b1a76caa2e45cefa00f03bd4678157a663197e6f8ca22a5f39e0ae17a87cb8b4ea02ba573721cb9ff6cc6eca7faa7e9a2126
SSDEEP 12288:sM7RAaQUrDz1EKIwr6o1r3s1lzSoYNtEvckeJy31Z/VsDO7S/u70HT++:tS98/1E7wr6MgTSoYNU3eMFZNsihZ+
TLSH
T1DAD423E2C62D1F17E57DA67460A9B53BA258F9809F24C1FB83A4B34168356CC5CB0F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2d286a5669ae5a2530c9442716eb74e90b2bd5ed318eb7c17ee129298aff225d
MD5 3bbd8cd85ec2427b01d3cfc48b1c4b25
SHA1 645b68c87f4b75bcc6638056fe9ebf404a487bbf
SHA512 458e24e754ac1915aaa0ccfb99cd8fe0f9f0012d07d5c199f37f1255e8a9ac7ac90e7e5b367dc7eb61725efe8604bcabc3a10262968e00ebc2b38ef811863d67
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYc98/1E7wr6MgTSoYNU3eMFZNsihZ+:/gb4mBIBhGF/98/e7m6n4IeoXw
TLSH
T10465AE1E22EC02F5E0F9D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 d3c270118686a33a034123a34629266a99902f85d0388714c483337267c33c55
MD5 fc04b298b5e9f25b99fe4d8bbc90dda5
SHA1 81ebc0562ee9f8a7a1a9497f2c3dee5a2476ff2b
SHA512 3283e2ef33bb10509908648a9f7f831e5b018092164c95acd4890411be926d8c0c6a2c16f8c6e1a15217c69369cabd8c0459024016bcaf758c910a0f2b3f1a37
SSDEEP 24576:zG88u8FpJqH1bzria7/mP98/1E7wr6MgTSoYNU3eMFZNsihZ+:C7ZFPqVea7/098/e7m6n4IeoXw
TLSH
T13C35F165A7E102F1D47BD13889824667F6B1B8251334EBEF07A88B511F23AD50B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 bbd5c734b2ea01dc2bcc82781633bc4585922c8fab7fe9629010e46710764afd
MD5 196fc8dc7d387098240b55ce93a6b029
SHA1 dc9b7e8d9b5c7009c68c1ef6dac5554cb6786b6c
SHA512 e51c4259a3aa040e29bd817872b2e0e378d7ffc98f91aeb4a0a283c857867f91ade79413c673ebc08ecd4859245cd6de19998a7cb91f5cd745b3344aed77091d
SSDEEP 24576:rPUr+NQD98/1E7wr6MgTSoYNU3eMFZNsihZ+:rJQD98/e7m6n4IeoXw
TLSH
T15705E16F62AD1CE5E67AE17C8582961AF371B4521712D2DF03E0817E4E27AD8BC39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4e08597135871d5974423f21ab5a75600133bce0425780cfff5c1e751ac0b4b1
MD5 7deaf4d2f0f4c78d42432c8898088560
SHA1 98f164a8a98e85eff4f86abf68658bacb272d3d6
SHA512 6392933b29214dac552527edd1935164d9de29247b1a3dc92de8c36296d8d47d68bb9e479aa72a74e272a2eaa80aa833760b876f28d9d5a959a20e52d1c6145b
SSDEEP 49152:pBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjT98/e7m6n4IeoXw:KG05lO43bz/eKITN
TLSH
T1DFD5CF6A62EC11F9D0BBD17CD9C64A0BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1472f61e64f702ba301c3405bf601f7218a31f93b0208744b2ad233a9a469bdb
MD5 7c893b05491b03faa389a1965f87bd97
SHA1 5661a2d9561490c3bd666a0dd97c6416e6c6ed98
SHA512 f77b76b41e8cc51f3eeedd4c0e6f64580b113fef4a079678d839989d803223e8e0eb78667af5e43704d6d514463a1f0ac93f55a77bc0738de0a7bab8575f5616
SSDEEP 24576:4fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnV98/1E7wr6MgTSoYNU3eMFZNsihc:Aa5POZ3+Jt2pasx2+mb98/e7m6n4Ieo
TLSH
T18565AE5EA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 209660a94012055f1e375043c1e66168cde6e37893e8f323e7ab17b760963baa
MD5 7417718b6efe4334a8c7f3fc61df1bac
SHA1 7a1c47736eba12cd9660ecaf4bc5f4b823475e42
SHA512 45a65140c5ab1a2746795e88dd338b5db401c5ccec0d188d1a1032fb66fb789f5349853a22c4f2d513ebfb682214e35600bb5b07700e0e4e63030d159544df23
SSDEEP 24576:oNcwHdjbyQ4nLC18lb/EOjowL7Fk398/1E7wr6MgTSoYNU3eMFZNsihZ+:oNc/zEOVHFU98/e7m6n4IeoXw
TLSH
T167858C6623E901E4F1BBE1BE89779546FAB17865173086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3319d9da1b8f97083722fc117c808bdfc56543b6a08fdaf91456b84898e80b6e
MD5 0143a6b954d805e4346944dd2e66313d
SHA1 5afe487cacf5db6c82b53045eb6f9b9c920ce592
SHA512 7c1569030bf55f21e5b8fc96a419022a5c1b09c28c8539c4bd39fa3ee2bddcdc5222bb81bc9fb89e8cf9a6318ea83de57d9e1c933b30370a5a19a95ec5206b7c
SSDEEP 24576:q8kNvNnaFeYhJNtmZBmq98/1E7wr6MgTSoYNU3eMFZNsihZ+:q8MwBtOmq98/e7m6n4IeoXw
TLSH
T1C855AF6EAAB806E4D1FEC6B4DD238512E6727461173293CB8390C13F0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 70a46e9817561466943245ac1ff5349dbfa4587f6925654a66039e6ac370e58a
MD5 e6b02cff069cf3fca75fa8afc7e726c0
SHA1 3baaef8c2b473f55ac7ffed583cdb23cecabfffb
SHA512 0e8787ae1e4b272f07bf32605b21f486816a21876d6d7c3813f263d13c8009d2b6ec0c91ab6b309fb81917627d3dfc95b47254c92a56270e27b2573f0955f038
SSDEEP 24576:UD3FHshBIYQgAe98/1E7wr6MgTSoYNU3eMFZNsihZ+:UDVHeBIAAe98/e7m6n4IeoXw
TLSH
T17425E17EE66C04E4D57AD1BCD6A39A07E37138A9033256DB02D481B61F6BEE42D39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1300-316-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1300-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1300-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1300-109-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1300-103-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1300-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1532-35-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/1532-54-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/1532-48-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/1532-55-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1532-34-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1696-57-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1696-58-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1696-64-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1696-296-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2476-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2476-15-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2476-22-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2476-127-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2476-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2900-311-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2900-76-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2900-70-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2900-68-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2972-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2972-129-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2972-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2972-137-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2972-135-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3000-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3000-151-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3000-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3000-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3596-80-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3596-86-0x00000000008D0000-0x0000000000937000-memory.dmp

Download

memory/3596-312-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3596-81-0x00000000008D0000-0x0000000000937000-memory.dmp

Download

memory/3720-173-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3720-49-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3720-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3720-41-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4996-114-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4996-122-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4996-116-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4996-315-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5204-330-0x00007FF821180000-0x00007FF821326000-memory.dmp

Download

memory/5204-411-0x00007FF821180000-0x00007FF821326000-memory.dmp

Download

memory/5304-26-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/5304-0-0x0000000140000000-0x000000014025C000-memory.dmp

Download

memory/5304-29-0x0000000140000000-0x000000014025C000-memory.dmp

Download

memory/5304-7-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/5304-8-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/5304-1-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/5600-337-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5600-335-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5600-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5600-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5600-91-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5600-97-0x0000000000400000-0x0000000000460000-memory.dmp

Download