87262737e01cb8000d0e802690a44276081b2df9f55461d31a6fe12a03d38010

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_a0259cb3ae5029ff9d3c6c6a761fe4b5_icedid_njrat.exe
Size 1.3MB
Sample260629-e5xraac15z
SHA256 87262737e01cb8000d0e802690a44276081b2df9f55461d31a6fe12a03d38010
MD5 a0259cb3ae5029ff9d3c6c6a761fe4b5
SHA1 be534dced6a3b27d2608775daeb475f50118d3a6
SHA512 532f7900482bce9a9bf5374a6d04cb8543442ea3d960f6ce9b56a23f0dfec964a15630d6487f5be58df3656a2a90f92cf717fea56a6895e5a3a9b6858be30b1d
SSDEEP 12288:FNz3YJDTSzAUfYeU6LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:FNz3USzLwNyBo4kx929bL3Hnx
TLSH
T12755D0D46ED910B9DEB789788AC18405D937BC160771AADB13503A52DE336F38E3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3604	elevation_service.exe
5696	elevation_service.exe
2000	maintenanceservice.exe
6056	OSE.EXE
5584	PerceptionSimulationService.exe
1668	perfhost.exe
4504	ReFsDedupSvc.exe
3068	SensorDataService.exe
3628	ssh-agent.exe
2452	AgentService.exe
1616	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-27_a0259cb3ae5029ff9d3c6c6a761fe4b5_icedid_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-27_a0259cb3ae5029ff9d3c6c6a761fe4b5_icedid_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-27_a0259cb3ae5029ff9d3c6c6a761fe4b5_icedid_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\629ac743c353a95d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-27_a0259cb3ae5029ff9d3c6c6a761fe4b5_icedid_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-06-27_a0259cb3ae5029ff9d3c6c6a761fe4b5_icedid_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-27_a0259cb3ae5029ff9d3c6c6a761fe4b5_icedid_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008cfc25458007dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073554d448007dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082737a868007dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3604	elevation_service.exe
3604	elevation_service.exe
3604	elevation_service.exe
3604	elevation_service.exe
3604	elevation_service.exe
3604	elevation_service.exe
3604	elevation_service.exe
5696	elevation_service.exe
5696	elevation_service.exe
5696	elevation_service.exe
5696	elevation_service.exe
5696	elevation_service.exe
5696	elevation_service.exe
5696	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5848	2026-06-27_a0259cb3ae5029ff9d3c6c6a761fe4b5_icedid_njrat.exe
Token: SeTakeOwnershipPrivilege	3604	elevation_service.exe
Token: SeBackupPrivilege	4504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4504	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4504	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4504	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4504	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4504	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2452	AgentService.exe
Token: 33	1616	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1616	SearchIndexer.exe
Token: SeDebugPrivilege	3604	elevation_service.exe
Token: SeDebugPrivilege	5696	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 4588	1616	SearchIndexer.exe	100
PID 1616 wrote to memory of 2520	1616	SearchIndexer.exe	101
PID 1616 wrote to memory of 1544	1616	SearchIndexer.exe	102
PID 1616 wrote to memory of 3100	1616	SearchIndexer.exe	103
PID 1616 wrote to memory of 4628	1616	SearchIndexer.exe	105
PID 1616 wrote to memory of 4736	1616	SearchIndexer.exe	106
PID 1616 wrote to memory of 4356	1616	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-06-27_a0259cb3ae5029ff9d3c6c6a761fe4b5_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_a0259cb3ae5029ff9d3c6c6a761fe4b5_icedid_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5848

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5696

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2000

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6056

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5584

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1668

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4504

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3068

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3628

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2452

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4588
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-537605601-1362463912-856654178-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-537605601-1362463912-856654178-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1544
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3044 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3100
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4628
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4736
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3044 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c2cd3c2b8318d4234e283bb70ff16669ca783c11f6a1a4d6a3f47f1ed05682bc
MD5 122bccbd0e693390259ee41539531c2e
SHA1 c87efee90b83d1e911c84677224d4a2ebd409bc7
SHA512 028bdc3309c0a294e150fc1351dcbec7c0b40c80ec396bf1c3fac06f90309e6a8baf88faba2b8940b91fac9c4239cbc1dcade7ddd8eaa714abf6fcc0a0972ed1
SSDEEP 49152:/b+632BuPkFKRrdE6ohvstBhuXjfS4LWxn4B+kn3Hnx:93q6sjB3+k
TLSH
T1EDD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 7e5b48e5a5fb72ee9656f20e0a7c90775f3fd51aa109ece386b97c44e7ada878
MD5 8f27a4402fff24a0d87d909e7e6d74ba
SHA1 d298fe80d369d51630671f87be74c97c6c028d73
SHA512 ddd7817e2d439d96172c68a2c69cc2d93ba9bde6b590b78427402d485c8b216d9bd8669f5446dbf889c6b461bff87ce1e437aedf6f1997398d7214b1ec6a218a
SSDEEP 12288:I1XLsswWkxy2lRq2czAhLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:uXYfDtczAeNyBo4kx929bL3Hnx
TLSH
T1ED65012867D409F9ED6B9278C8A2C511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 25a8a216d5ba475cdf4fd93c74842906b21c2dbc3f22b8b83bf86b4be277f20b
MD5 ad008346cced30a780864641e5448aea
SHA1 0717d08b4ad783ab150429facccc6f5654cd7905
SHA512 a8325f710d84d403302c72992a4d58ca6e64b945a6253243e5985464668b6d12f29f960d8d848127b44c62c9f4d053037c4d3bcafb1e533c95131b7d2292ca14
SSDEEP 12288:bXZNYVLeyUji0h90ZD0wxpGZIVuArHsQLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:d0Le5ji0hmxfrMvNyBo4kx929bL3Hnx
TLSH
T1A3859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f890c9c42f201faa6b30623687d08570a275b8fcd4836b9f6576b41b5de817b8
MD5 ed07df4b78c28c59f8ff7e8512f64d33
SHA1 125a518244c741d53bb65ede821b97a6d1a834c7
SHA512 a9114d907a02939533fc13e73642936a8a88de181fe0060a3bdbe7d0456671a8a4e95221d8ffdd99275c1b89b34ecd1b95e6d5f539afebdf036652e6405adfcd
SSDEEP 24576:ua7/ezSC6vUyD/aqgrvWn6q8wyuJNyBo4kx929bL3Hnx:p/ezSC6vUzPveHjyrB+kn3Hnx
TLSH
T128755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3506b70574520526e2756a8587d2da2efae06466b2370cf8a47cd1e8797bcd84
MD5 d11cad1b41336bc7453a0bac033589ac
SHA1 7e69075e1440a3f5cc656126bb63e2616ada83d7
SHA512 1140866a14c915aeb83a4dd012debb481732d629ada8eb882c3f9b6564ba28807b9e7ec6d6205231954f4c506e12f7f50623edd45cf1018e5a7430a3c93fa387
SSDEEP 12288:dVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98dLDAptNyvUgXZ32dT4ePc7N29CD:dVbqPb88hv/l+YCNyBo4kx929bL3Hnx
TLSH
T154559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2c7f7f4232d1316202175d94f65cd6db801ed40672995c3ef6ed61615956892c
MD5 6d1554b35be2afb968e23e5aaf6ecb66
SHA1 1bb6aeeaefc265ac662cc2ae67b19cdf6d1c1bf4
SHA512 42913663ac21e2e3dbb139af53fbf9ed3feccebfd3914a6368751d1a46ef6553f02c731eb040656ffc24f0717538b139c41c118fadefc29a17ab9ea7d5176f3a
SSDEEP 12288:DmcLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:DmDNyBo4kx929bL3Hnx
TLSH
T1F4452312470C627AFBBD3F70749E8454CC35BC8D0D95DB94DE62ACBB58BC9A2DA21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 67d1eb8e43c59c56ef43fc40612a212a182ae46b5858d4908ec622bf9bb51fb2
MD5 d9d92ddbfc2146e1a1018e402f1660fd
SHA1 713a11915482506fa646fed44fb5daa754e4a9dc
SHA512 15184d3b1568f1c60d543acca38d97a78237988936e95aa04d8803a938769b586a5fa3ffb1b4c781b782243f8b68314357f0feea40bfa63e33b90ffeb40eaa98
SSDEEP 12288:2eBNUbTVO86UlLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:2JIU6NyBo4kx929bL3Hnx
TLSH
T14465CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9e36d0a991cd3c1352b54b7fc8fe492cc0955514f888f429bf3eaa4d036438aa
MD5 770ee3eec268ac200bb695c282439058
SHA1 f267bb53f97d1c2e8ac69bd304bf55baddaf451b
SHA512 5762dde67f2aa4971db9d60f2e1b6606db0da0e298efcf8e0dea7a01c12bdb9858559790cfeda2105dfdb0c82d591a60a50bac794a521601617f514c3bcc945b
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THf:CQvGAdlCEL8c/DRNw5Ce+k
TLSH
T124266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 9f1b0aa13326c6f0e9e5fb549bb5153a91f68a9a923976ec2b14d563a6f9ac5b
MD5 58d38ba778fe6849743e366ffeef5bf5
SHA1 f0e8d01dc3e64c2c5a76d17d78325f78cb02bd69
SHA512 1fb6eb57df9c2b6f76a2451076f2b2d77c288dfb346529dab558acca798cee72b53b77b261cc3f9d7b9c53303ead6469eee42287f4d0c0b92f6554f83554bd06
SSDEEP 12288:RAwSfxL/2Dc3XDLLmt0LDQewsAj3LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:yOewsAjMNyBo4kx929bL3Hnx
TLSH
T1CF75E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b226bc98ebb6ad03df63f9f2a69b98a4b95dcb37cb3d62f897e7e73c5399f4e8
MD5 bb8cad366d0fa2c6103b55d0af2ced25
SHA1 54d29d932b74a39a778d3cfa4080d4249942989d
SHA512 c193bb61b14649d0a3465e55373416e237d6072ccdffb5a7d6cea408a34b9183f9635b787dd043b1501cc499e0c669e06733e6849b5b8d2e59d6e34bd66499af
SSDEEP 196608:SUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH5+k:SUEtQevvqc2W1cpV2tI325
TLSH
T1B2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c4c4d6a84460b17f509dae247a73ff9f946c408c38cfac7620a65f169a3f7f90
MD5 2763138c3f0376b8d63d7763441293bd
SHA1 f27bcbc87554034a69c0ea52e6e7d57ccad669f7
SHA512 b21f4152ab6b358dd1bdd0d9fef73c05d66469543e1cd3810bcb81db1711414bc81b4274f1597b3b250b785e6683ab3723517ff63daa42890d853bea0203a934
SSDEEP 49152:sCbRquA/m2yL5zTfFiV+XenmE3/z3B+kn3Hnx:FoquVjnm6+k
TLSH
T16FD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0f89042ec0a3e75c6761b01332ed20f2ec66b37dc0c59fb9633c6ddc55dec07b
MD5 350beb0ae4bb21ccb6ca314ecf68f814
SHA1 635612c1785e703e71a3a9a596bbfe6121d68a4a
SHA512 d3a14edb2ca667b02151ead3f7dd29efc589ed5b96109560d38998b779fea0e6ab5dd0880d4e978e8faf8ca395f34ed718878205937bccfd018d2686f4c69447
SSDEEP 24576:PAhGL3IFoiwtA5l7S53lNyBo4kx929bL3Hnx:PAMUFoiq5iB+kn3Hnx
TLSH
T1EB359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 100335d3d7e476edf357823df430bc106001a108188528250613dfc73f38acb4
MD5 b526dc2c44997d72a3a5b5e0e6392a65
SHA1 efdb30e1f7110581b65596cdd5f5230089289215
SHA512 c7f82127e476cfb621be1a3a7afb2412f5f671c8fe370050ef892a91ea7dbeb539e04cfe22494e3b0c96977648fe2e9ba701f87a237dc641320d09c050109e41
SSDEEP 12288:Omw5HEjsChNzBFgl0WDm+CiLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:Hwu6OWoNyBo4kx929bL3Hnx
TLSH
T18D65F10677A81CF9F9A756388547C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8ea44b2e904d07bf09635a81a80215c60354d9302414b695be93f8ba6a35ee5d
MD5 488bb6fa508a9b1ba4182fd8b00e11b0
SHA1 1f8582336ccc79c2463cb35bcbddebd89844bbfb
SHA512 1afe89f4ba155633c460a76f5b12456195663d44100e2e5fafc44969164c662ea6d445eed267e8fae36ab8d071330598da8275710853324859cbb0e9a14d17e4
SSDEEP 12288:6gZ1IyHLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:hZunNyBo4kx929bL3Hnx
TLSH
T14F551216239831FAF2AB2678D8E58544CB327C461B7183CF5A2146BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c56217c7fce77d5ad3e56a0455351df6feb9faee9735f77f0dd505684859cce0
MD5 4faf1bbbf8ed3d318e1bbfecad339aac
SHA1 3c31aa218612005db4c6c7d8ac8ff0cd83570e71
SHA512 6dd0e65aa8a220a9178118a43fdc4018337ba48e860a5922a5c51546e4ea90d89f58c6bac9722d311df6cb250a9286e1e63ef4a540e20b84185885ac1db73583
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ub:6QRQyi36YOcPbLvw2gAf+PN3b+k
TLSH
T11D666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 54f61d8fbaa278bf24b74969e2a22bb483a04c641f93d05cf93866dbf7977ebc
MD5 f727ace1890e42dd7debdc456a741f2a
SHA1 84cbbaa550a2e64ac93b0119d5fdae6b0f5eb18a
SHA512 ccdeb1fab1c55b4d4082fcb6cdf8fd14bfc5900faef8e4f9a2d93e9ca64c15ac1ed6189d5c438bd9b702bc3fbe074089f16b5b1b87d8a19ca1cc954bc50d0a51
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ub:6QRQyi36YOcPbLvw2gAf+PN3b+k
TLSH
T1AC666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 17f56ef290af98b851bfc196e5b4028008ee9195777d9f8a2a7eddeac891a3ea
MD5 0a957cc85475f40455879884d58d35d3
SHA1 14fdc188607f703d0dfef06223830a31be55d1c4
SHA512 1bd022458383108a9f845759c79f49c9512f21b9ed505c56c3f210039568c0c5098f5cc7c4caf9c97c7ccb29f41850b8d4d311e75945916a1ce0483dd933abc8
SSDEEP 24576:CwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL03NyBo4kx929bL3R:868Qg55nhceWu7PNU3/HB+kn3Hnx
TLSH
T12DB55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8d92772d5ac6e843d91c28aa45e4750a425f5510d3e0e724b5f8c60a9bef018a
MD5 3f42b12bdcd5c141c41f2e91361cbad7
SHA1 8974188bace5cc9c2189a14483186a4c0beb84cd
SHA512 bb21519071c4021eb3c83be386eda0598e79b038d6718093b05b740b862a1666d78ca26cf56a5660f125b429cc35317abeb444967cbfc7ec237ec804067de02e
SSDEEP 49152:U3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99l:By5112gYy5azzVvt69nLKnhZQ+k
TLSH
T137167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2e03b92e097f1b9af0e7bb81ead82ae2016cde1e7813f2cc1ea83a44c56dd66e
MD5 7524f534efabfb047f59b3d3e37a9e3d
SHA1 678ec8e1c1691b6c1bd65bc2cef18a217578eb7a
SHA512 ffcb373b068e5e089b1afc755f1482a4ea8a3e8a574c84e768d52c20dcfb10abb7848db3950704c6e3d9d694788237557abe452afa9ef0d8776f11d7de99ab27
SSDEEP 49152:EB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glMB+kn3Hnx:eu6Jmdxd2dQ+k
TLSH
T150D5AD13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b72f965a03be61a2e324bf28ea3f83e473134a36c882247cfeeb2534d00d5eb5
MD5 bfb260b4fc6bbfdee0beed08422fc11a
SHA1 8b2effaa030258f0d4515bb0888ff7dd417d2f27
SHA512 134b87c8da53476d97d465b8abfd72297dfd9d01be78eb613ee6141837469065c755cf1d1e1fe1c7bdfc00c3a6e041c49ceee48cd2262a446bb2bc6c62ab6b6c
SSDEEP 49152:W1hpsNoJpF1A63U44CwH7R4xJB+kn3Hnx:WmifPWR6+k
TLSH
T133B5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 28003273e82f9219508ba447c57017323df3c6e740e7dc516a438d9b4e094fc6
MD5 781e178b949f13cb125f58f7de5ed1e3
SHA1 467f55c5ba68c3dfe0d8a0cbed9dabe284e67ec6
SHA512 4b87bbeca610640f0295f3bf134fe8673f41b5cb4cd57eb48d450146d5d3965e2bc200a6c172061bdff3146187e935270fec3fc2fc02572da31751d71a40446e
SSDEEP 49152:nSuZQIY0Be2KcRVtOnks6NMHqIB+kn3Hnx:95dKii61U+k
TLSH
T100C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c93f9a30e976e011b6174c424b788adbc82f420a92c4eca3eaaccb81be2e26c5
MD5 eb8165ca12e8272886e21bdb64900432
SHA1 2a7c41d3fc87127fec96107d6fe6dfa48bf80812
SHA512 9824bd22e836f56eefb357c588aac94ab73841206bc002b69400424e584a5facbb4e0b330a6c79fa99a7efe68c4d3cb83f84bcd621edbae1f4a2b13ca245b0dc
SSDEEP 49152:MhtSn8EApI0fig3giDn0AP5wVB+kn3Hnx:tX2imphG+k
TLSH
T19495BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f392c9be2ce317a0392298cdf310e83d07738eec171621a652fe7885bc971bdd
MD5 868883e89c505e10ed50d232bb0d20c1
SHA1 b5f95f1efb2da47928dd6d4aef9ee240c8dd8a3a
SHA512 1fecd17b9d123c76e01c712a62742b3b3feac4834050af9860637b9a98d3a01f776e72df165013a058b3e2ced784c9505d57e01e736bfe87675e0b288e66369b
SSDEEP 12288:wkLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:w7NyBo4kx929bL3Hnx
TLSH
T1044523025A0C637AF76D3FB0A44A8558CC34BC8F1E9593D8EF27987759FCEA25A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6ab0596595816a6f9148b712a94722cf36f5e19ea53504bde8cdf5ee7c134832
MD5 6cd5fba02e7932301980e737cc4016e0
SHA1 aa3996acc959ffab7b0518d02f9f7a484bc142ce
SHA512 781f890e40b76fc358045c03528fcf97769ff595e54ab99a793d19318b17662ba6dbbd8284b3c2ae9f2a9ce72deea4d6a3dd77b0a4f8ae3a9cc557abf896439a
SSDEEP 12288:CjLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:CwNyBo4kx929bL3Hnx
TLSH
T14C4523125A0C227AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA25B21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7710527db19cbb76fac0b46e04a0314864789523c7e6e34cf0ecdc7b5009e400
MD5 6b8988494739b844678024e0969c994f
SHA1 ff042bb8debdc4345c830b940eb8e2ab2597a145
SHA512 ad51b9af4237b6203a194f13ec82451c1e39d2ba7128eda6f9a2e86f43018b0a5f86d8a7396c3759a83181898bda475b0d8fc99079032305e3d3b9739892e3b6
SSDEEP 12288:rNLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:rSNyBo4kx929bL3Hnx
TLSH
T1214523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 6db387f90292b57bee27cd9168db5b9fc5c262f15ff9d0195d07cb92d2e20279
MD5 4007de00a914a4a67fbd2db140319ffa
SHA1 7081d0d85092946e58947dac85d557c0ece90ef8
SHA512 8476c325a1e06551160c0440d59415d6f50a66cd7aa02c969acd81bcbca63ea54fe5de960f5031dbd967ac3b4db71587cdd716481a9c175cff162b9c84dc0e19
SSDEEP 12288:TVGLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:/NyBo4kx929bL3Hnx
TLSH
T1D94523025B5C12BAF97A7BB0D8568054C835BC8A5B7197DFDF124CBB0DB9BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 bbbad93e9f0fda50eae8350784b67e8934de8580a4f6d912a51c0b9d71a7a882
MD5 e3219dac0df9f509d3c35620b5f65952
SHA1 81914ecb02c39a9f2f1a28fc33f72a70326a8613
SHA512 1a5b6ad68ae65b05d4840bf2c50d146ecc728556097d7adc9b2d059820e71fc597ba2458fd8818a4068fb21f40b4be47956de59bc029f71416788fa906950bd2
SSDEEP 12288:u+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:uNNyBo4kx929bL3Hnx
TLSH
T1FD4523025A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF67987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ff26896a15e7677281cdefaf1f866e0714fae946b4db6d657a2b0ba7bbc0de11
MD5 788535a05e95b227afd6b4641ee18305
SHA1 9bff48401203cce0bf52bba3641aca79ff0337e8
SHA512 1d54758eaa08dc2eebc0f978eb307c39961c99983a7139ff0b05450151104a828b787690a67206cf403e6becf2d479300342eee3abf71848019f45f0a3176300
SSDEEP 12288:A/LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:AENyBo4kx929bL3Hnx
TLSH
T1774523125A0C227AF76D3FB068498498CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1a55204a7a1a32d11511f42aff5625168fa14a4af611ae82a86fcac8c592e977
MD5 07a47fdd346529dc107724dcaab75ff6
SHA1 30315b2603b99af8b42a00c1d3ac9e9c6a11b20a
SHA512 fd79be49cf740fc4c1db5d260cd8d75cd91911eea6c2d41393c78e35ce2d988d11ab529e1f90558d9fc76aa0659049c038cd8d7728fecc2cc0438044b5f80100
SSDEEP 12288:RbLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:R4NyBo4kx929bL3Hnx
TLSH
T1054523129A0C233AF76D3FB065498498CC34BC8F1E9597D8EF27987759FCEA25A20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 81bdb98d1edafa1ddfa673f483664a9e42fd576bf96a9b898e2a908e38fd503b
MD5 3629e1d0655849dc59941f72def8f7b3
SHA1 b0168236d1647acb273fcdcc8965152f7f26d1a4
SHA512 56dbb2b99ac0ffbae5edda2ee15ce1afc0b038c80aa1afeb2a039d3a54904c58965662e03161ddcfa19388517c1ef6d4f0a91b62fc8a77763ce0ed8d361454be
SSDEEP 12288:uiZwbjzzFEoS2cPvyDLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:RZMXzFVSOQNyBo4kx929bL3Hnx
TLSH
T1DF650195B39418F8EC67823DC8158906C6B2BC4A0BB0C65F07A4367B5F773A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 471b5affcd14d269fff7886b5623b31cfd5d1c92d513902ff0cbd2445cc42481
MD5 50c1439e4dd1867948a263abd59762fb
SHA1 00916cc6068959f755630c480c2f5330b4978955
SHA512 b9dfa698652a1703c01ec4bb07f16940f9d4467cae063a2c49fe9d043d993ca48efee1262b91bb25e3f3823b6b1e58e802dd9d12732050f84d5b1afa746246d6
SSDEEP 12288:mILDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:mXNyBo4kx929bL3Hnx
TLSH
T1084523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 d2c097d66556d46084507540bcdb9524c656ebbe09be087b2a403030d98905d8
MD5 c2d2ac03e797ffba6aa3933c53bf7b01
SHA1 ce1b0edfb42b522601630faf4f4a9d63cf3f3d01
SHA512 6fc46270ec0d3029a9264875f64ad1c5a619caaed68d1e2c65f1e871dc8013665da668123cccfacd132c6f2a5914137c7ae98eaa26e144a4b5ebeac807ae9040
SSDEEP 12288:ysLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:yzNyBo4kx929bL3Hnx
TLSH
T12D4523125A0C227AF76D3FB065498598CC34BC8F1E95A3D8EF27987759FCEA25A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c75b21661db8ac39a69387cb671d4965f0b418b16d11f1899b0c396dc0fdf774
MD5 4befdfa309660c0fb3296e847d8db799
SHA1 41bfa265d9cf35e9f216888d0eb6d587f03d7954
SHA512 b49377077dd48cc033a1a7d9f6385b305ed26896d912fdfa18ae2c1d45a96d28dda0b2eb8918d7ea8dc60a20ddd50a19b7c0e0cfe7b19cb809126cc2a8479d2c
SSDEEP 12288:/yPz5L8HLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:yzy8NyBo4kx929bL3Hnx
TLSH
T1A655120777A831F9E17A6234C8960A05E731BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 0e4c8bb66c52a5e3407dd5040ccef3525eb1a5601d909b5491f82f59274e8008
MD5 45e6e7e6fbdbc77acd4218674a592e6b
SHA1 87d53acd209533612ecb631cbaf0ca497dbcc47a
SHA512 da35d6ba1793395db42b2d99e5ecb40d5b9d02b90029ce6ee7ddc37d0b9992b61642f8de15e9947138ef77628493a6fdfb3d716c477aa48d1ac00373805a64f6
SSDEEP 12288:KILDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:KXNyBo4kx929bL3Hnx
TLSH
T13C4523025A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0698bb26d1a4add440b2f3817c03f3d574ef3f1a057327d28125267d3b685813
MD5 ef5f54719a1706526e9474e31e069873
SHA1 dbed8f9bfdab0e193af88984c7ff12568994de40
SHA512 6961e084916327290369a178bb2119e6d44f474b812df126649ec02a8eafa10f7105a479cbf60c906af390e408b4d67ad21058f836370377a638f1912fa78eaf
SSDEEP 12288:qILDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:qXNyBo4kx929bL3Hnx
TLSH
T12C4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 b271336343f712fce9a8cfbb7a8220330c8a5990ad44e1003f1147f7f348a4ac
MD5 aa205fbd852686333397ff23c78ca632
SHA1 39f3284358f5c3b261938e08b82da53e9bd5b8d7
SHA512 b06a121547d63f53e94b39c6296862aed28adc00e1f0a242860b873ea39021f81ee7938a26602c7f92ffacc4072c85b99b855f71b9ef96f683f8526ef0df15f9
SSDEEP 12288:WyPz5L8HLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:rzy8NyBo4kx929bL3Hnx
TLSH
T1FC55120773A831F9E17A6234C8960A05E771BC360B608BEF576046771F776E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 1271fa1cd06342ae5dd14d1b7952888f72e112f985abee26661a0a8de04f5cc5
MD5 e3a83a33fa100f7ffe914a2a2ef27dfc
SHA1 496dbf4bc8a07abb72878a18d5e93751d2cca39a
SHA512 3eac0ee1ec1ad4b05b9b0ebb08a081558758229b3d4c6c79a09cf5465a0b41b5045fe1aa88ba5bfebac3f741771e0e47a623801d1e12ed01d28dcdad1016a837
SSDEEP 12288:XCd98WYoaLHF3z0z04PDvh9LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:STtaLl3z0zDiNyBo4kx929bL3Hnx
TLSH
T1956501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 f640e08b21283ec3fba170051ece37dbc2669e5dd77130a085f37c5467eb2ba6
MD5 45dec0874fba960d5a748faadda8ba09
SHA1 3fda46b922e6e68f0cd1571d086884ee1d5ab56c
SHA512 af81829dc72ef004e962d373a4af8a41f433457198ac0b73600de6499306148e9c02464efc373297ae5a6c27b65053713cc18af702b67725148df151945fd1ac
SSDEEP 12288:8i4e7ARdTfgwCHKy7GLbbdIv6LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:83ld9CHKy7GZ2NyBo4kx929bL3Hnx
TLSH
T14575CF90F3E810E8F1B79A3489764511CA767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e2c7f71307ed2af450398bcb5dbe7f005550119473fe7efd5b47349690c96d7e
MD5 30ed9e1c4a3db9a2e22082cb07f45359
SHA1 34df1b2a0a4cb7797ba57acc7192c845c04dedd9
SHA512 920dab17c6d5ac28781ac0aa15714c98c37a297b74636ed17797b887b4d83e3ba4d6ee1c46b11759d42e768e05a7fbac7b006adbecbc2d70091a3aa894c6081d
SSDEEP 12288:HtLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:HyNyBo4kx929bL3Hnx
TLSH
T1034523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 73e54820fb069741d548d4df57d09d03dd276ea3326266668fdecf15c3e2e179
MD5 3542687e713f5fd6e21c4a4ec11854d8
SHA1 e1035c9ea538ec65182a7e336854c95644a569cc
SHA512 d969831cb1a600574d17e0a634772de1290ae9e124a01a81fc9415592d5334f9501bb2792423b946ea2beb7718886b346600b9ca400cf6b1ededd413b73696e7
SSDEEP 12288:6nLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:6cNyBo4kx929bL3Hnx
TLSH
T1FC4523125A0C227AF66D3FB0644A8558CC34BC8F1EA597D8EF679C7759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 63269e0c3ebc12bd62efeab0cd0b0ba250869e56d8c974604150afa73a0bebfa
MD5 f9e2cecacb20b07f5e2a40c9503fa09a
SHA1 191e325b8eecab2dde63caccd44e38ef297ab304
SHA512 f397c0b2a97db614d24abe5f799f2e98396aa66ef14cdfa02c98af5795ad3309f331ba6302e0bd224b028b0ec125e40210e0de1ad53655a1f57b77f93e21ab68
SSDEEP 12288:+6LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:+RNyBo4kx929bL3Hnx
TLSH
T1A04523125A0C223AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ce8615055ff8852cc5774260de9fd90003ac2e096137492c5c5bde262b235ec2
MD5 f4df1b8a41630d0dcdd60d043326a1ae
SHA1 f5af7b457982f5235c44d634eb8adccf4266a91c
SHA512 92403b3655ce74d5f64c9a1ab258f45c8cc737d87ffa9c3c9bbec1754ed406ca284f6d61bc870a41bc8015617e92ba761417340679752ed6b0d0c0b1888b3314
SSDEEP 12288:LILDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:LXNyBo4kx929bL3Hnx
TLSH
T19D4523125A0C223AF76D3FB0644A8598CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 eeb0f08a1f868e70f76ba0f391acbd4209d31f383c851ed13937f710664c2ebb
MD5 1e32baf38981f59b809486d65f50a75b
SHA1 e94c531fee14b91f0b2c894518037ae075e90292
SHA512 18efa508e1327ed2a1c2f26271b3c17327de54717d2783477cc24380627eadd67ac9f82ac4814292cc77594a3571723927ce8939b07a1a2650d15e2ac623f2c6
SSDEEP 12288:RtLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:RyNyBo4kx929bL3Hnx
TLSH
T1544523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 71670a2ba156e9e28835d1b75add5aabdba02e6aea61fcfa0d2f5985ba1db71f
MD5 eefdb06164e28b601cf36d2c4d69aedf
SHA1 0fb7434ca01f3be045920248dc9e006a81195d82
SHA512 a98f747b7116542ea2e59abf17a7231527213feaa599e2f9ce8731a91ee05392bf7f7699b09f01281ab76b475d5773e641b7a68e6c462f3858ea87ed435aa1e7
SSDEEP 12288:yALDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:y/NyBo4kx929bL3Hnx
TLSH
T1D04523125A0C227AF76D3FB0694A8554CC34BC8F1E9697D8EF27987759FCEA34A10107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 bd6f8308b67a221e0f4162a08cdc20c3593a556c7e783d7ba800d28fe4ebcddb
MD5 729385c7bf6fdb58431daa191c32a3c2
SHA1 f84b80f77da5aa9d118d086804d55cb4e282e3d5
SHA512 b1976b00858dd0bc6bf3c2662eaaca73be7cbdfb4f29577528f4f4eb13b9842e776b180ee0f8ea2044c1f47555db44f8adf11f3e70cc5a151dbda6195b09fb20
SSDEEP 12288:0+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:0NNyBo4kx929bL3Hnx
TLSH
T1874523025A0C623AF76D3FB0644A8198CC34BC8F1E9597D8EF67987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 a2e32bc5e3e10d25eb831fe8bd07ed1f88dbde0309ba4649136cef58cc42b883
MD5 8b112ef5ecd9c3a6c01e35a3be956925
SHA1 32a939b5b98272b4a9c14675255cdd975f956a3a
SHA512 e857a497126c47952e5387e564837117ec8e370ac97b49c9c955d394325b804bc17e0e704c5ec6c3742ad12dc96b0a59693c66a7f6693d595b8ad0e1a4163d04
SSDEEP 24576:Ofwvqk9RX6wkyAIjNyBo4kx929bL3Hnx:4MnYIsB+kn3Hnx
TLSH
T1EF85DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53BE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 49410a42c101ad928515eb4fcf71f83c397c4544b82318e606d1bfc4c2cc182d
MD5 a711400d49bb0e6f49cc034cf843afe6
SHA1 e0ce39a79a48700bd3fe5eb7c225da57828b8ce9
SHA512 af98b57173c6b6929787909860aa08cccd7f05c2d3b339994931ed51fc4e7c68f729b92099636c39874029345fde94667e0bc786e13a94ebc5f46d95a309aa2b
SSDEEP 49152:6YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK01B+kn3Hnx:BySzP7+k
TLSH
T120066C56A1A801D9C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4abb128f1435988d4e9185bb359601c3c49d66ee93ea58615f0e8dc22c12b8de
MD5 765218f2c9705938f1b5f853da1d13de
SHA1 f26fe04d9f6953afc0b94452b43a7660d66a043e
SHA512 f4e71149fc84912aac6bd1ad035264d8efb7d5d21c1ce68f7b973bbf424d753554f0838e4c114f8f3c859081c9c27cacf42efacf2eabb60b52d97f9f3545e7a3
SSDEEP 24576:l47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYANyBo4kx929bL3Hnx:l47JUQjTirIhCnDHUPfF/FB+kn3Hnx
TLSH
T10B65AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6514bb9cfb6f09ad3305ca7a90530087be36934d6a1bac5731a0e76cb2170e56
MD5 12becfe6f3bfa2e84ae93e81d9a7b554
SHA1 90c1bf79c74a975c7ad3515ce791f00864fc089b
SHA512 1b20ff728c03e3afd988d92db935a612be298f8f5cd38feea0e5fcd8d7d5eb7686ea3fa91f8cff7de57d1b9fe623ac6f238e116c511468984035e7c8dbf5d719
SSDEEP 12288:upsf4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:fnNyBo4kx929bL3Hnx
TLSH
T19055F00AD25812E8D16E2274C7468A40F7337C5A47E1D3CB97D0F87E1F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 0e7157bf5d13f7c83471dfbf644d28dd51f971e7b6063fd6e5630bfd15c76440
MD5 cfea09b00c159ec65b2d9b8ea9b8a148
SHA1 4804b0131f401e92477a34b9bd035eeb71bed7be
SHA512 6683913bce34ddaef0906de498ee0bbc2f257d1b75b61b034623643d10757d1b6d168c87d387fb84964a1b244cf1573c5ea486ba1a27c5bb37a148cd28a76b1d
SSDEEP 24576:SGrUP2XP9S/kp5tzsEaqgd+XIKrcSobM/M4:JrUO/9S/kp5tzxKd+XIKrcSobMZ
TLSH
T1D24518417666CB4FC66940721E36D2CCAB707D41EE046F0373C88B3F957665DBAEA282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 fa1986582c66a6ec9ebbc3a0b4925afc71125ac3f80e7d3b650938b91c332efd
MD5 463f6da1355ac62c1eb9bc307cf86eea
SHA1 9bd88a1feff8ae69d46daebf75f6c1b4abf926e7
SHA512 8c55f2ca0c6a8e273b9d232ea29e2cac2f29cfae5a5f56957675a938daaebd7119378c01dabfa303d425555f09e34bbf474bd04a77b2ceeb391019d4be9d67ca
SSDEEP 24576:FommzClVb+jeVBvJoxSW2BjNhy5B8PMtSBv9SoR2w/tw:FommgVb+jeVBvJoxSW2BjNhy5B8PMtS+
TLSH
T10065D7419537E6CFD1B76072072A5B0DA764EC02BB095F22B389443ED86AB16B1FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a7941efd53b6dbfb8f2f0e288242bd77b0d48143fa71400bb849e1098e208684
MD5 d9eb1c0378daeb7b78ad428cc4032310
SHA1 0fe1ad2a9be3c924664b1bde82366465b84ab017
SHA512 20f06c4fb9f153071ed83a7f10c52031cf316cf29b67011fab54d3892139b8f36a42cfe9742e794611d612ed8386739a4d6e959e443c45c6f0196a5d1addc6cd
SSDEEP 12288:7y7wLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:yPNyBo4kx929bL3Hnx
TLSH
T10D452312974C663AFA7D3BB0645EC124C839BC4A0F50D6D7EE1658BB59BCED28E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 dbabcdd16870df6448eaf3b579b26cc39afafe7c56049368593b97f5d4b9917a
MD5 00b9561e15ed41c2b8c8ce30ec64278c
SHA1 edd04019cabd57a6053ebafdca335f65f722d7e6
SHA512 735475857ce93c26e351163dc4d877219a5813352ccb21d1e0a714824da8980f391e39e3c34d8e2b4ca40ba0ab0ec926f1f743952c8a84a4878b7cbb8191c912
SSDEEP 24576:pgb6bmBIi49WNNFpg1rSvFv7bYJNyBo4kx929bL3Hnx:pgb4mBIBhGFzB+kn3Hnx
TLSH
T18F65AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 b55fd255c27964f6071bb5119c65e7341397830d05b5fc9a5c5523a86301b960
MD5 b97865a24ab05049b90d974bd12ee201
SHA1 614d53a452b36955a96d88a82332d3963b34c30d
SHA512 8873ae95f18db5a6fc906aadfb7478bfb24465bf51d2d6fcc8d6926b1d8b98fedcc2403b1c53229cfa7f51deee90da1e7d8f5b0b9e610022777959cc0f0eeb84
SSDEEP 24576:8G88u8FpJqH1Jzria7/mQNyBo4kx929bL3Hnx:/7ZFPqVAa7/mB+kn3Hnx
TLSH
T18D85F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 7868290d1dfd7f2c67d239231815a947cdd4b85e625d5955304ca8f579af0c10
MD5 10bf8f4a29c24f2da748248f6ac61c8b
SHA1 da8d49d1ea66a18c02f4f11458a0d8f791fbb120
SHA512 9bf221ff90f48973f31fbc1b7768d42e35d79fe5a92587a861dac82b548f83287cc8aa3384366c48692912cd76a2eceef40829da33894e4278d1c0ec6d549ef9
SSDEEP 12288:GHvUrBFrEjwaQPLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:GPUr+NQ0NyBo4kx929bL3Hnx
TLSH
T11E65F11F22AC18E5F67AB17C85868609E771B8560712D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e8db2d481e4174c932322691be4aaa5ed4fc38e579bbe835cde67c4d45c324ab
MD5 2bf9a01e5d683aae4bb04eb3e7ccd4ff
SHA1 566bc7f759f0fbc9f2d6ae9bb06df5236d84b4fc
SHA512 42895b5c0717a358751b66799513bfd6043e00969733dae303274ca19a9e7b0c990a13702f5ac894b11e1b033f0167cca4b80fa8ced2c82d911650a192378785
SSDEEP 49152:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/B+kn3Hnx:hG05lO43bY+k
TLSH
T1B3D5CF6A62EC11F9D0BBD17CD9C6460BEBB23815033556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 49f901df513a8aacec08a66682ed54848430a317fa82659caa924184f2dd5ab6
MD5 de8b55ff19673e3408e1fa5b097a4787
SHA1 148504ae62e9882fca3dee3b9bd4abe1b0792513
SHA512 6dce99dd8e6a07ffd66b270c8c2b692b3f9b6ef3cc30f10909581eebb9c8b9694f8dc1c189140434a792fdf9d7afed235e7b622abcb0dda8d13a820586a1c724
SSDEEP 24576:jfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn+NyBo4kx929bL3Hnx:ba5POZ3BJt2pasx2+mHB+kn3Hnx
TLSH
T15865AF5EA6FC01D5E5B9D17CC583861AE5B1342653319BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7e40c8bac7c4ad9455ca527e2e75f23f0f78cc0990b7726fef1891078f8407dd
MD5 a5037f56aac1619c3e31cd5913911972
SHA1 920badb8c76b4c4ddee4a7330591146e2dbb9501
SHA512 2de543c534ec31fb33c7cc803e0e8d7a7ee66200e2e919a292eb4c0cbe03c2064faab05961c97cb27058b2037367d43fb0af5a1642c93da39d20a73fc1996ce7
SSDEEP 24576:8NcwHdjbyQ4nLC18lb/EOjowL7FkINyBo4kx929bL3Hnx:8Nc/zEOVHFGB+kn3Hnx
TLSH
T188858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 941a6ea0a4cadfa50b3ddc8978b38acb733308cc474f14ff2b7cc00f2e5c89b5
MD5 d4c759445cbf3867e2208af719524755
SHA1 0da289640fe5ef817d55440ea1e779d37fb1c092
SHA512 0081eddf1dc31627b1633044ade95f3dd8a6e28d8ef19b9ec329f7096ee704d0fa1e3af15d99cb5f40b2e441aa7d13320c41fea95a96eb0c88558ab9201261cb
SSDEEP 24576:YTkNvNnaFeYhJNtmZBm/NyBo4kx929bL3Hnx:YTMwBtOmQB+kn3Hnx
TLSH
T1D355AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 58f3a618497e3c007c49d537fcefc54bf72c638454737f2554da07ef3ec93299
MD5 6f6bbd421cf9bf6d0d9bfbb0e2c7ac97
SHA1 bd73ded636dcce311eca8adc9b9c2fbbb9402948
SHA512 73787829bf44c3800c99c173781d2eb759b9bf4e3198ae241d6b7a1c0fef53e56f0d9e73a9ed94e49913b96130db0e7ba5706ba53c05b1075812aed3f6896f00
SSDEEP 12288:mQcMxWDXN1Dp/fshBItT1IQgAELDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:cD3FHshBIYQgAbNyBo4kx929bL3Hnx
TLSH
T12C75E13EE65C00E4E57BD1BCDA538906E67138AD072266DB06D4C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1616-140-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1616-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1616-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1616-312-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1668-81-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/1668-305-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/2000-43-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/2000-50-0x0000000001760000-0x00000000017C0000-memory.dmp

Download

memory/2000-44-0x0000000001760000-0x00000000017C0000-memory.dmp

Download

memory/2000-56-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/2000-54-0x0000000001760000-0x00000000017C0000-memory.dmp

Download

memory/2452-130-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2452-124-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2452-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2452-132-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2452-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3068-309-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3068-104-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3068-97-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3068-98-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3068-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3068-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3604-18-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3604-96-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3604-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3604-24-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3604-25-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3628-110-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3628-116-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/3628-117-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3628-308-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/4504-85-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4504-91-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4504-324-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4504-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4504-306-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4504-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5584-77-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/5584-71-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/5584-304-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5584-69-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5696-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5696-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5696-122-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5696-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5696-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5848-17-0x0000000140000000-0x0000000140146000-memory.dmp

Download

memory/5848-0-0x0000000140000000-0x0000000140146000-memory.dmp

Download

memory/5848-13-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5848-7-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5848-8-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5848-1-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/6056-65-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/6056-58-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/6056-289-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/6056-59-0x00000000008A0000-0x0000000000900000-memory.dmp

Download