88add5ccd2488425ae1fb2deac6b6c6d4cd2d09ac26c02644b01d695fdb7c813

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
Size 953KB
Sample260629-vr78vsav4x
SHA256 88add5ccd2488425ae1fb2deac6b6c6d4cd2d09ac26c02644b01d695fdb7c813
MD5 2d69ce6ba485de58e5752f376d711f86
SHA1 3aa5f4418a75e69c5ed2445674a03365dffed201
SHA512 f2dd08fb9089a2877352a471b287c799689ba7e16b2e9d69048940a86574d38b9bda44e70381d026f45724f0e80448dc6662658efed6680d138447cdf725dc22
SSDEEP 24576:Qot3+TporGvTWQMSBhvn/+r18fVSnrLFY+iOOMAep10:zt3+T4K5dBh3qIVSnN7iOOMXpi
TLSH
T1A325014536D404F8E5B3C678C9715616E2B67C665B30C79F03A4276B9F333A0AE3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6092	elevation_service.exe
2296	elevation_service.exe
4268	maintenanceservice.exe
4976	OSE.EXE
984	PerceptionSimulationService.exe
1752	perfhost.exe
2524	ReFsDedupSvc.exe
1304	SensorDataService.exe
2024	ssh-agent.exe
2940	AgentService.exe
2996	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bbbc69b080095f6d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f66fa5ceea07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006383dcaea07dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009071a6cfea07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
6092	elevation_service.exe
6092	elevation_service.exe
6092	elevation_service.exe
6092	elevation_service.exe
6092	elevation_service.exe
6092	elevation_service.exe
6092	elevation_service.exe
2296	elevation_service.exe
2296	elevation_service.exe
2296	elevation_service.exe
2296	elevation_service.exe
2296	elevation_service.exe
2296	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3480	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
Token: SeBackupPrivilege	2524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2524	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2524	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2524	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2524	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2524	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2940	AgentService.exe
Token: 33	2996	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2996	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2996	SearchIndexer.exe
Token: SeDebugPrivilege	6092	elevation_service.exe
Token: SeDebugPrivilege	2296	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2044	2996	SearchIndexer.exe	98
PID 2996 wrote to memory of 3740	2996	SearchIndexer.exe	99
PID 2996 wrote to memory of 4808	2996	SearchIndexer.exe	100
PID 2996 wrote to memory of 4524	2996	SearchIndexer.exe	101
PID 2996 wrote to memory of 2004	2996	SearchIndexer.exe	102
PID 2996 wrote to memory of 5052	2996	SearchIndexer.exe	103
PID 2996 wrote to memory of 1208	2996	SearchIndexer.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3480

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2296

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4268

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4976

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:984

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1752

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2524

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1304

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2024

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2940

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2044
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3047816590-610495838-277027736-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3047816590-610495838-277027736-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3740
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4808
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4524
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:2004
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5052
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1aae23984935c88a391ec407091c982d2afa4706b7f1c5b645dd6be6a0f77f0c
MD5 ac03ef1b7f3aebfc916c5b0b59228a80
SHA1 3aea1959671eb178feb58413723cea983299c670
SHA512 0b63e903d66f95b70e2bb402f318f7f0e620134506335780173e1e7366ad68a761dc4d54e481c2c8b117559afa9f9798b12633240ad0547e7702820f447ee817
SSDEEP 49152:Bb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnDVSnN7iOOMXpi:H3q6tjB2V07ioXp
TLSH
T106D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 547ef3b4c7138df3d1ee6e7bae518406d96c55ead27fab6e4f3a55a194a5f61a
MD5 923dd44135179676565803263ef93859
SHA1 ceb6e2bd61d1496f570122afe993f1400d8d76e6
SHA512 459f2b6116bef76f059f4200442843dc08f276b8341772de8362afaabd4551ba7907705fa9860693407406d962a6e53333c699efab40dfb73a5667120e5ae040
SSDEEP 12288:z1XLsswWkxy2lRq2czA4KOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:pXYfDtczAKVSnrLFY+iOOMAep10
TLSH
T17F05F12967D408F9ED6782B8C9B1D512E633B8914360E7CF03E49A660F633D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 f269773e00a74deb000ba2291e1ea0fc1eb79d93b8926fefd011698ab82a859c
MD5 d02998ae9c83768574b8bad356115e83
SHA1 1a9e8c622bef0b96c0e2d3807cdfddd0aa1f49da
SHA512 0ff2ca9c4350cf6992d2ddd5038024d62718662d28803681a55d07590a78984560d46c18918103283e898309f9bc4ee2e99886ce3c2f16aa073c2bfa80b94c96
SSDEEP 24576:y0Le5ji0hmxnrM7VSnrLFY+iOOMAep10:yPji0AxMVSnN7iOOMXpi
TLSH
T14135AE16F6748371D073C0B9C5D2A69AE972308257308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 088d5ed58323fcb6127d661426b5353e9b4c7651ea4e08ce9dd6d3e55d9f1bd3
MD5 0ccfcc5034aa93000ce6dbef9a479638
SHA1 e355e54039c9aec9bc7da458854b6e5b710f5d41
SHA512 f4a899d4e1c3782130f3d4556240eea1cf4c432f617627d54bd549971f60bbf1c7b98aedf54d87bda8cce099d34727785634d2a42f67d1854f83c25bec244981
SSDEEP 24576:Ma7/ezSC6vUyDZaqgrvWx6q8wyuZVSnrLFY+iOOMAep10:r/ezSC6vURPvMHjyAVSnN7iOOMXpi
TLSH
T158755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8867857f9db36db37434d5ef0d4b40ad73a60f40853882077dca85d2745dc929
MD5 85bdfb7e7a0c010b249b755c2dff1aa8
SHA1 8904961c7fb4df4947949f4549726ad7fc991876
SHA512 2e38ab78caf833fbaa37b3d7779cea29ea24dd79403aeaf1dad6ab1125b9cd029e35f39dd87cee4e1765fc5f2effed4408f8be0d2eb9759158a83e895d99e168
SSDEEP 24576:4VbqPb88hv/lV7GVSnrLFY+iOOMAep10:4VO88hXlVyVSnN7iOOMXpi
TLSH
T199559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 9393ba860b0741e518480e982bc020d011b8c845a7fb80381d96950d8439f4ac
MD5 9b84b7f119c4e5d2bb7fb7ad1cbb2285
SHA1 db1decd522009ab067ec2c3581f3965eaf9937ed
SHA512 2dd0cb5b63226d86921b51342b3dcefc7e233f5fafb6a215da721041af702d0047b6e298b9f976b97104e181cefc9236c6997b7e78cc6967aeb644dac894e99b
SSDEEP 12288:mGzKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:mG3VSnrLFY+iOOMAep10
TLSH
T1E1C423461C4458F6FB6AC7F116B8B072F239CEB664606ADF41E03AA64DF43ACE097351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 4ffba4b9e4b62d2fb0f38af3c49f23f63ec26e04edc3cf8df00f28090691f3d3
MD5 9e28e7eb89805a83354700c568179ed3
SHA1 e354c6b763356a782b6594bae04d0100a372f788
SHA512 5b9015d40f85242880131b997aceee1ebe72dc791147283449722049d7c995d7fa25834e23dbbfa663428f3afeffe635e61cc523d27f8d7cd04fd907956ba568
SSDEEP 12288:CeBNUbTVO86U0KOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:CJIU+VSnrLFY+iOOMAep10
TLSH
T16305CF3BAE28FCE2C27A8DB85791C600E77274714B61A3CBD165830EDE236E45D7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4f5fb63f3d5b17bbdf81bbbb76ae7529bd21e18a40aaddbfb1479035feb1fcc9
MD5 a2f3f5458680afaf86a27c324a991748
SHA1 5bb288adc31793313f7989bb3b4d79d280ca0afd
SHA512 5e02ae30c28cbb9f3f837897c97c1e6a4c0c7979192dd0432ef60171818f25706d25558f25a39c75fffacf548c1623fecc1c4964aff89b559409c906f01bc9e6
SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THQ:LQvGAdlCEL8c/pRNw5CpV07ioXp
TLSH
T157267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 86491f34b476148e4d5c2b62e1c223d9e87a5702b0c6ca0c45ede382a6513118
MD5 b1c150c85c8c1fbc7b9cda9f82affef8
SHA1 d61f58c1b81a593686cdb5fed28422c219f04250
SHA512 9e103080adba4b233f47b40c3b51f15de964941fbf1856c1896a34a85b9476bb2610c6004dae02d688651bab81a706ca2374ee2618522b16e5d018d2e8cca3f8
SSDEEP 12288:FAwSfxL/2Dc3xDLLmt0LDQewsAj+KOVSnEILF0GlsHovwjEtZklMfoeQMghqv24t:mwewsAjcVSnrLFY+iOOMAep10
TLSH
T1E615E031FE74E436C7BB0DB21B35D716643CAA204B611AC7E3E84E9E59702D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2503471b3b78232aaf52b2f60c71204e0e13763e8ad002155f772de30ac11ee2
MD5 047b5fb2cd4bfd09eafad83234444f56
SHA1 9e855388d1705088491f421ec71c9be8b2e46e67
SHA512 ec14dd4f95054bde14ed2c7554905a841f96ad55b4fd3f52eb443d83c502af66fdb75036a2b060b762ab1ef532f7045669caf8d3d418b8c5a8e276f8004c9a2d
SSDEEP 196608:SUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHEAF:SUEtQevvqc2W1cpV29I32EAF
TLSH
T186474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 23959027586982cc62d286fa9f17e837798b12c0da518a7ec5237c7b2d03ee3f
MD5 b03dcca648b108a9a45bf92db8231a51
SHA1 8cda82656cde5bfdd21ca2502ecf4272862847cd
SHA512 cfdfd1ee00137c354b239c0427df18fa0a1a279833969c075f8e0327592ddc5f2b4fb3766c560f5bc9a450893d0b8f51036a8d878b9003165c213bd3f356c8ac
SSDEEP 49152:9CbRquA/m2yL5zQfFiV+XenmE3/z8VSnN7iOOMXpi:6oqtVjnmdV07ioXp
TLSH
T194D57D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58A3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 30216350011d5e6ecf953f68e53899f891d46860938d38b0278eadaa5d50a86e
MD5 683ddebbd33cdb7aa979c2431d12c87c
SHA1 2c4cd800fe8f7effc66402304e1060851ba35e71
SHA512 a492689c03de073a4b0976db8e83024ad582a290216b11ff86929da03d8e81499d42ff2882e1b0b4f711df976213a82b77fd6a7ef327a7e1565c433f811be491
SSDEEP 24576:QAhGLmIFoiwtA5l7S539VSnrLFY+iOOMAep10:QAM1Foiq5tVSnN7iOOMXpi
TLSH
T12135AD81EBF945D4F5B3ABB899B69171EA76BCA65E30C20F1160D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 025ec1555d17f0a9da9e6c301482915dd289a3b4b2329ed49e1da0a1a2c80562
MD5 d6b3afdeabc8762a89aa826a6b5a1f23
SHA1 025cb17cf618a629bda11b68ed8c8ef8a6a3ec2e
SHA512 946e92790aa53eaa32b38be93df74bccc8c0044f69a63b62da11fba317a10a33fd5eb9f352d58292d445cabe81a3d2be607d633940e80f07b1313079710d2c3d
SSDEEP 12288:Amw5HEjsChNOBFgl0WDm+CBKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:dwuXOWgVSnrLFY+iOOMAep10
TLSH
T1AF05F14636E40CF9E96782798657D132F7B2B8122A21DB1F03A0C75B5F77361AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 1470aac284d2c8c14d767cdc4926c41b52cee83d60f460257c761e6f191d8c4e
MD5 da3bcce925d3414b1f37119d65ef6d0d
SHA1 bbeb333fbe4fb6023e9a0c38a92b67db4841cefa
SHA512 3e8590e509673b6c8fc0c8ed68b468dc3a9de9e0a775672617db64075df986744a3e57cb6c62c7d50fd2a265abb43dd77e4726cbde51e2347713a65b54fca38f
SSDEEP 12288:JbZ1IyuKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:VZuTVSnrLFY+iOOMAep10
TLSH
T114E4129A36D420F5F667C3B889F4A515E372B463233153CF02A017AA1FB27D95D3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 60739cbee773c9a48ede868de8cba360075422c3b659b2f8e29473b41104416f
MD5 57ba5af1377c3258fd29e519345648bc
SHA1 83ef1536ad9d3cb58771ed1f33c7da4019bfe767
SHA512 ad55a30869b86161ed2ae2865f5ffd48abcc33917fae89cc3f7d52ba226f8df92f0aebf58e164be27d442e25f00803c98edb22239b5f3a87a15d97f184dfd001
SSDEEP 98304:nQRQyi36YOcPuLvw2gAf+PN3iV07ioXp:2QyiKakX+PNSAF
TLSH
T113667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 028bed3baf3966a68dc42d0ed0e823f3f29dcc60b1a2df4ad09e225faeae3bcc
MD5 6ebe7ee342945cbc3cf0ba0ea84535e7
SHA1 03fe7880f72ac7f7adcee640749fe7f6d04657a7
SHA512 7cb9ccf3c801e3ac5c3272e41e36d9d75d3e5dde3afa73c438a16f28563f5a148a6775f1f7dd926438c0f2b759aa08ce0808b4bb219606c3075b75ea98d4d038
SSDEEP 98304:ZQRQyi36YOcPuLvw2gAf+PN3iV07ioXp:QQyiKakX+PNSAF
TLSH
T12D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8f44c468c1cd996930f105831cae37f29bbc872e3cf425531273c8c306d0404f
MD5 ff167bd3acf57b1c406b05fbec1ad90e
SHA1 ce1225a53067f668b34e2dd444976d6fe0c8b2ab
SHA512 9427db2725b054f7532ce095a45d722b8f26de6ffd1af90f9a4d12e64f45c7a3bf8bc92e15963599545696c22af1a4df196eba27d7042587b52b3918147e5bdd
SSDEEP 49152:j68Qg55nhxeWu7PNU3/MVSnN7iOOMXpi:dthGRc/MV07ioXp
TLSH
T1CFB54933B2F200A9C44DE1769F4A973196E17C758FE0E3DB815172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5c7447430ef13d8a53d952f974b16df63dd7a5d5f8682191edf7d7aa7d5ef808
MD5 18c90f7c70522bf5186853c7f10dbdc0
SHA1 ae903235666c81e27c367c5902ffcfab3a32753e
SHA512 b2b5fb3e99e72862c3af4d4cff8c9e9c17a18096699f88ba34d2204c14c165b414a69d631df44ce2e1ee1343e15f4c12b60b8a5b842673586e1a88df613e4301
SSDEEP 98304:Ny5112gYy5azzVvD69nLKnhZ3V07ioXp:wLIH+WhbAF
TLSH
T1B1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0b8baa0731bb030b126501ded0319643ae8214d5ae51bbea8b4c93750ca3b38b
MD5 81aa7f619bc1ba5a026a082476b7817e
SHA1 67ec14060350451399cc0a81d3dff916906ef307
SHA512 6d548cada009fb590280da7813193deb709b928932d2cab295e1ecab27c270ef950b19d88f242022762f7d04aedf2a034e63f7ee029bb1fd99240bf1615c423e
SSDEEP 49152:1B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl6VSnN7iOOMXpi:7u6JmQxd2d6V07ioXp
TLSH
T1A9D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 875bb634d6c6963bbe3d5845a45ceeb8f488b73e1dd4fd832a94e3a00bbe6bc6
MD5 d1b74e27f5e18103c111991063d975bd
SHA1 324e30c3bcd22221af4fa5c8e0fe9c6247b3bc04
SHA512 3eeb3784c52024f28f22c21fbe4c6d029088d8f1b861e4c9055d8602890653a8b9e78c09d69b07a0c852fd1fd4db5e92439b17cbab09edde3d1e6b09c3f32123
SSDEEP 49152:d1hpsNoJpF1A6yU44CwH7R4xeVSnN7iOOMXpi:dmifPVRdV07ioXp
TLSH
T11CB5AE13F29900E8D06ED17887569632EA72BC460B34B6DF0A9077961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8e3e05dc8f9d3291989f73268b059531f5be48938815aeef1dce92926ff07e9b
MD5 957374b8ada3793c6ad051547a787ac8
SHA1 8a1af5ec048b720be007951336c2d60fee4314a8
SHA512 99b0daa0f19cdf53c11e5a7c03846e65fadf7085f8a8cce3b791b8fba4a821f4831054f45b30d2bb722490d1300e0df587ff912d579f030b53787341d4a3a04d
SSDEEP 49152:BSuZQIY0Be2KIRVtOnks6NMHqTVSnN7iOOMXpi:P5dKOi61TV07ioXp
TLSH
T1C7C5AE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1158f8b12c455501f87c6dbfdbdc2df0ce20072dab93d95e76263b475de6ee3c
MD5 434ffeb1b454d856031a28bc80716691
SHA1 0b3553010478d1c8cd965b64a090722be7870efa
SHA512 6bd79e46a77a2cd39a21d6f85ac25f7efde03de1fd2c52d4291774694effd23ae227425368ea0b7542c9cc472b08bbea1f391e7edad947cd173dc9dc1a5f8460
SSDEEP 49152:9htSn8EApI0figGgiDn0AP5wKVSnN7iOOMXpi:sX2i/phxV07ioXp
TLSH
T17595BE13F2D900E8D05ED1B4C7568632EA72BC160B35AAEF0A9077561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 1e62a370ba631dcb9644781d556a3c70de1d976f6bdc1a3a9c63e02ef37cc7f2
MD5 be381e13259a56465e9a217a840c6bd7
SHA1 0f7317853532fe26f14c79f8168c018ffe0715bf
SHA512 708d28a4adcbc9ee6e064644c70f2837162c0c754b848fe12fee6af09dc2615d9f4a6336a88c05478bd9928d3bec45a8bc1e1ad120a7518b83802e62d045992a
SSDEEP 12288:E7KOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:EvVSnrLFY+iOOMAep10
TLSH
T1E9C4234A1C8548F6FA25C3F142B8B171F23D97B7752026DF42E42A665EF43BCA097790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 fcd65fb130bfdf81f5a6f1c0e7097b2d37d69d5b31559e1df66de41a6ab919e6
MD5 6225751e0fafce239905ff3ae3e17851
SHA1 18c6e2fc8f15d4c3cd3d253793d4e8711480ee60
SHA512 a7802f6d2abf36fd190f7db70ea9f23e4388fddabdd433842ec98c09699edaa2fc0bb7ba19becd1f1b28275338ae3f0f74030d16f984f88e327d7e9ba42f56cc
SSDEEP 12288:XSKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:XIVSnrLFY+iOOMAep10
TLSH
T17AC4234A1C8548F6FA25C3F142B8B171F238D7B7756026DF42E42A665EF43BCA09B790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 83b036db013d81afd4b57fac1dd4dd5454a8e8cabe895d48f99c4883907b4bcd
MD5 7e7e3da412fe78acc51bd4181e0adbb7
SHA1 cea982d93ec29897c547c111eaea683ba890a765
SHA512 99dd662e69987075e045512c8014d77e1362e9a127612a0eb1a13747f725f1197904af5be8feb2f5d95442c4207127c953ae9a3523c9ada63206b6abc8a86f81
SSDEEP 12288:m8KOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:m2VSnrLFY+iOOMAep10
TLSH
T14FC4234A1C8948F6FA25C3F14278B171F238D7B7756026DF42E42A665EF43BCA09B790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 6b13d885f233610222fc6102f4fb197aa97316e760861465a275f18ff968cd3e
MD5 cac97d5345a9269589f96f969fe6d1f9
SHA1 555d38cbe010cc2d64e24611bec0dd345f1f7854
SHA512 16f7ae6ac86b8ea58cc475349120af3fada9cd203a2be6f92231af1b91b53ac007676f4dfa6a3ccabc29428fe85114d8d35e402f99408cf70b8877709a1d70df
SSDEEP 12288:RVtKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:5VSnrLFY+iOOMAep10
TLSH
T1BFD42346299904F6F966C3F486B4B131F379FAB6723067DF42D01A660EF03ACA476B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 c39bbdc38a2744a3a483d23e1dfb3ba3e8765951855e0128524098800152d5aa
MD5 0304e06477092f6e526ec366f2322337
SHA1 914dbd2e43cadb246365e0f80da31981432de33f
SHA512 89f0ddc57ffeaab6f36fdd983e3f4eba4e6c3e3a4351a117f4cb96bf75b14a76d8bbf7210039230304f088e631dcde4aa5f23195f68f43ad1b635ac41ef66a1a
SSDEEP 12288:hFKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:hlVSnrLFY+iOOMAep10
TLSH
T1B5C4234A1C8948F6FA25C3F14278F171F23897B7756026DF42E42A665EF43BCA09B790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 9d4fd5ae34168d470fd2051fb1935802ab57e1982b6c4c922be28af009138197
MD5 85dc6492531523258f970e6b01f0992a
SHA1 213eca2123766e842f847f4f50965ea435b4b9ee
SHA512 c8d85c344cc1dcd20fd056e70c6ea88c8692b4c9a462e8906f1bf947d6ee31430f28b8c88067735c6269bc7727491dd788d4c31351c60b94ea911df453a7e3a0
SSDEEP 12288:cGKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:c0VSnrLFY+iOOMAep10
TLSH
T1F7C4234A1C8548F6FA25C3F14678B171F238D7B7752026DF42E42A665EF43BCA09B790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 b39da91047b8942f249aaa1e024b5097b382ae5dfa2f037bb2e4cefb9e9eee01
MD5 c05ad6e8d3013b7b74ea55def69fc15e
SHA1 adde12870b4361f2438c2beded778089930c05bc
SHA512 3a306286732112a0592cda35e16d40915d766d2994bf6435771952e7babd982b72e9c989bb70d977f8740ace4d0293023eeb7fcd744744a3a44c981c68cc44aa
SSDEEP 12288:MKKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:MQVSnrLFY+iOOMAep10
TLSH
T1AEC4234A1C8548F6FA26C3F14278F171F23897B7756026DF42E42A665EF43BCA09B790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 f4f91b4525e65bd2b60cb55d7540d60a534789fac72dd74f4e09a840ab104413
MD5 640ccd0958e82c1ab9a26c1ffac27761
SHA1 e312eea36332413e4c401ea0274723a3666e45c3
SHA512 d334c78fac3fec4a5e387d5e7ec40f7178d101cd869a8a4079f336e85daf20386153d2732a563e915e91ea53888eaf744b87e5fa491ea6b9d89866681be8000e
SSDEEP 12288:ziZwbNzzFEoS2cPvyyKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:eZMJzFVSOoVSnrLFY+iOOMAep10
TLSH
T1EA050195739008F8EC67827EC9659916E2B2BC6A1770C65F03E436671F733A01C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 30bb71bb26e79194e3ec43f91fe27a263103758b3e05afab6653a6ff908007f7
MD5 7e591472d4e7e7d54f76c2fdbbfc31bf
SHA1 e9edd18eac43a2cef71e4624687c96342303c964
SHA512 03218bfde9f7f83c7b0717fbf697a3b54c6d59df6f27a4a4cde9becb7adf497f12c7f0360424dbb205ecafbe5f141d4f82bb87abf949ac9ebbd7545c94e72f28
SSDEEP 12288:qHKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:qjVSnrLFY+iOOMAep10
TLSH
T1EAC4238A1C8548F6FA25C3F542B8B171F238D7B7756026DF42E42A665EF43BCA05B390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 6adced46b1c0309de437734092ff6547dc120f1967a3d01e7efcb67c18797a49
MD5 30da268c79d876c676ca4868a4f6fe46
SHA1 681ff0fd9b5557f70a667aaca71c5137badbec88
SHA512 f4c8b03172a7d32c17a18805ff6c65f6c0c07e52fa7ea37126dad319e2f519da4e1023fe49007b32da3398923a64f2d108fad21d920b614d91defccc1eb51402
SSDEEP 12288:IjKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:IHVSnrLFY+iOOMAep10
TLSH
T1C9C4234A1C8548F6FA25C3F142B8B171F238D7B7756026DF42E42A665EF43BCA09B790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 1c933c333a1052a6429475b1669690c03c805b59180d84f19ba8d8489fec5d60
MD5 8a3cafca4f099592554f2faeed1473f0
SHA1 57b13b692fb2a48371b6fdc66a0aacfa08bc2828
SHA512 481cb8066d8ca61b8672a9df35aabf02e3bce893b53cf8ccdb87decc0a3d9ca5a20943457c09bb5ed92928b875b2e3faff4777b1e4de3cf893d8ae8e866b016a
SSDEEP 12288:PyPz5L8uKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:izysVSnrLFY+iOOMAep10
TLSH
T13FF4024736A520F9E536C2B489A16A12F375B87617209AEF03A007761F673E49D3BB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 cf2ca7f79bedc9b3a6264f4869af8a7733449f459336a4fb438f70a8c25265f7
MD5 4a6387965f87b991fd09ab7aa76c417f
SHA1 4e52721ed05035d87a3ec2a8121a096727ba5a35
SHA512 1b1a9979a7fbb0b6693cb678ca165c6f583d9d7cdc196881d94d167af3509302b0475cad40036f6cf187fb82b6acc0c7cb5bfefb870493c70366ef3b56669d46
SSDEEP 12288:LHKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:LjVSnrLFY+iOOMAep10
TLSH
T171C4238A1C8548F6FA25C3F54278B171F23C97B7756026DF42E42A665EF43BCA05B390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 ba2ec9ca416590baadfe1ad1a2455594b2f9a7c736373b724327b243a28a157f
MD5 b08c83f68bdcd9554a689abe9e01cdc5
SHA1 2c793dfe2ae1da45fe02d3e673e4b9cf39e8520f
SHA512 a8e74c2a48add14005ae9f77ee6e2e88aafa8a2720aa4adc7eafdd34c5c0dab0f318155cf659534c1ae21e56b454e6eab8a40e367a2f047d58253ef4803d771a
SSDEEP 12288:9HKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:9jVSnrLFY+iOOMAep10
TLSH
T10DC4238A1C8548F6FA25C3F54278B171F23C97B7756026DF42E42A665EF43BCA09B390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 712eae76dc4ddc144db7b18fb9e5a9f59d14b787de3fb39f41307855047459e3
MD5 fce4cc892f734401affbb2378920b435
SHA1 699a049f4fb76a742474a17d15d23d8ee5748896
SHA512 da25d397ba30dd046e317c080fe397bae0be4fea181a3b48930408984d16627f365c8b06cec4fadeda6db11e5bdbf8b9f9d4b8f7dce47bb37d5049322aafb576
SSDEEP 12288:XyPz5L8uKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:azysVSnrLFY+iOOMAep10
TLSH
T1AEF4024736A520F9E536C2B489B16A12F375B87617209BEF03A007761F673E49D3BB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 356e75b0e2653e674de712de56d96bdd890cd2131f7169b44e05922624ede994
MD5 60a757254c88561d22202f008562f48e
SHA1 8ad6081f4e0db8e9144591a8f529e0449e538ab6
SHA512 30b4fbced40847feb9bd458bf2ec38386a5f479c27b2af6382f7635445bbff646cb1150b5955e6c6f2b919a26c0090038798d0c2b8a4ec74ac8eb47c684dcb3e
SSDEEP 12288:oCd9XWYoaLHF3z0z04PDvhMKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:xTuaLl3z0zDmVSnrLFY+iOOMAep10
TLSH
T19C050195739018F8EC67827EC9659912E2B2BC6A0770C65F03E4366B5F733A01C3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 a237fb01308442cb62f03dde250abd81beb7cffd92f92e2d516a6c78c0255de6
MD5 3da6854af026b92972c8cde854f8f7ba
SHA1 c9825c2604373124bed2a376216eb96d8edec89a
SHA512 e78ac5f88568dbee898b829ca8603b9118399a9df3bd99d98435d67795feb75f2cd90abe28875f6dc0ff1db458cefdd097d82a9d27162d074391687e3162b0d8
SSDEEP 12288:Zi4e7URdTfgwCHKy7GLbbdIvZKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy0y:Z3xd9CHKy7GZCVSnrLFY+iOOMAep10
TLSH
T13C25CF90B3E414E8F0B7CA7589769511DA767CAA1B31DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 184a7ed92d70ecf496138f2bc2e509c627b51254d3e81f896987494700570aa8
MD5 86d1527df477bbd04b7779ae2c159000
SHA1 53192cb49f2a4c22f17633b4a0d667282053ec88
SHA512 d74d18cac24c42c22267812820bbbdcbb98dd838dce988e89860bab4365705e2e31664d9851cceb22af6748961bd2723d339058ccb119038b26e69e2e6af3075
SSDEEP 12288:EcKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:EWVSnrLFY+iOOMAep10
TLSH
T18CC4234A1C8948F6FA25C3F14278F171F23897B7756026DF42E42A665EF43BCA09B790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 3289fcce740f0258e0efe8b36b27dfd1f0f3a73e0fef6ed477c2dcb6ea3fc800
MD5 84c4cb95240541b9c02f8bbf914d5a8d
SHA1 dc865f6ed19a9cf56ce12236c0ed3e74e0af1f4f
SHA512 ef5b0df82d4f170e13f4b2057bd3f924bb9de7b610f5bb24966937771f1f8cac8b9b6d58e92e6e9eccc52eb57b1412965ac8f6bee212abe9927112c3a2805c67
SSDEEP 12288:KOKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:KMVSnrLFY+iOOMAep10
TLSH
T16BC4238A1C9548F6FA29C3F142B8F172F23897B7756066DF42E429664EF43BCA057390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 5834d43026328027268d99381ad4f5baf5e8c19cece5ce8e052c38abb0deed51
MD5 f4ca5e0c4847521f262f32eaabe00f90
SHA1 3886b0d54677854daf666cb2fb312707b46a19fd
SHA512 ec9686be5d43f5839531f54aa06a7d7674d58f117c3b4d8a16b6410c1868c2713bb939747677c40f309272ee152eb3fc50d1c8cfd2b29f7b169ecc6f10a0455b
SSDEEP 12288:AZKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:ABVSnrLFY+iOOMAep10
TLSH
T1D2C4238A1C8948F6FA25C3F14278B171F238D7B7756026DF42E42A665EF43BCA05B790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 c306f604dfe8a2e62c7b17cc877c78352d159ef7b7ae0b87d823c48025497862
MD5 ccbb5562cf8827f11825c41f67e7d648
SHA1 baa0328ac73eca4a2c13c41efa2d76798ae76e3e
SHA512 c0b0d21bd41f4b90eac38a219ea83a8c0109848b1aeca699f012fb0604aaa0664708c18cc33b40eca0208c6a2b6bd0969b4cc60cc9b7b128dc1bf98a61162d48
SSDEEP 12288:jHKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:jjVSnrLFY+iOOMAep10
TLSH
T14FC4238A2C8548F6FA25C3F14278B171F238D7B7756026DF42E42A665EF43BCA05B790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 a18c79e841d28da629f9d5a6af105e16de750dbe31f7066071642789e0282d2b
MD5 4ce68af2ecd8256a92a295eceaf4a11e
SHA1 c9022ee44b2d86e4403ac3ef9cf3486e6268cf90
SHA512 c901d6a6f6ef18e689a0df3225e4fa0ae57a7fe0b2a988936fd9cf15674c36dbfd14f7b43b94af41d29f4b91a616c0758d405f23ced01cec48848090de9dabad
SSDEEP 12288:fcKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:fWVSnrLFY+iOOMAep10
TLSH
T1D3C4238A1C8548F6FA25C3F14278B171F238D7B7756026DF42E42A665EF43BCA09B790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 b58ddcb8e9a1aaf326f6806d3922eb20076022ecc1446fe98453638cee3c77e8
MD5 f28df258e4150fe808b0b1497caae49b
SHA1 5d36147280d69da067044fdd9f4bd2a6e1dacb70
SHA512 294d7a603bd370ef62399010bca7f29f10727ebd0a4ff1507de41cbee0be86c7020fbd521a3a43081bccce2024c696acac9a20301819309b39c129382ff3d2ed
SSDEEP 12288:DfKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:DrVSnrLFY+iOOMAep10
TLSH
T138C4234A1C8548F6FA25C3F142B8B171F23C9BB7716126DF42E42A665EF43BCA05B790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 821c32893b1dcd1adbf949c0f9a8c02a6c14cec63d73d9c1d7d288b075b6ac32
MD5 39e7a5781dba897bd2dbc4a0e5b9edaf
SHA1 9e1ef1d8c09771523f9f3af5b947e50c4de38b3a
SHA512 7713c24d4820120e382698e6dc3bb0a4fb0c7823852b2a316afcd59fa18b7319c5a64cb6881d7e86bc2f45815f654fa9f1b3d80d2be9a1a206bc880aa687597f
SSDEEP 12288:yFKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:ylVSnrLFY+iOOMAep10
TLSH
T1F3C4234A1C8948F6FA25C3F14278F171F23997B7756026DF42E42A665EF43BCA09B390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 a632b8e190ef8e6b3c6067727c6af20e677ff51a84ae194fca7f019ec3e145d2
MD5 797ef3ff09e3ce30d4229bb23c132e67
SHA1 01b7f01fb93ae061fb7bbea981594e05694fab4e
SHA512 2d0f49e8ffcb27670de977062709bf3b0bc653d97d0c96839f2a40c237b05d2c08ee15cffe0309fb604fbfafc14f9843b6fe0978933003de23d858cd6e8d5a0a
SSDEEP 12288:ykKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:yOVSnrLFY+iOOMAep10
TLSH
T105C4234A1C8548F6FA25C3F142B8B171F23C9BB7756126DF42E42A664EF43BCA05B790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 55e448861f9bc21ce59e969d1fa837ad00e72ba1e3e98ce3fdf384cd0165cf86
MD5 6aad9ac16f8590ab73e365e86095d09c
SHA1 422d93d61826c5442751f9631ddb0d6498aee1c9
SHA512 52ce615eeb5b7f632dc788df9519593f0a5df25e66601702f0e72c1d558ca2448edeb14f84023bcad1d579c1a4aaa306a317e33010b01c9243a26caf6f013e73
SSDEEP 24576:efwvOk9RX6wkyAIXVSnrLFY+iOOMAep10:IMnYIXVSnN7iOOMXpi
TLSH
T18235DF29EBD844E5E177D27C89B7460AF2B178691B31C6CF029A53AD0E33ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 67efbee3447a9e521713f9afbcaaf869569a85d8aec9df17677d8a185cbe24c4
MD5 3950772b3a932cd49952d350a1406d27
SHA1 42ad0ef2d8edd60a13233e713d024702fe520779
SHA512 881c89b0f51c1206d6c830b692d7aab582c1a56e528078137c587ef062f25df61e2c4c3978414b328991d05e7bee41bbee6695cf55b10a9264edaa0d2def7b76
SSDEEP 49152:dYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0qVSnN7iOOMXpi:TySzPCV07ioXp
TLSH
T1F0066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f1f81c73217aa15b52a299c02b7551a90f9140319deccb2ff1893badb0e83859
MD5 132f9d0859ca51af1de09cf4b967d242
SHA1 5043d5127c8cb0c69cb97cef70d9a9d2885beccf
SHA512 b10504234b6204e5f44cf024b7a9e9ac813d3dabefeac682a9cb5cd878e6d9513ddb199d2320ce6cf8a2864689cdc3e0dd4db4857e26a42002fb73529548259a
SSDEEP 24576:Z47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AY4VSnrLFY+iOOMAep10:Z47JUQjairIhCnDHUPfF/6VSnN7iOOMw
TLSH
T10265AE1EA3EC01E5E1BAC27885159A1AEA71742E1B31CACF12B0437D6F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 5ea0518cf75974c5451a3d2d619327b17211ddcdd12fcc8f693319727fc3504d
MD5 6ac4b0f7c47663ba83f59ee49c11e812
SHA1 ea3ec258f27896e73a49a97ea00d9713521f8e81
SHA512 70049d3a540c8a930bd0048ba4d623535d615fe96cd4024e22825aed651103e15d6e7057b6ad6157be5b0e984f887c3a4892419480a7fa3c4ac1d0a7c5e8376d
SSDEEP 12288:jksfXKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:PTVSnrLFY+iOOMAep10
TLSH
T121E4F00AD29801E8D06E92B5C765A651F3377C6693E193CF42D0F53E0FB62A49DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 d7277f6a52ec8bf0026b6df5cdb0ddd1861c6c9bfc1a0e47d4e409df0000a860
MD5 fec67c6547af210092d47d03e2612447
SHA1 fbc538f62e74c758be2ab19d645ee419ece30634
SHA512 b9a033874a72c379c7af6e64ed387660cc91ee5c82e02f411f97a5d520fe8ae36cee5568bb5df7cceb4dbeffcc2c0ee17cf9edef31315ac988b863d3ea2dd727
SSDEEP 24576:smQDUPUQp3HOVDle5YS4cVRoPoHsbYTXrS:+DUsQp3HO+5sCigHUYTXW
TLSH
T1DB451600B626D78FC6A950325E76D6CCAB707C41EE05AF0373C9473FC576658BAE6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 e32dc4495e41917c0aff938fc9e912fbb99f50861148b3408e9481c11fd12709
MD5 ce10b67d3761aad246cd35c293278ebb
SHA1 3190bed6dd7509f01ec992008823d103ec4314b9
SHA512 cbadc49814acfa604bc25faf7e2c213277bf515b92caaf90042097b1b5f24d4a098c27c5e8b5c41aee0f5b8db42d55eb70128d74aa2ffe488936bf6fd7d5e638
SSDEEP 12288:KY8xean6iSqTntYBnEd5LfjVnH3BfIQesihxkL+qxLoAWfLfLsd71Dc2cg+zRx5l:KhD6ru7jVbDFcgMR/ZF/05K7
TLSH
T194651A00E4B7E34FC96E9037573286CDBB746C42BB452F05738489389866B6EB5E63D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 3702944923cd63b34347df79a19d55914e25d060dd911d165f1cfbda6187a2ca
MD5 5aa1636b65e00cc534ba2a7a0dfc3ca7
SHA1 8a7ac8b061ece66eb85fe47728c64632fd096a8c
SHA512 6fd9e4dc8bc8fa6bcf82717f73e57e239798ff6ee0bdb52a5b3a4e42d2503c47209ee36c3cc523090b369b31e27f9119d36505ebd3c5d9cb50ad441bf7f744db
SSDEEP 12288:QM7vKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:RbVSnrLFY+iOOMAep10
TLSH
T18AD42356198848F6F97AC3F00278F131F23DE6B66B2095CF81D026A65DF07EC98B6741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f07dc3f840c6c175b973132233844357cc4bd3fea5976a145bb57f6f776ec9bc
MD5 149d346f4dc07ea6d10794b1ce87dafb
SHA1 f0f0ae57e244ef6cc34fe7c43b3c264a22c5444c
SHA512 3dfcc2592e47f6d1807de8189adc9dbf900676d51b068ee0474647b70ad77534d88d607abb0d6b5b773a4d5a5273d5222c423b0d2037974751843fa345f59a14
SSDEEP 24576:Jgb6bmBIi49WNNFpg1rSvFv7bYZVSnrLFY+iOOMAep10:Jgb4mBIBhGF4VSnN7iOOMXpi
TLSH
T10565AE1E22EC02F5E0FAD2B89DAA4417D6B278161731D2DF0151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 44830c02b3643bb65018b52e1052348c3e2e41859efd54f88d95cfd06a62f541
MD5 6f1526df390653f44a523f088e83ab5d
SHA1 dda68df6be64dfe4c01dc173425ac7a5b8afff72
SHA512 fcc626b3583d5c86fd2cafc30e3ea7089706d122ea11bd1dd663896e18022603cdc2f40e1fd21ef8d9e18d40e9fbc912224c5624acdacffcf92fa45efe7a5b16
SSDEEP 24576:XG88u8FpJqH1nzria7/moVSnrLFY+iOOMAep10:W7ZFPqV6a7/hVSnN7iOOMXpi
TLSH
T1FF35F16576E101F0D47BD1388A964663F6B2B4261360EBDF07A88B511F23BE44B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 969fc2b3900a7de1a6d33dbc7060a4ed2e5b375d276e9e40aafe55f5be45f989
MD5 fe6936a5e0ad0a543850386ea23d8f54
SHA1 9a80d11e1b9ee71827e430a06e700f816c724504
SHA512 8f4bbc6649653025ad6ccc3e165ac07edb75068fb49eed24ea18a9455fc9a69b03e1c482e8bab7f847bddc593c1244c2e99239d6706a44f14a7eb7fc9dbd3122
SSDEEP 12288:AHvUrBFrEjwaQ2KOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:APUr+NQEVSnrLFY+iOOMAep10
TLSH
T15505E12F26AC18E5F67AE17D85969619F771B462131192CF02E0417E4F63AECBC3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bd57bbb610f2237ca9e95260cce0d4cc1cda968454ba270254f0e91415c3e761
MD5 bc777c55f7811e25e2d2e26bbfc22def
SHA1 bfaa14d9b07ba79d8a13b42940957cebe952db05
SHA512 9e0ed984298dd53738be4a11aa1a5fc223a4f81ca4154dfd7816e6b228be4037c023bdf0e3791bba1f14f0f988a53c46c1008f9f8b340f218d403f420495f8a6
SSDEEP 49152:TBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj0VSnN7iOOMXpi:8G05lO43b/V07ioXp
TLSH
T18BD5BF6A62EC11F9D1BBC17CDAC6860BEBB23425033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4f86c9236529c59eab25b7cf50d5fbd12fa9d6e1e8ab00e2d670e12a4ec9a7bc
MD5 b9d1fb45a841d6d35e15a357e6aaebf1
SHA1 9a5bdcc57c7859c34c56878ac2d7fd51dda1fc14
SHA512 20e8712df8a1ee52bfaea4a4e21495d2741e7f924626a1f37ada6631f96103688069c7e3d12836a2bc6c85764136c38020383b661f554dfbcb0617676e65e627
SSDEEP 24576:Gfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnqVSnrLFY+iOOMAep10:ea5POZ3hJt2pasx2+mMVSnN7iOOMXpi
TLSH
T1BF65AE5EA6F800D5E579D17DC583861AF5B1342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 dec5832386098555d30d35af8e46bffa9f74d1597a3e0e2e7bf751646dbc9533
MD5 8688ccdc819ffb60f7bf6274324c688f
SHA1 47348a41d537fd309de42ae69d6ea8d9f7118b58
SHA512 ebc5b4cb65a802d5c8374bb38e2219708fce5500e4109e22f24962091eeba704099b280dbccd35ceb310af78df9d06d89de93f670abfc6469d9182c7d6b36d94
SSDEEP 24576:aNcwHdjbyQ4nLC18lb/EOjowL7FkAVSnrLFY+iOOMAep10:aNc/zEOVHFBVSnN7iOOMXpi
TLSH
T1B8857B1622E901E4F5BBE1BE89779546FA71786513308ACF0291851F1E73BF85C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2976f882d22a9a819f309dcab60a6ce7719f433483ad024c0ff03a0a76f81c9b
MD5 19a3f75bc8568a869eef6d5cbde2bd26
SHA1 8383db29c1cb1cab7e5e65b3e290a6e992c75e05
SHA512 aaf0126a7f9102a1f6799f7c85fcf3ca896f0d959bd6897a41fabec042646019d4beac3a54794ea0c4a306b42c9f5d6deffbe292a774daf9cd9fc20dc0930049
SSDEEP 24576:F3kNvNnaFeYhJNtmZBmOVSnrLFY+iOOMAep10:F3MwBtOmOVSnN7iOOMXpi
TLSH
T15255AF6E7AB845E4E1FAC6B48E238512F6727461173293CF4290C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 0091c20fc08811c5a3a9767925d5363763a32f573a9ab0b663050c9822260674
MD5 a64e36cc7fa63576aa49f76c87ecee6e
SHA1 55c5b4c0e73a91c1b22fbe1f26a07da14fa4ae21
SHA512 ed6a795173d9a6bf81cb5d50d80418deb5959bf4e288690f449c45650e7b6be6139a111a15965af62d50096fa6645022b35b5a8c59c778cf21d70e1f18a86150
SSDEEP 12288:KQcMxWDXN1Dp/fshBItT1IQgAbKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oyD:YD3FHshBIYQgAPVSnrLFY+iOOMAep10
TLSH
T1E425E17EEA9C04E4E57BC2BC86639506E77178A9032166CB02D481B61F6BFE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/984-67-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/984-309-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/984-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/984-73-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1304-315-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1304-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1304-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1304-102-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1304-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1304-108-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1752-79-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/1752-84-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/1752-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1752-310-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2004-404-0x000001CECCF20000-0x000001CECCFCE000-memory.dmp

Download

memory/2024-115-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Download

memory/2024-121-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Download

memory/2024-313-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2024-113-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2044-318-0x000002534E090000-0x000002534E13E000-memory.dmp

Download

memory/2044-403-0x000002534E090000-0x000002534E13E000-memory.dmp

Download

memory/2296-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2296-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2296-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2296-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2524-385-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2524-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2524-386-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2524-95-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2524-89-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2524-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2940-127-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2940-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2940-133-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2940-136-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2940-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2996-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2996-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2996-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2996-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3480-77-0x0000000140000000-0x00000001400FC000-memory.dmp

Download

memory/3480-7-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/3480-0-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/3480-319-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/3480-6-0x0000000140000000-0x00000001400FC000-memory.dmp

Download

memory/3480-8-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/3480-322-0x0000000140000000-0x00000001400FC000-memory.dmp

Download

memory/4268-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4268-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4268-47-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4268-40-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4268-50-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4976-308-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4976-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4976-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4976-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/6092-14-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/6092-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6092-23-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/6092-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download