fe42eca105cf765d0fc7e2bda8126dd210d981f0864cfaf2e55489b838b16cdd

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 09:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
Size 1.5MB
Sample260702-lrcyaady5k
SHA256 fe42eca105cf765d0fc7e2bda8126dd210d981f0864cfaf2e55489b838b16cdd
MD5 c4009cfa7331952db53fbca69caa6d34
SHA1 0f6ff11e94d7ba00f9534076bcfde0904c955a10
SHA512 8657d631787752f9f0e7ed0e55f645f9feb41e9aa48102367cefe7ed032a0ea9c4f9e5afbd076ac3712899790e2ea39b02bc97f7f387d40ba0ff565b8aa1bd0a
SSDEEP 12288:bLdgNWIT12UL0iUbwRLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:bLdgcU71uNyBo4kx929bL3Hnx
TLSH
T13265DF16A6A508E5F9F680388552953BF93D78450364DBFB06934E662F33AFC9D3AF00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5864	elevation_service.exe
2092	elevation_service.exe
1692	maintenanceservice.exe
5552	OSE.EXE
4992	PerceptionSimulationService.exe
3860	perfhost.exe
2236	ReFsDedupSvc.exe
1868	SensorDataService.exe
5544	ssh-agent.exe
2172	AgentService.exe
4812	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\27bfad1458f5f28e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109015\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000daf732d8070add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a6d146d9070add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eeff4c97070add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000a5776097070add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5864	elevation_service.exe
5864	elevation_service.exe
5864	elevation_service.exe
5864	elevation_service.exe
5864	elevation_service.exe
5864	elevation_service.exe
5864	elevation_service.exe
2092	elevation_service.exe
2092	elevation_service.exe
2092	elevation_service.exe
2092	elevation_service.exe
2092	elevation_service.exe
2092	elevation_service.exe
2092	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4764	2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	2236	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2236	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2236	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2236	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2236	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2236	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2236	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2236	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2236	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2236	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2172	AgentService.exe
Token: 33	4812	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4812	SearchIndexer.exe
Token: SeDebugPrivilege	5864	elevation_service.exe
Token: SeDebugPrivilege	2092	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 5468	4812	SearchIndexer.exe	99
PID 4812 wrote to memory of 5392	4812	SearchIndexer.exe	100
PID 4812 wrote to memory of 3352	4812	SearchIndexer.exe	101
PID 4812 wrote to memory of 2412	4812	SearchIndexer.exe	102
PID 4812 wrote to memory of 4892	4812	SearchIndexer.exe	106
PID 4812 wrote to memory of 4496	4812	SearchIndexer.exe	107
PID 4812 wrote to memory of 2356	4812	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_c4009cfa7331952db53fbca69caa6d34_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2092

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1692

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5552

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4992

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3860

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2236

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1868

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5544

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2172

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5468
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1797646245-3139070211-3019596475-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1797646245-3139070211-3019596475-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5392
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2960 2956 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3352
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2984 3000 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2412
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4892
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2984 3000 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4496
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2960 2956 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 619fa9b33c30d18f25c18d5f2c02f7a6f245b3adfd1a20c347697901e2c68fa6
MD5 f2703db71f7df490200307b6cad243a0
SHA1 62ab9691c2907d8524aab8d1ffac58bb09d98e59
SHA512 a5b3d2e61d18ca07184719bcbb038673858df463cbc2468756f8a5b3a4a112dbe27ae5d14c8568778e1c9dc2cbbabcf7aa7f444b171f55886651a7f976eadfd4
SSDEEP 49152:Gb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnwB+kn3Hnx:43q6sjBz+k
TLSH
T170D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 3b05df4bff3f2a8f8e82d17012d0dd26c92f4c380dead102f50e3033924583fd
MD5 7f725bc6da3268bbf67e0e7abcb3c12d
SHA1 ed6b5f98dd1a41471ac284311008b6b199fcf324
SHA512 ac8520ee57cfbd15d59932028029b6ad0d3a142bb9194c006d4c6056f131d7931642fb9144a82ac8107a58e9a0b92a29c790536854f0ff63411bcbb2c40b64c2
SSDEEP 12288:n1XLsswWkxy2lRq2czA1LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:1XYfDtczAqNyBo4kx929bL3Hnx
TLSH
T14765012967D409F9ED6B9278C8A2C511DA33BC454760E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 ad253cd2548fa8de4fb6ac70c61b5670956209955e61270fd745a671fe224b8c
MD5 7ace52908cd7b3975b57cc3a2f72ddc8
SHA1 56d5f7dfc07ecb90732324cea46e6e834bbfb70a
SHA512 4b760048d5daaf4c814a944def2ed2eeb233d98f63a75a5550be95a09a1d2131c51562292c65abba1bd05a0757d63011ec4fc1d767da0986e778e4ca6e3469da
SSDEEP 12288:nXZNYVLeyUji0h90ZD0wxpGZIVuArHs4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:J0Le5ji0hmxfrMnNyBo4kx929bL3Hnx
TLSH
T109859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0b65de393001280dd96afe34f7614ad67ebe484a86ba7fdf28e64995de7ff875
MD5 d7ee1d2df34b463db3b2e4e40f146738
SHA1 da33f86bf28fc2554d9d10a169c9b0cddfffeb15
SHA512 ac20715832e05b6e709a368a989138f998fead6bc5c3528e3e62c9aaa176e585dc6dba246abee921ef1e07f75b2b28fd8cf3ee5b064a6984546e875ee8f49615
SSDEEP 24576:ka7/ezSC6vUyD/aqgrvWn6q8wyuxNyBo4kx929bL3Hnx:T/ezSC6vUzPveHjyPB+kn3Hnx
TLSH
T17D755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0e4bad30cd7fe670ea02381bc06f9ef2a0980b29c35b6a00eee000fee9e2fc6a
MD5 f56b57b17a48a6267858d0409ee9c2b8
SHA1 f6ce6340eb82a82bf50b3ed4d3e3a974c95e5f87
SHA512 cf407fcda128521eaa78c88cfd4a28dc19e7c631ff7265114a048079cec82f9cf8ca739ea239d2205ac37ceededb17aa182f9b65c2ae11d7bdc1298e853cbcfa
SSDEEP 12288:cVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98hLDAptNyvUgXZ32dT4ePc7N29CD:cVbqPb88hv/l+YeNyBo4kx929bL3Hnx
TLSH
T147559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7c3d3c7659cc00b8b4d2b1a3be5030f556972e032c250ec6327edcf426cc4739
MD5 b8fb08afae0fe5ee46206364dc1185ee
SHA1 35d18a9c988c417a2efaed9c3116b9638d427b0d
SHA512 69dc0a133481c9d391cc33f7bcde61b8d1a1bea57b3f29b1ce3dc898635dfaed8c3738e63b06538758bf7425d2d577f1f1590d73d2dde7177d785f965fb33f14
SSDEEP 12288:amULDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:amLNyBo4kx929bL3Hnx
TLSH
T127452312470C6276FBBD3E70795E8454CC35BC8D0D95DB94DE62ACBB58BCDA2DA21103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 fadd5e8964d026919abdeb8d21d4457a7558617789fe38e3bb84c7bd76a7d5b4
MD5 67512b139fee4d2650c09855bd1f38d7
SHA1 41b4a5bbf5576e3b26c70ddca718209bd34be024
SHA512 1384694f070ccd5ace9b43e6c3fde4789a5780444b7cfeeb86a25793c6e391a8c8fb08bc7400e73d026b91fb89d4791a0e92f0408be49904d119c1340457d180
SSDEEP 12288:MeBNUbTVO86UZLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:MJIUGNyBo4kx929bL3Hnx
TLSH
T13165CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7249c7457a00d550f8f323dd33d39b1fdbfe9e6997d98936e2b51e35ee3b087b
MD5 fdb879bc783abb3bc3dc449cd0281641
SHA1 8de141261ef10fb5dfac7a61f4204fd7b51af517
SHA512 c6edd828009260e8685a382802fd2710e54e82157b08a8640dc9ed66a62bc36a228a8359bc651a3998b4a34b2600fcce877bea84833c5c39f7545a1d7828dc37
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THb:TQvGAdlCEL8c/DRNw5Cm+k
TLSH
T1E2266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 e9fa1741fdff12385d71a8193649f9b9bffa5ee3b8a6567673356cf12e228376
MD5 2e3d4254c8b56b2235c9d1d034d89139
SHA1 247040252a1d1d2ea454dad70140c71519af08c4
SHA512 19b529c945bf10f65fbcd3d57633fc1164591ec3c0d50d7ee4ca48eac5f96104c1c8ca31b0b4b6ca045bc71aa2d8bdc9d4038042e9d950af342c35646d0f39e2
SSDEEP 12288:XAwSfxL/2Dc3XDLLmt0LDQewsAjbLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:wOewsAj4NyBo4kx929bL3Hnx
TLSH
T17375E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 79ca3052dbb66963f0aea1388f9a3351c5941f2a736968f01497cdd8f1836a97
MD5 09dccc861173dc2c63a7052b014f7d3f
SHA1 1b674caa926eda070b9790f70c912afa8c358763
SHA512 79578813a6062f55c90b03fd553e15788e9b3fc14f52d773442f162039b6870da61b0e7cc5d9facfba38934c1d853024b6f24182f60a4c055141413496214398
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHl+k:qUEtQevvqc2W1cpV2tI32l
TLSH
T134474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4b6560a9abcc1c9c76023bca85a40b15063b704806b05c3992c06a479d4fe2bf
MD5 39b135e2b481da2f40819c646ed78ffd
SHA1 57902b539af71c01c894f3ad6394686bdc19c8e2
SHA512 5fefce1cbe4a6a20f55a6d50c04e92dd4495687b60fc61226a7afce80d9ad2130692322cd3efd6c34b49003b9655dd8ded3dc0ad24ca54d79bc84a10a981b554
SSDEEP 49152:FCbRquA/m2yL5zTfFiV+XenmE3/zbB+kn3Hnx:SoquVjnmS+k
TLSH
T1A3D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d67f17981bcf84fcc3eece6850a77e48eefa62ba87a7a6a81846f139a9f2696a
MD5 79eb2ea6ff864719268b5f78c8b4ac5b
SHA1 25b82715d46c8ab2e87df874ba9b6440691418c2
SHA512 efbc0651771ff7670c51b8d9e3acec12f2ed2a785c3d8a46bd3e10652fe9b5d7021a41a9e901158f00c14fd5434616f263de03765b8cd938929a443e505f58c3
SSDEEP 24576:uAhGL3IFoiwtA5l7S53dNyBo4kx929bL3Hnx:uAMUFoiq5qB+kn3Hnx
TLSH
T15E359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 ed6ae57ad15583022bcf972901192c7bd7d343f25c77aea9f40a027bf8aadf42
MD5 2d2e09842effdd49bb3de5bc5b8f6cd2
SHA1 f1e8b18af9edba91ce26ce3ac0f4e476b8ae6cd5
SHA512 079b62be16b80333bf0fdd6871dc8460eab11fbf6513eeb948cfea34536bb6c30c0d20d7aba805e964a953ec522921d0e4545332269f1940119d93e207a6e238
SSDEEP 12288:dmw5HEjsChNzBFgl0WDm+C6LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:Ywu6OWUNyBo4kx929bL3Hnx
TLSH
T1B565F10677A81CF9F96756388587C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 83b049cf241fe0fc81bc25e75401c7631271a0bc6e78697ca89e414074a2e257
MD5 4c1f066ac4bf42889923b9a086aba497
SHA1 40f008f0b8ec790d2942bda97dac8737f81b9920
SHA512 9c09f5009f80370300a9c746629624ce733f6141246d0df15fb112077542b488ad42625c8b3b1bc508f650215da8e86a25813d82a0ee23b3d2406c4043d43f8b
SSDEEP 12288:RgZ1IyLLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:KZuvNyBo4kx929bL3Hnx
TLSH
T136551216239831FAF2AB2678D8E58544CB32BC461B7183CF5A2145BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5a2ccf674b1497cff1cda16aa3abd5dbb932d4c9cdcf4c8255bec8d4ae78e2ad
MD5 7bdf0d40efc6dbf892c9fb59fa4b24f4
SHA1 cbc0429d67b22b7dd6a8de2e2a76720efe094cec
SHA512 a7388cf6f1e1182d845db36cb1ddba1ebeeecd9e230166f6451e56ccafd9540bd9b92e449f7466b7c3676738d6ec46df9e8d90aad0dc134230bb37d41c757eb7
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UX:pQRQyi36YOcPbLvw2gAf+PN33+k
TLSH
T1EC666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 15ea59474a44c5785b32d964f1b04839306bf4509f9317a3f1c57b1cda70eb45
MD5 efa2e444c0572ee8619f5676a1d7a2f8
SHA1 e1f1d23e2d1d39f35e3f515daff89154486e20bc
SHA512 0a759e3325ed11883384ca89729c6e726fde80d7970a50cdaea1442b0f213e80d091772f5913c90834dfbc891d596a27c8ab9e307e25daf58221976f65920ad2
SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UX:dQRQyi36YOcPbLvw2gAf+PN33+k
TLSH
T1C7666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fb56f33824024a141547e9dabeac78aef40403ac7ff2cadf0baabbe5c6b17e97
MD5 b09a3ffd8956b41c0094eec8d02bafd9
SHA1 a8f035da1fc85b0687cbace252ea48cd2bfc2715
SHA512 0340092b81eaaaefbc96f75da4e0df59fd5ff182ebb355bd14c0ea537a84357be25f85a0466d6e2e8f475f0074ec360acbe5fe0debbb067365d6bd2ddfc64e24
SSDEEP 24576:twvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0fNyBo4kx929bL3R:J68Qg55nhceWu7PNU3/LB+kn3Hnx
TLSH
T1C1B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f6de4526e4f42b71d7edc153425810fd1ba832f64f145ecf1af2c6a27782e3d0
MD5 ef93dcf7b62b46c9953b5e655dcb56a1
SHA1 f581422a51c2b85d06a76c27fc30131e4e6186e0
SHA512 a6997c21172ea9423c398ad843e3874b8d44ee40bbcc03aa8d164d2f7feaab9fa56112b26382e7245e64257417e5b9e4c012d371cc4e1d82a9f6ceeef52df2bc
SSDEEP 49152:e3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99B:fy5112gYy5azzVvt69nLKnhZ4+k
TLSH
T139167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 47656247a9c3d52b672743b0eebce2f602d9434975454b07bdd95db50aa00f82
MD5 6568863cde1f65cf264144309a669e75
SHA1 1471f232d0b39b80faca62fa39c6bf79af587a0e
SHA512 8fdc19fa189d5ef621fc0d5d07c64dfe15046a5e86186bdba0019cbe6353aea709e42326201ddb82de2a62cf14ef600516caebcf3db149c1166819718a0c44da
SSDEEP 49152:sB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glJB+kn3Hnx:mu6Jmdxd2df+k
TLSH
T184D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d52803251b16831b0de79edea9ee4070e04e056c0fa92d8837917aac58301cd5
MD5 f92f1d86aa460eb5eee357c81734f2b5
SHA1 1ae5534ce5ed9e9a762952b68766ccf8dca9eaf9
SHA512 be36d1a0547b9634f0aee1c1fba198cff7d30015a3189ce0d751b81ec246d07658db827d51d6f76879ac219adf61085f8f3e636a22d01d3da2a4534d01aa156c
SSDEEP 49152:Z1hpsNoJpF1A63U44CwH7R4xNB+kn3Hnx:ZmifPWRS+k
TLSH
T109B5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 93e557da1497acde7e8712c425dd7da4cd587d44c2c2027e154921e722e8bab8
MD5 d81c942cbb6087502069dffab45b2f3b
SHA1 e13ad6b7ef6aea86ef94b90224f9b439d1d449e9
SHA512 f144a267b495aad7a42b7992e66ba0d49a89cc7d6a7e47a5aa0e70781e6d9acbc88258f020cf21782e67ca18976e112859488fad851da56cc6f2dc673272ba8d
SSDEEP 49152:PSuZQIY0Be2KcRVtOnks6NMHqgB+kn3Hnx:15dKii61c+k
TLSH
T1A7C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1dfa87e4a07cab45107df6942f4aff82bf88b073b2c82e80c4c5647abd8b840e
MD5 cdcf105736f49576cd5f53213889ddc3
SHA1 9e806b09f6e1b3bbc8de4ad074fb64134aa60eb0
SHA512 50f3e81c0bdfbe9571511225f6fa6067ee149cb15221507c2506412bc2e0b2e8ed61ff01365762adaf6cc76447474afa73bbf22a65510649e39353249eb2d5a5
SSDEEP 49152:dhtSn8EApI0fig3giDn0AP5w5B+kn3Hnx:MX2imphe+k
TLSH
T17295BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f0659f5faf50f79ed570e3c67349f798d9ccc3e855a3fe13cd820a11e1c3873a
MD5 662cff941bb67823117d8a5c8dfba8ee
SHA1 f66fe63bcc08a1dac5940b33e7380f22ba9f6825
SHA512 f54fe5d54a8bd78edf6862f0d975135bb3c83af0e2fc476d11365526c907fd3012353931a59bd42ecbbcab4f705be365f618ec65c7fe46a7b507096d2f053eae
SSDEEP 12288:KsLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:KzNyBo4kx929bL3Hnx
TLSH
T1914523125A0C627AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA24B21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 580ac2d1ca1867bf32880d848154a2ef031e4e5d7c56b1a62ce12c0a8dc3f353
MD5 03a5f54bf3d9f96a1834747d5d161910
SHA1 e7bddb0a4e59b586b660615fc2db57e7d5366048
SHA512 be8e049cd3fbd16cf062d456d8801538334ab0bab3411c4deca2c6efc19416f99e9573e7d2295a3d4b2e3f7110b149b6b613a6ff8dec979b4b863650a4ba965e
SSDEEP 12288:z3LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:zMNyBo4kx929bL3Hnx
TLSH
T1364523125A0C627AF76D3EB0644A8498CC34BC8F1E9597D8EF27987759FCEA24B21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6598b50d0791bb30541c67e38eb08afecc5582878bffd425a0ab8902c30fa658
MD5 a234e08c3633c3e725645820c2b347cd
SHA1 8d8729f9f304b5b78224cd5495cba34f77f5e8f4
SHA512 b36c3e3133d9db6c6b337d4fac36044a9e123671cfd877ef6b78a5a757b810c45709d6727a86cf6f81266b2b961b70288b9341b63a2a63ad0baf9b13bc3d27da
SSDEEP 12288:ExLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:EONyBo4kx929bL3Hnx
TLSH
T1224523125A0C627AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 54b8dbbd5cd35a06ea1cfa289fc4be8fc95cf0a4075781909447e366634fbf74
MD5 1e5f072ba22de3eb93a5642a8c95716f
SHA1 a16954f0642b0e4ed1ef801145f7368e1cc03e1c
SHA512 f4c83271761938db57a021a641a0aef7497b61c865cfc2bcf99590113b3580d1c478d57931d0bd20679705248942f9baf32d3ae16831d05833dcd9fa619a6a8d
SSDEEP 12288:eVOLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:oNyBo4kx929bL3Hnx
TLSH
T15E4523025B5C12BAFA7D7BB0D8568054C835BC8A5B7297DFDF12487B0EB9BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3afe35f27c52e4389d84b70d977abacd65434988be0ae51f813adeb065a6c244
MD5 bf3234dcf7246333c3caa6690a0f1fd4
SHA1 bf9b7def115b8458b8226bef42ad9aeb0a767806
SHA512 f55f6860d2a11f1517258797bf5516719d6279a4dda93723ec7e506b12f013c168707b29e178ddd0526a37b3c3ac45fc7d96c66baa35d6d84071c2f7493d4aa0
SSDEEP 12288:C2LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:CVNyBo4kx929bL3Hnx
TLSH
T1F64523125A0C623AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c0c11bb6c68013f392c6c523967ef1cbbe687b1196e43a9cc583db3d61763890
MD5 21ea4df780f9f3a1545c4846e7e78a7c
SHA1 c79ffad2462aedfef54720965e768fcf8c82e2b1
SHA512 439343c60387f3fc8a80628f741fd76711ab208d9633b55bc6f8e07c151eb431b68fcb810f55b631daa5a65bd4d26b5c2c10fd57b9ede922334616cbe0185343
SSDEEP 12288:vTLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:vANyBo4kx929bL3Hnx
TLSH
T1154523125A0C627AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 d20b117da9256c8abc61ab3d7daef5000627ea109ab4785c7df490f783964a5d
MD5 d0c457910bfe14f472c34ca26c07518e
SHA1 69b7ae21402daae6bdc6880e44cbefc708a1dbb3
SHA512 76601d6bdef63a7bc055bb5a2bed0df6672da03817b8298f34b1665f353ce05bc1c8328133e67e2a37d08dea7ed1f733bca6116d4084f0d446b0f13f79a222ac
SSDEEP 12288:R/LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:RENyBo4kx929bL3Hnx
TLSH
T1624523129A0C223AF76D3EB065498498CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 35eadb6e7ff550c81d58834598651e569718aa078e6e305f51aa4a6bf4601b58
MD5 a5087ff055fba5a2d4b5467edb82a69c
SHA1 d220924d9f77aebc262f3b79921c4ebd0075cb0d
SHA512 0bc1063000caf5789d04ecd5910d2068f983d06206624c9a95670a30c32a8b45778a24ba40171e0c00ab8895badd65a0eef251f23fdfadf159bbd26c8aae1aab
SSDEEP 12288:DiZwbjzzFEoS2cPvyXLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:uZMXzFVSOsNyBo4kx929bL3Hnx
TLSH
T1CE650195B39418F8EC67823DC8158906D6B2BC4A0BB0C65F07A4367B5F773A10D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 246858a03eea191c8e5b16c785c62510ea4276fe6d8b74ba7bce3062703f7a5e
MD5 fe8b7888621cab8e10759a78ece24e14
SHA1 4f547cd6d552ef1a3c6f77d007a7c1f984ebd04a
SHA512 5bd0ba15cc0925c3f33943f6747fa1d7fcd855338c3187940aed6041f1c58fcb0ac9b0bdc1a78f077623d73832f29e2b3cbde609041a4b639ed1dd0cb4323177
SSDEEP 12288:QALDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:Q/NyBo4kx929bL3Hnx
TLSH
T1004523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7a841d4f3eca6a74892b653f25479e6affa48ab91d7cee49939fce4c931491be
MD5 5deb62d3e358689c8b3f9d1a8e54c361
SHA1 23fd8bcd07e4519ee4b22802b8e7d1eadfd42883
SHA512 fcef475e2d7640ef95231b56226b39bf8c9c9f5219e8a3d08979059a9bf9e490e5d5f575dcfd0577f75d3b303d639275c6f071f40e5924872534d6bbc3039255
SSDEEP 12288:YELDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:YbNyBo4kx929bL3Hnx
TLSH
T1044523125A0C627AF76D3EB0654A8498CC34BC8F1E9597D8EF27987759FCEA24F20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 2098bdb60c66612485bf7fce9f6c2dd62b0889fe61bbd6df9cc6956a11ecf457
MD5 2c82266c5673a458f0b4b3311b89cd29
SHA1 a53df3719f14d6a6faa70e06d48489e25ad9371d
SHA512 c3a6b8248f25fb3619dcd07d174160902940fbe72e5046169e048d5d346aceb523eca8bd19c7e5ea085f928c4713b7a562c0f10042eee8b9dd7dfb1bec93a797
SSDEEP 12288:uyPz5L8LLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:zzyINyBo4kx929bL3Hnx
TLSH
T11B55120777A831F9E17A6234C8960A05E731BC360B608BEF576046772F776E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9cff799949f81064e4441fa06ae17b2e98c220fce2ac3659019bb241c22faa75
MD5 4b3ef74676a396385a63a2951dee0075
SHA1 7142eb60af8190a15a444c34adc9eb9a47f1028c
SHA512 a8bb1458e5a573b7e214618d04db25d3445310515c8fe5bbe04ed84081990426147a4c93a2c7a4a00cb9ef667cec6e717be838b121118e1c7d46310eae37c583
SSDEEP 12288:DALDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:D/NyBo4kx929bL3Hnx
TLSH
T11A4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ce372a4e01476fc62034115803be85ad8283a87de46fd4e0eb466fd74edca369
MD5 d9582177880af0dd2e4fbf0ef046f53a
SHA1 d53f93fc392eb9fb41049fd7941d153c3843eb36
SHA512 e75c650eb257a58c93eeee7fe12a18c9322e034e7d8e80265ff0078e5bb2a3877123db50c1bef4cd1c78f86e9680bb58a59c15f11e5714385b291af29bc92afc
SSDEEP 12288:uALDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:u/NyBo4kx929bL3Hnx
TLSH
T1BC4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 f994631b1046b4c5f5bdbdaf1a07a49c902bbdb63b5bcf8590043668f57cf473
MD5 9705746374950245e01c5975d6d50dad
SHA1 548baa1e85fc90af825d741634a9a2b846d54870
SHA512 01af2f9f172424c505c6b8b027b2c815dba898158ae9fa51c1260334b1fe8e6b6492e5db8d4f7c5cda24f022e0e0f00994def1dc8ffa6e74c48b7cd253590abb
SSDEEP 12288:8yPz5L8LLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:lzyINyBo4kx929bL3Hnx
TLSH
T1DF55120773A831F9E17A6234C8960A05E771BC360B608BEF576046772F776E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 81d308c934c6c252941ad35d391496a50a0edc551b217274cb2d3d513d4ff77a
MD5 797156e21cc4163b54e6fdd3368953a2
SHA1 91b7f7466ab737eb65054e186a9b62eb784a2fb2
SHA512 4f7226da87d35c5bb9ea8eda6c660ca2bd88e04814e95458ee50672ea15e2c6428f3015c4f6f5a4ae668183ddeef34158e23ca206e8a7c59b84e9f4877ebbc6f
SSDEEP 12288:tCd98WYoaLHF3z0z04PDvhBLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHl:4TtaLl3z0zD+NyBo4kx929bL3Hnxb
TLSH
T1EF6501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 2a5547808caa8d92b0b26ec7b749f0cb5bf94afb417901483b476eaa837d4a41
MD5 62b31ccc51a33417bc9db220ced31b22
SHA1 8ab97c6b352820b85b8146266d09d465ee992a01
SHA512 021d95c7aa00a66f159df0934fc7583b1f62399190448039426ce7efa379284fd4cc25355dec947ec556bf88624fc98ca8994f099054739834aa49e64d4b5667
SSDEEP 12288:ri4e7ARdTfgwCHKy7GLbbdIvCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53F:r3ld9CHKy7GZyNyBo4kx929bL3Hnxb
TLSH
T19175CF90F3E810E8F1B79A3489764511CA767C9A1B31DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 26ea3f3b6c0e7b0542f627007b8101b48f278240556759a3d1e254f3e3c7d5bc
MD5 704371e900d7c57b520166286ab37b89
SHA1 06a95c656e1a7a0c2f78d4859051e7e9962d1ba3
SHA512 145fea157bf9213e0bd869e930a4ac488c32846bdc01fce4bc1c0251bb968b27883d0a5025a831e2fca871981f941948a2d0f82e186f5e4fa8a76f92824f22b8
SSDEEP 12288:BRLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:BuNyBo4kx929bL3Hnx
TLSH
T1164523125A0C627AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 bf1835304877d51b5bfb5b8c116151f0e714fb635e50c9e3c56f54e936d55e46
MD5 fe458b2f84fca139d793bdad360383f0
SHA1 742527415bad74be458732d70d5860e5aff76aab
SHA512 9a5c02adbe2260f1dbd3789c1b4800850d4f96cb59fa6c2bd47d3b6242f8568acb290c55933ca3790f36ebcca80af0773e42d85162356436ad71999f2a255005
SSDEEP 12288:OrLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:OoNyBo4kx929bL3Hnx
TLSH
T15C4523125A0C227AF76D3EB0644A8558CC34BC8F1EA597D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 77ea9ab380526298ae6e86e4d8ac9dabd6eeff7879e45b54619502631d90a375
MD5 6ff6ddd52183992deb4da65d7f90a740
SHA1 3946ff5d79c872505669aee7353930fcb8be6f2b
SHA512 552406c2b42d7ba10c90a0866ff645bd5eb9b2588bd2843aefe14802867b65128571f057f2f99843fd1f39fc8b17ea7221526462c71e9b60ab4aefc97a2b6db8
SSDEEP 12288:lCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:lJNyBo4kx929bL3Hnx
TLSH
T12A4523125A0C623AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 2a32a10c113bcc8b8b981515c4b9586b354faa552ab95920ad198aedfc1e658e
MD5 29739d8e6aaff7bc289ff47e55a6b276
SHA1 1ddc5cf9cbff1e9b202b092a8dfc4e3f55684e05
SHA512 5d11e0362bfb9afbcd34913ca5a21b0ed8c6e5e393b25acb2306fc9245d0b85c020f0cdaf24d45957d443eef0474a85d6ed6ae92800e43c178b5824bfc12c663
SSDEEP 12288:uALDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:u/NyBo4kx929bL3Hnx
TLSH
T19A4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 a4d568a5e49403cef0d77cb551fbfbb3e53a4a7f7355b2596a25afbc8ec7839d
MD5 fc5a109e6a651ed0041200a84a72a2d9
SHA1 679994b7f46f766a002a338b71ae322606ae2169
SHA512 8fa018868043b4b4bf4fb4af9ba7e9f4225533455f3cb24d875c8d2f0e7128ae07dff8508280b396bca38c49cd385f30a8988b2dfea737cc6a8818404c6853af
SSDEEP 12288:YRLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:YuNyBo4kx929bL3Hnx
TLSH
T1594523125A0C623AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 650fd8c9dee729678db58255cba1991f417ebfa5b373f15892b92bba5f6aeb43
MD5 3d74d06dee1dce5251afbfc1c8a6d5f7
SHA1 0b79b9669f971adf884296ec260a867e75a3b38c
SHA512 95c6d5346c754cf20b77bed527ecd31b7605b3783d69f0769dec2ea5df0cf59653c7ea9eef3cd615148ace1f300370186f038bd10161e8013ca384e33e607b3d
SSDEEP 12288:JILDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:JXNyBo4kx929bL3Hnx
TLSH
T1D54523125A0C227AF76D3FB0654A8554CC34BC8F1E9697D8EF27987759FCEA34A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 3f9db77307c7209945fb9f5cba6fe1e4428886885da7a8557fa031dfa8794b03
MD5 f7aac1b66a59271ab21e8daf5009b874
SHA1 8c02a110744c3703eeb091719c047ebf17f05cef
SHA512 f1cd26dde4c8dc0a039cf3f13329b35d55501721eb25c13243777f8accacf208076e24c7a11a99027b1181a7f50b45c6e46431ed75a54f853e94b8b1676b0d75
SSDEEP 12288:X2LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:XVNyBo4kx929bL3Hnx
TLSH
T1E04523125A0C623AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 ab960739729950b1b37f7ccae5dd79d7179c2be322c106ee3c2012d13635d6fc
MD5 5402786ad2fe1b5390fb0b841b6c8fd1
SHA1 2581a1135402142aa0e05d24c79e7203e9c24b08
SHA512 b39267fe5cef7f66a0c32690b7012056d53efdf08ab38abbfd1b9df365b4832b874a38339e457ccfd455ee8de12bd9f37c7491c75db4bf726bc43d01cf93aa54
SSDEEP 12288:hJLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:hWNyBo4kx929bL3Hnx
TLSH
T1A54523125A0C227AF76D3EB0654A8554CC34BC8F1E9697D8EF27987759FCEA34B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 3a256935a2a6da03fd87780c9fad662567e880e1cdbbf90cdd696255c481843d
MD5 b4d182a4c022e437ac13acd60a449bc7
SHA1 9e8b3ad44c4929697be536f05886cc2c0ede274f
SHA512 668ea455fa9d0287b4bb7ad4085720905321a286dd875f440998b42c0790885e891cb9c3e6c8d0beca89d53a5ed1d81ec0f9ebe55cba2627c7502ac34812f051
SSDEEP 12288:q2LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:qVNyBo4kx929bL3Hnx
TLSH
T1224523125A0C623AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 8e73e56f91a9dc0b432a3f1d7c3539e6c7d085a81b8ca8229aea630b68e2f08a
MD5 55f4ba93add26630f865d8bb56f56841
SHA1 fd1d61aa434607038968451a780ebd038f235326
SHA512 5e7157d370b298147339151b55cb0e8ace476856a2f940c85b283cc61a65b2ec8f8b302feb39d2ad45d9efb4e9dedd1411d3bd326eabb2bcfb4599d20e50776e
SSDEEP 24576:Gfwvqk9RX6wkyAIrNyBo4kx929bL3Hnx:QMnYIkB+kn3Hnx
TLSH
T16F85DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53AE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 bc6600687e5e8879cf61cb4c802fbd1397318bbaa8cf65539f87c6b2a3ee4ec8
MD5 cc3360a5100bddad8eec7a8bbfce7c64
SHA1 596fb1ac8ce19e6d721e792ff96d1899052ca267
SHA512 139f3f2d75f13ee471db516a8e9e31ab8e8e5f5a897b7c230dbb06fa74c9616b29fa6ce0e86d3491d421352178b3cdbb7641b56f6a8da1536ba27030db2cec36
SSDEEP 49152:qYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ZB+kn3Hnx:RySzPX+k
TLSH
T13F066C56A1A801D9C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 dbf4da52a5b30448cfce58c4333dadb94129cdc6d1b44c007da3956ee50d39bc
MD5 34cb28e33db0cf77aa11b212ff48995b
SHA1 873977e6e7416a8d8a24455966cd0d21aa73d0bb
SHA512 5bb5ad50c923cd79ead8a59f7ec7f61b285b1f2bcd65290a89fea821fcec65d7b6d2b0109692c76185cb85a791e24f92d96bfc148cd69b4e5a8ded481e3a1ba9
SSDEEP 24576:Z47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY8NyBo4kx929bL3Hnx:Z47JUQjTirIhCnDHUPfF/JB+kn3Hnx
TLSH
T19C65AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 969b87ee41dbcd964fefc61594201470aae69b3d86e94f3c9f4ab8facc52ae0a
MD5 1ee8f818a163350caca23fe03ab7550d
SHA1 3d356eb1d512d885cdb4cef31d33eff6e8adb10e
SHA512 c93bb0ce08bbdc5e83e4039369a86460a77c8af931e5cab7a242c071459f2a6dc8015a2aadc9dbdbf5e7545516cc3934a3c5f1fe3320ae0d27a0e2e53b4010a1
SSDEEP 12288:PpsfQLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:gvNyBo4kx929bL3Hnx
TLSH
T15655F00AD25812E8D16E2274CB468A40F7337C5947E1D3CB97D0F87E1F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b186c4c42f0a5c03c96573014b47160c8887cc2466b220b05d505f096b711ba7
MD5 524bfb0d12810df7bb63a6326935c980
SHA1 1b71aeaae7c02ea57cdfa699179db51a261a1839
SHA512 e5159acd3a282f34b612feb65a938e57180e23ba1e423bcde71e8be6f81e842b8383d744c0f82b6382c888021004476136e2df877a424727b55be8db22b15437
SSDEEP 12288:vy7YLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:OHNyBo4kx929bL3Hnx
TLSH
T18C452312974C663AFA7D3AB0645EC024C839BC4D0F54D6DBEE1658BB59BCED28E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0e776e659b7f1eda2a02c61288e7dcbb2d131112fe122df6ed4da787cb04ca85
MD5 057b2c5c25bedf193bfe5126015da109
SHA1 420c458920e0d254cc0c9d83e27824c0a587f501
SHA512 edc5e8b37e57e85437d550ff2d42f69f46f1a01f22a7f2a4428d4cd7e9fc3f4fa5eba9906668560eb4b1873150e6902ac9d8aedfed394c687641bc833b8a6810
SSDEEP 24576:Bgb6bmBIi49WNNFpg1rSvFv7bYxNyBo4kx929bL3Hnx:Bgb4mBIBhGFnB+kn3Hnx
TLSH
T1A365AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 1eacc2a5a842e54a3d8035eca842cd70a839164aa7fae3d4cfb1b161ed58c497
MD5 d747c028c47f00be695540c4acf02e84
SHA1 d1bb93ab86b141fac26a1b70f43947ad0ad7b27e
SHA512 dcf7fe8152d01e7371d9af3c6dec86cb9aca0fdd2ce2679f40ce350f2073730079489b005ea423fa04226a375e620dede0617435b547561fd52c975967ec683d
SSDEEP 24576:kG88u8FpJqH1Jzria7/msNyBo4kx929bL3Hnx:X7ZFPqVAa7/OB+kn3Hnx
TLSH
T1F885F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 bbea75f9a7f4c3df271c3ea82756995524c29c4ab0ebec0ab64006730bb76b81
MD5 97254d49035b933692566156a06beabd
SHA1 082fc42007ce0ee0c1823bb8d9253b599b14e6e1
SHA512 340861a4b435ca16b7bb6e92007d71adc61f379270448743b860a2952b2a230e9094c6873f501946e575037b1eb8bc35b0f975ee9ce1b2eb100c70bfa79b6f07
SSDEEP 12288:7HvUrBFrEjwaQDLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:7PUr+NQQNyBo4kx929bL3Hnx
TLSH
T11C65F21F22AC18E5F67AB17C85868609E771B8560712D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 cb419af9b8f2e8883f9d82e92ed6a4c8910c3e73b7d9580b5794bcd2f01d5a05
MD5 f1614ed0cb338419ccc4822c9caaef30
SHA1 06b800b8663f714f918715d7d6bf0b7b0fa22fd1
SHA512 0e9beb7b8c804e6f77f861cbcc6a532d1b62265748b4df489e26bffc62fbe3be61567a0af10138fe0f40d22bab82cac1e1a8acf8cf6000f4394965653b16b973
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzB+kn3Hnx:yG05lO43bQ+k
TLSH
T120D5CF6A62EC11F9D0BBD17CD9C6460BEBB23815033556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4dd3d1c7467aac074796fc62934f0ca9e4d6bcc43e098930e54c803c6b0331df
MD5 23c4adcf66aadebea70409a8ed7b3e5c
SHA1 ecfc6dd3d8a67341947d2fb7d5a6c7c060dff7fa
SHA512 435519e0c79f92b653544ad6c61aa270cbb399b818542b7ff6237aee63a5d6de5c2d65bbc10bab8b18cc8b4aa21e9b8181cc83946cfe5923a0e8639dcd347b60
SSDEEP 24576:Xfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnKNyBo4kx929bL3Hnx:va5POZ3BJt2pasx2+mLB+kn3Hnx
TLSH
T13A65AF5EA6FC01D5E579D17CC583861AE5B1342653329BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5d53abc964bf29cfc9df0114e0c728d77ee2e6c8c136869c79e07093f9530331
MD5 1e5864f6d7a6874301e45f3aa04879a3
SHA1 e74aa9559dd4ead158cbe3142472e3852ed55a16
SHA512 34b425769a6598b10a8626922af5903dd165796068deaad22b2ba59dfbe7e652b15144d0d3f18645543becee90d0fc44d78127be1c4aa566b451d983c8843565
SSDEEP 24576:hNcwHdjbyQ4nLC18lb/EOjowL7Fk0NyBo4kx929bL3Hnx:hNc/zEOVHFuB+kn3Hnx
TLSH
T186858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d652a46436e86c1da457ae92de30bd5bdf98b1f9ea397c3ecd9fac7c25bb7e28
MD5 ad240208d20ace7daa3901ef3cb99d81
SHA1 a30087ef496e0c5361e4b53b439f79aa2c7cac67
SHA512 83541e6cf1687ef244e5ec3b80ee083dd845dab0346b5f8078de869340bb2e6eefb2078c9cb443e09e5e66afd3513e10bec7048da1232d0ec2313719b15b8b11
SSDEEP 24576:aTkNvNnaFeYhJNtmZBmWNyBo4kx929bL3Hnx:aTMwBtOmdB+kn3Hnx
TLSH
T12A55AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 7be30f4f584202d321264e457babae8b00e202cee42380bbe1debcba842e748e
MD5 7f1a2d81a93d7a7fb54a565d77a6faa6
SHA1 30e9f88e62affb86d069355e2090b95db9c5c482
SHA512 36686f22930fca27799037050611aaeb80734edf93168f6aba1782937759b27d1ea2f3daf299c3e8b5b3f55a90d14842b8e94be0d45fb53a36787a7cc303ed3b
SSDEEP 12288:NQcMxWDXN1Dp/fshBItT1IQgAMLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:BD3FHshBIYQgATNyBo4kx929bL3Hnx
TLSH
T18175E13EE75C00E4E57BD1BCDA538906E67138AD072266DB0694C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1692-41-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1692-52-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/1692-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1692-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1692-39-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/1868-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1868-360-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/1868-362-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1868-96-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/1868-102-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2092-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2092-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2092-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2092-107-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2092-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2172-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2172-128-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/2172-133-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/2172-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2236-89-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2236-83-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2236-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2236-379-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2236-359-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2236-377-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2412-394-0x0000020EF8F40000-0x0000020EF9188000-memory.dmp

Download

memory/2412-365-0x0000020EF8F40000-0x0000020EF9188000-memory.dmp

Download

memory/3860-79-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/3860-305-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/4764-8-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4764-7-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4764-78-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/4764-0-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/4764-309-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/4764-1-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4764-304-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4812-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4812-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4812-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4812-364-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4992-303-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4992-68-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4992-74-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4992-67-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5544-109-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/5544-363-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/5544-116-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5552-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5552-55-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/5552-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5552-288-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/5864-15-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/5864-22-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/5864-21-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/5864-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5864-94-0x0000000140000000-0x00000001402E9000-memory.dmp

Download