d9401acb4c19c09da334db32a98d38835fd7652ffd3374e4bfaa8938447f7aea

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_81963f474d71ab3a5aaca437f1bd1ecf_icedid_luca-stealer_njrat_stealc.exe
Size 1.6MB
Sample260703-rey8msaw41
SHA256 d9401acb4c19c09da334db32a98d38835fd7652ffd3374e4bfaa8938447f7aea
MD5 81963f474d71ab3a5aaca437f1bd1ecf
SHA1 9fc2ccf68e20810728356e346e628d986648df19
SHA512 8f8d6d5d97554876cbfc7a27bcd2c7975d64b09eee402361ccf7643d77ec81ee3b72f17c81961a2ecd0dbbc271a34d878e1d962e5a37a3acf2fa5de49deeef61
SSDEEP 24576:eNYW1EKHo6mAfOvrhvVULUfUKOUsqjnhMgeiCl7G0nehbGZpbD:Z6uBDmg27RnWGj
TLSH
T1FC75D06AD7A803FDD1B7D174C9C28906FB77784907B15A8F03E449B66F272A04E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5812	elevation_service.exe
2936	elevation_service.exe
6072	maintenanceservice.exe
3308	OSE.EXE
2160	PerceptionSimulationService.exe
5652	perfhost.exe
2296	ReFsDedupSvc.exe
3696	SensorDataService.exe
6824	ssh-agent.exe
4656	AgentService.exe
2772	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-03_81963f474d71ab3a5aaca437f1bd1ecf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-03_81963f474d71ab3a5aaca437f1bd1ecf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\56455dd8c8b6c6e4.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-03_81963f474d71ab3a5aaca437f1bd1ecf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-03_81963f474d71ab3a5aaca437f1bd1ecf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_90781\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-03_81963f474d71ab3a5aaca437f1bd1ecf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008561ab41f50add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e861b42f50add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067cf5342f50add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003f2e9785f50add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f71a9942f50add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5812	elevation_service.exe
5812	elevation_service.exe
5812	elevation_service.exe
5812	elevation_service.exe
5812	elevation_service.exe
5812	elevation_service.exe
5812	elevation_service.exe
2936	elevation_service.exe
2936	elevation_service.exe
2936	elevation_service.exe
2936	elevation_service.exe
2936	elevation_service.exe
2936	elevation_service.exe
2936	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6748	2026-07-03_81963f474d71ab3a5aaca437f1bd1ecf_icedid_luca-stealer_njrat_stealc.exe
Token: SeTakeOwnershipPrivilege	5812	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4656	AgentService.exe
Token: SeBackupPrivilege	2296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2296	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2296	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2296	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2296	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2296	ReFsDedupSvc.exe
Token: 33	2772	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2772	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2772	SearchIndexer.exe
Token: SeDebugPrivilege	5812	elevation_service.exe
Token: SeDebugPrivilege	2936	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 3420	2772	SearchIndexer.exe	101
PID 2772 wrote to memory of 1112	2772	SearchIndexer.exe	102
PID 2772 wrote to memory of 2780	2772	SearchIndexer.exe	103
PID 2772 wrote to memory of 4856	2772	SearchIndexer.exe	104
PID 2772 wrote to memory of 5388	2772	SearchIndexer.exe	106
PID 2772 wrote to memory of 5516	2772	SearchIndexer.exe	107
PID 2772 wrote to memory of 5824	2772	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-03_81963f474d71ab3a5aaca437f1bd1ecf_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_81963f474d71ab3a5aaca437f1bd1ecf_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6748

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2936

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6072

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3308

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2160

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5652

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2296

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3696

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6824

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4656

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2581000985-3042091657-4068028891-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2581000985-3042091657-4068028891-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3420
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1112
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2796 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4856
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5388
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5516
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2796 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 aa39fcc5a6af6d94333f4830f6606b01c5b1490b503c342a9e215cdc261b95cd
MD5 fa86bf32fd6b00a546eb7dee3f62a408
SHA1 b5e18fa4bfcfefe439207a46cf172f5ba4acd87f
SHA512 0d1a2095e1b750e2675bb7c2bba42dac97017ccc990e2cffd5e5f50b3785e46b3bad5900ddc4aa595708aec8930c4e8ee069c2872497d5c21196dbf414325c60
SSDEEP 49152:Sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn9Dmg27RnWGj:03q6HjBOD527BWG
TLSH
T1E6D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 1501b2f57ec81b9ef4c647709fe5308a48b1aaefd1c0245bd3f754d1f4373451
MD5 a9505ca5a70f2711b7685e66d873e629
SHA1 02d390abfd33244e259eec23ecb3f88aa0015470
SHA512 5bb512c1246bced2f93aaf3926d95ff8c60599c59ed2bc8e06f215446c17fbb9cf2e1415c7ca707e51c2f73f8fb1d496e957a83e966f1627562a4170391e9c83
SSDEEP 24576:KXYfDtczA8sqjnhMgeiCl7G0nehbGZpbD:RtcNDmg27RnWGj
TLSH
T15B650129A3E408F9EC67817CC9A2C515EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 3bb1c8dedfd89b29e426b721a613915c74375cbbb91b18afa8862fe831887922
MD5 fb51456957f1427989cb23408a5eac87
SHA1 2914e3f63a632d864a8e474a77d637e8b94b9d5e
SHA512 4e05952d638d07cf9cc53e554d71ecf4f353c99f3fac0d4ce93a033e1473e007b41c1155fd73257ab7f709534d5fa09821a5a930b466c7d7f8756aa1fe8c3ceb
SSDEEP 24576:M0Le5ji0hmx5rMLsqjnhMgeiCl7G0nehbGZpbD:MPji0AXSDmg27RnWGj
TLSH
T1A8859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7e7f3e95ad0b87d5f6eb059487445ecb7f8bd24a6c3182a2bb87bcabba8fe634
MD5 09e15eb037dbc599b25292868b4073d0
SHA1 344a6e38d81f00e9ad99cfbcee9d534380886ee0
SHA512 29f8f00dda8eac2b64e61c202a021963774ff1d57bdbd67683a428fd83c1093beb11fe83609c4a303512d751c544248d673cb85ae57ddc9076cb955b4d958c18
SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWE6q8wyu5sqjnhMgeiCl7G0nehbGZpbD:7/ezSC6vUzPvxHjyuDmg27RnWGj
TLSH
T1A3755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 97f17100afdacb3c4b48adf59d9ce02acaf19cd2a28e6d8c2c810df821311531
MD5 312d72c2927aa067f861c84784b0302d
SHA1 620373ab651dcbb7a9a9fa19c8e0f03acddb289f
SHA512 138fca7a3a276900361071baa60ce53e0ce678c88fc18814465bc8ed6d3cb566580827074c28d197207da7537364965678e45b4dfc10cbeabb209b1506667eba
SSDEEP 24576:MVbqPb88hv/l+6QsqjnhMgeiCl7G0nehbGZpbD:MVO88hXl+7Dmg27RnWGj
TLSH
T19E559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 0454a47c789874eff299006663b518a6d5868e8faedd698085d66eaf70ddba22
MD5 e3c7230d7aff494a49feff425ada02e6
SHA1 22e6ac02ce2692576bb25dd78c01e24bf6a0f54a
SHA512 874628a90def7a7dd52564cf6aad9743d1b86f38f60170caa076d00e24c40e48bbc77978e4e7397986dd4021924cc2745bbacf2ac11f7d5ec44ed0d802373a39
SSDEEP 12288:W5PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:W5PsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1934523BE824C10CAEA7608B5C3E9F51DAC137D5698200843AA637CFDE6F5458CB39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 3b6268308bb9b0c00a1cdff47615455fc0253adfe169d1447e879564b2dca37b
MD5 174ea7b03c1e8e9e4bd9265a5792a155
SHA1 6dac4ce0e95d14f3498cc6de9765a46200283afb
SHA512 15b146de58780e2bff96dd87d83c711fa492ddcf82c0bd8f012121b0ef1feebc0fd445bae8c80887558bd34f642505d9f0fbc3a4f1be616561637a83d7a8eaa0
SSDEEP 12288:2eBNUbTVO86UIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:2JIUIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19765CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 089d720ee05cadaab40f19ac61a035a0f915024bc545d0bf225d37af1b6415c3
MD5 822bc7584e484008d5df3bce0bc4f676
SHA1 d4c42d69af3ce62cfb8b78df9ab47a015e1075c8
SHA512 fc5bfb14fd0be2f08b0a9923f2ae52b73dcdfbbbfb14d1714d001cf0b0f2c929ab39a6b7ede2925e2e9ce0b22e10ba680adf4cf53d92c22adea1a94b589d452d
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH3:rQvGAdlCEL8c/yRNw5CtD527BWG
TLSH
T155266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.4MB
SHA256 f2d0bca1db2be3f04ab00adea6e2cb97f4fb6a9f71c0bc383487be9c9d85f12c
MD5 f5a9b483461364a13a6c7f6912d520ef
SHA1 47c961e7e01384dd2178a4b5654af14d96ff639a
SHA512 a71755e4d01ca6f297c19c1ec12261f1dcfba88e163e68ad8021cdd12f3a0f7ad03dfa1edccb84a258fbdc0f3b9f78fda6e967d64c1dfb9d6caaeba7083caddd
SSDEEP 12288:NAwSfxL/2Dc3XDLLmt0LDQewsAjuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:+mewsAjusqjnhMgeiCl7G0nehbGZpbD
TLSH
T16765E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 43444ad8ac0c1ed83dbaf0f059c45375fc19defdb22289270266e9c207e5fcae
MD5 c41efe68a961a8e5970a75c6c2447393
SHA1 224e41a190aaa19c951b7d872a233a03d9c9639b
SHA512 110607792fdd8c8d52b6634dcfef98d482f311948cba04443b36a353e24b97ff01b226b4cc29e05c5bec73209c37c0798bad5e7c393abd1d6a6e58543c9b7c0f
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH6VQBWG:XUEtQevvqc2W1cpV2EI32NB
TLSH
T180474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9ae379faa0ee7d20416711fcd4ecd9782e833201124a415f6672b4acacf14e03
MD5 4348bf2e5850503726671535e595df99
SHA1 98a431eb435cf5ec96a949044df031495e51b52e
SHA512 1f890a4f785fa393f2cf2ae56e48f9afe1efb1d3e37b9c99b712b93afa2a1109e259f228d83fc0b404b248293e038b8537a697dfcb3a41d07a0256f895baf0e0
SSDEEP 49152:4CbRquA/m2yL5zQfFiV+XenmE3/ziDmg27RnWGj:xoqtVjnmpD527BWG
TLSH
T13BD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bc7a9fe05f7b7b099a2a0ced14f2f87bf764b9a15a822b46bc726dc6ccfb413a
MD5 5604ac6890d8d4dece440d5ebae099e7
SHA1 4e556564f358b24d7b772ca1303642fbccbc870e
SHA512 a866007f39388d427709be55d72fcea4b3900bc86f23f1346b0b477596e925047dcf7d6f965b5a32d08b98a11df08372de9f2c367cf7c3343a202eaef8efeb5c
SSDEEP 24576:dAhGLJIFoiwtA5l7S53VsqjnhMgeiCl7G0nehbGZpbD:dAMyFoiq5ZDmg27RnWGj
TLSH
T1D7359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 32de3579956437747837edd27efa4ab392357fe888441968297f5e5d8c0359e8
MD5 bbd8ec111de524df62e481d7812eaea8
SHA1 91339ebf6373fc8a83d60d2e0fe5152fff384211
SHA512 aff2fa16da4d53abf0b757b28cbfe22125fab02bd97c10c21e8b55fb15993dea04c4a31516b09aa3e1cf63d53049e8c14d5415963eb341188d0c28475e465ee3
SSDEEP 12288:fmw5HEjsChN8BFgl0WDm+CZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:ewuxOW6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B455F15A72A80CF9E9674539C697D136F7B3BC122A20DB1F1760C65B6F33260AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 07446620b044e9f602c43ad1393e89c6eb329e0b744c879eb72f4f925c649a56
MD5 5b95310df0e12d8b2a538435507bb406
SHA1 e426b809252bb0462e18d043471587f6c9f0151e
SHA512 447211c6dfcfe3f351285eee72a609153cc81636141efb940adc54bb5a2c6905e725f416b5187fc6061acaf44af4c8f747b27fa4fce9becb948d6f6e291b46d9
SSDEEP 12288:7ZZ1IyeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9ZujsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1984512AE239820FAE5634178C6E5D609E7333C63673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 67919c828854b24e09b8f21cbe6763ee068a95caa867b1500f5eed3f60ddbd44
MD5 d6c175f7e56d5fadb8d60499e4c98e80
SHA1 ed785047fc00b21ed35dc1d154ecd91b5d399e5a
SHA512 d958399f606e132e5fcb03fe73d7c0b7de87373e98e669a4ae82085531cc6fb369ceca33bb9b5cc15b2f8da1ec14e421003e98c4a6bbadeedae33510b0c4d964
SSDEEP 98304:cQRQyi36YOcPQLvw2gAf+PN3wD527BWG:DQyiKayX+PNAVQBWG
TLSH
T1CB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1c17779e007022773adc889121cb4bd8c21a3f2f5d81cdaf788fb95438945c18
MD5 f2f203c91f72017366175a36128ef14c
SHA1 6d0f7b32cbaf9a4986dfe7b0f1b16450186b9164
SHA512 9cc3e25d025dd022c02ecb9437bf6652bcc61a79c5178e82e55a34104a7f294710cf3cb51f7470a5d25220d02a966d7ea6db1f7d58c0fd6e47064c7d7db136f0
SSDEEP 98304:lQRQyi36YOcPQLvw2gAf+PN3wD527BWG:cQyiKayX+PNAVQBWG
TLSH
T145667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5d50f5338da89731d63cc08b2deac242f9924e964ac646763a72a57e9fe355d2
MD5 ea6a0f94f95cd11256bc946ecc775809
SHA1 b91e16d2408131318d3d91bfc6fc3a80f20b2b45
SHA512 155f668e465beb1788147b22925f47d43ce24716ccd9194093708989cbafd0a9533566c87954e85182a0ca7a1acc989de0897cb73339a843ca74bd624f3d1244
SSDEEP 24576:twvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0zsqjnhMgeiCl7Ge:J68Qg55nhheWu7PNU3/SDmg27RnWGj
TLSH
T153B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 41a543af9eae7d47cff2f337cfcf91db04ef05fbae7dff2947307d296c9805cc
MD5 342aaa59972984bfd28ab927289c972b
SHA1 b03c02fa13c72c0bd50aa7907690cc7361e307cb
SHA512 88b7672eae2c1964b3d2a8cd0cbcc0d40dc3689cecf321755000dc8fbd7d1d09fbb94caeac13125eaae2e33dfbee6563c709fc3a4cadb849f4a648a49a9198c5
SSDEEP 98304:2y5112gYy5azzVvL69nLKnhZzD527BWG:nLIHmWhBVQBWG
TLSH
T192167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 91b3ae96b92f268cb03154adb2fa94584ca3e2613e52dde6ff50faa7ebb19038
MD5 4503d5bc3bdb52a5e54fa5b72eb0193a
SHA1 81f4a9027ae9c0e463c27c0798922bddac5b434c
SHA512 19708e35a1b43693056ddeba449de4678482e09fe725fbda450ace7c675e2bb941c4d6395c4939b365d73f26c908f4d92d4ec00043dcb9cc00b8fea901d4b1bb
SSDEEP 49152:7B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glyDmg27RnWGj:tu6JmVxd2dyD527BWG
TLSH
T169D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 78ba4018f7c5171068a79d5e021b6a940f8eecddb439a7d310ec629659c340dc
MD5 ba97a0a919377221c1e35e8223b34d25
SHA1 9f9393c7109796eb276bd11a0fc5bc356d267108
SHA512 aa7c621898e525b0b8d01fcea3be333af006630162813a06a680bea8574f79e4b3eab5ee8284a90ee7c16f667083f61415c75254a15d1aa4195a2dc976e001f2
SSDEEP 49152:P1hpsNoJpF1A6UU44CwH7R4xUDmg27RnWGj:PmifPbRpD527BWG
TLSH
T173B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0bebf1fd805e5db971a109a4bbda5cee42f9deab640c90964056080e8a23d67c
MD5 d057bb37d858d71269e5751437aec4c3
SHA1 6a55f4b172fcb8572ca6b003609b61535e4e6739
SHA512 a861563cf49e1203dbe97c9bae6618b76937ad0c555f5ecddff13708638360fcf13f462de22b966bc7ec33ba7d2fa7078684f833a4a5e522673041e38913f226
SSDEEP 49152:XSuZQIY0Be2KRRVtOnks6NMHqnDmg27RnWGj:N5dKTi61nD527BWG
TLSH
T1DCC5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f86b88d839757f388e6e7d1c9b768762f1d79628a18cfdf88af7b7b3621c9214
MD5 80844c4872bb4a2f8485856e4689e75b
SHA1 74a0c3670f497f9cea17c1807a6c73db068328c8
SHA512 cbcbcb784367ad4761722b5640d8ecc11f344974f67951c17402b1d63bd2593e83a6153ed30310a51d54f5bb8c1c162a93bf1882870500a867772a5751e397cb
SSDEEP 49152:vhtSn8EApI0figngiDn0AP5woDmg27RnWGj:+X2iyphlD527BWG
TLSH
T15395BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 0a5ec01950f07753a454afdd62091c464256f7d34ff962c54849cf40fde14555
MD5 3643d6ead6fb120e26ad9922e12de226
SHA1 4035c623af286137040df829d17822a7b458f149
SHA512 708d37a90d7f00144468eafa65e869bfcdb0f192435c4e99a7d7176f9ca388c7a3d8b5b430c2ce0e1557afbac1f5dd2b5740c1a549548362ebe184e4babd250c
SSDEEP 12288:CnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15C4523BE915C01CBE92244B5C3E5F15DAC173E57E92004837B6778BAFBF24A84B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 087e94ba2bcf109af886fc279f69e593f5a01fe16fc8d271e5f8911788775fa1
MD5 9ea98ecba1626ec11ba808d14f131a86
SHA1 15360d821b5355f232c001ee86b686ca68768b27
SHA512 d1588756cae8fe6588960eab35d7db4685b0ed3bae4666c78914c0fe38c4c56b7bda0dec6456ba95dab4db6673f2d0a4b6b8467dae5f82668a51247628216480
SSDEEP 12288:NiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D64523BE915C01CBE92644B5C3E5F15DAC173E57E92004837B57B8BAF7F24A84B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 a1bc44131da854f433aeda7ad4d5b8a1955bf97ede84c0fc932940e7c05d7b1e
MD5 d58db5385bb38e7fe87596bef928acb5
SHA1 f4be91967cc0b882fd73f24423a5dbb620e81a93
SHA512 2ffa8096a464b3a467122f01b6dd4ae4cdadc71a97b797751b0f8785fdb5fd60a892371c9d1ba79e60e99a24453baedb480b460661cfb16968c34ce2709aa133
SSDEEP 12288:QgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F44523BE915C01CBE92648B5C3E5F15DAC173E57E9200483BA5778BDFBF24A84B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.1MB
SHA256 1ebfeeac164cd900c12e865c8d788f86e17e2d5cc950a57ff71a9ad990ba2d67
MD5 1af0f4c006911522e23fba8406542cff
SHA1 339ebc5690c553a69965cb15c7a909665cfbc858
SHA512 d531e2af161122b287b245c0864aa4d4952dec4df775393898ac0e1c91ece783fc12740bde23b6e0ce21842e360e687c58995edef5886b8d99bcff3209cbf0c5
SSDEEP 12288:PV1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17945236E535C01C6D83285B5C2E5E11DE8277D97EB3005DB6B132CBE9FB26944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 c218e25d6681932950f1690a4406a7557475150004e2ba156d363234ffab7632
MD5 715f4993e26fd89a5a3bb3b9791fb276
SHA1 ef67dce8acf3236a85b2db768af7510db542b7de
SHA512 4d989c76163b64c3ecacf6a62c5064e9e2fc429f6d2d56c529ae9f765d5916b40f9fb875852355f050cb1c0312a0e41076c93a1f2e6520da366510192fd5a1ae
SSDEEP 12288:v9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:v9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C24523BE915C01CBE92644B5C3E5F15DAC173E57E9200483BA5B78BDFBF24A84B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 33181ca033fc76286e9a47751d36b77531088cdd0d1b6049cee0ef5219044a5e
MD5 9f2440460e87cc6a9990877a2b8081ef
SHA1 82bcf2c8017062a2825d0449e648df9048071a46
SHA512 a55f53ccd96c2441ef2189f277e83595059a45bbd3d23915e1d41af8f3a93a1e70a016fa1a5e424e8b97bbca7d0234edfb538fb43f4360913bec7e8d9171d684
SSDEEP 12288:YmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19C4523BE925C01CBE92644B5C3E5F15DAC173E57E92004837B57B8BAF7F24A84B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 029994d3a137f3a48b671c766c91265bfc997b3efc8c9c1792608df5cd664fbe
MD5 8688bd4deb53def986768d64547b1451
SHA1 891b1cd60d035d1796751631da42c77cc00b2413
SHA512 0096afa76f91615ae319c93f0f09a7d11a4be55682a69173a0d79f005b930757fe9590de5a22646ccba683cf6488190b057e2e29a6e79db5b5a20e42d4a757c9
SSDEEP 12288:VKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10B4523BE915C01CBE92644B5C3E5F15DAC173E57E9200483BB67B8BAF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 b7ff83147ef4b4036611b04701f36d1694d72cc86c24d54c7852189903b13ad3
MD5 e92d24609cafe3233cdf6646ae514d7a
SHA1 761187b094c5d7648d473a02ceb908c45340a445
SHA512 324607ac494d000d69514769acccada4b4162f9ebd99d76f66eddef165f199a40f9a3c8291717866e4b4bea60d2e213fb344f3a7a4e6a3b1c4f786c1fb3ddf9c
SSDEEP 24576:tZMhzFVSOCsqjnhMgeiCl7G0nehbGZpbD:tZMhzfaDmg27RnWGj
TLSH
T1E06501A9B35018F8EC63813EC965D90AD5B37C5A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 773b00637d7490a3b04a2fd0c9626203ff3b564f04213036480df2813f660240
MD5 8755d737dcae930386391a3cb72869df
SHA1 34a4bc09b266b386e99072cf38a94d024d3e3be3
SHA512 cb0dca57ab399f122fff51dd5ad6e8dc3fe0b89522e5312d58d3a9425f70d501eff90263c1b643924564423598e6e54f877a17ce584aab90f29d3f7823dcb041
SSDEEP 12288:KTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1414523BE915C01CBE92608B5C3E5E15DAC173E57F9200483BA5B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 c573a5b65facb6caa2c8b87885a142668b8081c91591e9074518f839c7d425cb
MD5 4986d511fe60172a520d020e20f5eab7
SHA1 dabb9a830a018c7be4ea10a8ef07cf3c52c1ce93
SHA512 a1c42b4c2d96e489da4fba161a195fc00773756031e05ccb4e49365b31854cad1d4034811eb3dba33ac431c21f42cb5562129064cb07dbf3b08104369954cbdd
SSDEEP 12288:H/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:H/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1294523BE915C01CBE92644B5C3E5E15DAC173E57E9200483BA5BB8BEF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.2MB
SHA256 8a797c1a4b07a182261f501ac74308d8bce4db00818945cc5a23169760d759fb
MD5 4c676e9ade6c001aa536004f60b8ca13
SHA1 9e0f21a0f157c0bf54f0382f6a2e4c79332d1ad9
SHA512 1a16a7c853cb61da537f475902fec976b3165a320dae2244483461a9719d4b38f52872d13ce6f19c266db6e52d66a11f1f76a92c9add3fe2e695e979172ec937
SSDEEP 12288:fyPz5L8eXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SzyesqjnhMgeiCl7G0nehbGZpbD
TLSH
T11B55025B73A530F9D5368138C5A29A06F7337C3247204A9F17A516BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 0f553960fdee1498ccf2e2dd6ef3d94c77aa89ec62dcb84b2284744c469bfb49
MD5 5bf1ccaa744fb79313034d07f05da9c3
SHA1 ac98f5a2a0006ae53a648a0137461618fb168a3a
SHA512 4c037ec58e11e5a294dfd36b0686373fe90ce9a98327928f68b8bbe79a571b2c4a4e4190e43220d91ca66a9db9f0691ce0ea576c3fb28cbd01c6380265559342
SSDEEP 12288:HTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE4523BE915C01CBE92604B5C3E5F15DAC173E57E9200483BA9B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 73e73918eaca0e319eedd2acadf870a897dff8222e1accb8ce1b22c90d4ef83d
MD5 18cfd5f6e5017733c8903af7cf8e53bb
SHA1 0b0c54162e929f1d4dbd38145e66d19e512a9bad
SHA512 562e7a0421ad4b33ee1b7ff95eaa85ba9d42b67fba1d3e56fc685eeefdb839cbbe9c21c8b336a7058eb6b9a8064e24f4d1358923b5c99f88643ef39c6bc9c569
SSDEEP 12288:CTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18A4523BE915C01CBE92604B5C3E5F15DAC173E57E9200883BA5B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.2MB
SHA256 49c76553221d0f30f196fbc3611787dbcff07b32fbc9fe3c66a6ed9cc4eeee15
MD5 9a9c749105e3fdcaed47b2dae32bbb06
SHA1 60035abdbc64c5a0e9127b337cba53dc529c7740
SHA512 e2e9e332005437237f4b2d58bb5176ebc55c07f7422deb7fadd71ca72d3414ed984f00e63a5556d87f814dd9d08b2800b9d0cb8d92b12e2761c49fa5d356a5e3
SSDEEP 12288:3yPz5L8eXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6zyesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FB55025B73A530F9D1378138C5A29A06F7337C3247204A9F17A556BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 ee4b573c07cd7e076639566400eaa3c2043d290d053a58dda57faa46deb10b98
MD5 d379327053d9a0638c2781a05a10e22f
SHA1 f4e6bf93d7e9da471a46d873a778f2304444bcd1
SHA512 1485ab0a549f0775010a6f1bff8c46e7427ae8b61d16d913d7f237d3263b9d8fa3542f8b7c80a6ba952d30821228442babbb3a563948d3287e66fc61e43a637e
SSDEEP 24576:mTCaLl3z0zDwsqjnhMgeiCl7G0nehbGZpbD:mTZLlj9Dmg27RnWGj
TLSH
T1DF6501A9B35018F8EC67813EC965C90AD5B37C5A0B70CA1F13A5366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.5MB
SHA256 c886371fe08154db328df1f98bbb5e1bf10e455f0fb4e09ecd5b187dbbc60c24
MD5 fb71859cbdff872e19d8d007b88adb6f
SHA1 37fc72ac9a89998921c33a20ae88a494fd72db41
SHA512 1e07b6e87b02a61fcdde3e6f494f8adbae57d910cf7429fb31738be7e50ae5daef6139aac2fc059c497b3890926c14b7c7cd9799a0fd25a7e7e6c2fd0f12d94b
SSDEEP 24576:43jd9CHKy7GZ0sqjnhMgeiCl7G0nehbGZpbD:Cjd9CHKyaaDmg27RnWGj
TLSH
T17975CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.1MB
SHA256 933deca7908c577823bf1d8c35180be4484b3f7f3e90a3844792e633f3ec6b84
MD5 a6959d6e960982dcb5110e5f60ea0e7e
SHA1 cbb1efc25b7ed692c6554651cb46e6003e07d2d8
SHA512 10cf601d08b148d177e550d570925f591507f34f92b122f4fcb6491aef02b8d03805fb3bbca5cbf3c2fed7d85e2af2fb4ea3ec77feed3e587505b66857694234
SSDEEP 12288:PAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CB4523BE915C01CBE92604B5C3E5F15DAC173E57E9200483BA9778BDFBF24A84B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.1MB
SHA256 3c67413120185b9e27e15510034131ea407031ee1ac1ce86a2f819c83a4bdf8c
MD5 6b6db7751746b546d466dbb13c6c4ee4
SHA1 7294ae4a981fbba2f59e1f6b14d23101bbc8bb13
SHA512 4b9ed81fa2dcd4fd5fe8d2f7d317b638c28cceb3abedf28243b7c6c4355d7b04b97080b705568accc040da4e8c297b8444c59ee51fee366a29d3e74ec080cab7
SSDEEP 12288:m+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:m+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EA4523BE915C01CBE92644F5C3E5E15DAC073E57E9200483BB9778BAEBF24684B39423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.1MB
SHA256 2fa3a1770f3bb2d3aa42a2fc75899c91ba4a18b15d3d9dc4d7e4668daebca3eb
MD5 5066e3a21f3a2fc39b10efa81b8fe89d
SHA1 4dedb28fb5ea1c462a0fa9c340bd226fb4f78c28
SHA512 bbb05c76fa9064073988d4da54a91eea71859b9f53b6a7868e8cc531d1809aec5a7035b70b60d3bf7709b0e98b95c1642cd4a5f02d4df50e609fc1819236e162
SSDEEP 12288:EBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1164523BE915C01CBE92604B5C3E5E15DAC173E57F9200483BA9778BDFBF28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.1MB
SHA256 087f78ed2f7d9991152bf06921c65a246488087f2f6a4e01ae1d5d4abe270bcb
MD5 f0c2e6c0bdccfb63274d583cddb6e4bc
SHA1 4f9bad4ff5c7836f6fcab605254add7df8e5799b
SHA512 c231d7109aef7895f3129781409046179cee68a768ae72123dc8c08ecea7fbddae0d56347258c9a90fbf96c14dbecf1c7d13d4ff0a3fab7d87f3fdcbda40d96e
SSDEEP 12288:4TXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4TsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A14523BE915C01CBE92604B5C3E5E15DAC173E57F9200483BA9B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.1MB
SHA256 20ab0e8c608f8b22b61a7df2fffa943cea5c4e57cee20be10945ce51a022b2ec
MD5 9bc0115f91e6e1791637bcb38d088b94
SHA1 f03b74f1ad2519bcfe3e791863435cd531d29d7c
SHA512 c6450ec3e47546b1eaaaf5c79a78fb165edfada4381cf5ac80f651789455e89f0caebd1c7607befb1d4d7e37ae7aa9b2b9a23ced0501e598c7a7eb59e6a912da
SSDEEP 12288:fAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18B4523BE915C01CBE92608B5C3E5F15DAC173E57E9200483BA9778BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.1MB
SHA256 384f7c847e0853af62d262106e772965f744189e4f421423a3b7ef6937a7aeb0
MD5 9a0d157a2457317e388716ac58559442
SHA1 ceb6d8ee70d640e4a8dc123a4e165c1a4e1ef017
SHA512 493331d23eb42e029024231547016f15f03ec3a8b7c26677b2357fb8b970a38ee1093f295f5edc5d81d906719de5ec4c17864cd536847d06694d04f68337718c
SSDEEP 12288:MbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE4523BE915C01CBE92244F5C3E5E15DAC173E57E9200483BA57B8BEFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.1MB
SHA256 288e2fe75342157a83a6187344ff815a6a9a2c5bf90ae2023de3cf9a2e5ff54a
MD5 6441a58325c00bc43d9c624a3b884ee5
SHA1 57917f94539f060a79c48314849c0041d27fe08a
SHA512 2b8415f4dd24f44af7b69d6d4c4b62067574844e38bd18c0ab178d0ef87407a81f521f67f30d1c32f917d7dd5b536d0c91334fef0b8ebe60ee8deede6a74cc8c
SSDEEP 12288:U9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:U9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1384523BE915C01CBE92644B5C3E5F15DAC173E57E9200483BA9778BDFBF24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 7b49e1a5c48d60418aa10f2bdafb9ae869b6d2779af1ee7a26276ce55c5bd518
MD5 a88a18a75e515f60b959ec962955a570
SHA1 d4e1dc30f0d57d355d7b30f7b4206e97ceb2116b
SHA512 7514e00dd17e28b07efed3db33e0c71af6f404e56b59bebabf771809f4e9909832b176c885b548f7bf94d791662792c0dd8a7ed3545e0c1401a9a8318de1ffb6
SSDEEP 24576:AfwvFk9RX6wkyAIvsqjnhMgeiCl7G0nehbGZpbD:lMnYITDmg27RnWGj
TLSH
T19D75D029EBDC04E5E177913C89B7860AF6B278691B31C6CF125A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 14038cd5e1550158893875d9d69016e844b50aae308b304797e9728d19c1b84c
MD5 2ecf38b9d8214e36ab8bb2fab2fc19cb
SHA1 c6781908bcbf7bd78bbb6babfe2ae63523c765bd
SHA512 a178bb6a2e370e062d2cbd70b2c25f83cdde500d479901f7fe83d83a3902120b8ed4c89a394b3f5b74870fe22ab1ccfdc88832f660964b98b8fe47b7658934f1
SSDEEP 49152:BYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0IDmg27RnWGj:pySzPQD527BWG
TLSH
T10F066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 54a9472c36ee4734a34cff04042bdefbecc19700a11351afe11bc8995d62043f
MD5 c1363a876fa0f970d1a65961aa139847
SHA1 571fcc27236ded3bbe40866df4513725449b5367
SHA512 3ba8a86f6c7afdfa5300640305d0109d889202a4c1ee7a796df7d5db19454bc8d0cf70dd9c8d0cc6886d071c644382e59e2073e5314cd31a6e40a766caabadc5
SSDEEP 24576:947Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYysqjnhMgeiCl7G0nehbGZpbD:947JUQj1irIhCnDHUPfF/4Dmg27RnWGj
TLSH
T1CC65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.2MB
SHA256 d236d500b93eaf99c04065363c7bda36b9d8bcf85871cc2275dd20a2022d1c99
MD5 0a9cc358a47ca8e180cd0653603a0b5b
SHA1 329ba773155998a094135936c9036d03ed6ebff4
SHA512 b18b344cdda1b466254ee205e643971ce3dd18072a79c7a41b7fcb5892b4f6384912a3b5017108eac6219350505c75bcf1c7ab8a472fa61e923987a9fed9d5b2
SSDEEP 12288:4ysfjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A55011AD29802D9C06E5179C3969605F7333C2697E093CB67D1F87E1F766908EFAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 960KB
SHA256 871a9f7a824dda1c0b64b2b30b4b925f31fd6153a0fe388428a92e940bb59a93
MD5 a2fc9744f91e7e58eb43f537a214fb04
SHA1 7b5d10f0d82cea30b7a07fd0408d538a1cd3ee36
SHA512 a67cc19f3e4051777eeea74be6879bf254e6d4108f36bd7647714e4d0afc3f1100a1e62b0d27808df597f18aace8085f0705963853189997cf5539ae1e8f8203
SSDEEP 12288:6x6rU3fLAJVFlrVwMhrbbP28UKiDeeHCK:6xYUP0rlraMrvP2nKneHCK
TLSH
T18A251701B666C75FC6AC40321E32D5CCA7707D51FE04AE0773C89B3F9576A5CBAA6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 f116641f4a748b6ef3011a71388cd8a66b9357a0ea1e0558fbd4a41be9915093
MD5 c393f711226e5e7ea9311e5a6218fa1b
SHA1 e25f9a9df7f888732826b8c582b3efa78480dfba
SHA512 e9f708d942bb7496bede2c28e163a5d8b0889e1af18906d0cc193a64adc32f11e18f11b27586930229c56859aa9d2a9ccc68b3e24a2bf54c624b319483b93c5d
SSDEEP 6144:6oCEeSChFpyMq+oloVF0tEAOxf9MtMxF9MtMxV5z8fo0wVfBCx4W:PuyYVFuWawZBGx
TLSH
T1F565C740E53792CFC1FA6071072A5B8CA764EC06BB496F26B388453ADC66B15A4FD3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 b87a7cc309528c67b7a7c77e8fa523ba910dfc437bdadfcfa961895240dd9aa4
MD5 747dc0bad90872c646ca79d587fcd38f
SHA1 75ccc89b9b003e936d40e0f39ffb72a04fd4f4d0
SHA512 43796482b91f41f8ec0732e74c3f82f63d0c4ef4842b2af5209197274cfc46b5fb2c2da43223540a351780f6ba3cb95268de36d606aa479ed646968b5b2fb2a9
SSDEEP 12288:G07rXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7rsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18145237AC35C118AF83605B482EAE12D681B7E669F2004C3BA5778FDF6B18D48F39517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 58c27d83b80e9fada379b7f7d696d20d378e2240280cc2bb21ddb8b03f6d3753
MD5 c20fda7106f29b6ddb1c5a2c9af15f30
SHA1 05629a51ecc309dce2fee7ded7e9e7fa14ee67dc
SHA512 c4f5fdc4b156d7d831fc4d1db8e41cb8bfd45867fd2b7a2f147b1eb646ff2351ebab2f57ef1ba952645920671196764849739df1eb67155f396b4b38e4992ca3
SSDEEP 24576:qgb6bmBIi49WNNFpg1rSvFv7bY5sqjnhMgeiCl7G0nehbGZpbD:qgb4mBIBhGF2Dmg27RnWGj
TLSH
T19D659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 8ada2b407e63b154ff6c07d2bdcb0e4d5f98693776b4266e17c1fd712f197054
MD5 9e672f0a1e706bff19e47b08c398df83
SHA1 f7439a3639beb04d76d81eb2a13afe27df3a75aa
SHA512 e5b796e84e1ca90d5cd067a6fdd545ff33c6ca1bd23bba534565793e36ae6130ba44807784fc3635276577ff4b28c8e8b6b16f9dae8345ad2d606c69f6d85f8a
SSDEEP 24576:0G88u8FpJqH1Wzria7/mCsqjnhMgeiCl7G0nehbGZpbD:H7ZFPqVha7/1Dmg27RnWGj
TLSH
T1B085F16577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e6b1ab28d26d6a993fbf33680ada0ace139722b2c5adfd9d0ff9aad39f14351c
MD5 67baf02d5c9aa9b99a97dcfce7cc8c32
SHA1 3e70d767cd4e383a68f1b797673f670dac4c5098
SHA512 57e13b68e6461b48d853609df7bc0b44087d1622413487ce63b5fd72f81d12f0c446d03f65a78f2312a1176c41899d31c259aa5e5ef1097baee3b76d352de71c
SSDEEP 49152:uBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjqDmg27RnWGj:xG05lO43brD527BWG
TLSH
T1BCD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e21fce09b1bdf114014c53b7b825c593a691cd06ed7cba01daacdbe4e1e7dda5
MD5 ef083cf97aaad8ca8b771965da077d9b
SHA1 57264febeb7c4ae3baa9ea367c1b23099481f906
SHA512 f56f5fa721096971fd7df12f1f379561dd8f28640c5ad02e664226e4cb42ce04ce92242f46cf1caefdd73cefdb5581a38fba0c4c8790eb114702f1808ddf068e
SSDEEP 24576:sfa5POZ3dpFWVM50JicR2hG0lasx2+47eidncsqjnhMgeiCl7G0nehbGZpbD:0a5POZ3+Jt2pasx2+mSDmg27RnWGj
TLSH
T1E965BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5782cab585e1bc3ec06eb43739ade7ae1299d583b9c14fb54ebdba3f4c11f419
MD5 ffd8692abaccda80f8eb5ca0891e3238
SHA1 28bff72c3ee00892159494631d33fffcaff59a42
SHA512 d888501ded921af423b27b723eec814f6517e26cd3754996b85635f8597cf2d2a7bc4d40e58c124e1a65d10b8d5b1e63d4cdcb16c3f0c958361b3238c70df7a3
SSDEEP 24576:oNcwHdjbyQ4nLC18lb/EOjowL7FkasqjnhMgeiCl7G0nehbGZpbD:oNc/zEOVHFVDmg27RnWGj
TLSH
T103857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bd32e01ccd84cbd5360e5f64a238f6dfb0252f09d1bc05117affeeaea5db31e0
MD5 4176217d8711497e6895ecfcb4e2789e
SHA1 9d5568d3753b21d8f636a1b1024901dc73b11b06
SHA512 12142ff0970c3e13b2074be4bded2041de0f3c07e88ee6f92e98059c7a3b3908ed8b820eca6be2bd8ad2718b8d87205e88cf74ef97a6602ea67787d834ad9d65
SSDEEP 24576:d8kNvNnaFeYhJNtmZBmCsqjnhMgeiCl7G0nehbGZpbD:d8MwBtOmGDmg27RnWGj
TLSH
T1F855AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 8d2fdd4743368778b2e29d8dff40e60a7a12f3344e904e715bcd2b8277b0ba99
MD5 ff675e33f2408a146484c51aa0ff509c
SHA1 e66a5727c8b99c3fc8f15d7d84aa12b88724adc7
SHA512 4a97d7d37dd42c8dd03260052ee5c4c35188050a5bc7e2910682b5976813b6537bdef63498f7d47983790e18e0dcf7fce34f04e0a1a1445329a220f67d4bb051
SSDEEP 12288:LHvUrBFrEjwaQWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:LPUr+NQWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CF55F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 f8cb6a63ce33ce77db6596eb40f8a0f38c0582bca4f9df0a22903298cc2871a4
MD5 f2e025e7148b4ba5dc8bf18c91a10e37
SHA1 f35164456717e13739e098cfb8df9f248feb080f
SHA512 625fad310ed8231a75007ec1713994090d4cb628bca132b87faf162b14cef292ddec4e5412975116f86bad80b5e9a1f6179e4d4b6a29f37ed4df3c18116c3abb
SSDEEP 24576:fD3FHshBIYQgAHsqjnhMgeiCl7G0nehbGZpbD:fDVHeBIAAbDmg27RnWGj
TLSH
T15F75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2160-73-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/2160-310-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/2160-67-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/2160-65-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/2296-330-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2296-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2296-94-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2296-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2296-88-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2296-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2772-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2772-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2772-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2772-152-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2936-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2936-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2936-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2936-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2936-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3308-61-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3308-55-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3308-54-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/3308-296-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/3696-104-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3696-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3696-315-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3696-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3696-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3696-110-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4656-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4656-130-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4656-136-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4656-139-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4656-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5652-77-0x0000000000400000-0x0000000000522000-memory.dmp

Download

memory/5652-311-0x0000000000400000-0x0000000000522000-memory.dmp

Download

memory/5652-78-0x0000000000760000-0x00000000007C7000-memory.dmp

Download

memory/5652-83-0x0000000000760000-0x00000000007C7000-memory.dmp

Download

memory/5812-21-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/5812-23-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/5812-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5812-15-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/5812-115-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6072-99-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/6072-50-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/6072-44-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/6072-43-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/6072-97-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/6748-39-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/6748-26-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/6748-0-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/6748-8-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/6748-7-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/6748-1-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/6824-124-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/6824-118-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/6824-314-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/6824-116-0x0000000140000000-0x00000001401C9000-memory.dmp

Download