Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 06:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe
- Size 1.6MB
- Sample260723-hmrdbshf85
- SHA256 950521fd5b9619c7770c00772d07bad2364f22e3779aae19c69ea1309715426e
- MD5 8bfd96132d1b03c7c921cdf0c2df5161
- SHA1 815da67d42b06ea5c31cf27b9ff3918461b9ff14
- SHA512 8961b2f14a7df710b156d89701930c1c319ceaca487e7b425f72896428bbe3710ddf029586fbd79610a900996eb436c683d3998660a3cc27fe60f03e1c22af59
- SSDEEP 24576:I2O3SB1mB1Ch2ifWTnnnRIwH6LRgy7iBY5/ryIDxXv:E3SBoBg2aWTnnRIG61tySHD
- TLSH T19D75BE1BE59BC1F9DC76C1B0C9928516EAB3B40983206ADB02A4955C2EFB5F04E3D73D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 4348 elevation_service.exe 1864 elevation_service.exe 4156 maintenanceservice.exe 1296 OSE.EXE 2176 PerceptionSimulationService.exe 4200 perfhost.exe 2308 ReFsDedupSvc.exe 3152 SensorDataService.exe 1092 ssh-agent.exe 6048 AgentService.exe 2420 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe - Drops file in System32 directory 56 IoCs
description ioc Process File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\11d6eeac763f1d8f.bin elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000003e49bf6f1add01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a5435bf6f1add01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd66eabf6f1add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e4c57e00701add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 3084 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe 3084 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe 4348 elevation_service.exe 4348 elevation_service.exe 4348 elevation_service.exe 4348 elevation_service.exe 4348 elevation_service.exe 4348 elevation_service.exe 4348 elevation_service.exe 1864 elevation_service.exe 1864 elevation_service.exe 1864 elevation_service.exe 1864 elevation_service.exe 1864 elevation_service.exe 1864 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3084 2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe Token: SeAssignPrimaryTokenPrivilege 6048 AgentService.exe Token: SeBackupPrivilege 2308 ReFsDedupSvc.exe Token: SeRestorePrivilege 2308 ReFsDedupSvc.exe Token: SeBackupPrivilege 2308 ReFsDedupSvc.exe Token: SeRestorePrivilege 2308 ReFsDedupSvc.exe Token: SeBackupPrivilege 2308 ReFsDedupSvc.exe Token: SeRestorePrivilege 2308 ReFsDedupSvc.exe Token: SeBackupPrivilege 2308 ReFsDedupSvc.exe Token: SeRestorePrivilege 2308 ReFsDedupSvc.exe Token: SeBackupPrivilege 2308 ReFsDedupSvc.exe Token: SeRestorePrivilege 2308 ReFsDedupSvc.exe Token: 33 2420 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2420 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2420 SearchIndexer.exe Token: SeDebugPrivilege 4348 elevation_service.exe Token: SeDebugPrivilege 1864 elevation_service.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2420 wrote to memory of 5780 2420 SearchIndexer.exe 100 PID 2420 wrote to memory of 2588 2420 SearchIndexer.exe 101 PID 2420 wrote to memory of 2776 2420 SearchIndexer.exe 102 PID 2420 wrote to memory of 5492 2420 SearchIndexer.exe 103 PID 2420 wrote to memory of 5608 2420 SearchIndexer.exe 107 PID 2420 wrote to memory of 2316 2420 SearchIndexer.exe 108 PID 2420 wrote to memory of 2484 2420 SearchIndexer.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3084
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4348
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4156
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1296
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2176
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4200
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2308
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3152
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1092
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6048
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5780
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:2588
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2868 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:2776
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2936 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:5492
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5608
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2936 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:2316
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2868 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:2484
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 9dc0734032148ce3355ebce0135e9313bce787b1d06a73433c116ca7dfe4b87f
- MD5 870e537d6e188d2bdeddb8bb146b770c
- SHA1 c83089f2bc330c4e159a0e59e4440ba330400913
- SHA512 2c729ef7b91b764562ca528e24684ab1065f282550bf454f714251a4f4c90dc9304384d28a44fac3ff4780ffdb763f29a9d8538cb221b1e2e601b7ad11dfb02f
- SSDEEP 49152:vb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnEn61tySHD:t3q6mjBBn61tySHD
- TLSH T19AD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 dccaede64c89f3989b8cbd2caccb6c13d28a4fc7f8a15dee96d1acaf9a81c18b
- MD5 41ba7b2aefd0ab57a487082fe0d3560b
- SHA1 ece3e606c5282b0954022c06016b0f7da583dea9
- SHA512 2e0994f0629717b41bd742eec3977ac86dbbf940cdac0e750dac03597dc2c3f5d945cd219f188fa72013a2d01ce117e6625bcd4eb6e91b4e863bf2b69503a4bc
- SSDEEP 12288:l1XLsswWkxy2lRq2czA9mm/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:rXYfDtczA9HH6LRgy7iBY5/ryIDxXv
- TLSH T11875F128B3E508FDDD678238C8A28551E672BC5547A0E78B03F4A9295F337C85E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 baa35e5e8d53958fb6bd0c6a4a88c48463b60b3c7c81d2d79f245e44aa7bf04f
- MD5 e6070d8ed1db050c89caa57c3b913399
- SHA1 84472dcaf653ee1c1e155e3e3cc3013fc7aa100e
- SHA512 f292ec5d9bc8967ff21063e8137f8ead46aea24e20fc7644d151b30a7bbaf41b073ffac2cc25b2ce48d10a851f109c6aca8c4495e1d118c7e300a4c0c82bf765
- SSDEEP 24576:w0Le5ji0hmxhrMcHH6LRgy7iBY5/ryIDxXv:wPji0Azjn61tySHD
- TLSH T13985AE26F5748335D073C0B9C5D2A68EE97130825B308ACB4296D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 a3c501a3c920ccf1d23c8d47ec3fae2e3052b99a2c705b4530563168ac2e5d3e
- MD5 1510b4ec37198439d8739dfddf7ce6ba
- SHA1 d9ba4329c1506ea505bde426aacccefa5de7d1f7
- SHA512 6add079710914bf1d9c7e37cfaa25053fbed14b9d008f22c5562f1cca6f23d84940795c4beb08d430d6b1bd061202ca082f85fa69589122c1c3df2b4af6b1ce3
- SSDEEP 24576:ka7/ezSC6vUyD/aqgrvWj6q8wyuOHH6LRgy7iBY5/ryIDxXv:T/ezSC6vUzPv+Hjy/n61tySHD
- TLSH T19F755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 400c670a5844949b9f11d4820142a44050aa095610fe2e02b5e3308a3039100b
- MD5 657ae6445b0918c6b28949c21833194b
- SHA1 95d7f1bb83a52b9fc63e3fef9bdf4c4847ecc583
- SHA512 95c7ad5707aafa604e06e63eeb7e9b1fdb185d0d4158f5882a0f43a1ebb615dc1b2f23f23cb9c2a24358ffdfb44f2101e921db8354001ce674fc9f486738e625
- SSDEEP 24576:HVbqPb88hv/l+BxHH6LRgy7iBY5/ryIDxXv:HVO88hXl+Dn61tySHD
- TLSH T160559E66F5748331D073C0BAC4D2AA9AEE7234425B318ACB1246D76C3E677D6C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 2877f1358dd80a5cd81c39596b58426b38b86ec99e76d9f037fa1612ebc461ef
- MD5 82683dd318079a011867a1ebedb1d682
- SHA1 c41acd9293884788786ca0e96c093244f53885f4
- SHA512 70e6c5053226eb0b844a886a92204d53c7c11a86b4d89d88a643baf4a00f3ccd3a09e05da0f143021965e07174b17fc57caf220973c09297068ddf20eb5da420
- SSDEEP 12288:VGAmm/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:VGAHH6LRgy7iBY5/ryIDxXv
- TLSH T1F2552365F5FA02EFCBA90630C8C916D422CCBF59DC91498261F5BA6DFCB5A44CA0F613
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 14a84db226326b6b3164a69cec6cd8dcf33190747b05e69cc10454af012aff5f
- MD5 bc3acbb3b96f0c68cbaa47befc3b5bbf
- SHA1 2a4d10aa31c6b75adefb0480165693b065c864a5
- SHA512 7bb028b95310bc9dac7dff83f163f10f699d3d3b397f2a80d319888e093b0008b8d14dc22ee09c990fc15d73ae89ca11a2c4c6a72a572e4c12002a04479008d6
- SSDEEP 12288:YeBNUbTVO86UJmm/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:YJIUJHH6LRgy7iBY5/ryIDxXv
- TLSH T1F075CF3BEE28FCE2C27E4D785A918640A7A278704F6193CBD175C20EDE235D45E7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 e2063eb8eec5e830bf24a31684fb360e8b03c74de9d9480bddf0b4a58578db62
- MD5 e51140e94d51fecd042692e57a56a336
- SHA1 4d248ce13dcd090bb589a87397ddbd3c41e453c9
- SHA512 2f4039203508ce72c1be12db5f85d317fe066a44057c010ba3cd240d14f4982051f2c3c07dd869c1f0516d31182d5f8226605ba5c799f60ee1546286d9fafdc1
- SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH0:wQvGAdlCEL8c/WRNw5C+n61tySHD
- TLSH T1C9266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 6882e164ea90fe9ba129b66cc7ee512cf0394b4116532a5f710855e149ca05bf
- MD5 7f6dbf2c5a52ab984014848c37846b4f
- SHA1 3bc3f53781b04a27e6520f30ec58730faf944acf
- SHA512 bc7c3ad231d47f283db5668a129e45c43c4fa7da09618de226bac481ade03e4f37e1f3efd80af91dc744df4459595caca084451b44813ae3603f63c2a5bf9563
- SSDEEP 12288:VAwSfxL/2Dc3mDLLmt0LDQewsAjTmm/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dWO:2fewsAjTHH6LRgy7iBY5/ryIDxXv
- TLSH T15075E031FA75D036C7BB0DB11B26C716146CBA204F611AC3E3F89E9D99702C2677AA17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 56a86c6acecb97ac1b518fe87c78db206447265159689921010f59aa7d3fabbf
- MD5 71b73457f769a77749f05e41d062005c
- SHA1 c14b71c9b7b3a4339c77589deb8c3b181b6d80fb
- SHA512 dda3fce0581bd7c1cd4002b8dccc1102f60d46ceb67b03a64b2d713ef92ff0bcad9da229f5b6b8c3dbc06c6ef3c91c24426e3d7000430da8bcf0f9d8ce946d84
- SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHb43H:2UEtQevvqc2W1cpV20I3203
- TLSH T198474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 62ba722b1a7f0d279590fb5da20e759dbe61c0a7145ea2cd9cbcbb5acc093e9c
- MD5 bd42b7d879ba3a0d9a6ec80ab0fba977
- SHA1 401475b0ec0d891877ce76f123207fa5e137afa9
- SHA512 47cbce29ed082ceb2d7fff1d3ff23d6c488b17478c6d2b1a808a3ca08e934b5752441615b959f7038f3ac3f29c08756576d6c14882e00c675ce34e1af2e4ce40
- SSDEEP 49152:CCbRquA/m2yL5zLfFiV+XenmE3/zzn61tySHD:Hoq2Vjnmqn61tySHD
- TLSH T12ED58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 dc26e24bcf65dd08751c989d3681d73b1c0b65d4baba75759b0a3dc8cb42e80d
- MD5 fc4a42e6ab8d094f4f0413e634bbf5f8
- SHA1 c901a0c2071c27be57d227379eab6650562f86a0
- SHA512 8fa959dfab0a4bab20059d19d1b78a18b8a2f3807e39ca158588ea2dfba6e5f4cf214acb144db40bbe1a12f5f613deb25c95f0b3e0f35fbc24a1f4084d6d4b07
- SSDEEP 24576:AAhGL6IFoiwtA5l7S53KHH6LRgy7iBY5/ryIDxXv:AAM5Foiq5an61tySHD
- TLSH T169359D81E7F955D4F5B39A7899B681B0EA76BCAA5E31C20F2160D11F1E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 5914b4a768470523eed5e1634553cee2236123bf96dfcf0b8862a7408b8041c4
- MD5 4d8fbbc9613a8a4b41dbb2653c0e1275
- SHA1 512805c27eb8f515567226415535bf0e158cd17c
- SHA512 5ffb60152bbb704cf63154dfd0fb83b3c8a1cb57a5298c67006063c9f0ae0ecc84748539295a038d792cddb6fcbb66ab4f4cb861551444df3a5f8f74a23b66a9
- SSDEEP 12288:Kmw5HEjsChNEBFgl0WDm+Cumm/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFv7:DwuROWfHH6LRgy7iBY5/ryIDxXv
- TLSH T1CC65E14576A90CF9EA664238C5978175F7F2BC122A21DB1F13B0C65B6F33351AD2EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 3a9139179bb3bd0899ed55fcf260c93f12472733f0632ea0a6fdec49516ac002
- MD5 7018cdc805bb199c978df57ea1bb46a9
- SHA1 30334d581e495cd2ac7de4fb38a5d476fc63779f
- SHA512 d751f97b7578c1d76aa31d42752f53b6d0ea3b57e819954071bb6eba582374e9a901055979fa043cbfc84008f955e019bfa51250afee851c3ae8e3d35102eb7a
- SSDEEP 12288:cyZ1IyDmm/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:hZu0HH6LRgy7iBY5/ryIDxXv
- TLSH T16A55125932E921FED2A74238C8D146C4A3A07C66677143CF12B5666D6F73EC18E3E722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 7483a4c6423e5fc1df89daa30651c3f033f1c06165cdcc90dd7688d4b1da9635
- MD5 e0df23e466f821f9ac4455b921d7b2bc
- SHA1 afe6bee545b1c1c554fc93d4a7852c0105d33dad
- SHA512 9fb323a751f18378ec00201a7fe1691629f8541b346787a3edb8d5d36a06476272810d688d932d4c3110da06e98314afd95953a8d6ea5ee55378ab9ee8c6d5c9
- SSDEEP 98304:lQRQyi36YOcPDLvw2gAf+PN3Vn61tySHD:cQyiKanX+PNJ43H
- TLSH T137667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 ccc64ec28c55c4a45031453020627b2f157140f8082e0ddb7fc061b9e1406635
- MD5 5d81d45f136704dd6d3002d37e995331
- SHA1 c96793e7c8adb0defb0554401f9c0fba32cbd830
- SHA512 d0f757d3fc8b0edaa28943ccedd466792f4f39ec69afb67ce677208f840d134b88536e083ba78dadbf08d8ace018ae1a33abcdfc1bf3f1ce260f06d7dc94e3a1
- SSDEEP 98304:bQRQyi36YOcPDLvw2gAf+PN3Vn61tySHD:qQyiKanX+PNJ43H
- TLSH T13B667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 32b5e0bd402a71e42cf4198d97be446b16b723e7dea251a740c8605e8f401cfb
- MD5 44990d4726af02c0ce470953488fc94a
- SHA1 ea3866c6070684033cac4c8adcafb3fd6fd55e12
- SHA512 eb1a40bb18f310cba8e08bc9ca65798c3704f8c462e8787c36ff1f512ced68342f4fe33961245d5ad34a30542944e89e3ac6499b7700af351f605f51c4958795
- SSDEEP 24576:XwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0EHH6LRgy7iBY5/d:f68Qg55nhkeWu7PNU3/jn61tySHD
- TLSH T124B54933B2F600A9C44DE1769F4A872196D17C758FE0E3DB8151721A1FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 7a571ee5bca5059c77933872067cf3e5788cd031ba754565a3097e47072b0ba2
- MD5 4cb8656b9343c70b0cce6565478bdb68
- SHA1 2a5ca0dc02b38ed6310825986aa046918d134401
- SHA512 b330a89fac704315310a3262006c262189c242e376a0c7e330291d3ab9325aba3ecbd7863880140ca0c73d83201f78a3c871239b20cfec5f953a2827821c498a
- SSDEEP 98304:Ly5112gYy5azzVvU69nLKnhZAn61tySHD:mLIHRWhc43H
- TLSH T1F9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 1a714e27b9331ebd34057360c685ab84b8419398345d1ed0826263edb9c462ab
- MD5 1cb7704c50039c41a2959389d9e2788f
- SHA1 67695052271290e3c5f618745166018ea5f1da3f
- SHA512 e2f384ec743ef3e7c7b502687d3dea59da33cddf2024ad80599fb7b86c714d99dfa02f1d40e58012c54e2a1319375dad7d61b774dbc7b3c023bbbae74553a640
- SSDEEP 49152:xB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glNn61tySHD:nu6JmIxd2dNn61tySHD
- TLSH T1FFD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 1191f1b0740c0fd15b11563d5012cb837dfad061a3e206bed13bd3ea5da1a416
- MD5 978c7a2d56e171091033d01bfd691d6b
- SHA1 35b293ce8aa5f62093ad7565fb2a795dc5ad2990
- SHA512 efb8e297fe3b9ea4c4e32323112bee9d871cedd829dc9d42bc0d53800da72da59f00c77e05ba1fa58696b3ecd339877eddbf261a865fc0c631c30d125e8c5715
- SSDEEP 49152:e1hpsNoJpF1A67U44CwH7R4xpn61tySHD:emifPqRqn61tySHD
- TLSH T1BCB5AE13F2D901E8D06DD17887569232EA61BC460B34B6DF0A90B7962F7BBE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 166ebb15d752b40d4917ef6f191433309c9e779ab3c3dac3636146e8764fad56
- MD5 fb62292dbc845cd618b0f8d04c102e0f
- SHA1 5d8f72027724c265cad433d6989471d57fcb7a4b
- SHA512 efa2e7facdf3013087df68954bc8b34742981fabe5a939777a8bfe1ad30e5153fdd0b9dca600043a11956fec9fd8e0e60e9dda075553ccf0ead118f2c6255ff6
- SSDEEP 49152:aSuZQIY0Be2KkRVtOnks6NMHq0n61tySHD:E5dKqi610n61tySHD
- TLSH T199C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 00ab6f0a1f630588d482ac2b90f24447064ba5f5d5d9d71d179e951afa8e0703
- MD5 96f638db939acbed363cf4624155e2be
- SHA1 8fe1fccd99faa8cebe0fb817a193aa029048f89f
- SHA512 477cab370e84aa97b4cc56ce355c5437837bf57add060c5db9f997a3e431ff73106e5032b304872f89835f703b405c0e893652753a829d0ddf80f0371e0804d2
- SSDEEP 49152:xhtSn8EApI0figjgiDn0AP5w9n61tySHD:gX2iWphGn61tySHD
- TLSH T1FF95BE13F2D901E8D05ED174C7468632EA62BC160B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 46284720dfe2258f66f05fb239ae7fc4c43c5beb1ebe1b2271c007c0e9722ca7
- MD5 24b336d42716b929dc1508ac1bf521fa
- SHA1 d82ea92dd61afe825170fe61d08072d2dabe5284
- SHA512 034d91d4fc323bf3982657ce7a9e92b9ee8a598ed89dd3f9fdbe197d9bd825ccf37406866b6fe00f10aa412b8d318031e53aa614f0750ea814f8df744a2fd1cf
- SSDEEP 12288:z4mm/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:z4HH6LRgy7iBY5/ryIDxXv
- TLSH T18E552365B4EB02EFC7590630C8C506D462CC7F5AEDA1058372FAB56DFEB1A488A0F952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 8fc0abca634fb97408373ba24dee83d5f0588719b9d46e4440d637f5458fb70e
- MD5 395452012c987dbdf4ac5664767276e8
- SHA1 0fd0ea234e804ad66905a12f359f809ced82f42d
- SHA512 8bbd2d63ef8d00aeeded2b69450216f1dc12bbf8abad4ddda35b7c68afd41b93f1743ba9205d390fc76e46cb4f722e4c18993782c7572f628f6c9564b841bca3
- SSDEEP 12288:dnmm/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:dnHH6LRgy7iBY5/ryIDxXv
- TLSH T142552365B4FB02EFC7580630C8C506D462CCBF5AEDA1458372FAB56DFDB1A488A0F952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 6404ddfbb287104976c1a8b90424df726db85ebf20481985c48419b07e0c2548
- MD5 548f8ed84c1328cf71616829073513ab
- SHA1 8a4444da8c014eaa3a95976057a1c23f512e9bae
- SHA512 75401e146db1da8b320dcb28aec66fbda0c174721124d0ec13f7a0d8c99634e43961339e89df2069cce6589a389a7f765eecde6c61c6d672b9dc1275ee6bd0cc
- SSDEEP 12288:6Bmm/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:6BHH6LRgy7iBY5/ryIDxXv
- TLSH T193552365B4FB02EFC7580630C8C506D462CC7F5AEDA1068372FAB56DFDB1A488A0F952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 41306f34194d5fb40612922d2f50f3002ede0ea38d559a05ce5b6d6bea121012
- MD5 937d6f0fffa5113996bd0546391c3cc4
- SHA1 fa9b3ce64a8e767b71702e4995a07863c9392736
- SHA512 7ef256ff8ddb024787bd37655e56f3a005f21c7d2eadbd44241aacbe5e189108a93b3e2463ebe2e3203afd92a56cf7e51247e9cc2938ffa782ebe05765737f10
- SSDEEP 12288:OVqmm/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:zHH6LRgy7iBY5/ryIDxXv
- TLSH T11E55232576FF01DFCA658230C8D102D4A2D8BE5AEA3143CB62B5755DAEB1B84CD2EF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 0380f63b344ffe3d2a6e0662ad2b84eccd357a7b16292a49d8194f9806433ed5
- MD5 13c783928af1fc1069ddc3c5a1cbe3af
- SHA1 49a66024d4f2e9a1b6a8674fdd2e312bd6cfb2f2
- SHA512 96d70547389259b58a920a3171c2daaa7a3383f0cebe8456fde0a74dbbee14f6c64db490a133e3720e21e21fb65e2a1b3722c8a7ea317206fcee56953790c328
- SSDEEP 12288:BSmm/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:BSHH6LRgy7iBY5/ryIDxXv
- TLSH T1F4552365B4EB02EFC7580630C8C506D462CC7F5AFDA1158372FAB56DFDB1A488A0F952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 fca736c08edd4e282bab68f3af34e1529710f55471ca7265f7c11a66a14ffb9b
- MD5 f9bff364a2a68e47c4d6f41bea089f76
- SHA1 0f827770f8556a0a5a5db7006e615b047de8ec22
- SHA512 4efb2e0049fe69d92ae16ede7e7c76ff872fc23c2058334228ac4aa7df87d1c3f421b4c3ea6d155aa9c500c5c89eb84d72ae4f334ab6eb8615884c7ac3533db3
- SSDEEP 12288:jrmm/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:jrHH6LRgy7iBY5/ryIDxXv
- TLSH T197552365B4FB02EFC7690630C8C506D462CC7F5AEDA1068372FAB56DFDB1A448A0F952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 0366ba09152bf6d777ba185988135c85549f5729d07bf6b7feb05835c709f7e7
- MD5 2e8f2d4aa186580adef56c7d8859c7ca
- SHA1 d4f693b987038e551dd94d068777901dcfb79d6c
- SHA512 0e28399953c461bd3c41171c62655d70f82d705ef2a4853b07f5b8d1aed2a3d60aab4de8eb9d02cf2ef3274d4134740ba5574e5823c6615837a3d76d535ad74e
- SSDEEP 12288:ovmm/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:ovHH6LRgy7iBY5/ryIDxXv
- TLSH T152552365B4EB02EFC7590630C8C506D462CC7F5AECA1468372FAB56DFEB1A448A0F952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 8b7732df2498f832668c35eaca54a6eca0120a16e9b118a9b5816de9b9fef711
- MD5 792259231733969c97a5b55e1faf9456
- SHA1 a13ef54f07c4b20edba985e241551e8a4f44ffe6
- SHA512 db833a2f86ab499c4028ea2ccb677cdd8c96224086bb22fe1757dc5d3e546f722f0f22843bd2ad83c22a354eeb1f68ea8576894b60e9e4281e0e1789901bc510
- SSDEEP 12288:1iZwbDzzFEoS2cPvyHmm/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:4ZM3zFVSOHHH6LRgy7iBY5/ryIDxXv
- TLSH T1E57501A5B3A008F9DD67823DC8558985D2F17C5A4B70C64F13F8362A6F733904D2EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 18447221e72fe196ab09731eae4121b0c7af56cab8ae809bef1bceb5effd0c55
- MD5 a886204c6ae19b18b48911d66941d3ef
- SHA1 c486a5ec62ef02a48145f4fadd8ffc082711ad42
- SHA512 6cf62ebda8ae2887a4dde5b6092aa3b726a646730937ea19dc22c34cb0366d4974f43668a93874770bee175eddd12ae49f272d37ff8bbaa854fed4a94543f252
- SSDEEP 12288:3P/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:3jH6LRgy7iBY5/ryIDxXv
- TLSH T176552365B4EB02EFC7580630C4C506D862CC7F5AEDA1058372FAB56DFEB1E488A0F952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 b0e7e65a4f9cf57a5cca877d80254adf1774b27ff32d3bb4f3928c3232ecd154
- MD5 54b7ee37a05a5d728a9271cb22a333a9
- SHA1 96b856fd627a11fe572a752e514521ad08117b0b
- SHA512 ec916e34b5dded106b4b83256a2143163eabd0cf3f3beb199151bc44767d9280bc40673365e1da4de5ef4df85472bc02d82193d57f4a9ecd0b63aa27a90c1548
- SSDEEP 12288:AT/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:A/H6LRgy7iBY5/ryIDxXv
- TLSH T14D552365B4EB02EFC7590630C5C506D862CC7F5AFC91058372FAB56DFEB1A488A0F952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 7669465e3efe5cdb52951478a169e19d3509dab9753224f02ea3f3d3a503d9fa
- MD5 f844be11d63556c126cae3813358e3ee
- SHA1 e6ee2c44219ccf0c6a72349a05f2cb6164cc0965
- SHA512 6e4003bef9e459ec5615cfd12f2e9e79277cac63ddf5200957f2862859638bffecdf961ef047756e178926a423bb636a6b7dbeb9c826542f558db96222a3f361
- SSDEEP 12288:WyPz5L80/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:rzy0H6LRgy7iBY5/ryIDxXv
- TLSH T10865021772A621FDC1764234C8921A81F3B5BC365B208A9F13B4567A6F737909E3FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 d6910e9014cf5c55da87af2163b91228632648f2e08f566e300b170953490bfc
- MD5 64fe4405462f9c2c9ec62fab31979862
- SHA1 d84e453991a0c823bce6172b528a9e8532957dbf
- SHA512 ba17eac8c4d2cd3a887e49013ce8fe331af338bd1791233f57a0b69f6b8ea64b30578984589b3431de25ab5c020a4b4fef2bee878d45400eed2df8505e553704
- SSDEEP 12288:sP/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:sjH6LRgy7iBY5/ryIDxXv
- TLSH T13A552365B4EB02EFC7580630C4C506D862CC7F5AEDA1168372FAB56DFDB1A488A0F952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 1af8402b03956cb097297d797f4a3b629b0fa4e11c3220bcaf14908e1702149f
- MD5 71a9cbc11f9b0f2dad02fcd82ac5aea3
- SHA1 15804a5e17043a0c309c3adb115e1d70f8af4606
- SHA512 e7c76acec4961a49e357e41f5ea638d26785b051dbc2f229c7a869e9fe11339ab1ce97c2333d917a59f6791717451ba8e7399d4128f241b005fd91b045ee6578
- SSDEEP 12288:VP/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:VjH6LRgy7iBY5/ryIDxXv
- TLSH T19F552365B4FB02EFC7580630C4C506D862CCBF5AEC91158372FAB56DFDB1A488A0F952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 12f66604dd2e5774e10b1875a287a49160915bf600fef37f385573b8fa00ab49
- MD5 828832c6339ecb0415993726f9d56ebd
- SHA1 20f6e13eff7817110a7cb073edd018530dd83811
- SHA512 ba2b3a10a8954c910a72ad0f3a8c7ff335f10eae1cf7457ef234b0cab051f5bee48a2e9dee52da4720945f95de7f4fb826f66df676690c2c2e26d4cfbdc6fa60
- SSDEEP 12288:PyPz5L80/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:izy0H6LRgy7iBY5/ryIDxXv
- TLSH T1C865021772A621FDC1764234C8921A81F3B5BC365B208A9F13B4567A6F737909E3FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.5MB
- SHA256 6113b324a587c770462ad1228e703c7d47b067f4f211c68c0401ec70052a0b0c
- MD5 68b0a64b747be74ea973e1e76f1a48e4
- SHA1 117d7831ccf3be0117648994be94e7122c8df623
- SHA512 572c43b5706e427d4e27ca612e8366373c7f4d0005736170928e785938afaf60362a456376da6e9a66e7ddbbdacc337bc51b112300e5ae880acc8b359348b434
- SSDEEP 12288:7Cd91WYoaLHF3z0z04PDvhG/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:2T8aLl3z0zDWH6LRgy7iBY5/ryIDxXv
- TLSH T1E57501A4B3A008F9DD67823EC8554985D2F27C5A4B70C64F13F8366A6F333905D2EB96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.7MB
- SHA256 09b330186140bd532adf2c932c8c622da482168e27df45318b054ab3623b8fdc
- MD5 ad0199b2974f8f8c9b6f32b7b03c1942
- SHA1 77fe11b56e6047c6ce6820f443358b5c2ba59a84
- SHA512 0451d2f6f5a267c038839cf6e805db3f9705d40358eeddd5b8f8e77b49ea3de6374a55788092639b9f88dfa09ba428b271292ae8480267ede2e6bdba72102717
- SSDEEP 24576:j3rd9CHKy7GZaH6LRgy7iBY5/ryIDxXv:Drd9CHKyay61tySHD
- TLSH T1BF85CF90F3E410E9F1B78A35C9764511DAB67C5A5B31CA8F03A8661A1F33BD18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.2MB
- SHA256 3a2ce64e0bde2ee36a72bcbca3076428ae40f7e672d47e766fdfb2997ac80cc4
- MD5 298e67de2cf4042d40768ed1835b660f
- SHA1 cba36f3ac93aeb7b089bea1a50e8974bdd9a99dd
- SHA512 def272bc899619e44eaca7ac5789e5f67bbd0b4fe0c0939861792c35ca0d608add233ca3e56e5e64381e12e0314e146b7d891d46ec7475d7c645f6e9b6fb3f29
- SSDEEP 12288:42/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:4mH6LRgy7iBY5/ryIDxXv
- TLSH T109552365B4EB02EFC7580630C8C506D462CC7F5AEDA1158372FAB56DFEB1E488A0F952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.2MB
- SHA256 4400a996a97e6b177e3c6d641ba01f91cfb00f4af75f6a792074dad3269c542f
- MD5 560506e7cf2d63f9de545dc7c88e8ee9
- SHA1 b4f6faf45c7dca08fdda505de7d2605d1e422941
- SHA512 2f49c5e1ff5b89dde00a0347fd53669156ce12a7e4708985d477b3437314f2060d191836c93f86291e5c69afddb093a601e98a7aad1f9c5fe7c3dcd06ef75d7c
- SSDEEP 12288:EU/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:EUH6LRgy7iBY5/ryIDxXv
- TLSH T189552365B5FB02EFC7690630C4C506D462CC7F5AECA1068272FAB56DFEB1A44CA0F952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.2MB
- SHA256 8e664599e900af3724a766b2ca9c04b7e33d4672a92554e902ee2a2ed25a52b8
- MD5 95dca4dce6deaa412df3c5fc93e5cf82
- SHA1 43e0478d65b95f09afe441c35072169ede1570ce
- SHA512 9df6df664c25d264ab08a143c3ba4d2f7ea7c7c47a17c1a880507323d1933394acd0ac47c72d292aafe9421ee951a535479acccd158f9b871a9f3d64764de29a
- SSDEEP 12288:vt/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:vhH6LRgy7iBY5/ryIDxXv
- TLSH T1D5552365B4EB02EFC7680630C5C506D862CC7F5AEC91068372FAB56DFDB1E488A0F952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.2MB
- SHA256 86710edcb8f6c6a0a15830e6a983cf5752bb773dd26fde04d16673863c278a90
- MD5 222d6b96c4d3b7bd6160c28c5c9095a4
- SHA1 6b4c16e10d33864621c0b985429c9401c67f88cb
- SHA512 1b0119d15400ef5faf1cb83badfcbee6b4e45ace11708e9c259174884dcff854bed283cc8085fc0facee73879484bd8a7c2d58a284738117c9b5934b6fb66817
- SSDEEP 12288:aP/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:ajH6LRgy7iBY5/ryIDxXv
- TLSH T15F552365B4EB02EFC7580630C5C506D862CC7F5AECA1168372FAB56DFDB1A48CA0F952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.2MB
- SHA256 eef42f4c347c599e32c16ae9d5d01cec9080dac358172da57c2f8e15210a9a48
- MD5 63abd63dda325ee5ee341b576fd5e679
- SHA1 aedcae341b447f947eeea5e8a8fdf45d13c21287
- SHA512 451c4e3c5fb85049c0b4b6c9cbb40efe5783e57d2fe803e8d4712394a194b71756b7c3acf058a5ad3b5028769b6b79183e30f03cfe188770ae292fd44bbd1ebc
- SSDEEP 12288:s2/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:smH6LRgy7iBY5/ryIDxXv
- TLSH T13C552365B4EB02EFC7580630C8C506D862CC7F5AEDA1158372FAB56DFDB1A488A0F952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.2MB
- SHA256 50930c7d02cfca4cbf6c088967ebc38131265b9c8c3cdf81d334bb874f0c329d
- MD5 09dc4932d928cbe7b043b806e3bbe47f
- SHA1 4c982c248f4538ceb671da00edb0efd369eac4f8
- SHA512 a90fb7a429daff39e7f4700c27c857d5c3083d11b4beeee64992173982d879968d71fa6f8158d58aefc2d7207a931970a8ff26c631778d035897dbbf014e17e5
- SSDEEP 12288:hH/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:hrH6LRgy7iBY5/ryIDxXv
- TLSH T1E6552365B4EB02EFC7580630C9C506D461CC7F5AEC92168372FAB56DFEB1A48CA0F952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.2MB
- SHA256 3a07bb3cb8550e947d5c269aa859342cd0bc0a18bd035072357b7667319a0ba4
- MD5 9b4664697a0c41f37d968e18ebd3d4ff
- SHA1 49ba916e52dc07bb8b27276cfed3c5663a51739d
- SHA512 c4c5a7b725f55001f5264f7a8d307d9a208f8f0e786cad54ded2d3705e8ae4f1481f94d8269943bfc6549bb363ba0efd8f796246b63f61fb1340257fba66703d
- SSDEEP 12288:xh/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:x9H6LRgy7iBY5/ryIDxXv
- TLSH T1B4552365B4EB02EFC7580630C8C506D862CC7F5AEDA1158372FAB56DFDB1A48CA0F952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.7MB
- SHA256 aa49bdd03574360e48f4bf7cfac0827fabc37872bcef1366aa1bbf9bc526c0de
- MD5 1e9bf4611dfc8630a2432506192f621b
- SHA1 5b53b1f34432859382b80212f4c60af54a907da1
- SHA512 830cddf93accecd6747ff176c8b5007170e316450bb2b82687d7c5eb211c9305003eaa46f921019a6b081111d8219b9732a51e20d0b84dbbd20ac82709193ede
- SSDEEP 24576:Nfwvzk9RX6wkyAIgHH6LRgy7iBY5/ryIDxXv:kMnYIgn61tySHD
- TLSH T18385D029EBDC04E5E177923C89B7464AF2B178591B31C6CF129A536D0E33ED49E3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 1b1c702a03091c3adb7efdfb75cd74ce3c595c9c5554f1a92df7a7828c7f2d11
- MD5 dbcf89a760ce022dac559403d2233731
- SHA1 9d63b17756ffe6999aa5d781cf5bc429b5fd44f7
- SHA512 46d532e228a126d306f61f89908d47d1dd784d6f9b3e69a0058c45577536d19e0ca2c11a057e8509f0aaa67e2a1ba9e98d9d071fd09b2cb9aec7022d778d93d4
- SSDEEP 49152:RYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0dn61tySHD:oySzP1n61tySHD
- TLSH T1DB066C56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 f3ae1581b1cafd0fe68549878b71ed98d65002866419378399a543b944f23726
- MD5 69f60b8620afcef6f0ec2f8a8cb3bcac
- SHA1 3379fed9cb64bc907e61873861c2e7e267474759
- SHA512 6d32ab1ef1d20f5d3b5c4b060ca0feddcf0ddbc2a46ca4c8f0ec48ea5c685839f7d4f49a1fc9b505caa7b48d356892ed9149af66c7faf555feb170f0e38e2236
- SSDEEP 24576:T47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY3HH6LRgy7iBY5/ryIDxXv:T47JUQjqirIhCnDHUPfF/Nn61tySHD
- TLSH T15B65AE1DA3EC01E5D1BA823885554A5AEA71782E5F31CACF12B0937D6F23ED48F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 34c7d31c0451f14f1c2d1713576ba4544800f7c027965470a7aa38a66b8aa99b
- MD5 4de428f563d1b042fb927d4b17ddfddf
- SHA1 908e6d5709da97e5559901445069227f45d200c5
- SHA512 288a89d82b86952f3a36252f40cd466d5a252aa9f5c74c5a95754197af1bd5e2bcae18374e61fb4ec822ed2a75190bab6e7e6a62cc6403701753f2dec5c16c40
- SSDEEP 12288:Upsf0mm/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:F0HH6LRgy7iBY5/ryIDxXv
- TLSH T15C650119E2A802EDC16E5234C7854680B3677D6597E1D3CB63E0F53E1F766809EEAB03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.0MB
- SHA256 56e1986c106a5fe0e0b89fd02346a0a436f070e4e2a3d3f6ba9e63f4d38741f5
- MD5 1cbfc2010fcbadd560fdb2af9eceaaf6
- SHA1 69a7d7bdaa06064c38c992fae9403f6e6b915e67
- SHA512 8d8ed1d90b2c37149fac0810cfee3d1fa05f955d62daed4ebad2d239298198b3644b8724a25a7b10e149a6ab9888ac765938190a3946151778dd49b50c679a11
- SSDEEP 12288:CS2RIU3fUIWDqRqaTMnjKLdnEPRKeWMVwN:p2KUPULDqRqFWLdnQRKKVw
- TLSH T133350641766AC75FC6AD40321E32D6CCA7707C01EE45AE0373C8873FD576669BAE2292
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.4MB
- SHA256 2b0c9c31e65d977f748ac19a318fb5ff61f7e6b212b0d586f7c2b3117bac4962
- MD5 73146d69080db45af7ce1dac6be0f245
- SHA1 d442e769a2eac3a073645b38e61b206e5fffead7
- SHA512 359bf7a9515d3f53a3a7e64298508b0a18d7c44e90dee386f8716cf719193b1daabfb07fb10abbb645700f045b8cc753a5f85ccd81dad2bf0ed5b76c5730dceb
- SSDEEP 12288:LbeGapP8zClh+1Q50srO4a/wwccNtzabD5sUFuThBLrTyZ6bLiXpvinniGZTxPw2:LjnK4zhZP
- TLSH T10E65F9819137E3CFD0FA6072072A5B4CB764EC0677456F26B3C8453AD82AB25A1F93D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 12d06bee6bbab5cfe2d6dcf049acd6281524213312fdd6b5efbfe3ca13f1fed1
- MD5 4366efa056713ce77dda844175e496e3
- SHA1 31ead2137d99fa661914d4d4e1e4fe4b9ec13e86
- SHA512 e3bd82b014307d7d28b969fa76b86f82523bfe7532f2ef90ba54f2ee98199f5b71f974934faabb24635f030d831f574b7b4ddfceb54371e64dbf146e91bb6c15
- SSDEEP 12288:SF78mm/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:O8HH6LRgy7iBY5/ryIDxXv
- TLSH T160552321B6EE46DFDA79063084C942E4228CBF699F5045C3B1A9756DFD71EC4CE2FA02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 eef339a2a51d5a99283ce075fcaffa4ca236b6bf978289aa96b8f0369c25732e
- MD5 8f497ee825fe96f933f70e886ad6249e
- SHA1 9bae624d1c9b609c03cebef8edc42941f88dda46
- SHA512 fa3166b3a931b62772fac68d6099999400232dc8be0f94776dd43d1079172793688d438bd15b53ecf80e0189e718211a2abc7949b4cb084f640c495666224670
- SSDEEP 24576:Pgb6bmBIi49WNNFpg1rSvFv7bYOHH6LRgy7iBY5/ryIDxXv:Pgb4mBIBhGF3n61tySHD
- TLSH T16365AE1E22EC02F5E1F9D2B8CDAA4417D6B278161731D2CF1251426D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 3864a4ab12d4a5d71477b6d56df72f11b86df66c7820040ebc4a3e8d3ef4754a
- MD5 0211ff718160e963f8d88a73113e249b
- SHA1 4b1cbc2f8d9ee1f4ec59ee31c89ca12320fe6581
- SHA512 fea2aa8c491c3033a745b614b8cd219f1e4aa1760d96e6d7bb96115cc9cf3b4e3a308ecd36192b136ed85e6c60de2f63715b1c76086822e5ff28f00f1f914a70
- SSDEEP 24576:9G88u8FpJqH1vzria7/mHHH6LRgy7iBY5/ryIDxXv:Q7ZFPqVya7/Wn61tySHD
- TLSH T19A85F165B6E102F5D47BD138898646A3F6B1B8250360EBDF07A88B551F33AD44B3FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 3340431994e9d0606d7f6c27991213fb43dc533a039480b1e51cff831700ebf6
- MD5 f5d6ef0a091c422fc8a4d9043ad35f74
- SHA1 44846c50223008593a2089c975cadbc0103e2b59
- SHA512 9aa028b0c687cbb18acdc49a77fa44552282663179237e8c4eba417e71e8c7dd3884c2b2bba6e530e0969c87f9f80faaa9389820984580b9410d5b4389ad4473
- SSDEEP 12288:jHvUrBFrEjwaQbmm/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:jPUr+NQbHH6LRgy7iBY5/ryIDxXv
- TLSH T12665E12F62ED18E9E67A913CC5824759F371B862171192CF02E0917E5E73ED8AD3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 6645df79b756de294fa717140e58a3a06646b622f6a4b47c440e89df98232ec8
- MD5 4116ffb3683cea782f0b9189b317cf43
- SHA1 de3d04252d164ac07bc520c7270b5e947b4af266
- SHA512 cdcf7db418f66e1e1c94ce8b4a44302ecbf8cf1752921963cd9ef8f6d5c2bf060dc23b0b0668d665b899671655f4a7568dd3d577da4dea27c3fe67d754025a37
- SSDEEP 49152:hBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjrn61tySHD:CG05lO43bon61tySHD
- TLSH T164D5CF6E62EC11F9D1BBC17CD9C6460BEBB23815033556CB02A486A91F27FF4997E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 8b62d9e1f1d5923f33a806b0eac3ac20b1daf3ebca948ba295002763b2f4bfe6
- MD5 64819c332ce717f3f78137032ab15f0c
- SHA1 737ed177911e3d286badcc667113d81b62f548c3
- SHA512 21d73be02fac2be4ed3273b769dec132b645a96f084b8148fd28581ce5e0d96e146a7dea7588334f1e952014915547506dc2e622699bdd2a03f7299b77e78e1d
- SSDEEP 24576:Jfa5POZ3dpyWVM50JicR2hG0lasx2+47eidndHH6LRgy7iBY5/ryIDxXv:Za5POZ3lJt2pasx2+mjn61tySHD
- TLSH T19565BF5EA6FC01D5D5B9D17CC583461AF5B1382253319BCB122182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 05fe96823a8ffc1f990aa1adce06cfb8113a17c618cff9cb5c66643265d014ae
- MD5 b8c835c2afad3fbcd44e4d4eec616061
- SHA1 4b0a28d5fd1bf9fe0b244dd2bfcf44fbae597ded
- SHA512 50cb7e2eaa03777f5d6d85a9d7d0346a69de3590a8f72ef62252f27253adaf5f64bd46be6d1684b834605aa6fb7925b80d98f8a699a198df6587f81e3e231b2b
- SSDEEP 24576:+NcwHdjbyQ4nLC18lb/EOjowL7Fk/HH6LRgy7iBY5/ryIDxXv:+Nc/zEOVHF2n61tySHD
- TLSH T1B5858C2623E901E4E1BBE1BE89779546FAB17865573086CF0291811F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 aed9beeb413b3178438fc52eb80a9774e249ac6a33660b4d2b0648a0a7450dad
- MD5 0089471424a1a281ec033b2fa00bd70c
- SHA1 014083b38d06fc8e3c6e5806efb9091e2dc71af2
- SHA512 defe0487f88452b24674dc76026719b21ffc38efa7f2b248767750e2c72ac19af0daf607eba36d7642f4e0cf4d658a476120e5d137ad7badec5a62c1e543ee61
- SSDEEP 24576:UzkNvNnaFeYhJNtmZBm5HH6LRgy7iBY5/ryIDxXv:UzMwBtOm5n61tySHD
- TLSH T11C55AF2EB6F806E4D1FEC674CD238512E6727861173293CB5290C13E5E679D89E3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 ae6833b205811bd5187e5527922aaa90c9bb23b2a5a59ff104e1fb91b719f0a3
- MD5 3e91510012a1c3e0a79c7a2f05f41433
- SHA1 5524a8175c2a9c3b37b4bddf83699d60af2e5a85
- SHA512 ca4a8d68b9008a68e3f9c1d94bd8e57071b7d99721a3d32712a3b644d4d056a23566092910c28d8de6a63e326cba6c2da54c31d979c49662099525ea7b5affb9
- SSDEEP 24576:UD3FHshBIYQgAYHH6LRgy7iBY5/ryIDxXv:UDVHeBIAAYn61tySHD
- TLSH T15275E13DE6AD00E5D57AC17CCA934A06E3B138A9032256CB12D4D1B95F6BEE46D3EF10
- MD5 SHA1 SHA512 SSDEEP TLSH