f678355be73ff654acda2fe3926fb94ab0a620dfb717d2642a68c30ca08395e0

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 08:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_92e35cdfb723d67c4b5856519a779de9_icedid_mespinoza_njrat_ryuk.exe
Size 1.1MB
Sample260802-j7fm1aff27
SHA256 f678355be73ff654acda2fe3926fb94ab0a620dfb717d2642a68c30ca08395e0
MD5 92e35cdfb723d67c4b5856519a779de9
SHA1 9a7c05ca0e145c76703fd3b5806294802c66f18f
SHA512 79716778ae3ae6b3c71eed6fcbb10e11907de3f01474b99d641e69be6e5ed17fc339529f91d52f49029be9865b2ab5ef42603781a9ca51d519bd2e8864b23585
SSDEEP 24576:K5phzGIvN8KFeWROc/Px13mD4/wzXyuWk9c/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yhzXDeWROc/513mDzryugLNiXicJFFRI
TLSH
T1DD45E046A7E401B8E0B3D534CA664656F7B338555A30CB5F13A99A9B2F337608F39332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4148	elevation_service.exe
4088	elevation_service.exe
5408	maintenanceservice.exe
3616	OSE.EXE
1112	PerceptionSimulationService.exe
5704	perfhost.exe
2784	ReFsDedupSvc.exe
6052	SensorDataService.exe
4892	ssh-agent.exe
2164	AgentService.exe
5296	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8565f7b0e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_92e35cdfb723d67c4b5856519a779de9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_92e35cdfb723d67c4b5856519a779de9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_92e35cdfb723d67c4b5856519a779de9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_92e35cdfb723d67c4b5856519a779de9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_92e35cdfb723d67c4b5856519a779de9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e3718a15722dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dbdf56a15722dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000004da7ae45722dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b093efa05722dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a6b1c3e45722dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4088	elevation_service.exe
4088	elevation_service.exe
4088	elevation_service.exe
4088	elevation_service.exe
4088	elevation_service.exe
4088	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	764	2026-08-02_92e35cdfb723d67c4b5856519a779de9_icedid_mespinoza_njrat_ryuk.exe
Token: SeTakeOwnershipPrivilege	4148	elevation_service.exe
Token: SeBackupPrivilege	2784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2784	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2164	AgentService.exe
Token: 33	5296	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5296	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5296	SearchIndexer.exe
Token: SeDebugPrivilege	4148	elevation_service.exe
Token: SeDebugPrivilege	4088	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5296 wrote to memory of 2892	5296	SearchIndexer.exe	102
PID 5296 wrote to memory of 3208	5296	SearchIndexer.exe	103
PID 5296 wrote to memory of 872	5296	SearchIndexer.exe	104
PID 5296 wrote to memory of 4480	5296	SearchIndexer.exe	105
PID 5296 wrote to memory of 2684	5296	SearchIndexer.exe	109
PID 5296 wrote to memory of 5488	5296	SearchIndexer.exe	110
PID 5296 wrote to memory of 4336	5296	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-02_92e35cdfb723d67c4b5856519a779de9_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_92e35cdfb723d67c4b5856519a779de9_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4088

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5408

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3616

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1112

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5704

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2784

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6052

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4892

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2164

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5296
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2892
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3208
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2496 1880 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:872
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1496 1644 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4480
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2684
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2496 1880 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5488
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1496 1644 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 40182def87a7faac3932f558d0937a78555f3e4079963d03a688cd3a1a8aa09f
MD5 a635e9971aa11308919e27311f4671b9
SHA1 1109910f53cadd15372caccdb23bf6f7f9ad2b36
SHA512 5415f2ded612d33449fdcfabefca1c888345d074f562ca9fa3162fccae20cc34987d9bdc7602c8561d5bd7feee893f3212b0e15e6d4c5c7dac469428fe1c801c
SSDEEP 49152:7b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnFLLNiXicJFFRGNzj3:J3q6sjBq7wRGpj3
TLSH
T1BFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 d8a0795a7e2be0b50c150e805bc4f4f9be07ec3010ccbe71e9ad71155bdd2a0e
MD5 3cc483db2a57fdbda6fe09bdca42c0f0
SHA1 d27787045866939d7ee0a689d7ad1e57fef51dbc
SHA512 917e650271cdf999ad8e52ce0dd563fe80ece8df668fa43df2827553e90eb98ea62b4091b4324fba6c2b4da102cb0fc9b936413f0aee7f11e2fa405fb4d85061
SSDEEP 24576:4XYfDtczAq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vtcLLNiXicJFFRGNzj3
TLSH
T1D775012963D408F9EDBB813CC8A28411E6737C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 786e19efbaf95b645adb8db4eae8c2be5eea963312f9085e054b564ef253a8dd
MD5 2c79a8585324666ae03c7e785529c51d
SHA1 3c48b07bf902a1ce7c038b78f4bd120dd4d2e805
SHA512 9365f8c8a784a64fb1a2dbdc8b9a1c1c574fd5dd20876503b3ad2e882d457bbaa495c97b5d4cd81432d967f0b2f4bb625eac36144d582f0d176b2c15b5aef833
SSDEEP 24576:e0Le5ji0hmx8rMN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ePji0AacLNiXicJFFRGNzj3
TLSH
T10095AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 158498a5e8b5eea18d786b7a1117bc5822676d84cee2f1b4d3a6917797f68c3a
MD5 efeb55ccf589d159d4021df3c321c9b1
SHA1 53d48657bf8d06b9135e9367bbb0f77ece994a66
SHA512 5aff33c4b00b5c9694a621ebf638360926131797a9e6f4fe4e898c1fd3844e17bf4a426e583f113f733068161b296ec3e729c07a0171ac8f844878ea8ecaeb19
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWn6q8wyub/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:R/ezSC6vUzPveHjyQLNiXicJFFRGNzj3
TLSH
T1A1756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c9572d2e9299599f6addb9ea293b932b64971cf5e26c6114fe1f0329f6a54492
MD5 74f7bd92389c7473d5f0f42a42dad3a3
SHA1 01f58d2a8dfd46e6e4921b59b8250ee754ef16c4
SHA512 dfa1ebf583acc29abed059dde21c4c189585b6c529bfc944405a8fa3eaec1f24f2384986901e63eb8ee2d02f33532db4ca394fcd65f1dd3bbe9e8ba0d1d6001b
SSDEEP 24576:bVbqPb88hv/l+Ym/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bVO88hXl+DLNiXicJFFRGNzj3
TLSH
T1C0559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 7920a6cd1eaaaed917ea10f7341edff6a39c26dad112cf7f1ae7b36dad6fa8a4
MD5 7aaffbc8704071956b1768f86a19bdfc
SHA1 8b64d93f7d02b7d0bf989ef01109c7879c044da6
SHA512 075fe1b9b1407c18b1a6697d23ba71b098b076b44ddc6ff2ade1ad652477fcfc49e26235aaced1a50f3d286bb09318e53cebddfd46eb49cb67bd2c775568553f
SSDEEP 24576:fSZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oLNiXicJFFRGNzj3
TLSH
T1436523D3468854B1FBFE003A867A5828B5845E2C8A595DE3D2503E5E917CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 f0472b8a8c663c9e9ea81bd58e41e07228a43cdd049c38132bd21badf4e3a9b7
MD5 4fdc95d61fa1f02bc9d3a299cf883e57
SHA1 8f429d9882cb60bb2371f1d7b7c1a6d12f318fcf
SHA512 5f6997449cb1a677170e22bd0ab79fc4346eb687b91a1e38448666192ece4a24613efbad75f54343364d2eac45eabdd81df9bae6fde1a80e18e6cae6ebd720c0
SSDEEP 24576:3JIUe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3JIUeLNiXicJFFRGNzj3
TLSH
T1F485CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 cdd0a61ec81027f24397a08c21efe9307e754c2dd2a24a9ee541c95e56a415ae
MD5 ca94c49cfb7b56702f290fd9ec889e0b
SHA1 92a0ada3fa9aa502cc373562ea88b80dcd0a2e23
SHA512 314e8c18d41109da3af859dd91772e10e23effbf2c671f30315588fea28779a720c31ad71ab6c94f42befad5827e82dd5b44d467f0425dba942739c4dd29d5b9
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THQ:xQvGAdlCEL8c/DRNw5Cr7wRGpj3
TLSH
T14F266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 f3eb9af01b801a7421940dc81eecc2e50234a7823f38ecdfa69aadca494237f0
MD5 1a1e664bfb6e98bf4e6ed8a48f9003d2
SHA1 e0727f345bf312fe29f7e5b4ef00022492af8fcc
SHA512 063d43ebcc583ebcc4134ca6034a2503e35a3ebdbe263b37c55a0781b6402c8a304827ab57fd4715bd84ff527e551bef505ec369fd55da6c1cca61a81e0a47a4
SSDEEP 24576:ZzewsAjs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5ljsLNiXicJFFRGNzj3
TLSH
T1EE85E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 da5d5b4f15a234b18dd80f57a098462b3c23c6bc599f8c965ebc167e60e6e7aa
MD5 4400da86cb02284048122e38c4f0493b
SHA1 2f1ac0a26ed7df845507be0fccb905c62bfb1b5f
SHA512 123b903019afd1d024b70899355386be75c0ab13129513edbd923c0abca442611be2a8f82ee8740472a58ee2f10d14683f91d447af95b5070eb120305b9fd48c
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHAF9:jUEtQevvqc2W1cpV2tI32k9
TLSH
T197474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ed02a2b431f47872bbfb949a8236c02f77feb8cc4a786010b8497bf5418abae9
MD5 310f23b2f513c459f5e40bab98e4f521
SHA1 394957ee62620084ae962a34248f1eb596597f8e
SHA512 d743bdb85f9148e1fec44a302d0ca3e8675a0ee7513ee66b698f54c52bb299b74ff01572b135e74ecc40c20aa959ba70513df34a4710eac9ce07503f27cda7c9
SSDEEP 49152:rCbRquA/m2yL5zifFiV+XenmE3/zMLNiXicJFFRGNzj3:0oqHVjnmP7wRGpj3
TLSH
T195D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ddc068a87fce2e71849e9b9ff15e7b59cb6596d13a22492842e05153103c8e80
MD5 1250c2815615cd05ecf22f6f10fa0064
SHA1 b109acf8d0566242c976bec0b133e55a8d3541b9
SHA512 22c5072943dac0b057760337119a115ed66b3634abc4681bf12e4031b28b9b1efc480f2be70a8922c5d32f080360e33e5e66db481a1bda6d4826f289c4f42e1b
SSDEEP 24576:YAhGL3IFoiwtA5l7S53v/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YAMUFoiq5fLNiXicJFFRGNzj3
TLSH
T12A359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 ec06619d09b2a27b9348f54f2ce623501615cc80a947c9ecb56e944ac10bb55f
MD5 8294798cd01ec318ca52510642797d3a
SHA1 7182e9bd94e1ec4327392369ceb606ce7f1eb1ee
SHA512 49e3b24e02c9ee9b4eab0496306998d5d0426a5c3e84b04e6fda48b722570009e0196258fc34383d7d2d96c8e5b3c41cefb9891c06608506ff05954b92e09eac
SSDEEP 24576:0wufOWw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0woOzLNiXicJFFRGNzj3
TLSH
T1D675F18632940CF9E9BB41398657C035F7F2BC152A25DB1B5360C65B6F37362AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 ab658d00a8b189d9350f7edaf16e92e4eb75c24156660cac52ed1fbcb777079a
MD5 2043211b0528e10470b21697563d5302
SHA1 b02eb9e10ce4dd8fdfc9b0747f7c08c7c2862ccc
SHA512 6711dd7022520f1577d2ee60f282b39a533a6b8d1c31215f1805e26e328d8ead75c275f99bc66d3bdba7d15988ecc00c534eb8560273aba690f7e8e03657a3ac
SSDEEP 24576:/ZuF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kLNiXicJFFRGNzj3
TLSH
T10C65129622D820F5E6BB003DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 14b668044eb3c10466154965207dcc2cd72d81e217b0f2aedcadf61ead9de099
MD5 339ea8710016e7bed5bd4995755e1b2e
SHA1 4a9bc5b086a638db7df948fe8442161dc812a111
SHA512 b023bca4b5281d37f6761757827f26a7a4fc66feb6fae85aa95cd1707cdf1017fbc097c4002b1974dfafb71af1f66a1cd6feaa5ca42ec2fc61f2bcf63783cd48
SSDEEP 98304:BQRQyi36YOcPbLvw2gAf+PN3C7wRGpj3:YQyiKa/X+PN2F9
TLSH
T11D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fe181ff75c11db2266881a63b4a42828d635060386934f8ebdc93a375444b8d0
MD5 d2b5dc459535531f43967e4c37f71076
SHA1 a16b75a2a64471c603f0d24255c1da7d231067d9
SHA512 761e8712526007147a522ed6561e252977d34962a953856176970c1f7a4bcba1b31fe2c9047f13d3e1ead861409ed79a975a4a524bd1ef2480432a99c258b874
SSDEEP 98304:3QRQyi36YOcPbLvw2gAf+PN3C7wRGpj3:mQyiKa/X+PN2F9
TLSH
T142667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4b41da78d3cc1a1623cc19d8b6d71c5f374419ff7268d3063665b72160e9a73c
MD5 46311a1511a9776052787c3b2027b539
SHA1 67b1e1c9eb04b2e3658119192bb13ed789b1375a
SHA512 1854fafc6b52be7fda740d93850a125ae63eb2b268771652c3651ab67891ce7d55c5ea3119d765fe2b64325ec3a9ed6e8f3cbf87dbb2b1d1fcd8be8212919b29
SSDEEP 49152:168Qg55nhceWu7PNU3/cLNiXicJFFRGNzj3:DthLRc/c7wRGpj3
TLSH
T1CEB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 73235d425c6c8b637fe755b06d7743a576de962c3ed582db6b3e922ab9cb4683
MD5 0f7c15f0e1cec1e9527e59644f4bbdaf
SHA1 8e4f0d2c36bbfe4803ad83da7b439945c7077197
SHA512 8a9ef22bf6141f51b8352a43ce8d43c24e7cfed210e32530f59d556b33e2228eb71a16b0a99d9e96b2033111ca2c2762f9518bec3dabc44e06cb224ac1741910
SSDEEP 98304:yy5112gYy5azzVvt69nLKnhZZ7wRGpj3:7LIHEWhrF9
TLSH
T17C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 dc4d48451f280ab8ea0550e257309ede9d9bb30b767e04607e5ddbc7052a3f0d
MD5 b94f1cc63f5b0fee59a5b2348a04ad0d
SHA1 403290b7a8e63666b983295eb3f2f4b225ddea29
SHA512 17d6fd0653f85e2b2caa89785acb76539caccf564dd9adcf6125c8a9cfe3a7d0a2be936a360c882e06f461bd131ba67dd91fdf8beedcfcf883d2a95b9bd074e0
SSDEEP 49152:iB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glcLLNiXicJFFRGNzj3:Qu6Jmdxd2d+7wRGpj3
TLSH
T16ED59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 551a98ae568ab5c0cae94a39899f5f1072e77603f2cbd11b8a6076d836b96116
MD5 a5207b996f3a365d4d7f0b115b5ab8a6
SHA1 c8c185c3b76d21568527e58c387fccf7736c2c3b
SHA512 34ad4847e0ed2c6fa39c5b915d986bbf5521f1ae34e2ff19b5e466b06bc8bad71127d66be8b60bbe2a871b1e73350a3bdf85349055865eef353c8b6e8890bf9d
SSDEEP 49152:41hpsNoJpF1A63U44CwH7R4x+LNiXicJFFRGNzj3:4mifPWRP7wRGpj3
TLSH
T17FB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1ffa6cc1165beb86a313afa06b64e841816c7882485cec6bf3ec161799a580aa
MD5 2069f66f6338712b5f1e6dccaa37d8a9
SHA1 281a9b76e9d098556e836154210d7e53e60aca07
SHA512 74dfa703d5f7045e4dff1c4c8bb05b31b90efdff729e2ceff988fe034eebf1c4efd1454ca03de772f72f9d347df424e8739b47a179099fa3b31e91b5b6026ad8
SSDEEP 49152:pSuZQIY0Be2KcRVtOnks6NMHqFLNiXicJFFRGNzj3:n5dKii61F7wRGpj3
TLSH
T196C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 691cfad19cef7cc3fc71bff4fae2757c9c3f7ae61e7cf50008d03909eaf5a839
MD5 7dfec82310cc6a840590b3a5f20eb680
SHA1 c8bf872298ce69c4b05a566f0228d7cdd39f93a5
SHA512 b906f49a5826263cae49529aa3cf034bedb2f4af8e8bbbb533998da466a4a1f7569f7e1f75b0b1fca531a0db663ed74c9b1a49df38079b92e8564eca91065363
SSDEEP 49152:jhtSn8EApI0fig3giDn0AP5wqLNiXicJFFRGNzj3:CX2imphT7wRGpj3
TLSH
T12695BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 ae010ea10fe3fedb7da23616b283a72abcd8f23f44cc5388be89e1c38ebd27eb
MD5 4f1c85730a36adf275d3b447813608c0
SHA1 ca1708caab3ee8b96f61053463bc8bb5a4b80994
SHA512 687801089b2530cf48ce6cd8948341fcc122df3a432743ccda2119d2aa89867871d32d8fa46f56367bd5dd8d455e97e4766359331f6dfdcbb04e333dad1d4045
SSDEEP 12288:ztiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1666523D2558955B1FAFD003AC6754428F5882E1DEB5618E3E3083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 9043096647ad76b2e073d61cdbb83d10de49d0c3147c047f034c7717ce9fb822
MD5 aad40b61f2b920d43fdc91ef15221ef4
SHA1 77ec11638d3bf8dae8135e5c9b6ffd1233232056
SHA512 550fbe04eb8ffc69d44433da8ce66fba052828c5a271e8ec0ce2bc0646a321cf90cf92b693266e1eddab511f4e4693b23a1687995200c08b64910e993d5d055e
SSDEEP 12288:OuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:OY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1286523D2558955B1FABC003AC6754428F5881E1DEB5658E3E3083D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 41b8f63e376444aef034a9f280e7b73778ab2be35f0951b8fd5b76807b68dc65
MD5 e6501d829d234d7b8740c5265ac4df9a
SHA1 782689c0eb1333a8eacbf720498b4bea9ab18bac
SHA512 fb8346a08d1c5a0e143f1c4d3e4a5d3ddcaf39e2f2f6ecbb741022a22a5673c589b9746cf87908c4364125e11d1102c3872c50f4327b51cee5b8f7a445ad233d
SSDEEP 12288:bsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EA6523D2548955B1FAFC003AC6764428F5881E1DEB5658E3E3483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 f98830b87b71499a0f631cbcc4b1b7786bf9a556d7191ff9247d119d3c90fcea
MD5 eb1473e1098c3cf080fa1d5c205f4a77
SHA1 c5282cbdd786d131fd875866341e0e4b810eaca4
SHA512 c231379e0637065bcba2e947348b817bb1c54c30068bd1530613dee354fe75d17288195fcc6d0d6d11bb29c231aaa77f0bae5c167f61d69f4b43d4a3a3fd8d03
SSDEEP 12288:IVbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T152652392168901F1E9FD8039C6764424F2A47D6CD7325AEBD3003D1E5A74FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 f39d2360fd53b5a8d647c946c99fac5b59c9fc9182248c78f9ef44c30c7357fd
MD5 5701d0e71fe55b824e5a132f961aa416
SHA1 6dee0c415918cab9f14c601a5516829030099a3c
SHA512 b86f70dece725227e7ce1b8777bd92bbf1ab1235d16e52550620b3d94d457f2980c3fed0fa4140706374b6b9a73c3b2325abbcd92847dc1656268b713100b76e
SSDEEP 12288:4jiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4X/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17C6523D2548955B1FABD003AC6764428F5881E1DEB5618E3E3483D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 cc36d7fc7c8e2047ca632ab4424b739363c193c7d96e02ee94ca17ce6a5daa37
MD5 ea1f17a7e1c17f5c000924afa7d1de5e
SHA1 799cddbc870677d754b90e74db6d90e40b834efc
SHA512 66da25d09ff03a2f0fe6736e0e919d19a8cf20a73e08a569908690822f34359b09f540e5742095b0a93f00c99a728a5319d2ada4c7bdcd3b7379705551d80806
SSDEEP 12288:6iiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6k/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1106523D2548955B1FABD0039C6754428F5882E2DEB5619E3E3043D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 9c264a7f41e4976dc9450ddd098ea70e7d1fd5007945b6e6f404e4adaa660d1e
MD5 c9f9e5199683afc3eb40a817499615b8
SHA1 33ef7a3b8e1c53ced51c9f376190074e40040e66
SHA512 8ce7bdb9016c0461ffca67428fb0a06a6a2880c498d3c3a33bac3e6101c31a5274f38034e70462c4eca10f2d72963703c5ff5d0f014eaba665c72effb17136ef
SSDEEP 12288:KWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Kg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1366523D2548955B1FABD003AC6354428F5882E2DDB5659E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 082fee46c2fca13c5a1431da6d1091dc088137c9e999e6ceb95565aa4e1e32a0
MD5 ee20fc5195d93c4aeae36f0ac7315860
SHA1 f1f44c6313976e7767c28398fffc3937bb8c279c
SHA512 37fa458b0e50c8cadca3bea8a13473e90bbec00d0429bc228d2b1e3dee51bf0217d6ad55ba644668bc46c5063c00f7bea87ace98c11d9a6340d87679d28963d2
SSDEEP 24576:FZMSzFVSO4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FZMSzf0LNiXicJFFRGNzj3
TLSH
T164850295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 9f95b52f0f4d407936a3ba490cd3d2ef3ece7309c83a878c188d12984f13b06f
MD5 e5deaa6a5a878ed2ba3aec6daa7542a3
SHA1 c86a2206c607509ca48221ea06eae4167b2edf57
SHA512 8b97aa3adc3f99957bbed4e88fb445b48272993c75f8f39469abb6316b61b4cb43c0f42e3f6d897f47fbb49560c20bfea22f52be6e5a3a2a7006e6bf2086e95c
SSDEEP 12288:YJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C46523D3548955B1FABC003AC6754428F5881E2DEB5659E3E2483D1EE238FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 f4b310f4db568a56a1cf15fae2c83d2a57f4caaa3eef33c0f33f974a918e3f10
MD5 fd2d33dec559cf92ac4b8d02af728d85
SHA1 bc33d2e27b3678f3173df527795c4e2e46fb8b48
SHA512 81dfed70b00e4959aa3a037f99519268e7301a6177a233b17122e31fc4836296eca61678966b9ab456133734ba784aa87f24a1ef7c20a815d704de553b83f99e
SSDEEP 12288:iliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ip/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A06523D3548955B1FABD003986754428F5882E2DEB5659E3E3083D1EA238FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 858d83a36a420028c19faf8dd9bee3bd331ee0e18b3bbe9b4abcbf0ad3dbda15
MD5 927ac5c3775baa6afedc49e627e934a9
SHA1 6ae5bbd85c024b96be02ba15d7bf94e3ecce1158
SHA512 733b87c2b547358c591e1b696169f7a92d81a715580fd1ecf0e3b755fc4196d611358879802cf0b86723e136765dbe9904cb55455041c6a7fef7cdf068b01ef3
SSDEEP 24576:Rzy8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RTLNiXicJFFRGNzj3
TLSH
T1E2750147729530F9E17A4139C9620911F3B17C3647208AEF53642A7A6F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 111df841a344f10912e8034e77631f1d4dc6a14bbb4c6d2cc4833e966a4a4c57
MD5 0cb95b2a168625fa852f029394919db6
SHA1 16961c5da415b731b1756ff85eaf5737af7da79d
SHA512 5c1dba87e943b8b4d2251fde66aee880c72becdfa2a8f902102af36d8b65e5a64f2c671f64034a94863a66a91db367f4c1bafa3af4971c44e3e27d53ebeee32b
SSDEEP 12288:1JiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1V/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1876523D3548955B1FABC003AC6754428F5881E1DEB5659E3E2483D1EE238FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 e461b7210b4370c36f6500c6d198a89118ad582471909fe9f092f44a732ebcfe
MD5 64317ef1c8b095fc7ba57a28fc3e68be
SHA1 4929bd947e01d6c6386791671c93ca21a6f20812
SHA512 71ddeea0ca30d80bd65e2bef3e325bf5a1830205953b9dbe1a995f1bff1a53f38d7174369f628e0b52014df9a3d8f7d406aa88e4dafff96a8ebae7116a144d05
SSDEEP 12288:+JiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+V/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1396523D3548955B1FAFC0039C6754428F5882E2DEB5659E3E2483D1EA238FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 2ee1b285db2dc98209ff92008f05c216c3687c4f7a65339651324d107e40aec9
MD5 367df7fac101c36334d028878af4de6b
SHA1 aa8709d28a248f2a3f16dbc82658867a44a8e365
SHA512 90be01fa2355fd5735c2b9c24cdbcd100617eeac7a19b0c9b95e488c95284ff47a0d766d1108d775cec4f13f1db66fa25b927dd03d93afca232724ff84da3761
SSDEEP 24576:Nzy8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NTLNiXicJFFRGNzj3
TLSH
T1F6750147729530F9E17A4139C9620911F7B17C3647208AEF53642A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 83a1d7e8cb87b11addbd8c007aa410529196a8b2f0f000458eb6d3cc32e316d7
MD5 0ada67f9d1d994825cd3d6ba659830b9
SHA1 5b2ba8e5473232798f23610a71ca3d46b4f2b8e2
SHA512 13acd50685b33845b16064325abea115358994f2fe30514f04c30b69342ce4611fd805adbc4fb5b4321b16a63cf80f33fbd8855d7d318ad0c843755f06ac3560
SSDEEP 24576:9T8aLl3z0zDG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9T7LljbLNiXicJFFRGNzj3
TLSH
T1568502A5B39018F8EDB7813EC9258815E2B27C1A4770CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 c718822cc2cedf94877daffed6a21717a2042876be24f6544d688dcb19ceeb86
MD5 c9b3914d122485696b4a3ff82ca8ab9b
SHA1 6b00e45b70c728a3518f48f6e8b7814682b789f8
SHA512 674f23f15544c70e1f00fd23f9e2e57698f0842da06a542e0619cef9c6cd220ec4615a37202f33d45e1cc19145997b0fd17078fbd7bcc6886a32e989b317ea35
SSDEEP 24576:M3Qd9CHKy7GZi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2Qd9CHKya0LNiXicJFFRGNzj3
TLSH
T11595CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 a13be30874bbedbc3f1cb5aacd759965fb364647e536ceafaa44d9d5e65f709c
MD5 d9a8407b5684e5a41a3a7fe75cace3e5
SHA1 36f633c91cfb151a62f01420bd4df4c1a1988254
SHA512 ec84601ca91617576bff538757c35fa9fcad7aab8e402e0f688c8ab43575816d862e3b6be85aef477b68c9d1a6c81a623140beff1a986482a392ae1cefdc82e6
SSDEEP 12288:fMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:f2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14A6523D2548955B1FABC0039C6764428F5881E2DEB5658E3E3483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 c1fdde70e037c63bde3ccd0e2682b7607e60dc884c3609c9a197e79840ff2e3a
MD5 4a158b9a9babad39255e5caf9f225fe4
SHA1 4d8e17167de911da0fcb41cdc352d196c8d8e820
SHA512 30c5ab720fdf522bd19319b7d6fb672d168a91d4195d9e546c57f9f0db841bd2c956197395deca168debe118a36614ede5df8c0412c540a8c20cbd07e7d8bc2a
SSDEEP 12288:n6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1106523D2558955B1FABC003A86764424F5882E2DDB6619E3E3443D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 8ebc222dcc6aad096b453b0a2ba115c6454eb4eafe3ce3eb1f00b75cf765024d
MD5 3e9c7d4c951ee73f84e9795101e84041
SHA1 68849f4638e3a23a02ab64b4e514ad21fd931746
SHA512 614b896ad2d66022b76b7336e884f4699692bd123fdd0e56620fdd4543cec82695e63ce9801755bc06835d4064e844982e1a0ab9166f447fde0177183c519093
SSDEEP 12288:NXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Nj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F66523D3548955B1EAFC003AC6754428F5882E1DEB5658E3E2483D1EA27CFEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 86c99071b485e748024739542f1bf7feb6603a22c42ec440c8bed4e9cd9b8b73
MD5 62bfe8a3e776f003be65cd25208adf36
SHA1 b3f76088026c4a328ae618c4f24b8c722d5f7a0a
SHA512 d4a2241465d5c23af3c2a02ee9e1b27e87ec2e87eab778456cbe2cfc4014d204c59a1a4054177da0b6ec7af4a16cffe6411f5eb4fe7488c9f69a0c3a203cc1f3
SSDEEP 24576:L6V/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8LNiXicJFFRGNzj3
TLSH
T1756523D3548955B1FAFC003AC6754428F5882E1DEB5659E3E2483D1EA238FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 a6066a78d924e8dca5407ccd3c745617a3d7d039bddcdb0598d6905891b5cd82
MD5 99892e58330b19baea7b768b63e10af9
SHA1 49273c6008fe8d3b6bab233e9a34c1ba832b6b49
SHA512 dfe4f29547dce770ac0fe0f15f0ce7af0195b05ab68311714b648cfdcc9d41c4fcc487630e60aed059bdd381c7201294bc52c3f706cb5c7765439cc998b8721b
SSDEEP 12288:PMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:P2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BF6523D2548955B1FABC003AC6764428F5881E1DEB5658E3E3483D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 4bfc66b31393ea24dc68b331c354d2f6fd7f90735543ba1f6083e331ec41f78b
MD5 e1d02cfe746a05b37cc0e27dd7f27237
SHA1 ebd07cbccd22e7e00fe2e3a9745ad523baf30881
SHA512 f494910b380f59e1a3009f665ca85dfd387fbc176942166cba2faaa4ae00a10655bd2567cc933cb32ac62e82118da54a2e8d41d133fdb29c376fd1a129964a02
SSDEEP 12288:/xiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1856523D2548955B1EABD003AC6764424F5882E2DEB5659E3E3043D1EE23CFEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 b957ac76529c0649a9fecaf14d52f1030640e372a7b3c92fd7ac3855cdabbcbb
MD5 3cd160fbc33b86ee3dd3b64932304fa8
SHA1 e94a63e9168d04a52f92816e48fc11103ee3fcf3
SHA512 1b99c0ca722f6c19d443bbb4e1647ce64b587eba4ce0ee4d3f9fe29eb7f55475a1fe6c9cbd50b1f0a431ce91c0b1d78d0b42f345f0fc0bad02eb9012645769ec
SSDEEP 12288:UjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:UX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D46523D2548955B1FABC0039C6764428F5881E2DEB5619E3E3483D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 05520d808292e0b0b7ddb56517f8fb5f4c645383841e98e99242ece26832008d
MD5 50f44328d55bfa8ac1ad649ba8b74351
SHA1 310d3417411c49f128be92bb0d661b243a4e4991
SHA512 aead55e788155b368e38dc4540c0137032a96665bf600452fd4fde86efb5b50e4a3c4b7d5a28b14158abb0adaefb561506515e32a010b7f77848f1a62a6eb915
SSDEEP 24576:Efwvxk9RX6wkyAI5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lMnYI5LNiXicJFFRGNzj3
TLSH
T15795DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1a648c18a6b6587d74450d0203a284c0f2638ec108a362679dd826b9f4132530
MD5 0d42248675d01ee14af49af9ef13dcfc
SHA1 0a3ecdd532167bf960fc5870a9aec4cdc6d745c6
SHA512 9c37e627ac2bd1cd0afbcee614380e4ed5a28fe0ab92c8aadcff8a50654ecc48ece21d04b9fba43be6620bc4141a1820b55533ea55ee6b7d234e139c4aea3904
SSDEEP 49152:hYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0KLNiXicJFFRGN:sySzPi7wRGpj3
TLSH
T1F0066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 da631fe97b56f4c675e039180a2977b60f8a475d89fa651352d6c1ba092c9b1e
MD5 b5ab7b3b8d7cffd4158b4028273b6334
SHA1 f51188965dca67541392e52e0bd23cd278da08e5
SHA512 49aca991b2aedc88d261effe1424f9c5f87c75095265c96d5de8217c48f786844bd9a02181cf725f17677d28cab2aa3f309868586b9d3b953ca6f8d0d42b815f
SSDEEP 24576:M47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:M47JUQjTirIhCnDHUPfF/aLNiXicJFFS
TLSH
T1B365AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 cb9703d0c5afc0faf382c1757051cb6f254619965ba139fdac5e42f3cc51ab1e
MD5 1f45f708fc6a77a376c7ef2d3e04911a
SHA1 75a4911ac9d3cb0fa0d7758bae8062e4ff29c841
SHA512 826c878272f85ffddc3c02183b081ed2151ef5b1022e30f45ab050c73142e5da52bac387b376cfe767f67c82591749ca2d114b686370b9f05007d4e992af6ab4
SSDEEP 12288:NosfZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:VF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13875F15AD28802E8D1AE5139C7564900F3637C2987E1D3CB93C0F93E1F7AAD59EE9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1012KB
SHA256 21a9facd326cf54a3b0324a7e1dbe609f9bd4ab90abbd7e729e6f7643ac1372c
MD5 fe37e707f86304fc521b9004fcd18a4d
SHA1 588e69004936be010639526983c6998202257361
SHA512 7de607483f7740704aaae23bec85eaa9c8ba5819b41b51dcd2afcd39ba674ce321c0b6f8f1dcc2c927aaf7e8f866adb2486b1f201f8a492f005755a5a322e389
SSDEEP 12288:KUfHv+4U3fZp38qF0pyrhxKlIY/qtzhuyY+O07mZI5:KUnnUP/KMrXYIKwhuyY+bl5
TLSH
T17F253910766AD75FC6A940321E33C2CCAB707D41EE459B0372C8973FC576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 325KB
SHA256 e3ebfe3eeca814067cf8a0a775d23fd7e663bdbc6cc93cd4e9a591cc79d7152e
MD5 0975ad5dfc9fd0eefdd8eca2c3a51fc6
SHA1 71192c70a0f9e49db306662a36596522e2c5cdab
SHA512 4bd10421c012afcf9bd94f2bc8cd7dc1ebfbb106e67edb161f67e329cbd5a4d9600fc9877c09c836b05c3ba21dd35b0e546a8812d4480863e7a10fe3fc7e88af
SSDEEP 768:y9lToOlTPBlTz2+EQMl/Typ9lToOlTPBlTz2+EQM9j/Tt9lToOlTPBlTz2+EQMvb:Vhugt6ejQ
TLSH
T1FC647411B744B329C0B641B7987196ABEB3DF013CF2353433BD81A99DCB22563A7AB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 afd35513dd67e808a8c49fce6666c36bacb562b6699b2c4a4d1eb938ff9414ba
MD5 9d063ac91ed4c5de1a6086245cf41ef3
SHA1 7660c792e63ea2783524ba15634370b92fc7c32f
SHA512 3370b4efd0c085dd51a753095cd9c5ee31aa46c0cd3e74b15280d17834bdf9df21276f11a85803f19959f61195d0bb8a4e6b16b6a0a5af72f9a1ec85a377ba09
SSDEEP 12288:Vq7BiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1636523A3568859B1FAFD0039857A8434B54D7E2C9F1558E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 190c20060a76f6e8cbccc8852391899b6dad840badbd13c9f0b238f47d3eeb30
MD5 e248b8f688720c3664dc68e59277ae37
SHA1 903b5f200beef8ab9bc192cdf77a34c3ddd2eb54
SHA512 de32c48259bd487a0d20a2298d96d38741edf252b1d475974b512b84e89fe3fd38acc17760553c96a3529060486517e2b38541ddcb49be8c0a9d71aef0912036
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Mgb4mBIBhGFILNiXicJFFRGNzj3
TLSH
T1A665AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 b98b948e11ff86359cb6a853e6130a50d3b8ad79810a63faeccc8b9d6b19ab3e
MD5 3fee4d3a79b064a3dc276a04632de84e
SHA1 33abf5d278a537dc6983315a0b7025dfbb50ffa8
SHA512 dd984e9884825b0199b77d479fba2cd3dea9f1d8de047cc9de1bf4efadf46660cedb512684feead7fd9dec1d80ff12d17a8967f8ec005779f2075e2648c9824f
SSDEEP 24576:6G88u8FpJqH1+zria7/m4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:B7ZFPqV5a7/DLNiXicJFFRGNzj3
TLSH
T1E395F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 1cc20c7534b2c2d2c28c478faf3056bfa5be386d7b36dc3a1bf8471f0d8227d6
MD5 e79d54db48a64a5e2dbb6240d8061de1
SHA1 181f206d38f914c31f9f11a9fdeffff3138e51d7
SHA512 3c0f078146dea74f66b0b983a8a329110ecb9302bdb16a0ea4cdeb6ef5794c5b8b8657e3c5568f83d7c860d472fda1d528410c46faa80fa9a521fd2f95426061
SSDEEP 24576:7PUr+NQ0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7JQ0LNiXicJFFRGNzj3
TLSH
T19A75F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1a6bc9f5c25f2e446890bcc84d4342491f76fa6a48c9edaac0157ef40b61f5f2
MD5 756296a69169a38da609df3eebd63f7d
SHA1 bd976b80a7c4302b20d105a854e6cbc6cacd4f63
SHA512 314a7ee6bd207dc5d96b32be7a62fe4310d3aa8f9d512724ab38c214adcf8df2b32ed4790c8b4a9db69f027d0147a078bf8b21831fb083f91e9519cf154087fb
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkLNiXicJFFRGNzj3:RG05lO43bB7wRGpj3
TLSH
T186D5C06E62EC11F9D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 36e0b5328796b5eb413d1708c8b7b8e89363f7e36b76a27a81006355785591d6
MD5 64abe0eb384c2cab8f7c3e7033bb36da
SHA1 4a615bff2d2f39ccec7ae8445cf8ecf950673728
SHA512 5bf17b4e2be757474bd75fb904b9574eeca9b67fd0b79bde01b65e9821e97ad6f8f29f5b29b364bd7a3a78eec99203ac60297b18b96832db5adca774d9de7c41
SSDEEP 24576:nfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnK/TwSfVcYG3K/cJHlnFR+IGNe8jg:fa5POZ3BJt2pasx2+mcLNiXicJFFRGNf
TLSH
T19A65BF5EA2FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 96adfa8921db967736648e9c92e2633a5e809712da244283abaff6015ad21b93
MD5 ac5e61c6bec37165632eed7cab0f6591
SHA1 17068bac6d01a7314826c70b0b2698a5faa213b8
SHA512 85bc21749619ce6b5364137e23d27cb2a541e822928972f37c3e0516585e3af9cde5b2ba5a993aee8563efe7df3dc9a586e5cd4cf00979a45b14c46538ee6eb7
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tNc/zEOVHFjLNiXicJFFRGNzj3
TLSH
T191858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4f25c22ae549403a9b0283a579d1c7f2eb0db2f2aa432fcd3ebf378329b05adf
MD5 3330e619866fd1547b9553b6e91c8b70
SHA1 e1027ebb861ba6a676552a5fd97b474791d8c32b
SHA512 7cfb44f8d1ce4d961b1ee7a4cc778312549134716ecc8a6525dd194e745554283795e13e6329f58aa34a08212f59185650541d8f9e0fa4acfa4442ae835d508c
SSDEEP 24576:STkNvNnaFeYhJNtmZBmQL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:STMwBtOmQLLNiXicJFFRGNzj3
TLSH
T15F55AF6EB6A846E4D1FEC675CD238512F6727861073292CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 1e69fc2e6a55074e438022c3db48eef48175ece26e12316e2fede620bd83529f
MD5 b9cb8250bb859cde5aa558c6b08563e3
SHA1 203531a9064af7a3a8bd3db1dfcdf76d9582bfef
SHA512 f086812ef3ecf9483a44927d244ae37b30ca58858c5a887abdcf72951352a3acde20434eae685c71f54ec7e7c09173b4498228f23fe54b9ffded8b43519206cf
SSDEEP 24576:VD3FHshBIYQgAR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VDVHeBIAARLNiXicJFFRGNzj3
TLSH
T11385E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/764-29-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/764-1-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/764-26-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/764-0-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/764-9-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/1112-71-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1112-311-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/1112-69-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/1112-77-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2164-135-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2164-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2164-129-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2164-138-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2164-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2784-92-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2784-348-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2784-98-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2784-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2784-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2784-349-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3616-296-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/3616-65-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3616-59-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3616-58-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/4088-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4088-145-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4088-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4088-48-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4088-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4148-22-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4148-122-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4148-21-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4148-16-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4148-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4892-123-0x0000000140000000-0x000000014020F000-memory.dmp

Download

memory/4892-124-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4892-116-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4892-315-0x0000000140000000-0x000000014020F000-memory.dmp

Download

memory/5296-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5296-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5296-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5296-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5408-42-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5408-57-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/5408-55-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5408-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5408-40-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/5704-312-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/5704-87-0x0000000000A70000-0x0000000000AD6000-memory.dmp

Download

memory/5704-81-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/5704-83-0x0000000000A70000-0x0000000000AD6000-memory.dmp

Download

memory/6052-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6052-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6052-110-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/6052-104-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/6052-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6052-316-0x00000000007F0000-0x0000000000850000-memory.dmp

Download