96ec321d61961fce2d5106ee1d69cbd5d9cb6e6f29a583eb9b2137e810a90e8f

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_fb24b10d268d21e5e41ddc5d3f5b0c0e_icedid_luca-stealer_njrat_stealc.exe
Size 1.7MB
Sample260805-hfgkjsfa66
SHA256 96ec321d61961fce2d5106ee1d69cbd5d9cb6e6f29a583eb9b2137e810a90e8f
MD5 fb24b10d268d21e5e41ddc5d3f5b0c0e
SHA1 cad0701813873c038653da6c33e64b379a7d2745
SHA512 552f4b9143cce960ce5d933e6e678ed76029c375ae15a1f7978fcd3d4519f91e49fca08a2bcc384d88989f6d7e4aa012007e443e6f16aa34c2424f587f447640
SSDEEP 24576:vSmK+DsAIBx+r4pnQ/tbw/2Mkjy6Fr7g0on:vWxvQ/lFTjN4
TLSH
T10885DF5AA7E803B9E0B39674CD924902FB777C4957B19A8F03D445B71F372608E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
2008	elevation_service.exe
2360	maintenanceservice.exe
3116	OSE.EXE
5076	PerceptionSimulationService.exe
3984	perfhost.exe
2004	ReFsDedupSvc.exe
3972	SensorDataService.exe
3340	ssh-agent.exe
5532	AgentService.exe
4272	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-05_fb24b10d268d21e5e41ddc5d3f5b0c0e_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8ef8b41de62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-05_fb24b10d268d21e5e41ddc5d3f5b0c0e_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-08-05_fb24b10d268d21e5e41ddc5d3f5b0c0e_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-05_fb24b10d268d21e5e41ddc5d3f5b0c0e_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	OSE.EXE
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	OSE.EXE
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	OSE.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-05_fb24b10d268d21e5e41ddc5d3f5b0c0e_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c274b69a524dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f7333aca524dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042fa016ca524dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dee672aca524dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2008	elevation_service.exe
2008	elevation_service.exe
2008	elevation_service.exe
2008	elevation_service.exe
2008	elevation_service.exe
2008	elevation_service.exe
2008	elevation_service.exe
3116	OSE.EXE
3116	OSE.EXE
3116	OSE.EXE
3116	OSE.EXE
3116	OSE.EXE
3116	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2440	2026-08-05_fb24b10d268d21e5e41ddc5d3f5b0c0e_icedid_luca-stealer_njrat_stealc.exe
Token: SeTakeOwnershipPrivilege	2008	elevation_service.exe
Token: SeBackupPrivilege	2004	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2004	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2004	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2004	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2004	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2004	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2004	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2004	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2004	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2004	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5532	AgentService.exe
Token: 33	4272	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4272	SearchIndexer.exe
Token: SeDebugPrivilege	2008	elevation_service.exe
Token: SeDebugPrivilege	3116	OSE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 4436	4272	SearchIndexer.exe	100
PID 4272 wrote to memory of 4880	4272	SearchIndexer.exe	101
PID 4272 wrote to memory of 1356	4272	SearchIndexer.exe	102
PID 4272 wrote to memory of 4776	4272	SearchIndexer.exe	103
PID 4272 wrote to memory of 5176	4272	SearchIndexer.exe	105
PID 4272 wrote to memory of 4560	4272	SearchIndexer.exe	106
PID 4272 wrote to memory of 3700	4272	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-05_fb24b10d268d21e5e41ddc5d3f5b0c0e_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_fb24b10d268d21e5e41ddc5d3f5b0c0e_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2008

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2360

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3116

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5076

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3984

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2004

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3972

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3340

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5532

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4436
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4880
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2808 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1356
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4776
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5176
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4560
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2808 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9d7e55443e54f117861fa601acb098d81912e4453bc4112aba4dae0f08c9d1c3
MD5 f34b24a8401ec87daf19794e02e29cb1
SHA1 1ca54ba2b7863ca1901232ff72f1372462e73236
SHA512 173d16c1942d79d9b81199e6762da5caaf70680eae261e3b80856a00ee08abd4a6fd0c66c7b4ba9823337ccdb991645683f8da98b6a0a206fff140a4be43b6ad
SSDEEP 49152:lb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnLQ/lFTjN4r:73q6HjBHLm
TLSH
T11BD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 404aed6989d308c1353b9925c5b3a52bb71b76541ab2333f78de1fbcf7ca173c
MD5 613f77ff8d14b37212c9d7f6a6c84857
SHA1 0b17cab5483fdb6b2e8804fb68095e9c00e2ffe1
SHA512 2494c8b4d142536534108e9665652e38665831e874b51cf1a42cd6d36c7a8adc9fc834a4dcbb8d169bd8cf4aeb7278e13c22b0d0fb2d1134e92757734f761cdb
SSDEEP 12288:r1XLsswWkxy2lRq2czALGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:RXYfDtczA7nQ/tbw/2Mkjy6Fr7g0oh
TLSH
T18265F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 6877eb4d94728e3ded1bbc765a626703e04547604de3b7b85bfa6a7528cd6de8
MD5 1fb84ca344a037563f21414ada9aa739
SHA1 832c73dfbfe16c8d5df18af5badbfb044b6f3ebb
SHA512 ebf171473c63a4b8c89b69b10335453581584d9ca96d5aa8a288d889fc3ba4e7c9c75e28380e57c479d9b484ead77e017a60b6027783b91b8291b0678641ea69
SSDEEP 24576:i0Le5ji0hmxLrMAnQ/tbw/2Mkjy6Fr7g0oV:iPji0Al9Q/lFTjN4
TLSH
T1E4859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c61c6e01b0931a75382ea201b816bce999ebc81047cacc5bf01e9e9029c74524
MD5 5a4b50e5a951652811d71336dd55a9ef
SHA1 eb1ca5796740dcc233f149bb340c963d3c9b3e32
SHA512 92542209b0547e30e9a26f335a18314e693aba836b66d657cd953a9abccda0bf3f0ab7126ccc4c3d19fd5457d7a4ddd6111b0646163c0eed2b27528723f144b1
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWE6q8wyuunQ/tbw/2Mkjy6Fr7g0oo:W/ezSC6vUzPvxHjyRQ/lFTjN4
TLSH
T175755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a2da62235c363c1145857da4c2d7fc7fa0ebdad782d6e5772a0614ab79718883
MD5 6e54772a556a97ac86b87501364e7aaa
SHA1 03ac953d311775cb10eda2862709950d6dc4a844
SHA512 d1e022f118d238adcbceabb242ecbdbca12258b9c24a547e29273e6058d0a8eb002ff89dfd3a5a7cbe937957f2b1e17a160233aa156d39ef3e8ef59407b75351
SSDEEP 24576:pVbqPb88hv/l+63nQ/tbw/2Mkjy6Fr7g0o7:pVO88hXl+kQ/lFTjN4
TLSH
T1A9559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a47922554b514a2fed25babe4f81c1f0117c8ac09f83bc9013570b4932de4759
MD5 bb08127050c9bc1f31257b3901714286
SHA1 292615d3f7a6e15e3b2bab52f909a98e26954529
SHA512 a9af14fc97933020cb7b58a87b1244151634504e8d4cb5adef6eb7b4dea8754966b357e22335c575289dccaef2c87388381f8dcc58debefa5f392e27ee898ea9
SSDEEP 12288:Xz8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:Xz8nQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1E75523796A24F897FF2B06B15C8284826B7B0EC1BFD5E74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 02f8b032ab9beca103c5ef38ce481ab3392caa573e60899fd72c9877dd0bf38c
MD5 af167882cc7337d345bc0090566afa3c
SHA1 4a7198ad1d6b4d67347310e5195534bceb8e9b77
SHA512 b917e8c0bf15b917cbc2314086e9670581033f725d0b58412aca6c17a29f48bc66f0d305197fb2c241ae65c28a583025b75bc194d781efb4c9c649a7a4c85e7f
SSDEEP 12288:XeBNUbTVO86UfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:XJIU/nQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1D575CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ae8bcbebfe88ea4fb0f39eb58c20f74dc03522da494d4eb05190fedc2ebb58e2
MD5 51e2aa36bf4026e8250367b640bdb8d9
SHA1 e1de6ff0bf7153ba8baa1be6097c3b50a3d5be10
SHA512 23e24f8e9651e43b425814e0684c60c705067a4d75a675bab93570a4c115b97a9b4635b70ad5f065424aed4a4ecb97513b51e00703b334ef57dbd486388bf295
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH/:IQvGAdlCEL8c/yRNw5C5Lm
TLSH
T1A4267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 fa3d5772f4a7874eec4f23b7348679491d3338c062fd9f99bd33a1c15156fab2
MD5 d24fb834e3ab3bb7c7103d22a7d579dc
SHA1 9ebf382abe3c46b9cebd3c7e6faa589542a5a76d
SHA512 28184919a157bc12bc8a784fccffa5ac97bd67c88c8bcc6d73531ed4c7dee5d40d9b057f91c911b4d38b8b21428e96001617522c7ce9b256868f73d26794a630
SSDEEP 12288:PAwSfxL/2Dc39DLLmt0LDQewsAjNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgg:YQewsAjtnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1A375E031FE74E436C77F0DB21B26C706183D6A604FA11AC3E3A84A9D59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1b7ae2541ffd3daf35579f85386bfe2a3fde102068993f4d6b90d788dff216ce
MD5 19cffe82286babcb2ff8f8f8722a1a6d
SHA1 7694da12c98057e19cf81a5f9bd2bdeedd12f6f5
SHA512 1fa30e7f47116c9a27ab7b243a68c836bb16cb87e4ae4b508e8befc5590b7636b4ea7143ae13db8f20a20b029497ae7c8ef3231fbb7a549baeb2afad58fb0c5c
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHqL:qUEtQevvqc2W1cpV2EI32
TLSH
T11D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 45d8d4ecda751230207ce1ca98475c789cca117efb858b547c6b7e1763f685c8
MD5 25d87020bcc75227de1017735577175d
SHA1 0d9ef9a63eb7141c4a53e304642d200d25e6e3fe
SHA512 6d255d86db8573cd88c3ae450d061b629e6462a340025ecf0eb857b731af5c36172917d3f887e0155d5b69981352223ad3035e467b575dea42a5ae9383269bad
SSDEEP 49152:pCbRquA/m2yL5zQfFiV+XenmE3/zNQ/lFTjN4:moqtVjnm9Lm
TLSH
T18CD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8f60c74dafa3bb0ab33c912e22755eb7e3276a449bc6ac29dda39957442d31ea
MD5 7fc4a159710bffcf666b948cc518b542
SHA1 63f67f339062e47599324e082d6cf12cb15c42dc
SHA512 6eebadb3490c9976f60d417ebf6daa31bfcb3b063d470854da18801f06f1a72ebc44e6d67fbb88d59dd0b19e38d6fc765af4f15d2003c26135cfc113f51e91b5
SSDEEP 24576:5AhGLJIFoiwtA5l7S53SnQ/tbw/2Mkjy6Fr7g0oa:5AMyFoiq5iQ/lFTjN4
TLSH
T18C35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 7b67b2fc32d78d9f08df9a0150857b44b7c1a8659646519980a8faee0c149d42
MD5 1be3ad00783d20ddf0b722bb68c880fa
SHA1 bd340a8190e7c0f3d511b7243cd6474050ce86d2
SHA512 2f52993dad3b4bc90c52f9c9079ba2e74f6b92202ada26781f880cbe56c3ba6838dc41245013881807f52efdd1d1ef9e1a78e3a2551b732c221dc5d12211bdbb
SSDEEP 12288:Xmw5HEjsChN2BFgl0WDm+COGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMY:2wuHOWxnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T11265F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5754969171e49da801cdd0bcea27281dda26fc6032f35cc9db1917baf5051370
MD5 8929427b07b50b2e67da95375f202dac
SHA1 e2f7c15a8bf061e4fde6eb47938935782e58b5d2
SHA512 8b7af1ef73a006286b7db0b3b6260de149b6e7e1d076977ccf10c6bb186663c75510169c66d38def5c100af3236db4ec5f17b18e1998430d21d1befc7d264acd
SSDEEP 12288:JXZ1Iy9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:RZuInQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1E855126933A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ff4a957100cb97fead33e8c1beae60c6bbba62c303f9ece4f61632e41fd64e7a
MD5 caaa7907ce0841a197fc1293d4cdd05c
SHA1 0aa569327fa4422b3499fa98e985afc3940719f9
SHA512 7ed51f85888ead0111a1a48b9f39488031ab6ae99be456aefb143e3c5b7ab7f69e743f4c5789a63544574ebb78a77440d8e824e742e5ebf4d351f258a0897010
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uz:vQRQyi36YOcPQLvw2gAf+PN3ILm
TLSH
T14E666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 59a1ce5e6c2e7486e388b1081073d8549d4ffc0637496bad878aeb7561714cd9
MD5 6a9928d23d52e0d5b3ccd530d119c949
SHA1 31159850866c8ee6c01dd648b337a33d59c8235e
SHA512 be82431476f852947ac0b9a761b252632bfeab48ef46b3975afcbf2268590fbc23c2bc3877dfe74ed0d534e97bc9ae74ecb7d58010a9870df63d17d92ffd6aad
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uz:2QRQyi36YOcPQLvw2gAf+PN3ILm
TLSH
T1E0666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8d5d04b661a5e3b1bc3bfd289bb7c56a5d3615246de9eebe99138b8b32ab952c
MD5 747d7725044f208c168413e678b10b0f
SHA1 dd2b154fc25f0084a16ff2bee3788e6665cec74b
SHA512 629715e7e26e0910341d7e866ea5a243bf15f8b949faeced375c6690f5db17500c14ed1f4bae5c820ab884ef1959e92c22761c928c9032165d26835285ebe7a2
SSDEEP 24576:TwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0YnQ/tbw/2Mkjy6T:r68Qg55nhheWu7PNU3/9Q/lFTjN4
TLSH
T11EB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a85af7857fbda735e1d37339f16c97c65d1890bfc6e0c510742a7022c456d2eb
MD5 2e8c57ec601346cfa5167ac1dc7deeda
SHA1 c815adef8727bc4b736a5648106fae238cd97ecc
SHA512 1af25e02e8f2bba969b2586e901779ad465308fc746649a3987e267ed5698137d3448dcd1a06bfe33009a1b20b3a7d3ec8932aaf66af819a8382f51f9c78a6a8
SSDEEP 49152:g3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99d:Ny5112gYy5azzVvL69nLKnhZfLm
TLSH
T145167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3b58aaacc62d246b6444189d899c0ee7a40828c11ddf3f2212a0a37778f57e0d
MD5 2b3007e510e533a0f0d951a3af0d0abc
SHA1 8d38e8eab6a0ad33d3870fc114fbe0581c2cdec9
SHA512 4e1f07968ffed5d258df0ae0f3ec233e0a9770868d1cf3beac7dbcef5d92f6f65bfe43f5c6e4254d40dac39d9126f7671c71f80db1e171d4c5e555bacf12e5e4
SSDEEP 49152:y1hpsNoJpF1A6UU44CwH7R4xfQ/lFTjN4:ymifPbR9Lm
TLSH
T1A6B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a5fa99784043116113c3c1090dc6468621ed27def968454b5820fe1685744193
MD5 5072f61f309c68a942991b308ed6aaf3
SHA1 5401f92f88ffddf45fa7d0c86a641a1a03c4c773
SHA512 2f821777e2edeb98ae42d360783635b3a8df04ba6224862e237c15cdea93fdcda51a8a8081dce5d5b45d55141601f32e55eb6b8703d5e234e3b9c8ef4bd9a7fa
SSDEEP 49152:ESuZQIY0Be2KRRVtOnks6NMHqIQ/lFTjN4:W5dKTi61rLm
TLSH
T122C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a5fc3b081e850fb292f6fda40b965833171c9fc797fbaa0ac2549411cd05f0f2
MD5 c70361201eaf1954f3ad968ed33e94b9
SHA1 3208a6339b9c1db6b2a17f832af1465ec8ce1414
SHA512 d8f32b9469630c293c67853f4636635a3dc9142e825d8f5d47be9b1eb8aa93cf8d65458e0049a8f09bfd4f83a8ca20ee4d6f3aa59824085b53cd0e20a6ec18d3
SSDEEP 49152:qhtSn8EApI0figngiDn0AP5w7Q/lFTjN4:LX2iyphhLm
TLSH
T10795BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1615a7dbad4b667ad3cc806dc7148c03051b60d848b3051f38258f36719ff8a6
MD5 ba76e86cd285ec7a8fa6af084f29bf2a
SHA1 48302f1545d0f14ebd63bb7d5cb08ef71cdfac04
SHA512 c0da6e7a6de550d9054603d11e8f22235ecca09b7c225179ff689f22af1f5df463706bb82f3b89ba4ce45faa2df653cce1c649898e390447ef4e39ca9375f502
SSDEEP 12288:4EGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:4knQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1995523697964F98BFB1706F18C828182A77F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 3b9f34c6bb0e949c57d6ac0cf904120ed3f62b0a5687c1dff8c63d3746179352
MD5 79fba6db3d887784012fe5d417be4cf9
SHA1 b2a5edd30b55f9d3356aec397804ec1e896580c5
SHA512 4b445d6675e97c8afcb0645532f895bb459fdc723c411268c2637218218a6fbb1d9c61aa83d5a0acbe910d6d5c29330fe6bd7a0afc9fde79e1479f56a1fcac60
SSDEEP 12288:5ZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:5pnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1A75523797965F98BFA1706F18C828182973B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 0c7596a87c27ef5d0e36aaeecafbd25626e2773292be353f419c25e2d3df43e9
MD5 dc029feace730d80dda9d1ea4cfed806
SHA1 2c21755da62aaeb7bf526da11fb8d253a1fe2fde
SHA512 a8e97a5f046e608a4950f8d59be39d19d8f5b001a7863dcd7810405b643461ff9a3bb9a03f0421e75227867d943ae4e6386f52e2c1b8ae96e1b02cfaa7dccb33
SSDEEP 12288:gnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:gHnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1E15523697965F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 0a6bd2114f62688fdeea251109a4d3d2291ecbb44a6fd9401fc194d9fa229a98
MD5 104ada2ad63d770e033735f101eb0254
SHA1 6e02e829aa92ee25e813e89dfb775d6c94268ef8
SHA512 d1851c96d0d164abd0b43f031f3f0a0c6ed27f590c73cc9f9206043fe4e7fe0d45f1d792dd1340443f5b969ba2382240ca59d354d9ffe03f8323e53692284f28
SSDEEP 12288:7VyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:onQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1D45523693A69F4C7F92742B4CC938142E77B3DC5BBA1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f826412fcae78372c5589d43b822e712fab059e0289b08883b98986574864701
MD5 1b32914e38163ad22df4145a713e0b9b
SHA1 bf064fb639613ec77574b9dd29673815c76c7eaf
SHA512 9808b919ca15d4d312ff24be0b5f84ebc7263224021cde781f5c2233a4ff3fd612474f5cd26a28d52581beab3e3c8a7894d0adae0e3b74e29dac87f1c37c98c2
SSDEEP 12288:lKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:lKnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1825523697965F98BFA1706F14C8381829B7B0EC6BFD1938F77482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 51b0447d47aea493eb75618d06ab1c37dfdf563e34754e855ecc749dd94a0a4c
MD5 2c8d19ef2d0d8a7156e1f408ca0eb628
SHA1 e2997dd6ba1825bbf7561f71024f111f919aff15
SHA512 7a16e82d21203580f7cd098a43492dd9e73c74696df8044e6358e1ddfee7c1799985588867981241c67abafa8306cf8e62d93f60b0cec8fbf31de5a2979d8a79
SSDEEP 12288:DVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:D1nQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1135523697965F98BFB2706F14C828182973F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c3f628d7145e9761bcb2cc0e44ed2987d153faeae4c51f7e7ffcf6b67e892b8e
MD5 02daf54b946ae50f7b09663d6cb86d6d
SHA1 365178628a49c47e6956991d03721f42492728e4
SHA512 995b1f8a01e7aeaf82a120759598d7c99d8b72b07245b0fd8cf2edbb5f143bd149c329506ed911aa8093c8c8c3f4c1e224e7de7392b1f1a73fdb61f7cf0582c9
SSDEEP 12288:HxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:HBnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1A85523797965F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 c64d833516d4211c933de203556ac39346400966431535608742e99b4707150b
MD5 ffc26d6ec38fef9e756052de05e9038a
SHA1 8e9c9db30a594cadd5a2f98821c29fd4dbede712
SHA512 0a89a626b76f3a5fb67ad9b19d53f6e2558b62ac2b95427dd8b80c1422cf76239faecfc8f1884fc2c4b2423c277e7928a819ee18bc28406a97bebd379cc79f9d
SSDEEP 12288:YiZwbDzzFEoS2cPvy5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:bZM3zFVSOJnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1AD7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0e0d0c1b81782d3852406132769e05e026907f5502f66e2f55a9fa2a85de5184
MD5 eb4d1b6ae095a24d72a9108bc0b56066
SHA1 9e0b916d59e43f39065e6a8e72710e40c4967172
SHA512 0c15f218f84b3681930136aea1bbae749f813f2f573518a322751efafeae72661cb4361b2579d441dfab2d8fd1a56e805bbe9c6f96bea133f66e1727cef9dee5
SSDEEP 12288:44GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:44nQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1995523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 749c7ab8cd2fc01fd73e19b7611923b21493b577df306960874c073f2ce4d30f
MD5 53796fc7f95820c4e147ff6662f57990
SHA1 8e48f89ad39819f8a131c4dfb59b3e0f2e7b3353
SHA512 fae04f01583f79ceed80d5118f50919b21e4f8259e8865285de959b3b1247ee4f03543003204aa2b7a304b713c7dc7048533cd593d17fb04319befabc13b19cd
SSDEEP 12288:3sGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:3snQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1BB5523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 582d59b1ca723c2d338e53e722c018ab857300b7a6eaba197b4f9bd5ccd0ab02
MD5 226b143aab0ef0530f668291adec6c6c
SHA1 b1a59dd758c05d00c7d86c087418b656661e060e
SHA512 672ad2f9a0fef49d9a8e1bce38a8fb3515a533f1f5925f44cb4e6009045ef683cdab92951dbb5f368fc65f6ce88b7b0aa6dae83afc1266746e53be819e7a1624
SSDEEP 12288:OyPz5L89GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:TzydnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1D865021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 394f6bfacdb7fe49c52ef9694cd0468d2069fd5d6e815c4a673b8214fb1a63ff
MD5 435196d759f05e8a7f9936cccea5d53d
SHA1 850a1b8398bf046a4002999671bed3ae40b3b01c
SHA512 8c934aa9695b4949113e60f2ad42aab8e33e14ef8c916dfe583bcb36d0895baba2eb12db80ada1f018e7a7505ce0ebd9aa30eb42411d617581a236f59f961f55
SSDEEP 12288:Y4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:Y4nQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1895523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 fdd25ac60e37944ca46dbe55050ebfdbb51c6468304568b09718118f416e9a8e
MD5 f27ec5b562e57c744be2662b24a213fc
SHA1 a75a47e6f2595fd3c1a28826a6d18994c9dcca12
SHA512 cd3df6401d9a6c5907cb55a9135b2448a69347501536a9aa0edf351fc2fd7aea0fa2d578f1218a5c7fd5763d98ff09252191b16a85d611b641159ce4b81f4faa
SSDEEP 12288:M4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:M4nQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1A95523697964F98BFB1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 0c9046455b97392e2917836f0f94306deef3db010e6e238315460055db9994a4
MD5 9f9057315ba70cb2c5c2b67e432dde4c
SHA1 fd019db0292fafc2782db3a66bbbf5c7e17a33c8
SHA512 813259d04931b02a8a61a654493f1a3edef2a6a88f08ae1f7bdcfc205bff5dbf69fad3b7b7d9a1813a2ea912f0d794a062c01641cec6ab0d7db3eae74247d5af
SSDEEP 12288:byPz5L89GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:WzydnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T16665021773A570FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 dc1fb698b3a83e77c31a25f9358c3ae4d4d63dfc32e0bcef98f52d23ea52d886
MD5 4a85632af0c3a229b323453754c19173
SHA1 44c90abf7f709bd9aff8febce48fe4b0b0371aba
SHA512 13de3e83c6ac844f6ba4d4e459ca3bc262c1a660466d1c2a8bc7e02d87f8382fd35df6be836d3cd5dafde6f64304e10eabeca20ca2d3efa218a7debe1ca1dc61
SSDEEP 24576:ZT0aLl3z0zDXnQ/tbw/2Mkjy6Fr7g0ob:ZTDLljuQ/lFTjN4
TLSH
T1287501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 87b21663d0ac9cbc0615ffd4852eca1fc2c4036ae5a31b1283398a6e3c9fb2d9
MD5 1b8cbb3e5ce155f20737e4663c9f5cba
SHA1 1d1a357a450b51a8443d09dd3e04d42b32accad9
SHA512 4566ac1d5502c7e852b0e46455f68ff2298989ed71d15269769713f9d1d6388241c76994a50fbce6bb7f74c5548cf7a1e55d077b34a16932c633d4944b7e787d
SSDEEP 24576:N31d9CHKy7GZDnQ/tbw/2Mkjy6Fr7g0os:t1d9CHKyalQ/lFTjN4
TLSH
T11285CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 494f06383458899c0f9f4411efe8947a53033520ad81ae02bbdc0cc5b37e12b8
MD5 58be7dd4d9c3c5ba6d8e56de60f9db83
SHA1 8a56141ac3a8b90370095d42593143c3abba9c22
SHA512 31c90fa915cd2b99cae64b15d069b48639bac4cd0d86fc1261b53a258888edaefd5386c60cec8dec34e589b6e5ad50c61b6229cd3c0f831d697bb329f83545df
SSDEEP 12288:HHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:HnnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T16E5523697965F98BFA1706F18C838182973B0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 34dad7f17f777d892adbc213f95ca1da7df9e34177fe16aba4191bdea594d829
MD5 2a15e5497e6fcb68ad68607cfa43d198
SHA1 7e9ebba7637c6291b007201b6e82aeec18a54c44
SHA512 c58d5f3bf123ea99e1a89264d58bf836bcc4f5a011249ebd2bac273aca1add6002a897fcd6b811bea0d641e7145d246ba77436f2b918a7cc9917d1d9fa93c6f4
SSDEEP 12288:MdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:M9nQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1CA5523787964F99BFA2B06F14C8381829B3B0EC6BFD1938F7B481129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 cb791129b54daf1b4fd25320ce4203cc3693c43ee2433ce7793434959261d320
MD5 aef833151a4b59b05e6957d6026aee42
SHA1 637978074da1a52279b16519c429f28959481199
SHA512 11344cdbc9c8179c8219f5b2f0207b2b5ff8be6ca3a827ca21bd5d0de31659bbfbe4f6c65731168f63409f8f185e07e66afaa3ce65d2e6375871eeaf13257e9c
SSDEEP 12288:CmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:CGnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1335523797925F98BFA1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 41d137a0bb9a263c6c1ed6f22d56cc72c2cd65a4e0af2d5280db75f151afa1a4
MD5 e83a83f756febfb527c27e7364c1bb15
SHA1 a4d58cd2cd1fcac0bcbf6bd47c66ad87ab7f7065
SHA512 b6765344b686c65f34bc39e11c178079b2b265169ad44c3f254d8826bc70532b23eb102a2ed8740e18c0f31129248552e8f614598149c3febd3269e0e9bee78e
SSDEEP 12288:24GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:24nQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1295523697925F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 9a707868b8bc31dfd8f95aaf05abfd293b820f9959b9ace6820702347dbbb075
MD5 e4c98ab296ba838815e823bbaddedddf
SHA1 c535bf5bfc3cf107dc60e9e7b5482fdf8e505f1c
SHA512 0e76097e25cb7dd7ffc4d80924605ca333e0a3a7bd830f1362eacfbaf383ab0c299293bd82aebe6e08c7a1ec2817592641ad0b7a9d699a16b4081fdfa7ddfffc
SSDEEP 12288:sHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:snnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1FD5523697925F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 460afb9d7c59c5ddea855f7ba21e21898a90c66223c59deae1c390107442d997
MD5 bf6f808cb9c10652278ddb4220515ee5
SHA1 5444a6b785229d196a9ab92754e8c7bfb82f4b2e
SHA512 69c2501b4946f5e44e0113e31b04a00dd56e45df70cae6f3617395918aa5cab8a55fbf0bb401075b6cb731f3972ab0007d7c52c57bc8dfdb3e08e91007e45584
SSDEEP 12288:swGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:sQnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1975523797964F98BFB1706F14C8281829B7F0EC6BFD2938F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c68fc3da0a68bbcaa496b83c38d408640580c572f2eb200c937062963f26def3
MD5 520ea8e2009f104a316c84bedb12c884
SHA1 5730bd897ca8fc3435bf256d080eebc53631a008
SHA512 e32c288dd3bc5df1905267f90348a74295a19e8ee70903a0b66a164802f8079ba309abc3936a517875672f6a761eb1d48e562f30bb5191f604b322a4daed861c
SSDEEP 12288:uKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:uKnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1725523697965F98BFA1706F14C8381829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 438931fe444b5e2502fef7a6df63e9afa2fe1fac6686adb9205d41db44d53ab7
MD5 de46b9eb10368ab982345e23b1dcc4f6
SHA1 8c57b35fb142ff5d825e16bd1cd999ce233891ca
SHA512 9c9c3f6faf567d35986d0d6971154aa77f48ed12d6b41171d06ceba64ab0165470cbc0f56f0633f5df2edb1be527bd193c23474ef87d84889fff3cc34dbe90a8
SSDEEP 12288:KPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:KvnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1F75523797964F98BFB1706F14C8281829B7F0EC6BFD2A38F7B481119967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 d0f8755d722f29eb0540a77a09b374d3d07d657d3ee771bb6a79e41beb8a37e8
MD5 9daaa861f61a36794a9753ca8e0c518b
SHA1 b92f8a8b4aa7a2b9cd574bf68f0a6087965a3e0a
SHA512 4bda90531bbd3915d8837fe3e04d76409ba64ce018e77d5d6914aa7ed8474b43520cdfa58dd197ccf1b66d74480215922460465423c45ffc38bcbb5ebbe76f64
SSDEEP 24576:Jfwv/k9RX6wkyAIcnQ/tbw/2Mkjy6Fr7g0o5:4MnYIcQ/lFTjN4
TLSH
T18285DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8040cd7e8f27e425aa06435060393cf414c3ed4f0005f9b4bf40742959ec8239
MD5 87739ed732e3b38fe5e94f7e6cdf0059
SHA1 0bdf14a0d8a0819bfacf1e2e57f635a7114437cf
SHA512 376f5a5e3e55728cb497fb1fcbae76a80698add78d598f8da6bbf6426350a60701af1940886d5668ddef4c1f97c099d949239303e88b77bacb1d7699acb5a8f3
SSDEEP 49152:cYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0bQ/lFTjN4:CySzPoLm
TLSH
T19E066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 134ffb237d7fd7bca426cb36a2133e104e28e138dd286bc5842799b0dfe35b67
MD5 5ac5ed4a6c6ee7a1a016852cb0a9e495
SHA1 8abf365cf6c68686ffebd79318b29fbab166cbd2
SHA512 8ec6d3f4be537728f300eba06641d6d9fdd22398992cbf9d9902dcefc2dd3a4b6a88d9e6b1663805b408ba98805339a9716864fed8f9702ae1baa3ebe2b170f2
SSDEEP 24576:l47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY5nQ/tbw/2Mkjy6Fr7g0o6:l47JUQj1irIhCnDHUPfF/LQ/lFTjN4
TLSH
T11665AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 1765706dee1e675d79fc3a69d1398c41b88ddecca0bfeed0af674f9f83697675
MD5 600edbda72e8d6d1b481e1114c21a9c0
SHA1 d6d6646212bc67d05fe8842a3ca5bf08758e5a35
SHA512 33f1492f0a176403ecbfea15555c726c6f936d50e8ae0bc7f2a18a86d6ff91867c5d7a5d828578149c3dd64d19856fca73fa2710beec47ed19fcac9a1eba8b30
SSDEEP 12288:TssfIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:/InQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1F265F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 1cdf4e2ea8da13deb90ed02118cdbb323012d6a33b92e428a8f960b791c3c4b5
MD5 ca25d3412f9e5e49a6ec301e04928386
SHA1 aa1537f0e0f9a04beba037fe7ac0724d07327339
SHA512 3b3c85314d71bde451d76e16b3147a8ee74cdf5bc8e1646e354eef7fd784362b91eaf3f1f235900ac4d7aa70a73752ee2808292f9aab65769735f0ea9c87d128
SSDEEP 24576:t+XuUPE0SzlSHRaSahL2CYfhygPncLeRtMb8gz:+uUc0SzMRaSahL2qgPnQwtMIg
TLSH
T194452741762AD68BC6A940321E36D6CCA7707D01FE05AF0773C9873FD476668BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 a7b9fe738e5c1f51da483da2222aa9d0ef8067b7a112d449fc9d927ac3447067
MD5 e2a1acb5fa34208f0b53e937d4e7f10f
SHA1 ee1011843cc75cf7c15070daf7ec7c9f78ddc677
SHA512 301e64b91e9a0bd31532eabb427138ba18a20582d9cb34f11ab4ed1aea58a8aaa2ccb291d6e13cfadac89033794784f488aa6831dc5382315d860a8ca6c2752b
SSDEEP 12288:K1EUQaaLprC9gAETe8rjjX0zfJFJN8fNmHYPV0xeinrv:K1h172zKsvKN6NmHYNWeinrv
TLSH
T107451B41A5A7E35FC9FE90370732868DBBB49C03B7452B0573444A3C9877A7EB5E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 dc456f625b8bb8f466d968aa2ed203a908bc96776d09c7ab60b5ab5a427648ba
MD5 939d07c980aa7cef50841ca8a79f63bc
SHA1 f34dd729dd9b485b73d437572f8cff2332ec282d
SHA512 3ca90989fce266de75837e289325ec278cf4e7cb892bcbef0c3669ce50bac6771bdcd7d1000724f6e44a20eab4d3ca7ec8a63fa9b1876c7ad808f4c34d2d45b2
SSDEEP 12288:767AGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:ignQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1915523756668F94BFA3B06B048928112673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 138a08c40ed6e152dd312f776cba7617a65fad1cfd275783a07b8541fab2bd22
MD5 27f16cf613a593e0f9fe907ef990ce4b
SHA1 acdc859ecae0e1ff474d084c41f548bba2da70b9
SHA512 468033b43acce2fe428fb3775321afd54af7a0283900b06332d749908ea1080ccefdf62b03e19928145d8a7367b38543cfeac978cadbf8eb674b9d6a4012faeb
SSDEEP 24576:Cgb6bmBIi49WNNFpg1rSvFv7bYunQ/tbw/2Mkjy6Fr7g0og:Cgb4mBIBhGF5Q/lFTjN4
TLSH
T1DB65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 2a186239f6c39ec00626087b5e2b1c3ba879f37867e44de13006267e3d2ceb89
MD5 b16da9aa203fc26e80797ed9ac41fb51
SHA1 da3531576d33c7d925ee20f703540bfd1ce61dbe
SHA512 e23c74515af8fe00fc1fca625692eaec6c4b139460a1680635bf71638830896ead9afb045161d1d70116abd38cd0214a327033562c34abfe2cb35f90d07e43e1
SSDEEP 24576:2G88u8FpJqH1Qzria7/mJnQ/tbw/2Mkjy6Fr7g0oL:d7ZFPqVva7/mQ/lFTjN4
TLSH
T10185F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 00c1fb66b95411243f8517ce9fc01527e76d1aaa4304fb7067c3126215a47458
MD5 d9cfe5d2b03dbf7220b17d2ae9535cdb
SHA1 d7aa78f6c381b821d7555cb10f6cb25a23593b07
SHA512 7bdd67fccf1969328ec7f6fd9a830292f1abc48d61bd9afdb790339dc41f70f05404361377a3957d778a1134775dead4fd36b4f03557d2548a306ea9204d2634
SSDEEP 12288:0HvUrBFrEjwaQFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:0PUr+NQlnQ/tbw/2Mkjy6Fr7g0op
TLSH
T16E65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f3f8b182cd8e4fbbd5832124ede7dec4dd4f3c456b9c86f6070d595cf5288847
MD5 4f4fef4615a915f60c0c72a155ca8ac6
SHA1 744d22c3c209ac04dd5930d427110192c56f982f
SHA512 5948569c706f5335be704621498a7f1b6c470b2256a066854b5217b0bc8cc05561e7ddf640927580e955741e7612f9ccb395f07c0dc0d7b7536c0bf99bb8626b
SSDEEP 49152:PBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj1Q/lFTjN4:AG05lO43bHLm
TLSH
T160D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0f3f11833ea2f6c764b414a9e842e0d27942605a670101a8c45ab62714158f70
MD5 cdfd72fd39d96d4a9d175c1a292003d1
SHA1 79466e16f5fd439ad38baf67860d4650b7ba73a9
SHA512 0d5ed981d3d79c117ab3f14105e1d2ed137c6bc9e1929063f965c4775856931029257d6c731eb40056738d9111156afa037149d160c53146b224fc70e8d58932
SSDEEP 24576:ofa5POZ3dpFWVM50JicR2hG0lasx2+47eidnbnQ/tbw/2Mkjy6Fr7g0oZ:Qa5POZ3+Jt2pasx2+m9Q/lFTjN4
TLSH
T1B265AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b199fb8270836698e4ba1a5284e9451bee6e29177fb4f5b6efe303597ca60940
MD5 49f3692f468540351ba872102892cfa9
SHA1 7e62bacec350816bfe2bf1f7cdb5e58b3ec16f11
SHA512 91d3fd72062f53a3cb3d3e5255d5599f3b28b448ba388976b7bce9a756b1a4d4214caa1d03af26a7e6295f45830d6d0bb27bb8d80782ffdbfe5a143a881a7ef6
SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7FkRnQ/tbw/2Mkjy6Fr7g0oY:3Nc/zEOVHFGQ/lFTjN4
TLSH
T126858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8a9df293a80cb95860f46ed4a41107c1f7bdb1aa8b634050d5c6a770b2bd2094
MD5 9bfa7598b0be70a25b3e805d6c744e76
SHA1 ce6587c75eeade626c49d0e88e1fb4c813d44474
SHA512 9000faa0198a2966f49d7bcc458ec7376edb485e475e43d078a906db46096b5e09006b537e6d751aa369b4c1aca7c895d54799f56029b2ffefedcffae7244625
SSDEEP 24576:i8kNvNnaFeYhJNtmZBm8nQ/tbw/2Mkjy6Fr7g0oh:i8MwBtOm8Q/lFTjN4
TLSH
T19355AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 b1b34ffa400ef06ee920e5a0232c5f14b72064ae38f11e33cde8cfd1b2f70047
MD5 b42c2fb9ba0c11300601cb1dafb9c938
SHA1 de5110c61f9a90aff34ed184a4648cae26fce56d
SHA512 401b5b9c6a8909269d4d92dc85df8ac7cb60e14219010e96bf8573886f0d8a74cea6053cec98f15f62da177ec4f7e755a6e3b340681a83c2ff84de91cabd110e
SSDEEP 24576:+D3FHshBIYQgAEnQ/tbw/2Mkjy6Fr7g0o3:+DVHeBIAAEQ/lFTjN4
TLSH
T18975E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2004-320-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2004-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2004-81-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2004-302-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2004-87-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2004-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2008-108-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2008-18-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2008-24-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2008-17-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2360-30-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2360-42-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2360-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2360-37-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2360-31-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2360-54-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2440-13-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/2440-1-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/2440-8-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/2440-0-0x0000000140000000-0x00000001401D0000-memory.dmp

Download

memory/2440-7-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/2440-15-0x0000000140000000-0x00000001401D0000-memory.dmp

Download

memory/3116-55-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3116-264-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3116-45-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3116-46-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3340-304-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3340-105-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/3340-112-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/3340-114-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3972-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3972-305-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3972-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3972-92-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3972-99-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3984-301-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3984-70-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3984-71-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/3984-76-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/4272-134-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4272-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4272-135-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4272-308-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5076-300-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5076-66-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5076-60-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5076-58-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5532-117-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5532-118-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5532-124-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5532-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5532-127-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download