ceb81084584315ddb140e80776252d2799f9735f5b4f5628a399a35009ccbacf

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 23:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_96487eac23e03ada3df7731d39c6c566_icedid_luca-stealer_njrat.exe
Size 1.4MB
Sample260809-3vqf8ada32
SHA256 ceb81084584315ddb140e80776252d2799f9735f5b4f5628a399a35009ccbacf
MD5 96487eac23e03ada3df7731d39c6c566
SHA1 f8abb226682bc26ae00c5d7331a1826d927fae3e
SHA512 7d30f3c9502e55c13c5fef7a71417beb71fb58456b476595a3cd7a122175315d5a1ea26032feb3463ed0f1eff3b1cdd1db73821a7450aaf89510a0771f355203
SSDEEP 12288:M+WCwhAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:MPAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19A650157729830F9E4B7823988625666E7B27C7507119BDF039407BA2F3B6D08D7AF20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
3380	elevation_service.exe
832	elevation_service.exe
1112	maintenanceservice.exe
6048	PerceptionSimulationService.exe
3764	perfhost.exe
5140	ReFsDedupSvc.exe
360	SensorDataService.exe
4172	ssh-agent.exe
5588	AgentService.exe
2384	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_96487eac23e03ada3df7731d39c6c566_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_96487eac23e03ada3df7731d39c6c566_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_96487eac23e03ada3df7731d39c6c566_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b168e5bf238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_96487eac23e03ada3df7731d39c6c566_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_96487eac23e03ada3df7731d39c6c566_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_96487eac23e03ada3df7731d39c6c566_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-09_96487eac23e03ada3df7731d39c6c566_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_96487eac23e03ada3df7731d39c6c566_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000937ab9e25928dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f5214e255a28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000032802de55928dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004bf500e25928dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd6734e35928dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3380	elevation_service.exe
3380	elevation_service.exe
3380	elevation_service.exe
3380	elevation_service.exe
3380	elevation_service.exe
3380	elevation_service.exe
3380	elevation_service.exe
832	elevation_service.exe
832	elevation_service.exe
832	elevation_service.exe
832	elevation_service.exe
832	elevation_service.exe
832	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2420	2026-08-09_96487eac23e03ada3df7731d39c6c566_icedid_luca-stealer_njrat.exe
Token: SeTakeOwnershipPrivilege	3380	elevation_service.exe
Token: SeBackupPrivilege	5140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5140	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5140	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5140	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5140	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5140	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5588	AgentService.exe
Token: 33	2384	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2384	SearchIndexer.exe
Token: SeDebugPrivilege	3380	elevation_service.exe
Token: SeDebugPrivilege	832	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2612	2384	SearchIndexer.exe	103
PID 2384 wrote to memory of 4452	2384	SearchIndexer.exe	104
PID 2384 wrote to memory of 4392	2384	SearchIndexer.exe	105
PID 2384 wrote to memory of 6072	2384	SearchIndexer.exe	106
PID 2384 wrote to memory of 1576	2384	SearchIndexer.exe	108
PID 2384 wrote to memory of 4252	2384	SearchIndexer.exe	109
PID 2384 wrote to memory of 4316	2384	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-09_96487eac23e03ada3df7731d39c6c566_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_96487eac23e03ada3df7731d39c6c566_icedid_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2420

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3380

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:832

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1112

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6048

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3764

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5140

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:360

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4172

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5588

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2612
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4452
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4392
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6072
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1576
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4252
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 92b41947a7526a728cea51b54da301c1a8545b8adc2ba6d5969b5551c1f710a0
MD5 4544534a925e3294f135083f1e6b5cd8
SHA1 420fc4f911cb60ecf842e8cb9f8e9a2ea5b12bd5
SHA512 bbc7cb37e4b8ca72dbb569c6b98bdf1868796a34401ce9a2fbb650e327c872d2ee794d9d1799ff6b0e5ec4ae73d82cd272d00b4cb4405e5e7b329b5d185dea6e
SSDEEP 49152:nb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnxAQgAT76sQuE:V3q6sjBRqGsQr
TLSH
T1EAD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 cacf7f5885e0bffdd4b49896ee00ff23ac26bad180d029cc4185a7b24bd3c81f
MD5 43723f13818b8ecbef075c7e8354bc41
SHA1 6694b450b3fe8c11c1b0f8c91a2afe53a22ff264
SHA512 a2f0d9aef477d7a4f2e1690e5351ed46696db3854bc4c6455bc9d709e0cd9888caeb54a04ea049b33f67319daff19d38a1cbb46e1bff707c3172f4e7f42cb81f
SSDEEP 24576:PXYfDtczAgAfYLH8AcevDN0FImbwQuq3Wia7gD:6tcHAQgAT76sQuE
TLSH
T18675F12963D408F9EC67813DCCB28515E673B8A54360E7DB03A49A6A1F332D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 5aaa6b4ee45be1eea3d56bbe9ab74fa3d9e6306ebfc62019c99b2df19b93b7b6
MD5 774ef06e713e8eb3d8841a5ebb28ee8b
SHA1 f98e83552eb9e38083cb42fd276598dbd72c6a27
SHA512 9b9de69b0e9d67dc03e36f0137ae70d6e3cfd4f6ebd5cb0398e22e14ea48bc81d3d206ccb0594593ac623010b22b038cf31cfc5c0e2a6e2cb7af2bf6a9165c5e
SSDEEP 24576:60Le5ji0hmxxrMmAfYLH8AcevDN0FImbwQuq3Wia7gD:6Pji0AjpAQgAT76sQuE
TLSH
T16585AE16F6788335D073C0B9C5D2A69EE971308657308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3a15b5c0f36d0a71987139c711d2aadeb58f491c51dfd3799efd41cff0bea836
MD5 012fa11901f22e4695c59b228a6ee01b
SHA1 dc93f4b6718cc837ab192b4764ceb8168555bb4f
SHA512 df4636a0790501564cc3f36033402a214e3c81ba3172f5d6e54e50b88a21bf952cb4126cbec94b9e1d3d991dea1d061df54dfda798fb3b05cd993fe344eb0331
SSDEEP 24576:fa7/ezSC6vUyD/aqgrvWn6q8wyu8AfYLH8AcevDN0FImbwQuq3Wia7gD:S/ezSC6vUzPveHjyVAQgAT76sQuE
TLSH
T18E755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3c55d19eafe553f9a1732fdea5be4213b4fcfbc6c8bdaa7843c9e9d74e6a44b6
MD5 54cec9c3b3c99f109499f54bd66ea49d
SHA1 867d2fca81e6686f6cd3b0eb90f24410b4899084
SHA512 df573ac0e5572bb20ac7ebf93294a021a4c4c502448a9c2dd0cbecd0b2af7df31bf3020fc325dc37d91e9685a7ebcebff65769f04411ef0532ec3f8e538d48df
SSDEEP 24576:HVbqPb88hv/l+YrAfYLH8AcevDN0FImbwQuq3Wia7gD:HVO88hXl+0AQgAT76sQuE
TLSH
T19B559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 87df9813600b84516c3a278fb29e1b1a21a035810989af651ae3f92e470b9fab
MD5 8d593ee1ee69dff835c3b1b6a36e41ce
SHA1 7cd04db88f21809674e1690d149d843bc72b800e
SHA512 64b5cf61d84a33059b4b73ef9160a2d09387f8f6a08117fe2e4f8adcee550514fd99e433c54004a0e7535af2fe9b6e53cfdc342e2b02ee4503f36fe07d147aa9
SSDEEP 12288:nLaAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:nLaAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B4552357864C30EAFEBBD1369CBBA5B963D1BCBC824597AA00463BCA793D408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 3ae9f4d7fe7baff9d74ac9c483ceb61a836643811c6989c6f9937e37da283755
MD5 875b08040313b0809f9c0a003afef23e
SHA1 b44a8304d6f7b619f4be6ff1f7ee4fea740a2fd1
SHA512 805b4a9757f1cda79f3b1157e695680e69825effa4156863f37a7d10a6b5751f77e5addd45a90eb6fd3835a7f9852b74765a93d34c34d8aacd7a6dd68108beae
SSDEEP 24576:zJIUzAfYLH8AcevDN0FImbwQuq3Wia7gD:zJIUzAQgAT76sQuE
TLSH
T19275CF3BEE28FCD2C67E8D795A918600D7B278704B52A3CBD165830EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 cd727d07e47034c7a6d67a19e0364090b1d83088e433b3ea83172401752ae34b
MD5 1b227ee45d567a6ebe0ab9249db9ddda
SHA1 fe7347ba04a06347176cc32a3d5da1b0d22c057b
SHA512 9d9c180c3ff0006c16c3a05364eca7d8360a69a586d623b7c46439a7c50e67ee2445ab9d949217e12f956c822f79bed0fa8a381cbbd3d8d514ddc59919aa142d
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THQ:bQvGAdlCEL8c/DRNw5CxqGsQr
TLSH
T1FC266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 35eb9cbc60e9047152c86db157cc573bc0ca194387e466df861bc51f1aa4da0b
MD5 f655800ad09b2975677108e27fe72d16
SHA1 af4664ad7eec49311a90b1fe1cc3a1b2f43f6809
SHA512 65dd052c723363db6535e9c7eb3fc63c50096dd4ae513ced20ec248ed43aaff95c1d626bb76c5fda519f61be4bb9db71e5dfdb986bc5e5e8254691037a4149bf
SSDEEP 24576:G0ewsAj5AfYLH8AcevDN0FImbwQuq3Wia7gD:Xlj5AQgAT76sQuE
TLSH
T1F875E031FE74E036C6BF0DB21B36C716146CB9604B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 75669c113add6d21f1a66ad8e5210c2554e21337a0160d9623f81297e4cf5b72
MD5 28e80fb3e45ed4ff4fd9db0deb60a42e
SHA1 833a9796e221872a9e2e3e3684e23131f0f42dc3
SHA512 2584f6061efb6d36d185ea24a752c1e6ad80e0615515103346624244e9d141b419cbf0701ceb420de0c9977a8a7c04b347e318707ddf0075d53cb31bfa432bc9
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHsj:HUEtQevvqc2W1cpV2tI32
TLSH
T115474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 215ecc9a01d87349750911aac0a8408b274c758d147f6faa34addae82375e493
MD5 421387d82dea661a9c25928dbac0b43f
SHA1 d61cf23863210eeceb9052ee2df88ad7abb511cf
SHA512 38ce126834a60a0e4a61376ed030228bafb4e0423268c13e2fdcf3c8eabd420e8f5e2c512d81b7680f60ae10d71ec148aebdb31b6d6167fae3797707c8c46f22
SSDEEP 49152:XCbRquA/m2yL5zTfFiV+XenmE3/zZAQgAT76sQuE:AoquVjnm9qGsQr
TLSH
T182D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 55cf30fcc664e77637829559700e0e43a19d2e7c61cfa117fb5b0b6d2a02595c
MD5 a5cb99198fa46e55be7df12a4f9fb9b1
SHA1 d7bad1a88a0cc513abbf76b992d9c06b88f89a40
SHA512 182c109748f15944bf7aa01d4c9aae8c2606a12bb0780c2aa2b482749de63fbdc071fb1e3bd7befc5049392f919dd7f706705056d4770d76c751a8099b4a8381
SSDEEP 24576:yAhGL3IFoiwtA5l7S53oAfYLH8AcevDN0FImbwQuq3Wia7gD:yAMUFoiq5YAQgAT76sQuE
TLSH
T16F359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0a718bfcceddccda29ac48e8a75d33490d0568a4c2f4345d5220e20a54d11355
MD5 b3d5ab36be9c172a6483c41bd3d9ded3
SHA1 85e3819fd29a5e1c0708ca10223e2af985b626a0
SHA512 28c809f61f2662172f9c1207cca332ff907594793f73ab97ff5f1bce6bd8629f7dfe097567fe19f0b405159d60906232d10d71f11ad79c4423999a16e22c6c64
SSDEEP 24576:sZuOAfYLH8AcevDN0FImbwQuq3Wia7gD:QAQgAT76sQuE
TLSH
T12055125B239830FAE5A7C139CCF25659E3B278A6532283CF0115079A2F37AC59D79B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b801577bab9ade7f82c757933e757b549e1ad93754ad7f258e805714bc66b802
MD5 08cb5df087b7ee7e485f8ee3ab945c3f
SHA1 969fa0cb66861e8336acc539f685e0a131e9c437
SHA512 7c5a965e4f003985a665c42f49c6762872d72a0bd8f358f4d3e74834b25f48df512f3bd354616f3bf9e340a35bb23292ca687b1afba05bb4f8ffdd665a10e1ca
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UE:HQRQyi36YOcPbLvw2gAf+PN3UqGsQr
TLSH
T165667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fc3b0baa941316d5e8cd43824a06aa41f7d5f7b2b732592ca4471b8a03e3c2c4
MD5 4a89ba5a0feef017aca6b29970400895
SHA1 034ef2b13d707cebe0d1f3d58a997b64d9bed769
SHA512 de233ce95bf3d539a2ca343843b71bf5aaf3bc8e7685e0866004e88146f7a066369bcff6a374c42717169ff2295c31af60084d024495deed8321626d4db11579
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UE:RQRQyi36YOcPbLvw2gAf+PN3UqGsQr
TLSH
T1E2667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 57c089d84adccd2c928331d013fb8028bd2ea4580e815f81296778239b1a17b6
MD5 3f5d9ed2d1f2d7f531b20ec149e20503
SHA1 2bbbe450059e48771d3fc28e6b98762b5cb2504a
SHA512 9e5734436780c75c21809b4fefedadfa9a39d4c4048fe837a88395c5b10f29751fd63d7eb6215907e0a36b1cf3c9cb7a45722e309928fdc622a9d19af6561a91
SSDEEP 24576:DwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0+AfYLH8AcevDN0Z:768Qg55nhceWu7PNU3/pAQgAT76sQuE
TLSH
T1E9B54933B2F600A9C44DE1769F4A873196D17C758FE1E3DB8505720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1d74aef0d71346d727bb06aa28684da54e44be64ace185ad5de2fb5ca386131b
MD5 b4c090229fe727192a22faa81554d429
SHA1 28270f8de18b8cb331ccbcfe6b189d8eb80e080f
SHA512 036f0072e1cf3bb3152cbc02349494697b16d2b7268c651f0e018857f6bb0c25e9133a70e096d31eb95d02b032c8a9cc16b66e965a902098044dd98e03a45969
SSDEEP 49152:23aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99a:ny5112gYy5azzVvt69nLKnhZTqGsQr
TLSH
T1A4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a13f0ec8b2fa0f0228801494a147a2dd6113044d20a0929716d9731e951fba8e
MD5 12ba425b80725bfd4b85de405b085640
SHA1 e98e8e5d5781abc5642d7df1ac09da8c483747e9
SHA512 a0a1ebe7da81fc340c8f6dc545f57536ccadbb0c196e4beefae1cb869b1f8815e6978563e1076e2ecb5effd1108e19a31e499f6f82d88e254a0fa1c763b261d2
SSDEEP 49152:mB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glQAQgAT76sQuE:Uu6Jmdxd2dFqGsQr
TLSH
T172D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3b618e3edfe0b5d22fb9eef44d3e0bf8f95f11408062b8fa8211ce105d5adc96
MD5 aee44687159af4fa9bfe65bb90abeebd
SHA1 8970a3968caca5c9ba5860f33a01b9b7a4f49557
SHA512 1d66e8fdec8bc29bd52c91d2372057b7c9d06da52659a6b198f3df4066ca93b7a4fe640bab376b4791e2e1936a6e26273414d4f51ece9134c4e23a2c5816ea52
SSDEEP 49152:o1hpsNoJpF1A63U44CwH7R4xTAQgAT76sQuE:omifPWR9qGsQr
TLSH
T126B5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A9077962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8c08edcb1efbdbf6470a971561b9e794485566eb9bd447762c0445bdfee9b937
MD5 729d580a197fbbb1e6d3506ece646fde
SHA1 39eb58ee15053d4213d75c86fab31dc2498d6fe6
SHA512 347078adfe4c2cca3a0536168c0abc88af09aa00f6401ee95f89082178a003686204999854c71419bf9c567740a41545f4dab99302954206348597864de381bf
SSDEEP 49152:ySuZQIY0Be2KcRVtOnks6NMHqOAQgAT76sQuE:s5dKii61nqGsQr
TLSH
T180C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 70940b05408d3a034438dc4755d71d8c35ebbb883eb56cb65d61678a7579d233
MD5 f3e20adc9fc08eb398f004fc3942027e
SHA1 b13231cb6eb4f115239093944459b81a7ba6018b
SHA512 015958df4a127b24d8202d0732b3e2ec1beca057ca22794b01ef6aa79d44658744ba10adf3e105ee1d0eda9d25703e49c5bf9d2262d11bce4278e4f11bd31028
SSDEEP 49152:1htSn8EApI0fig3giDn0AP5wHAQgAT76sQuE:EX2imphJqGsQr
TLSH
T1DE95BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1ca5730d223a61b5c1d0ff3252d0ae8986d4db6b783351ece89e135d1da47a69
MD5 36d785e3fe660633d1a6e55d1ad8a0bc
SHA1 3f92380f94d027924cf45fa4e5b1514f07294d02
SHA512 ffaa398c2dddb9391fb38769a5b834bdccdb767dfa72b31fa94d05894e106deb1fd49ebc51ae99f1ecde9adae78e2eedd678fda09a425e0d05cad8b7de00d8f0
SSDEEP 12288:iCAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:iCAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T10E552357594C30EFFCAAD1368CB7A1B9A3C47CBDD346539A110A278A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 fc89968ce691d1431f24f20ef2a37e33a4fb1474dafe19a40dae93934cf01cbc
MD5 c3221ed7fbb083db0b5a96b051e55bce
SHA1 2a1f38ec6cb8761e20135d0b3202e4a894e255da
SHA512 ff953696232d5a7da091fdbe06af72562c377ebe6bf25abc14d8e0cb3547a3a19e7ff3858037911a2a0274a33ae4e2c731f4628cd05730e484436bedb4eb7781
SSDEEP 12288:ltAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ltAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T179552357594C30EFFCBAD1368CB7A1B9A3D07CBE9346939A110E2A867A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3a2cfd3064290e02a675bb01461396d3a8229f36440e8e0040ad3e2ebcf8d57a
MD5 1d32bd35e3598544fb49c085e6c613e0
SHA1 1c9d8bf665b3c68ba9f1487d4a843752383486ac
SHA512 60c5cc4714e86aeade9fdb05a8ee416d150b90f1fe255371b7fbab497bc93892b74b05b4e5cdbbee44983a48477c99a57665d9a060afb8c5f4057192e38f34b7
SSDEEP 12288:NbAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:NbAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T134552357594C30EFFCBAD1368C7791B8A3D07CBE9346939A150E2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 09a664bf3a47af0a6a1e5c8445810df57938b2270c2c09c923987729e5356f84
MD5 66405eb8fc307fb52d9cf50575a96033
SHA1 ea0e935d21d7a6bf5f3d39bc24f4f87473e72b35
SHA512 a2c7d0e888c40fcc98fd78cb9395cc2d2ffc5193068d24134aa1659f981f9866b63c6af25995d693569da25c4d67aa727be32e06791294bd07c9a1d63669e095
SSDEEP 12288:BVIAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:MAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1BF552357165C20DAFCBBD135CCB791B9E3E1BCB9930293DF16011A8A2E3A24891F4E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 636e0c8daab12c0bcbc880c0020d4b9cf5fb037a191438bb250253095589b8fc
MD5 7ec76b071e7dc38eb28bfedc648ee839
SHA1 fd51532b6e0a63fe0afc098b83dfae5c2527707d
SHA512 a01b5edea55220eadd30e2c18b08bc20931342b582455d4ec3f17cbe9eeaff91f67709906c6d25fec17ca4cab1a2ce4880c5860ffe9fa27f6615d84da5d5aac9
SSDEEP 12288:XgAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:XgAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T10655235B594C30EFFCAAD1368CB791F8A3D07CBE9346939A150E2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 3f0785e4961068fcee7d45fb383926b6dce9ca0e89d3a97b4fceb872ccf445a9
MD5 000907d1d3b2b3c16d4d17c74ebb9e2e
SHA1 c81fa574b3eb69681779be32b5bf5ceffcaf961a
SHA512 1e51ef9d69cbf4e0d314b3fa88eee768d5167458eea4bb481430abbce1a66fccf268d73b61a4c94afc0c94fe093ee397332a672c95d5afd8d0c57ffb9dcca9c2
SSDEEP 12288:1hAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:1hAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1DE552357594C30EFFCBAD1368CB791B8A3D07CBE9346939A110A2A867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c169274d7debbb7b3f7250e6b117c2e507504146c5de2b32ba860d0345b39475
MD5 51ccdcc7e164b5e4f05c22ae5576ff4a
SHA1 602bdb99bdcbce096f30bfe7facf3347e51ba5da
SHA512 993786b37757069387f41e00a61a44992e5a84084735156165fc64a8bd404d67f85a6224710fad4a947b4f71432492ed1bacfbe3da214ca4ab5fd69517b287dd
SSDEEP 12288:AlAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:AlAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15555235B594C20EFFCBAC1368C77A1B8A3D07CBED346939A150A2A867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 3a0fee4dd61f9159ed0cdcb6ef87bf177cf27f3896a60227b68a65963aa7b3fd
MD5 e523241e0dad08ec38f9b65b4789514b
SHA1 71a7f4d8edcd654a68e13333dfe34dcf8e104202
SHA512 0b0439988c4e1c30f0afc74c466a948a9a9fc1b5e08cb0f69b12b1d29177083e9d949a02e43f4631fc9b63ad0fb11dc46af81d53cf23430ffe3fcfe3431c05dd
SSDEEP 24576:HZMRzFVSONAfYLH8AcevDN0FImbwQuq3Wia7gD:HZMRzfxAQgAT76sQuE
TLSH
T10C750195B39018F8EC67813ECC668916D2B27C6A0760C65F03A4366B6F373A15C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 dc3fddd773d41174a9ebc19b55274e124fe83de44a10dc00b574010de486abb2
MD5 3baa0933623a9c467706831a778def70
SHA1 8766c79f94f934c228d19e3165feb3c79e574535
SHA512 93855d08107b9756b439daf2900c93049b3308454bd25fb17e032b26fbb99fadaf8bd0edd0f2012cff8f1e268ef1de28616cb7d02a4c0fff0246a3abc4424c02
SSDEEP 12288:EeAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:EeAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B255235B594C30EFFCBAD1368CB791B8A3D07CBE9346939A150E2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 2f96d0d8528229e150a61218e52583107746ca24eb708cb4d03bd3c3516ea759
MD5 884c9442c276ad7ca932cccaf84893f8
SHA1 430a2c7c38daa14201895318482fec4bc3c80a22
SHA512 604634f660b91d70cc7ef99af741deb9812aa4ec2c50000b211fd97c20d633a051faed1d188886ee9ed558537c65c9ac0718a522742e2a591c1b8fa71cb504e9
SSDEEP 12288:2qAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:2qAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F755235B554C20EFFCBAD1368CB791B893D07CBE9346939A150E2B8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 57c7dc3864bd1ee3026395ee25149b68e0a1565657e8a0461b0f98e583aea5c3
MD5 566315838c9ff07bca3a09dfca1d5910
SHA1 deab7c8df6b27f212459f0e1e20022cc0e8c0c23
SHA512 681b67337ccef6074799402b1c81bc0fbd617277be7bc450b974be7671f564b85883cda1aa33f36bb0aed2ec1d4d37cea4963e2f79eb49b118d5d1b5ef2233b2
SSDEEP 24576:izyJAfYLH8AcevDN0FImbwQuq3Wia7gD:iEAQgAT76sQuE
TLSH
T14D65010763A530F9E477D239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 8373472ca29b1fa8ff136db7866e28bc2c2c01153fbb7e7b527b37697e5f7993
MD5 643c8e2f126d6eeb19ea5d28f998c6e7
SHA1 c65ef0776b70db39d04528f9a04ec9ef85beb065
SHA512 2de912552685e9c21adb85a822fac71107eb27e6d9198e83ac5ce30ed282cc3272cc7da1d037ace17ed072a41b8ea9370100b1d2377ed77082d343317e59da3d
SSDEEP 12288:ueAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ueAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D755235B594C30EFFCBAC1368CB791B8A3C07CBE9346939A110E2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 2fa6c349650ab4e4f978c811b795424a7f064c832fcfde90bb598f40aaaf27b2
MD5 a29d1662771e4a9dc907bd164aedf675
SHA1 e1d6b353c0164b0dbb7983ad2179dae8073c9898
SHA512 ef6f9e924a7fbefa10bacb5e36f558a428674ba19b2f2460c43c5ccf89e82d1c8379ca8247f6b2c3eb76e5a30ad0cf9e7e2b7f010a686af7c31f576f5f7698ea
SSDEEP 12288:2eAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:2eAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1E455235B594C30EFFCBAC1368CB791B8A3D47CBE9346939A150E2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 6bf24f78183316b663963331e120c9b18f22e8587c801d09d77fc5ea8a81abc6
MD5 5554dafdeeb37b0381f248da722afcfe
SHA1 3a24fce4e9cbc73021472ebbdbc4c529797083e1
SHA512 a1778b4e9bae4ae2c09171d63c600e1630680f61b52713d9b2d557eff028911989fdf612e6c50e0e62b8e0a4c22d1e6d54bd5a099049053955e6b9ff8ce4d07d
SSDEEP 24576:/zyJAfYLH8AcevDN0FImbwQuq3Wia7gD:/EAQgAT76sQuE
TLSH
T11465014763A530F9E477D239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 6480950e5e9ed18fdac0784382d64d93a74087add260a60797c0def61ff75326
MD5 7d775b2003fb57bd8c8ca14ab095d781
SHA1 9b8b1679d98bef70308aadeeb3b712ae40e8b727
SHA512 c49269e03ed619750c07cb1dad822a7f5d041f4b87b7959232062904105232fa13be25f60b0011837cff31d3f710574b5ee37e05744aa60ac68bf7ed169cd542
SSDEEP 24576:dTDaLl3z0zDLAfYLH8AcevDN0FImbwQuq3Wia7gD:dTuLlj8AQgAT76sQuE
TLSH
T14F750195B35018F8EC67813ECC668916D2F27C6A0760C65F03A8366B5F373A05C6DFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 9c4e215482acdcf7d8cf0441a8c996a95592899b653c022afc0ce6ef8525c79f
MD5 debcb6d63c78f499f5aea3ecb03eb213
SHA1 c3695325c28b231308b4a80d89911f5751d73958
SHA512 3dc8ee969a405b665afaa69fe2ea11d08df31f918f4d5993d7b1b37c356eadae745d1c5040c1494bdbe6000e1cb8f9d928f36a6d7817588e3ba53512dc4be0f2
SSDEEP 24576:Z3vd9CHKy7GZPAfYLH8AcevDN0FImbwQuq3Wia7gD:pvd9CHKyaxAQgAT76sQuE
TLSH
T1CD85CF91F3E810E8F0B7DA358D765511DAB67CA91B21DA8F03A4265A1F336D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 caf92db4a34f49d397463aae5057173ceaab78a16e1ed39f99ba5f87e7f3b6ff
MD5 187f7cd0a400969c02332f16609fc00f
SHA1 d2b93a78cf7d4048e196a89ccc832fa877125029
SHA512 8a839cad674869542c6baeab43e183749c1c4a427eae2f0e6b85efd80a59f4249c9e157a68579a19d3e175efffdd13ed4e0e21d41bd096d6b78069d0b13d2726
SSDEEP 12288:O7AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:O7AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1BD55235B594C30EFFCAAD1368C7791B8A3D07CFE9346939A150E2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 7f56191ffc21e95daae29e03d1d36052f28ab935dba4854441ee9aaf603499cb
MD5 6c3f9fe7bc545168bbc6f7d2932538aa
SHA1 6a4687aa8847165ab0467b47428107d9f533a385
SHA512 900f3ac419f61b1e31397a3578681ff28d7bc301274e42ab50479fdd859a862f180004d63517d08323e4a33bf7ca80a739a0e119cee0605f92dfd5961e616874
SSDEEP 12288:SpAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:SpAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1FE55235B594C30EFFCBAD1368CB795B8A3C07CBDD346939A250A2A867A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c79e64e5a6f4bfca05981d52a0ba2f4baebc5cbb24e2f367deb383de24958ce6
MD5 1597ab40e9d863c9f4e42f324661e47a
SHA1 a7949602515da70c835fb6014acedcb958a2e3d4
SHA512 0d726a7afd1f67e4d213fc4df04b268c58caa77bc3fee2cd5177c5a8d43b1a001c4bd08678635615ad45b128dc68230883136498f5ee15782d8d14c5e701f45e
SSDEEP 12288:aUAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:aUAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15755235B594C30EFFCBAD1368CB791B8A3D07CBE9346939A150A2B897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 dd49d8990f200d71e4a64bf491e6f5d3a5abc84d14442f7f05a66646503135a1
MD5 53ad7b8ad975b302013ec5dfe64a455c
SHA1 4574211b69d8bb38f16c93f438123bd067d7eb2b
SHA512 0749adddfdc0aec20bab40da4c483752670af3714fbf178dc79b4f6a2c8526d4e0b06ebcb2f1ef5119991c23666811e0b784b2d125674265a48f744857d1a3bf
SSDEEP 12288:weAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:weAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1A455235B594C30EFFCBAD1368CB791B8A3D07CBE9346939A150E2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 eac9a6f6ee7d248568c120c3eaec5e03f7c0a8750115cf51d7e34f72732ba440
MD5 6f8c5033df8dbd22a35aadf5a1b22851
SHA1 da978448e91bab14b67cefe2d495321010c7c2c2
SHA512 ecbddd3417e986ef9779494a9b8f16fceb3e16d024f7c829188a90afebff9433335a7a4aaa700a9ffbcf3f44e6d72a0081aa671ee6ed332dc33a9e77d495e3d2
SSDEEP 12288:W7AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:W7AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13B55235B594C30EFFCAAD1368C7791F8A3D07CBE9346939A150E2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 2ea59ae75bab708d428ad1848f776b1482424b8761037112c75d57d338999bde
MD5 3cce04deb9809978c0623ad292aec02a
SHA1 87706a81b988ef19bc18d79fac8ff429c1df9fdc
SHA512 5beef46cacb36b92b1d8019a19a78e6241287946fa1f35ba3cfa8df1a7e386b0670fd7055a17d6125e8bc54fd37f3f4661af878aea71f0e4f2021324668cdec2
SSDEEP 12288:fWAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:fWAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11155235B594C20EFFCBAC1368CB795B893C47CFE9346939A150A2B8A7A3E408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 8a934205a2ba5b7af1349400695b93b8822f8efb60fa14f6e4212ce73d7f0570
MD5 41b0f0aaaa30e7561eb53bdcd5775823
SHA1 c2203c0b5e0f5020cddf1eb921d56541a8e6e3f2
SHA512 c8e579a97c4c8903ce02236201d7c1f333001fecbcf7ca837bd36a888225beaf51dd4d1f290d5c05ed38943b388f910bd628d416281aeb9bd6778bd9790d6558
SSDEEP 12288:UgAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:UgAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T188552357594C30EFFCAAD1368C7791F8A3D07CBE9346939A150E2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 c8f91c1bce5ca5f4eb028410285a0733693152e4e15aad50e830011477ed0809
MD5 9f61cafc5509abb3c818c896d692f8e3
SHA1 2280218f4d50f5bc716b5080366da407160ca67d
SHA512 a3d2f469441715fc0dc6548cc6932f183583b8271b05f88399c16785ddea3c58bec77f442f01172a205da0ad0957d9f341638b3f69ff85b39c2934fa1fe6c882
SSDEEP 24576:afwvUk9RX6wkyAI6AfYLH8AcevDN0FImbwQuq3Wia7gD:KMnYI6AQgAT76sQuE
TLSH
T10785CF29EBDC44E5E1B7913C89B7460AF6B178691B31C2CF025A53AD0E37ED49D39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 23dfc87e678b14bde80f61b4a346de5408b16b10492149be93be1d7dfdd3aca8
MD5 5f67ddc35f03cfbbe75f4b3fe6444978
SHA1 5b13057684233b7386c9ba86c86f45a3cd4f6156
SHA512 f3cca38426050a93ed197031fedbc808226b91d7e5d01b8ab213fee555f9085911e2dbd2535585d8234ff04ee10f7cf7a0b4a6e95486a5f6e1e4e0c11b652d4d
SSDEEP 49152:ZYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0nAQgAT76sQuE:0ySzP0qGsQr
TLSH
T168066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f09c470788785cc787c2cb572155fd595c2dc0dbed2abf5b4930d274d48d8429
MD5 3ed60fcfab39f724b32b012269622932
SHA1 1b9331d5db5e69e948a1db47ce18215925865dad
SHA512 48d4c58c7482c429c7274c0bf9ba45be746b4331c28e62eec07b39ab86c4227d1e4015c21cbdb0fa33e19acb671734abf092d3cf589c9014262b1fa2761d0241
SSDEEP 24576:S47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYdAfYLH8AcevDN0FImbwQuq3Wia7gD:S47JUQjTirIhCnDHUPfF/3AQgAT76sQr
TLSH
T159659D1EA3EC01E5E1BA927885154A5AEA71782D1B31CACF1270437D6F23ED49F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 fa95dd369c9cc5503875124c14c1893715bde895da3b72345eb1a146da4532eb
MD5 bb23a9895933d53f1b57813d2f179999
SHA1 1fbe18364fdef0c6bddd43654418f1a3ea639d21
SHA512 39433d295561b599cbc4d53b661ddb6608fc14b6935167f307109ead52edf273e2c89f65ddd5f744b595f27501c45d2ac6758d9aa5c8749698f92af305d73674
SSDEEP 12288:sbsfOAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:jOAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13365010AD29811E9D46EA139CB664650F3737C6983E1D3CB12C0F57E2F3A6909DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 41e6efbf13e3b664c69d48bcf6ce0ae96bc61ce012290b2c552a32fed0b783a1
MD5 50b9a0c8a2356d78ce54801d90f5bc19
SHA1 7c1f275c22d37bc8b832b4d7c15a8d738b9d9252
SHA512 2a1fcfc8ba5c9447897b960e64c1dfddbc15c5269da9781ebbfaa743a98fbc705c57bc0b269c2ac2e74f6f76ff2d50003ecca63087974b231e38976e33b36fda
SSDEEP 12288:3j8PAy5C5OYmmhPEZboVzW2+AnQsytm4KqZqTiXgpsQb:3SAX5/thcESC6TpZqygpt
TLSH
T17E452950762BD75FC6AD40326E32D6CCAB707D01EE456B0772C8873FC576568BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 4173a0bcf0f8949287ae4f809b212f4e3a6a38342015d05505d772e3e7a81e35
MD5 73c706e28fd2771093bb8e336776052d
SHA1 a43cd9c2ba74daaaa8291cf4a1f5e37530b1f107
SHA512 9ced1ab785074666ab891aca042dacf05f016e5168ab6a17da57444017fae58bbbc24581a9a9438aa5f162cfb66217a843fa0e5e336e572eafb70046dd34a81d
SSDEEP 12288:rOrQ25gEZEEu9E4FKatNxUXazu+cZbCmNL5L3:qFnSKazOKmJ5L3
TLSH
T15665E8419537E38FD1FB6032073AAB4DAB64EC0277056F2677C8053AD86A765B0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 ab1bca4f2097823e6f0b1174d1a3a884546357812110fd7fcc245aa280f3d53a
MD5 8f0570985d5839bd1429938815fb55f6
SHA1 88a9e2860a5543d166ecf3e1d6c3ba38a5938a65
SHA512 a24a35132b2edff49f6a0de2006d8555798c9e1118b4f2b5f5841582663d370daf6baf9d5b1321f2f14e161c8a0f8db085f425fff51e6f44ccb8990d2d10dbba
SSDEEP 12288:b07GAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:QGAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14C552357874C64DAFCBAD135487B91386399BCBC870092DB640A27CA793D9C8D9F4E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a6226083e1a3593959a9beee5f0378b980a1956a0b5c036142959ed9e6775a4e
MD5 e1ef7ffbfd64a6927defaae13e6ea42e
SHA1 4bafe94e0aef4a2429fe088b30054bd2b9ab236d
SHA512 b411a5138e7a929bc89957eafac0bfe1a8e8b6a57ada99dd836b8f63f686c5e75171a23c655a167e0c6d707039a358282f99305d3ff8b06dfac6b5dcb215c7c6
SSDEEP 24576:9gb6bmBIi49WNNFpg1rSvFv7bY8AfYLH8AcevDN0FImbwQuq3Wia7gD:9gb4mBIBhGFdAQgAT76sQuE
TLSH
T1E165AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 8c3150374dedc25aaf2c9da046f49fb03c4e6bab3d89f9ec1ae193c23a06374b
MD5 31f4d9c028e609fb615c2c690cf32f25
SHA1 478244a9700c1532aa35b3d9cb2b09063203e766
SHA512 a0ef6e0fc6c06cc0e0010a92fc4dc6d7e30a180b1cf39227c77fa8a930d01b6bbe97e4d6f65aa1e90470cffc8a2e3568b047dfd0129733fd02dabef07e7a3bfd
SSDEEP 24576:TG88u8FpJqH1bzria7/mNAfYLH8AcevDN0FImbwQuq3Wia7gD:i7ZFPqVea7/0AQgAT76sQuE
TLSH
T15785F16677E401F1D47BD13889924663F6B2B8250364EBDF06A88B551F33AE44B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 195f18ac461addbae6712020062875f0c2728ac4253082329480f1114b74edf2
MD5 7dfd706800bd6312541ab8eee6286809
SHA1 0c8ead43996e96845deed123eecbf83edae8b776
SHA512 4ea3154e61f132ead39a8d70cb9879ebf0d81673d1cd978fcbe8a72fed295141474b17ad715b2efd5cb4b4d9a01cdbde5878017450499be4ef163ed63600232c
SSDEEP 49152:9BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjhAQgAT76sQuE:GG05lO43bLqGsQr
TLSH
T12ED5CF6E62EC11F9D0BBD17CD9C64A0BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2dbb335bd88e66f5e57a5a5d635afb7c2fb1dd2f8d111ac925296674da9e1379
MD5 bc058586b428dceaff2d6f2d7d78dcd5
SHA1 dc32eedaeabafd29dae195fe5a80b2384ae456c6
SHA512 4888b7942173c68f9d683322aa311d2b1da82bd8857272dd2bfcaf6f0553b30545efc1c7a9736cfe8d4fda93d4ca15551cba238e5c4038f33414c4e4f154b6f8
SSDEEP 24576:0fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnnAfYLH8AcevDN0FImbwQuq3Wia7E:sa5POZ3BJt2pasx2+mpAQgAT76sQuE
TLSH
T13F65AF5EA6FC00D5E5B9D17DC583861AF5B1342553319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 43d03d343ca195365260680effce7024baf504d611e853fbac5e50c7f16fe715
MD5 97b75376291ce9cef9b8655338e17ee0
SHA1 344c79bd1d60aa23e32daf6416805c7aa16d4fff
SHA512 c992011dacdf92241a37aea2bd5cc8f8443c6bc6767221a01944efe95f6efebaa9dd0ee4aaeb53687e57463d1199925744606de45ceb686b678fe064c2d50b1e
SSDEEP 24576:wNcwHdjbyQ4nLC18lb/EOjowL7FkVAfYLH8AcevDN0FImbwQuq3Wia7gD:wNc/zEOVHFUAQgAT76sQuE
TLSH
T179857B1623E901E4F5BBE1BE89779546FAB17869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4e002323a4dfa0d7ea386b93b7eedb71ca3b5bcaef5a722d345bec3433341e84
MD5 08c7ca6ca84f04eaa727342f465b3959
SHA1 537dbdc0410eb6bec8812da1dcfaf39f94f5c67a
SHA512 e77640fbb250c0c5d502e9e763b11815888e435006b693bd2b37ffdac2931e5bfc03b273107bc053b24cd352518a67d26de3544e751cb1e1ebbb0ef55f89ea86
SSDEEP 24576:XTkNvNnaFeYhJNtmZBmUAfYLH8AcevDN0FImbwQuq3Wia7gD:XTMwBtOmUAQgAT76sQuE
TLSH
T17D55AF6EBAB805E4E1FEC675CD238512E6727861073293CB5290C13F1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 7aca5dfed7563d55ee11316220e84db1359bfbe8891402ac5477d6530f3239bf
MD5 f2d4e81a7782898000e472cad1374bc7
SHA1 5765e1075b13c0c7af9e71d710d20819217c5598
SHA512 9b5f72637647944f434076e83f4abbc8afeb19b8c46077489cafb600c03a8123df0c437769fbaee4331345ba29605fe6bd3a119bcfdf455ee3e0c67edb014c9b
SSDEEP 24576:qPUr+NQxAfYLH8AcevDN0FImbwQuq3Wia7gD:qJQxAQgAT76sQuE
TLSH
T1D265E11F229C18E5E676E13D89968619F771B866031192CF0291817E5F37DD8BD3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 2c585d6bc0b4b2f8196ba294a832767bccdb77ae02c350ca3e51ad1d0dbfd3ce
MD5 2278d33ae0ca9a721c2876af691a5a04
SHA1 981b16a52b4de9051d8fd73daab35cade4782d8a
SHA512 7f298174e9d233c0c1cdd89b4d699a30187a05f46eaad9e810965ea860b85a5018643b06f8d11823bd20c1cd4857d6033d27a7e8e7b756aa60febe1b4fe2d48a
SSDEEP 24576:JD3FHshBIYQgAiAfYLH8AcevDN0FImbwQuq3Wia7gD:JDVHeBIAAiAQgAT76sQuE
TLSH
T12E75E17EE65C04E4E57BD17CCA638A06E7B138AD032256DB019481BA1F7BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 4cadc8f6d181f28aa80d99bb4a4919d6c54085f3d75bdd75e59ab6183fca79c4
MD5 0447e0165a1bd467cb733367ed559481
SHA1 6b4e64bd6e221617f8e1d1aa16d0cf5147475b1f
SHA512 23ba717c2bc69726930f25967c03ddf7ce4a6b1f91cefa6c3a408cef1b0ae2c8bd4bce9d351bf28deada86fedb956f1311781de108abbee32f341c116da752d4
SSDEEP 24576:Kwu4OW2AfYLH8AcevDN0FImbwQuq3Wia7gD:KwvOfAQgAT76sQuE
TLSH
T1E365F14676A81CF9E9A781398997C136F7F2BC152A21D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/360-89-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/360-300-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/360-83-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/360-298-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/360-297-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/360-82-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/832-112-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/832-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/832-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/832-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1112-104-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/1112-39-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/1112-108-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1112-45-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/1112-46-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/1112-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2384-129-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2384-302-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2384-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2420-7-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2420-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2420-0-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2420-8-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2420-1-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3380-21-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/3380-22-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/3380-15-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/3380-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3380-96-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3764-67-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3764-292-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4172-103-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4172-301-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4172-106-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4172-97-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5140-71-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5140-77-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5140-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5140-70-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5140-313-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5140-296-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5588-122-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5588-113-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5588-114-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5588-120-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5588-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6048-55-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/6048-271-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/6048-57-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/6048-63-0x00000000006F0000-0x0000000000750000-memory.dmp

Download