81933ff9a8b7fd6a07371fbe383104d30627891f8807cd7e5668e535165ab683

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_3bd476dcda4495e92bc9c3f17b8c1eb4_icedid_luca-stealer_njrat_stealc.exe
Size 4.0MB
Sample260809-vhc2csan3z
SHA256 81933ff9a8b7fd6a07371fbe383104d30627891f8807cd7e5668e535165ab683
MD5 3bd476dcda4495e92bc9c3f17b8c1eb4
SHA1 94f9d57234e944ee17e7c68f96d11c62a76de85d
SHA512 fd79bae8734d0f351af9ccf865b2d06847ad97d1e8b1ccee7989bde099355c1958d8e2a16ec56bccb279629a368d15324d84155e2c30e73f07280410a6f5e701
SSDEEP 49152:qQ719w1cnbdrr7w4lZPLsseVsVkIET9Fh65Cvwxt7Uv+MnIIC:qxc5/ZlZPOn4GGMnI
TLSH
T1F316C41263FA0399F1F39B789A7A56128973BC699B31D6CF0298515D0F33AD08974B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5860	elevation_service.exe
248	elevation_service.exe
1228	maintenanceservice.exe
5036	OSE.EXE
2548	PerceptionSimulationService.exe
5172	perfhost.exe
1492	ReFsDedupSvc.exe
4152	SensorDataService.exe
2748	ssh-agent.exe
1112	AgentService.exe
2304	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_3bd476dcda4495e92bc9c3f17b8c1eb4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_3bd476dcda4495e92bc9c3f17b8c1eb4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_3bd476dcda4495e92bc9c3f17b8c1eb4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\41826ad65387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_3bd476dcda4495e92bc9c3f17b8c1eb4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_3bd476dcda4495e92bc9c3f17b8c1eb4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f8e8c6e2028dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000046d1f86e2028dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0dd9d6d2028dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea6a5e6d2028dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ce62eb12028dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048bacdb02028dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b18f2b02028dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5860	elevation_service.exe
5860	elevation_service.exe
5860	elevation_service.exe
5860	elevation_service.exe
5860	elevation_service.exe
5860	elevation_service.exe
5860	elevation_service.exe
248	elevation_service.exe
248	elevation_service.exe
248	elevation_service.exe
248	elevation_service.exe
248	elevation_service.exe
248	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5044	2026-08-09_3bd476dcda4495e92bc9c3f17b8c1eb4_icedid_luca-stealer_njrat_stealc.exe
Token: SeTakeOwnershipPrivilege	5860	elevation_service.exe
Token: SeBackupPrivilege	1492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1492	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1492	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1492	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1492	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1492	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1112	AgentService.exe
Token: 33	2304	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeDebugPrivilege	5860	elevation_service.exe
Token: SeDebugPrivilege	248	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2140	2304	SearchIndexer.exe	101
PID 2304 wrote to memory of 5104	2304	SearchIndexer.exe	102
PID 2304 wrote to memory of 4392	2304	SearchIndexer.exe	103
PID 2304 wrote to memory of 996	2304	SearchIndexer.exe	104
PID 2304 wrote to memory of 4136	2304	SearchIndexer.exe	106
PID 2304 wrote to memory of 6100	2304	SearchIndexer.exe	107
PID 2304 wrote to memory of 4368	2304	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-09_3bd476dcda4495e92bc9c3f17b8c1eb4_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_3bd476dcda4495e92bc9c3f17b8c1eb4_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5860

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:248

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1228

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5036

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2548

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5172

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1492

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4152

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2748

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1112

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2140
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4392
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:996
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6100
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 76d4969d5931650d82ac1d4e876611973044afb4774879d1756593fc1b89ce62
MD5 352059394ee606619fd5e00182f56d9e
SHA1 12f25905b8e8c641447c5a5609b8d5f4aed521ad
SHA512 9b26335367e54fe74e64ff4243b9bf28aa1d1610ee18b14d567efbaa06227ec7ed93bf605fd9de9fb2ecf00a8ae5b879bf220c2fc05c24618a59858051a739ce
SSDEEP 49152:2b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnut7Uv+MnIIC:o3q6HjBFGGMnI
TLSH
T1CFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 38e162f31d2fce506753cf7eedb7525b0bcc8eb09e354679fa8af93237b1fb02
MD5 ca303381448f33e554cdab85bb6590db
SHA1 b0fd908a579923cd6c2c3f9edb401721c4961452
SHA512 6e9409dd86fcc46f48711ed553740406bfa59f0ec50fd1cef8cf4f147535980ea93afa52f92dffa710e586f92e7b09d9d549af8be88df8e3b0005b0146811daf
SSDEEP 24576:CXYfDtczAJ+Ys7Uv+ahF8MlMPuuICiJS:Jtcdt7Uv+MnIIC
TLSH
T1DA650128A7D408F9EDA7823CC8B28116E673BC914760E7CB03E495765F236D45E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 8839539a45091a24bdcc4f70b49d32a90fbe1b05eac960d5ecf4f41ea818a98a
MD5 01494b2028da2c7384ba5d36a1eda2da
SHA1 9bfd47fc86a33da63ba0cf0dc1a2e11bb88227ea
SHA512 b7917474f7efb14ecbf507d65cefa3dc0c63525857e5f42f64203a25d563e0aaf76cec2430778210b4b25a4a8501e8cb8d032f7af3ef81c2a1589a51dd0b0273
SSDEEP 24576:S0Le5ji0hmxirM++Ys7Uv+ahF8MlMPuuICiJS:SPji0AcGt7Uv+MnIIC
TLSH
T15185AE16F6748335D073C0B9C5D2A69EE97230825B308ACB4286D77C7F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 99c88f1bec5521d1efecf6eef3360cbe1426aa3a6db545d17b816bee162eea6f
MD5 ebd76dc795b8b436eda2fc8e453f7e3d
SHA1 071b689b2266b7757d072abe3c85c86653cc3635
SHA512 700abc2e82679b0a14b37ba93ece778b84655d527c5047c66c49bffc67f25cbe20ea0e4a02d9949e933891e01239c4d9b49c4fc2dc0730b3061d6e8a5a89e7ae
SSDEEP 24576:ua7/ezSC6vUyD/aqgrvWE6q8wyug+Ys7Uv+ahF8MlMPuuICiJS:p/ezSC6vUzPvxHjyKt7Uv+MnIIC
TLSH
T123755D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a326792a9013abbaf80e4166bce47f6d15daf216c9f63e8eb743cf486f7b6acf
MD5 0892c70f627dfe9a42dc03310a997edc
SHA1 8cd97ab597958d7d05bdae85b312c49cb4dafd52
SHA512 82d5e7097abd5c2050aaef5768c2d938c678c5c24823098d932521c7b28ee7c97930326655efd9360f5d63e780add69539222e8c2c29f13854a3234a82e45612
SSDEEP 24576:RVbqPb88hv/l+6V+Ys7Uv+ahF8MlMPuuICiJS:RVO88hXl+Lt7Uv+MnIIC
TLSH
T1C955AE66F6748331D073C0BAC4D39A9AEE7234425B318ACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 9341bbfd700957a32afe4c5cfee11706f316159eba531e461844025e26e53e69
MD5 f4153d80f1e0edcb22f52a0378c2d4ab
SHA1 835b1272a1199666f261cdf3524a39aad0ccf421
SHA512 85bc4fb2060ce0cba7e7285ba5386f71e1de677ee7f47dbaf96e050659c1f487ab9483853dc6ac71d9a1ec94c2437c99bf9ac7b1afbbc999d7469f08ba03e535
SSDEEP 12288:KRDep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:KRa+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1F6452361C70510EAEBE96230B5B9819B61F2BEA0596316C348E07173EE7D893DC67383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 9220979460a490e914a7125d4236bb8cbb5be9abac02abbc4c75287372daa030
MD5 e680bf3b897e00dfbc2f7d0260c1d47a
SHA1 c1b9b0de66cbd4eb5ba3d61527bc13300306059c
SHA512 619ed306835fbecc2ccd46330b37713d15db23875161f2388034f83f34b090bbbde113cc70cdf5bd3a1d34a7cce6a271dfea4334c5ddc1c530737cdb3044c30e
SSDEEP 12288:XeBNUbTVO86U+ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:XJIUN+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1CB65CF3BEE28FCE2C27E9D7856918240A7B278704F6293CBD164820EDE275E15D7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ef47d3448795ca6168b944624940732880bcd3f99912af260bfe286158bcd7b8
MD5 c1135e9d7e70096e21d4597bcbf816c5
SHA1 2ae809c054798629744b1bf7ff6f6e63edb788c9
SHA512 b24f7dae76291a7cf306ab14913e4246f791a0a58216695fbce027db251163ae2ee3e7894f3f5c6a443643a54da183f6a4f99f25d2609a5efadd2b8b5586cb0d
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THM:JQvGAdlCEL8c/yRNw5C9GGMnI
TLSH
T1C6266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 c02a7a9eacecdb84521f9a2c994452403ed358a73f7a1d36fdce7c8970b9038b
MD5 45283be452540a1fe8b02c0b3c16b909
SHA1 228cacab1c5b3fbc36a0b646e9bdf480b17eb33c
SHA512 e4a240daf03e2b519d6b5a961392f1200be2566ca96388d1d4f610df4b5d48e708789350381d6b1c7e702033ca42c7d9fc732200141c0c7f72c6b1b4b2e46a2c
SSDEEP 12288:4AwSfxL/2Dc34DLLmt0LDQewsAjUep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:ddewsAjv+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T16375E031FE74E036C7BB0DB21B36C716147D79604B621AC3E3E88A9E99341D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f3ec60d9481680eeff7e98620949abd99916e0c0328eeca23f64889fce6fede3
MD5 82358f1dc30459e4079da29b33bf9d93
SHA1 553a376b756d49f31f1fd3b50a5bd1f301267c56
SHA512 dac84cec34d2d0e7c05cbc1ce7e656e39061b2fe41f4f911863681d4cc0365897fab60b78e32a55f26e48418317970c5c92be7bf92afd064142cb1b2b70a3c99
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHH:vUEtQevvqc2W1cpV2EI32H
TLSH
T1D5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 40faf6ff58d2e623f87148034f9887007578cc33ae253a630050bc304fbd662b
MD5 df1c6a45ce25548ac1934f12879748cd
SHA1 dab4e27c18e9669437024342908d61b5b1336467
SHA512 aaea3585a11855ebd9a08ec2b22b1bd8d8931494a6b8c7d0e226eb673c5362a8673d983c7059ec11193ee6be6136695d1bbe48ddcb114eeb1a528b81bfc704a4
SSDEEP 49152:eCbRquA/m2yL5zifFiV+XenmE3/zWt7Uv+MnIIC:ToqHVjnmhGGMnI
TLSH
T1C3D58E0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1cd93a2ec664185eb1acddde25d58373c910d9e06f2d96f72a98d367674de25b
MD5 dd52a88659d6a4352ec72358ff9add95
SHA1 0bc0e4978b3f3b954b0985ee7e604adf36fe839f
SHA512 7e26c38d49aa88d782f470cbaee15f31dc538dd43e3fd7b3ba5bcbc013aa5be7cb1b5ae5bcd4b2d3eb25a11923966b1a421d829b9da3940dd66fb40c301bd913
SSDEEP 24576:KAhGLJIFoiwtA5l7S53U+Ys7Uv+ahF8MlMPuuICiJS:KAMyFoiq5Rt7Uv+MnIIC
TLSH
T1B6359D81E7F955D4F5F3AA7899B68171EAB6BCA65E31C20F2160D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 14d62bd7cc6f153f38352b4570d8492d0337b27b804731b85111ff8cd8b559a0
MD5 73d68bf785756bb9a77a671ab0f8bd57
SHA1 ee2cbaf0fae96defe2a39ab516bfa986a397a0a1
SHA512 bb630cfe82882f99012f7b73ca80407ec6d16a12f42215d1c0e4d219b6c5a368e7652c3edf014471db18c7bd9c6a1cf918fcebef1362a1471128099f72645202
SSDEEP 12288:ymw5HEjsChNVBFgl0WDm+C9ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:rwuoOWj+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T17365F14577A40CF9EAA79238C597C136F7F2BC112A21D71F07A0C6576F37261AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 89fac813502b90068245277cfe7f98810559495a5924ee4e2d20e9712a5877b1
MD5 cc8b178b355466727f0bb1235c0a9004
SHA1 e6dc3c27864f8ed1c794b8d622a0faefd282ae71
SHA512 c7e1c826070bdd9ce49f2d30f9ff16454539f2c20c276672de8508a5fb2387f585eddabb7815b8419da1f705e872e332dfd537a85caabc1c6607b6800fa00e01
SSDEEP 12288:4BZ1Iykep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:mZuW+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T164551255239420F9E6E75238D9F5824AE3B27CA2677343CF15A042666F37CC25D3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4b2afda9e2481f244f780a1a31d1618ef9b85c489d13b11778ba6c37d0225b1b
MD5 80900230e25cb11b47f0864a7cec8c32
SHA1 0c695ce204c869cb74f152ed3c1ffd84a797e14f
SHA512 43d18dcf9e23efaafd3ac8d0554177a515aa49528e285ff1a7593c21fc79e912b62ddd283f4a0988824c6204ed246a7ca27a4768b1e7eccbab557b6b4170ac81
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U:TQRQyi36YOcPQLvw2gAf+PN3EGGMnI
TLSH
T1D2667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5ae5b9ae80ff69a52308aa843ee20317363f57497047053b15c5bf4436ef3a0a
MD5 f684541b1d675e41be19111b47f59994
SHA1 3938c7a87ab95a111c430938d86bee316d133ea6
SHA512 9418ed354f1748be4865982ee43d33384a0c778a0b907ce844f537a149bd5cff280f9c3e0d7f4bc1f6a8d0dfd8c456930255a5ca1aa1ceba45d7730cb0c40a72
SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U:VQRQyi36YOcPQLvw2gAf+PN3EGGMnI
TLSH
T1C5667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 26197dd127258a3fef02478d2c8182472e75d89e93fec0886b5396e75ebeb0f7
MD5 45af61a6736c75709fd4bd903d588276
SHA1 2660c034c6c559bf6a8b8d4772e84306ec6d8b53
SHA512 b4bee048ba08d0f656c2cc804575724095536e163b92babe7d8460eacaa0245d5bb15292e12b2107021a1c070ee14ebe4bf9283354abed1f1980f6e33c8ec5b2
SSDEEP 24576:cwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0m+Ys7Uv+ahF8MlW:i68Qg55nhheWu7PNU3/Gt7Uv+MnIIC
TLSH
T1A7B55A33B2F200A9C44DE1769F4A872196E17C758FE1E3DB851172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9cf52fc23736ce420c79175a51d8d98c7e0968eb71c676b36409cf705ca29e3d
MD5 f7be17ba9758a282054181196e8d8152
SHA1 299f6bf9ffdf9752a0494e1044081b764182d94c
SHA512 84a69e9619b403ff67588274bb9056ae8c1c49d29af4e9b176606a24a66246dedbe71f9e859e2d6889f30e991445ee025778b92874d19cd0c2898ef572b52f7f
SSDEEP 49152:Q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99W:dy5112gYy5azzVvL69nLKnhZjGGMnI
TLSH
T1C4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 76edb9dd0937faf3eb1f79e76eca1fd71e2fd41c190b598193908a6ac72a8d3d
MD5 aa5d11bd43779aa55c6da0cbca170cc1
SHA1 c819ebd902dcf0fc21d3db3cd18db2bad72dda92
SHA512 7a0a56b41170f7455ee557968605ffc3b125dd0154ea90f5f3e11e373132ccf69702b5b6e95630896757a44f037ada2141974a2cde23207b09d86f5d0f64bcd9
SSDEEP 49152:iB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glht7Uv+MnIIC:Qu6JmVxd2dhGGMnI
TLSH
T12DD59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e571749a01357e9b3e49f8f7b1b0f7321db5e36c11f1b4f81fb39deca1a82cd5
MD5 11561fce26a4fd3e8b71e5b80ead7b7b
SHA1 6a1a0470173951a9e0e4bd272b16281665c1101a
SHA512 328a804fe91ea1d9ec79870d47b6dce48980739e98ce41b465b6205b8de89a5d2d6cd5aaa5f501d5b5bab260dda2bc678592b03ef283820d395345d03c7f0e83
SSDEEP 49152:L1hpsNoJpF1A6UU44CwH7R4xgt7Uv+MnIIC:LmifPbRhGGMnI
TLSH
T15BB5BE13F29900E8D06DD17887569232EA72BC460B35B6DF0A90B7961F7BAE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a7ee7587631b137328f0524803e6ca64bb0a01774db3ae0d76205accb31d7804
MD5 e133abf8ee52d38f1803e1d802d0a501
SHA1 4cad46a72755716d86678d1427778382358734ab
SHA512 e67e7f5906ffaf68cb83f817812de38c40f6f9aa32147f13f58bff94cacdeed704d5dfdcffc122dbe5445d028a4591ec7020ee143dab0b3ff8930a96728ee00a
SSDEEP 49152:ZSuZQIY0Be2KRRVtOnks6NMHqft7Uv+MnIIC:35dKTi61fGGMnI
TLSH
T1D7C5BE13F2E940E8E0BEE67487769232EA72BC464B34A6DF064072551E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 caae36dbaa04d8a3ba1f77aa9612ec5eddf03dbd45c0988130a6ae52942caf16
MD5 ddf5cf92feda5f9f8e29c3caaa558947
SHA1 23f0ab271307f36fe6a5bb3badb80b891e352da8
SHA512 7ecb3d427a2fbbc3c3d82613b6cebf975851127290d835152d631d2a63bdb96ed53720f9a8d2bc052bddf51b99363e97ce6d2ed46ae43a5126c76ba98b248d78
SSDEEP 49152:thtSn8EApI0figngiDn0AP5wct7Uv+MnIIC:8X2iyphVGGMnI
TLSH
T19895BE13F2D900E8D05ED178C7568632E972BC160B35AAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1db944c9a34bf3db90d32a000b309cf27933bc01ea40247ac93e12c1eddff109
MD5 4659615621326ff576d115902b3c1a40
SHA1 acfc8d2c0a64d41edf99e3aaede59722e9cc720a
SHA512 01bc76dbec5783856c1572344ed4269aad0df07519f8002b0b21355599cb3ed3bdb6412dac66d376c6568f513a6b9171a9c4f9e4d0e4abc05ff63a7830a69444
SSDEEP 12288:+bep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:+y+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1AF452351DB0500EAE7D85270A1B5829F70F57EE5AA6302C358E46133EF7EC935C27686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 92d13bd084cdead1b7b13f0bbcbdbbd65ecf4bd91d9a5111c9cb16d1e591919b
MD5 695092999e47b0ca26dd4b116e04f65a
SHA1 b34d2543d25312cc95851c6ac40b5cca0ccb5cf5
SHA512 94c55a30b742fb210c30fcdb5c7e0a4999bc6108d476410b1f33da363746c03f3d5d029d3b23dfe56979b11f98ed77a785e54a0e830b34520fba52d7d7ce19e4
SSDEEP 12288:H4ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:HL+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1E0452361DB0500EAE7D86270A1B581DF60F5BEA5AA6313C358E46023EF7EC935C27787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 0eadcb70034add4a9e51e1c522b364911cbc8c77dc38a732e052a20662e4e71b
MD5 b2b9c39cebc894f96d9df004e8f2439e
SHA1 6235b888c1946c1fde9452e150f22a61abf80df9
SHA512 e84c688fe690588248f42635d2d0b6a350cedc838d8dcd47c4175f12dd26d23abbe45aa5654394570caba009cd0ceffb8883b0b821d1d39639cb6c9f1f86645d
SSDEEP 12288:aWep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:al+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T107452361DB0600EAE7D85270A1B582DB60F57EE5AA6312C358E46033EF7EC935C276C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 02f5c9da426bd90bb213e2dea1e991d6d8f1bf0649f5493c6cacb31bb2f4f4e1
MD5 8dbb6098020bcc354624da381e0ac8b4
SHA1 b6aa8eb1a5f80b8099178663d60eb75e59aa02ce
SHA512 4495cc589b7071e8185a0f5229705a70056fab200f3438474441a701aca1910ceceab789beebc0df37a32a2085f67f0638ddd8a70fb31604dba70a0247179b9a
SSDEEP 12288:cVpep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:p+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T13B452351971900EAEAE5E334D5B6819BF1F1BDE09B3313CB999011639F7A8D19C33B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c53eb9a200c4643c97d5fd4ca49b73d19674a66c889bc49be6412e2f3c972cef
MD5 6587ed3edafbdc2558cf14fc5f6c5b6e
SHA1 6202cfae3b1c46d3bf23145585d7c96031b95c04
SHA512 e4bcecdcd981cf8256eaca1d22d46366354a8abb1ce06f90e4c0c6a80539441dd322e64b943b1e752b9cdf72a733a65a83f2f594e8185b45056cfdc7981e2be8
SSDEEP 12288:KRep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:Kc+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1BB452351DB0600EAE7D86270A1B582DF60F57EE5AA6312C358E46033EF7EC935C276C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 bb35071b5a8df9dd860a16ce8cc02d5974cf573e54d97b630e748c1c11cb77f3
MD5 02285788994b89d098ae5141ca9ea011
SHA1 ad2219c8ec60034e0e99ac88c5dc7f3a16c00ef8
SHA512 9a23f6f457030afd30092d9b3b5a6565e7f616b7710918cec21b21eac66499fd8c858b478c10bfe296288fe3da9aefaa31f4d1abf2b4e4d6397e3d4a695a5917
SSDEEP 12288:fsep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:fH+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T162452351DB0500EAE7D86270A1B582DF60F5BEA5AA6313C358E46033EF7EC935C27687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 cd9e54900e617ecbc880695a3de80e475396e6b9f373ba2797a36ba9b94dd303
MD5 3229552b65cda5ae3600322a6bfca089
SHA1 3da7249bcc741fd9b8af5951c3561ca69e3a769f
SHA512 a429ec05c93516466952ecb7d7ed274afe1e6d8bd1ae340ac70ae8f62eafca0c7cca6f3ee6f0417a057ae6170f21c95c113aaab4d94aebae63d8a44bdaf1f2fd
SSDEEP 12288:8Aep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:8z+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1BA452361DB0600EAE7D85270A1B582DF60F57EE5AA6313C368E45023EF7EC935C27687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 df82ccecfe39e6cd3d6af1f3a72fb98fbfc4456c4e7cd181c751506dab6ef247
MD5 cdea86378ae972ebc9059276793abe18
SHA1 20b5ebc18158811bb3a3a46836c45e5028d07640
SHA512 d6e099fbb920d1055d8efdc7b92a1222b2da20aacc6af83e2e03b7ffe4e7b29bf46b9c57fcd8e1219f6ecaa47239e6cdba148e7806bc46649a5a1f43a82d2ad9
SSDEEP 24576:hZMSzFVSOr+Ys7Uv+ahF8MlMPuuICiJS:hZMSzfOt7Uv+MnIIC
TLSH
T1CE6501A5B35018F8EDA7823EC9658906D2F27C690B70C64F03E436675F376A11C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 9d16f23848509f36aba4d7659d72ce24615198c12e61b85b13129db48d2a1031
MD5 2912707dd22b37d6f570ac32dabe75b0
SHA1 dcd5e94e9d5b50f57d6b50bf44f636c71366ae07
SHA512 3d5fc687ff148b273cca98c370904c8c6024810aae22ca444e10a13692f399d0021c8688cda0a37862db999f41aee8c2ce41eaf3225148dad225cefb93dc1ed5
SSDEEP 12288:tXep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:tG+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T172452351DB0510EAE7D85270A1B582DF60F5BEE5AA6313C398E46033EF7EC935C27682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 890233fb79a70d909d685580864dca80eb1e11c5fa4d754715ac667f271a43ee
MD5 bd0555ca9d1c12ff97bcdea0835a6923
SHA1 db1dde69b3b5ed3f80d6479d4eaa6d0d4722e2a6
SHA512 59ee92aa92779003f06930de8120621576303955d05c681644836de9317737fe496981b410d2c8a3caa2a00542f141f19c2a51e5e2c2736e98a7be68c2575395
SSDEEP 12288:vTep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:vK+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T13F452361DB0500EAE7D86270A1B582DF60F5BEA5AA6313C358E45123EF7EC935C27783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 dd018412908e6aa49aec8395b2824da75d613305dac7d19f9c1f115f3f165437
MD5 21af5f4e020e109afd36d0c850d3c980
SHA1 35e2e98b8b7baef4e5aa45da156a857a11c43b6e
SHA512 b4c50966f26f04a03d0daad8bed2e3247abb8d2588912a15d55596f856d4695b62dd69822ee8be439ee13211f1ce4053af755982415acbed8404129a138cb56c
SSDEEP 12288:nyPz5L8kep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:Kzyf+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T148550217B7A130F9D1B69238C8A20646F3B2BC7247218BDF56A002776F275D19D3BB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 790cb7d3bbfe94db42042fecb54b20be3c6f7927683f553e50dd01f24f9282c9
MD5 2a68fcff58d1e5dce7fc0f25728a53aa
SHA1 eced7465691a9c428ee760e98dba9228ad445449
SHA512 1607d2cd3f4d5aaa332026d6d4b6858e2eb7f523041e55a727c3aeec940d3f9784bddb2e78b5687fb1e52a06a1be7575253dd17bb9116a9c97faf2b3396df619
SSDEEP 12288:gXep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:gG+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T151452351DB0500EAE7D85270A17582DF60F5BEE5AA6313C398E46033EF7EC935C27686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d11c1c1d957b059689fd2ee3da5e4a6eafb83fdb8c007b7cad3127ba3f35bd88
MD5 565cab40a3eda61fd20724c92c80191b
SHA1 4e1360b4c2cfe311af160bba240ad4e20ad84cf5
SHA512 a7cea229c28959d06a252864039789762df6296f47f01ad00f117f29dc16595b9a6b33ac0f227cf420c42ef119b136bccfc4bc7df67d5c0f0a8600134f9f93c0
SSDEEP 12288:rXep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:rG+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1CB452361DB0510EAE7D85230A17582DF60F5BEE5AA6313C398E45023EF7EC935C27686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 2a170d64ed4da687499e3945a65bcdc1126d3edd5b4e76ea10b16c941f16494a
MD5 02c6d5c937f97fc88aecd9c8d8e7e499
SHA1 33a7b1346a8c1f83b0089a1768485e02d33b2333
SHA512 116c221f86ea425df9bcd7d1e481dccb97d8fc25b40d6fad2e1ca3395c3ec0bf517ef5116d1031c5a89df0164a7519dda40b35a1e02c3df2897835743dc95c87
SSDEEP 12288:3yPz5L8kep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:6zyf+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T108550217B7A130F9D1B69238C8A20646F3B2BC7247218BDF56A002776F275D19D3BB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 3bd17b013edbe974fb45e0523bfc895edd61faa8fe4b02868b6e86422019ab95
MD5 7a32260362db80039c06348bddb06007
SHA1 4d92a4094cb0b5a400a7ba915a252727782d3417
SHA512 71e6a54de34e9f2b2baf1437c25e442e29dd84f520a61bdcb4f3cb22790f8dd24ac2f96c54417434f94a21674d74190389ebaa4f978f9a72910ae05a381cee16
SSDEEP 24576:TTHaLl3z0zD1+Ys7Uv+ahF8MlMPuuICiJS:TT6LljNt7Uv+MnIIC
TLSH
T17E6501A4B35018F8EDA7823EC9658906D2F27C6A0770C64F03E436675F372A15C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 bee10bc20dda9c942556c14c44fff03ec005968145fefbed990bb8dddeceb63c
MD5 f32c5e66fedea3b6c3b9b78695b510cb
SHA1 ecd1808e53ad4543cd22eae9bd679413dfacb3eb
SHA512 80cec02325d1078efdc25c7810db0e29c03739254a39d8399c53d6ec8ccfd988b79787fda065356146dc80eab74e293a90d64a27ef073139f95effca97210bdf
SSDEEP 24576:O37d9CHKy7GZB+Ys7Uv+ahF8MlMPuuICiJS:Q7d9CHKyaOt7Uv+MnIIC
TLSH
T13B75CF90F3E414E8F1B79A35C9764512DAB67C991B31DE8F03A4261A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 fa3a0b4b9065903fd3e9b3afdacaf9f606118265f86635944bdbe8686c8afff6
MD5 10fb375a6e6ec3c5cfcab06632a4e6d2
SHA1 f1c276c8f252e49ba16f18e89c20b86d15a1e350
SHA512 e0038cb3d90c2115672a3865eaf71f7815b05bf0ea2d400f30da353cb849f9adfff0fa3db8ab0fdabc2282470bb4c45643de8489d77bf4580b78abcd8bdcf8af
SSDEEP 12288:e2ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:eF+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1F2452361DB0600EAE7D86270A17582DB60F57EE5AA6312C358E46033EF7EC935C276C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 20771a3a40a9b29fa2eb699a5a031fcea99318bd1dcd513789b5e3fce98f611c
MD5 7517650fab34d6dc3d07c519a8676caf
SHA1 1f7830d703f2be9ff013eabdae5918d3e4b89925
SHA512 182fbd7de454e2a879349c1312d05fc2c1cf2095e0db90abe224afce87510f6c1ac9bbc44f4de3e6c10d6512ce66ec66128a2b6394561717b75f13ae48a17527
SSDEEP 12288:NEep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:N/+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T117452360DB0500FAE7D85270A1B5829B61F57EA5AA7313C358E45033EF7EC939C27687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 60a206cc72a09a955c35209e35cfaa912536dcb8200750830fd32ed5ac397989
MD5 22ad8989a0090b7c684b6b10ce9d2b92
SHA1 c064cc802e42c299f61ef5a85fdd60b42ec5ba15
SHA512 342b64af070ce21b689b9840a47360877820dfc2f10c5922a42326efe107e257ce3efc7eefbf8bd9309bf6c454cbe01e4b42ad82ddcf004ea5877a916f37da2e
SSDEEP 12288:lFep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:lo+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T113452361DB0500EAE7D85270A1B582DF60F5BEE5AA6313C398E45023EF7EC935C27687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 7157294f4f1eef19faac414e8285225082cdaae6aa7ab03e594e2b5acd221884
MD5 eeb81ae163c52512cdab71f1b9827ced
SHA1 fb7bce56a8373b16a12be4f62a676b27a4001ffd
SHA512 dd907595a22bad50b06bc5a6caf5776c0a5574083d1f99ba893c8066c48359d55fc606436d891708f46c83d7759e6a067ebf75f44a15585294e059166648b706
SSDEEP 12288:QXep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:QG+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T103452361DB0500EAE7D85270A1B582DF60F5BEE5AA6313C398E45033EF7EC935C27686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 899f9c2c81a933321523df93d4336c8c21fd23bce19a8eceda826fef0e1ec610
MD5 f20c2d9fb3690a5f02e45ff9b1d3ac3c
SHA1 418daedab13f4578c509ef101e1b54d44f728c51
SHA512 93aaa9655df6db3fa74e0787bb3c2609168db52ceb0a420490dd16d2649196f65f1cbd54832c143f59295edd1b6e9c3532764bce080a3afe04d874f6a0918538
SSDEEP 12288:j2ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:jF+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T123452361DB0600EAE7D85270A17582DB60F57EE5AA6312C358E46033EF7EC935C277C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f3f50f3bd57d25798ad86ab2f351b8fbf9feb893b36e1b7a810a8ad1275503c2
MD5 c266ee2c8c63e12ddd52cdf82688a6de
SHA1 b241eba9e5dd42bb2be0db04ce541b044d8f6999
SHA512 2a1ff213e71d7b3f2ba528288674a5281ae56336cf992d53ee33d85ef895678809a987806fd574bb53d6b3a57f6150c63d8dc3f65028b42ae3faf6c6472d4c79
SSDEEP 12288:Pfep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:PO+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T166452360DB0500EEE7D85270E1B5829B60F5BEF5AA6313C358E46123EF7EC935C27686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 e881ffb065b8d8694463dcd70ac4257254927eeb7997122765d29cf3247964bf
MD5 bac8b44fbde03b3f3ec6319c783fa440
SHA1 280e4b3a2b4cea95b9cfb8c16c17aa5c85b0efa6
SHA512 ed90c2cf808e35fad6865fe30d33febc9cd22a8bd4d4de61ad5875b520f71de0c30de7016bd03396ba1b5364d26d0a1de6dd3057c6b417c744f6bda059304984
SSDEEP 12288:gRep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:gc+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1AD452361DB0600EAE7D85270A1B582DB60F57EB5AA6313C358E46033EF7EC935C276C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 ccdf34ae01f4401d47700feafb69bd8dc465f9cda6cfb25be7a77703ea2121cc
MD5 c0e9e11ed67d90694c11665b52188cec
SHA1 b5214abb43cd75d956cd77a71a7f05ab6f0ba0da
SHA512 ac319d7bbdcc2ce7d4e68800ebf4e224fe0e3f129e571dfb93947b1403eeeb26c5095fcd119286806b39d5474ac0ba25234af626a498aaa41eb588264b064652
SSDEEP 24576:qfwvok9RX6wkyAI6+Ys7Uv+ahF8MlMPuuICiJS:2MnYIDt7Uv+MnIIC
TLSH
T1E885D029EBDC04E5E1B7923C99B7460AF2B178691B31C2CF029A536E0E37ED45D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 77b72850e60ffef72b51af58cc2c8a4ed08538cc8a9141d79507687736eea2f9
MD5 a009037ed4f41ae0af1f56123409e60f
SHA1 355a7b9431b0009e8972041f7a14ad3bbc113364
SHA512 e9acb635737e52c5dd4beeefde643367c29bf47301df9f6c776d6821cbe7f6eb61c4aa126c2c6d5e3561651e5c84aeb79ee7f28e3793859133221d953db02761
SSDEEP 49152:0YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK08t7Uv+MnIIC:6ySzPkGGMnI
TLSH
T164067C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5bb62ae76f01c77c076f576bfd9d3fa4a13543237fc3f40fbb73dc799ce89119
MD5 8f1b32343fce4b6ec1f906d0a097bb02
SHA1 2beb148105d5689d8e3b12d5d77635bf85b10dc4
SHA512 a865e9acc7a1c002a7fe2d7c1801ef18f3f2130cb4bff53afeabb50270b017795e754c1d37731f7a1cedbcd441a1ea6e3fab6c993831656c062d9919edb2a93a
SSDEEP 24576:B47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYb+Ys7Uv+ahF8MlMPuuICiJS:B47JUQj1irIhCnDHUPfF/st7Uv+MnIIC
TLSH
T18965AE1DA3EC01E5E1BA927885154A5AEA71782D1F32CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 1dfabc324c07f5531bbd2becb3b579067d49bc3fa322628bdea0b0b0353f3af4
MD5 901469f72edc640b918d42c7b8c7fc85
SHA1 b561cef473e62f7d84521eb2ecc704f328b098fc
SHA512 82af63cd8752adcc7022425b0c2be57266a3ac8a0c3c82e98eaa96970fc0161b7420c6810dc52c5ef1615483fdd75d9fc7ae4c27aeea6256b99d33d477666d69
SSDEEP 12288:cNsfHep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:NW+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1ED550119D24801E8C1AE6239C7668642B3737C6587F2D3CB56D0F13E1F7A8909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 c52cfe2b50e34a3a896dfaba69093167fa28e11638bfbc931c61b8d8bed3a1c6
MD5 fe61063aafb68bb78da9b5ac0a948f8b
SHA1 b218a6d09ae970e79f30ae55dbb90e08189c7931
SHA512 7a5f52b3d467dda3cf3fd21774b83fdaa52e6b50cf4a00895d1000a72dbf8c699f4d0ff3e659dbaf9d6d0a5d7c2b6e87a24a872daf1f3f83acb0ab253b397152
SSDEEP 12288:urNPyU3f0JtW8018oARMWW/2Y0VO16mBnoHQtVRYlYGy9PV:urNaUP+018W/pALmBnp7UYT9
TLSH
T1C8350640762BD78FC6A944321E76D6CCAB607C05EE04AF0773C9873F9476668B6F5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 a2bd7c63b07ff299b0ae8e8f67ac679c01dcb7721c9259fa746c68c98e18eff4
MD5 2591751265f9413da8ee80e1bbcadcce
SHA1 57639cde7c0317a7b89f8e92ad11044ca2b41097
SHA512 85f9592d1a16a848b7a58d963e5cb5a97160a802170b5a8d7ba0254391368ee9b6ac7b67bfc6d281c59920c3b2ca836312113e7ec1c1008b97a6b40d54fc2428
SSDEEP 12288:gKp7539nE3zecSS3aN9Jwg5bZ4UnHan3zF++YjsA:gKpVNEjxDVjF+bL
TLSH
T12C553B41A5A7E31FC9BE543B4332C6CDBB646C06B7463B0573448A3C8867A7EB5E22D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 986e67444dfc55d2e1ba45f0d1f2872de1f424ac1370e2b436a7393ee482a930
MD5 ab1cff11be94cd132240733dd3be5edb
SHA1 6df985c38ef570eb0d2cd51bc26770121f3c97d7
SHA512 a73d830faeb0cf7ad7a8b9385c0e8536b1beb0689d8c9fda832287dd9d28e00246d15c9f9b6daf26f8f5152937419a2b9415d99d1bb294e7205aa1f560891390
SSDEEP 12288:jz7Pep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:ze+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T15A452361C70914AAFAF863706179C16A31B6BEB45F2342C3A8906163EE7DCC29C73747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 54ccf13c38eb331ba63334cf22b14c8a1acf2c334959ba5d39bf30e527f26bef
MD5 d3c451bf205b98eed3b363df5819f231
SHA1 9935995cfd080df90014e03c48dd666a876ed4e4
SHA512 c72612906e718c91c7bc8a404db721f6ee789727353519880c2eb35ed65ec6e00bf4ae84566a6ea717c2cb4321cb56633f48f3c12ff8f98ff0b9e940bd707001
SSDEEP 24576:bgb6bmBIi49WNNFpg1rSvFv7bYg+Ys7Uv+ahF8MlMPuuICiJS:bgb4mBIBhGFSt7Uv+MnIIC
TLSH
T11965AE1E22E802F5E1F9E2B8DDAA4417D6B278160732D2DF1151423D2F3BDE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 15884ef451eb059a68335bf6fd0a697c88f9ec466bb45b90f8246cf6631493c7
MD5 dcb04e916adf73fa5a3ec687c35dc32d
SHA1 3dea64429c6f89543da91e890c06ab4a3b0efb0d
SHA512 c6c9863d7800b62acf7bf85078264d2700ad104de2da80d98fa1947170e4cba1eb3aaa74faea19faf8b778b50c83cfa197bd1a07fed529d179ff1833ae0480c9
SSDEEP 24576:lG88u8FpJqH1bzria7/mr+Ys7Uv+ahF8MlMPuuICiJS:I7ZFPqVea7/lt7Uv+MnIIC
TLSH
T195850165B7E101F1D4BBD13889964663F6B2B8250361EBDF06A88B511F23AD14F3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ae03fdcc9bad38eec3e3a8ece5e70623091348e2d84f069215067f72af8e7c40
MD5 bb88673f658b50399b5d9e09f1b5fc24
SHA1 838e8327911a38c1703d0a0b4dec2c82ab1a20fc
SHA512 433f55c8914a4c2e386778cfe6f256dcc3a626d5f594e5db80b46a437ff9d2a408355968ec18668567c074b7e1e8c2a7622137668fa8b2c282b325e0c93fdb28
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjet7Uv+MnIIC:eG05lO43b7GGMnI
TLSH
T1D8D5C06E62EC11F9D1BBC17CD9C6460BEBB23825033556CB02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 40b9fd5590409acb6b16fbd5cd3a2516560db77fc19d045692f44ed3fdfa9a1c
MD5 6d81ff769c7feb469adb03a7a3d7e32b
SHA1 c0f4be5e6781dedc03e9e0ef207aed0da1f19bd8
SHA512 4bef8c9d91f2a436193a5c09f3e6522de3efb8f79199e69cc9cd9e025e5c8e259dc23d7a3d5d2cbd9f5606c023d6fef382f43d22d3e493960d9c4ecda6705325
SSDEEP 24576:Ifa5POZ3dpFWVM50JicR2hG0lasx2+47eidnp+Ys7Uv+ahF8MlMPuuICiJS:wa5POZ3+Jt2pasx2+mGt7Uv+MnIIC
TLSH
T1A165AF5EA6FC01D5D5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c5953e0f35a0d7c13c5228dcfcc964753fbb55249005f770d637a60ec8df4c1a
MD5 87903f30a9be3d44d9697a48867f32a3
SHA1 648d0339392fb4a13268b6d57d0cbb0aad82f951
SHA512 1f61996042967b5f561f8ce4b0d45685d706517e0e9a29cf1d8e5b1e53f4ec12daea2b40093e2092a78e826556f4fa86c0921612c8952cd9ff30ab72c34b0f31
SSDEEP 24576:BNcwHdjbyQ4nLC18lb/EOjowL7FkD+Ys7Uv+ahF8MlMPuuICiJS:BNc/zEOVHFFt7Uv+MnIIC
TLSH
T1AD858B2623E901E4F5BBE1BE89779546FAB17865533086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 661fa0ed3da59001be3205c14cafa9c9aca644371408a1897cd0ca7af19ce247
MD5 998b912a926d60d6ac4d79e3328f2fd1
SHA1 f62fa983560e11dee3ea732e21669fe48fba4337
SHA512 0ebf5652efd4ae67c112501d9fdb4d9a6e2275b7fff598edfdf7dbd88a6e2f7640b0bb54ac953bec940c49d9af8781b03a79ea873f68f614852ea062d4a82c97
SSDEEP 24576:n8kNvNnaFeYhJNtmZBmg+Ys7Uv+ahF8MlMPuuICiJS:n8MwBtOmNt7Uv+MnIIC
TLSH
T1E955AF6EBAB805E4D1FEC6B4CD238512E6727861073253CB5290C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 31859acee4d851731e32c353e3b8261ab31d9cb4be2a09ecf0deac95a3e78126
MD5 bdb48b9422c8658b7fc2c650f6563433
SHA1 2a7049d9b7aa470cd7bb31d5686572974f29db3f
SHA512 a09ca47e44830800eac4dd8dc8c6f14391d94117e8f91552778b91d7268873af47fe34b69d8e66dfc1d33c3f1226435d134aed9647ac624c4780c779fc51e7a0
SSDEEP 12288:pHvUrBFrEjwaQ8ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:pPUr+NQ3+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1C865E12F629918E5E67AE17C8592831DF371B862171292CF02E0817E5F67DD8BC3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 9140d831f6ad99c5de330e2ac73fc96990a0045a8280ff76a34f6da5f7348a16
MD5 0081e9fcfb3af8ec288e199946cc3c17
SHA1 cb7f4fe5d3b1e6fd3c837b1e7967e86525a5a9fe
SHA512 943b7c1b5ed992304ef6d7644aa044722cdd939aafc8264bb48ddad2daf988c296a0fc5c754ecc8b59b25555b24f92dea451d3b667b05080f8c71314a35a63bf
SSDEEP 24576:XD3FHshBIYQgAS+Ys7Uv+ahF8MlMPuuICiJS:XDVHeBIAArt7Uv+MnIIC
TLSH
T1D575E17DEB5C04E4E57AD1BCD6638606E3B138A9033266CB01D481B65F6BEE46D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/248-46-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/248-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/248-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/996-329-0x000001CE276D0000-0x000001CE27800000-memory.dmp

Download

memory/1112-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1112-128-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1112-134-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1112-136-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1112-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1228-54-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1228-37-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/1228-52-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/1228-48-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/1228-33-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1492-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1492-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1492-90-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1492-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1492-331-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1492-96-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2304-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2304-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2304-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2304-151-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2548-295-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2548-75-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2548-69-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2548-67-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2748-115-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2748-317-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2748-122-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2748-116-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4152-315-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/4152-313-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4152-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4152-102-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4152-108-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4152-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4152-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4368-406-0x0000018D5D240000-0x0000018D5D46D000-memory.dmp

Download

memory/5036-57-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5036-281-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5036-56-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5036-63-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5044-28-0x0000000140000000-0x00000001403FD000-memory.dmp

Download

memory/5044-7-0x00000000021A0000-0x0000000002200000-memory.dmp

Download

memory/5044-1-0x00000000021A0000-0x0000000002200000-memory.dmp

Download

memory/5044-8-0x00000000021A0000-0x0000000002200000-memory.dmp

Download

memory/5044-25-0x00000000021A0000-0x0000000002200000-memory.dmp

Download

memory/5044-0-0x0000000140000000-0x00000001403FD000-memory.dmp

Download

memory/5172-85-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/5172-79-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5172-310-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5172-80-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/5860-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5860-15-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5860-21-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5860-114-0x0000000140000000-0x00000001402E9000-memory.dmp

Download