3fa647734628a018301a546bd3dcb5538348be2e082888687123318eed07505a

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 06:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
Size 3.5MB
Sample260810-gyphfaxtet
SHA256 3fa647734628a018301a546bd3dcb5538348be2e082888687123318eed07505a
MD5 838983b4587f43ec6b0f388564fd7797
SHA1 5c98c8ceb114419fc78884381bef7fb43d70d292
SHA512 102e2cc04d01a51879a0772a12426e097a4b7c798cf1548851c1332ebfad4988325a0f4f082afaa5539350c87fa62ea87e5e32300fcd80820a92af8550163a5d
SSDEEP 49152:CtFQQcXCmXBkVFikQgCSGpYY73dlLjdGxtCm4PyTnxbUOVKYB5YGbULPBChZ2KAJ:CtfmkMlckKTnxn4wbUiZ0qGsQr
TLSH
T1DFF5AE4BEBEC55E1E1ABC234C612850BE7B1F8211A71D74F016D475AAF376B34E4A322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3428	elevation_service.exe
1828	elevation_service.exe
1092	maintenanceservice.exe
4468	OSE.EXE
5588	PerceptionSimulationService.exe
4220	perfhost.exe
5848	ReFsDedupSvc.exe
4448	SensorDataService.exe
3424	ssh-agent.exe
5048	AgentService.exe
4340	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dc434065e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001962845f8f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f3e0cc5c8f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e4a2d8a78f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047ab1a5d8f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000396b105e8f28dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000009d7d8a5f8f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9fe515e8f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3428	elevation_service.exe
3428	elevation_service.exe
3428	elevation_service.exe
3428	elevation_service.exe
3428	elevation_service.exe
3428	elevation_service.exe
3428	elevation_service.exe
1828	elevation_service.exe
1828	elevation_service.exe
1828	elevation_service.exe
1828	elevation_service.exe
1828	elevation_service.exe
1828	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4240	2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
Token: SeBackupPrivilege	5848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5848	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5048	AgentService.exe
Token: 33	4340	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4340	SearchIndexer.exe
Token: SeDebugPrivilege	3428	elevation_service.exe
Token: SeDebugPrivilege	1828	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 1464	4340	SearchIndexer.exe	100
PID 4340 wrote to memory of 4884	4340	SearchIndexer.exe	101
PID 4340 wrote to memory of 984	4340	SearchIndexer.exe	102
PID 4340 wrote to memory of 1788	4340	SearchIndexer.exe	103
PID 4340 wrote to memory of 2944	4340	SearchIndexer.exe	105
PID 4340 wrote to memory of 4148	4340	SearchIndexer.exe	106
PID 4340 wrote to memory of 1584	4340	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_838983b4587f43ec6b0f388564fd7797_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4240

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1828

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1092

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4468

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5588

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4220

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5848

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4448

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3424

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5048

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1464
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4884
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3064 3060 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:984
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3020 3016 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1788
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3064 3060 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4148
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3020 3016 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4df3dc2156e9b1d965f0f6123743807ea66c3773c2935f2d4c8cfb2f78f6f67e
MD5 a3ef65dabb92d6a31431c3815882a6cd
SHA1 998796575127d14bdc7f842cee325c3cb67dbfe9
SHA512 4540bbb9645f55ffa5225a66175492a4c645c375f084cc1dc80ed38165b3f1f4b38b24665bf29239e05f38549b4cbc84bce771c71e58e70f9f5c9cfbb3ccb1fa
SSDEEP 49152:Gb+632BuPkFKRrdE6ohvstBhuXjfS4LWxntAQgAT76sQuE:43q6sjB9qGsQr
TLSH
T1B7D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 f65fec6523f3de66d4c550a4e6aa48892fb2e7021371a51802e6990857e97fbc
MD5 6a5ca25103c6cddf1322823cd5f239ad
SHA1 135d292d8c09a2150897a1958e5cd15e0b2c1e1c
SHA512 2664d01cf424e38b25669ab7c7d10e6087ed464fd596ffec7f90918ee97187d51f99d198303c27f37dc434a3db56414df076b448c961d73cc219db6ec63fd48f
SSDEEP 24576:cXYfDtczA8AfYLH8AcevDN0FImbwQuq3Wia7gD:btc3AQgAT76sQuE
TLSH
T12575F12963D408F9EC67813DCCB28521E673B8A54360E7DB03A49A661F332D85E7EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 8350dd69324fc4ef8f930234f48ef05efc4f95da715e6cfea143f0159164d750
MD5 0cb056cb988e04d7047c9e5e60a04a98
SHA1 2325dc1651b9b85a43444b14c2f56b8eab08b26a
SHA512 a9e9e1f8fbe81e5f5aa45802860f5e5f95c7c154320b0f26b761a12e3cc88f8a186eeca2d0d6cb4467c8921ad7958c588c5f25371d4192ecf1c2e409d62c9686
SSDEEP 24576:B0Le5ji0hmxxrMlAfYLH8AcevDN0FImbwQuq3Wia7gD:BPji0AjCAQgAT76sQuE
TLSH
T11585AE16F6748335D073C0B9C5D2A69EEA71308657308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bd16489f84f7e744d17d7c590f27dc631779a86aad3133e89c1d6559dc7e8b68
MD5 e2b0f0c64c6ae27db7f8126daf0da951
SHA1 826ab35fccfb73842563f4e23d7ab09fbef6e437
SHA512 f8938e612e3bcec09fd84b9662318edbee1136a7e0064cf23fffc18547b7bbc13def5ad850f686402134d1ef287098bc858dc9d9b51332d8d2eeb08e471fac13
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWn6q8wyuHAfYLH8AcevDN0FImbwQuq3Wia7gD:W/ezSC6vUzPveHjymAQgAT76sQuE
TLSH
T160755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 21d7cf0b88d3de3dafae5a7b4535388cbe7852057f175108e4a697b2a0edd954
MD5 19a616019937eaa3c6f0456bd96fac12
SHA1 570aa3bb36dd2529f4739ad891ccfeeb0ab1c87d
SHA512 daed3994b04f74ad71a2effdbb716db4f3fc8070596b81182dba132223a78f03203432b99ce6f569bfde05ec962c152c2bd6099d459549eea72a2acd2a28fb60
SSDEEP 24576:tVbqPb88hv/l+YYAfYLH8AcevDN0FImbwQuq3Wia7gD:tVO88hXl+vAQgAT76sQuE
TLSH
T1C5559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E676E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 de774520202a5192a7785f0f43de58ab29f92ee5a229136a90325ed3472aa0da
MD5 317d5761bd6d4adb29d52e1828c97214
SHA1 18738125fcefb3fcb3938cbb1989592c87b4b8a4
SHA512 0d59f6f6c2b471016c26cd0d007c1151dbd5ee3d3ee9cf51dd71ad59c314235784a87708b42f434cda8f5e4251ee820f9efeb6654a7149de5781ea691bc6c2aa
SSDEEP 12288:ULRAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ULRAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T136552357864C30EAFEFBD1369CBBA9B963D1BCB88244979A00463BCA793D408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 8b01d736e269389b5f775217a1e514719813187c0cd99f812039dc21a245052c
MD5 bc80e73b46af3378761c38205ca49112
SHA1 7b6d73ab7b2010d6007b5c10241f2e1f89f349bd
SHA512 16e22847c44e6d8f69e4590a397dd802ffe9f15017db1876b527480f7fa6a2837f6cd25757fca60d8dda0e17c9d71e7072a9d19b75c05640915e0979a3ecf9a1
SSDEEP 24576:RJIUwAfYLH8AcevDN0FImbwQuq3Wia7gD:RJIUwAQgAT76sQuE
TLSH
T18675CF3BEE28FCD2C67E8D795A918600E7B278704B51A3CBD165830EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 aa12876b48f93254436b44bb72b98962c2ec77b0061b1010c725eb762d492e0c
MD5 16a683a3a990b6ec75fe39baf4ef6294
SHA1 8d8d97f4f0c5c904557f3de27a9174fa2288f7b1
SHA512 866ffe8f96628042e84916d271a7d1db191c5e714388bd839fb08df758ffdeddb498ae0878676828eda092b1a286727c1687196d26c430421a59a899a4de51b6
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THX:nQvGAdlCEL8c/DRNw5C8qGsQr
TLSH
T1E2266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 b6b0d782ca840f62f3bc59cbfa0219bf00d76ebc995a3177fef856763a66f805
MD5 99a0562c33fd54fd9c7fc80e047690ed
SHA1 8b87fdee942c04949edaf325f20b7086bec93338
SHA512 3ce41911c0eaaccc2fdaea67f0d9fb98f8d541484aa47682ea4e9fe691ae1f4d12444819c39c75e3e93ce9e03b135cca08f850d26a6f592e05b5c88d3dfff82c
SSDEEP 24576:b0ewsAjSAfYLH8AcevDN0FImbwQuq3Wia7gD:4ljSAQgAT76sQuE
TLSH
T1DA75E031FE74E036C6BF0DB21B36C716146CB9604B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 973c68c7da5f4477f5f0d9bcb80bd5cb40bd6971035791eebd966e217a81a3e3
MD5 d3c7df1782da9308057ab0f580fdcc66
SHA1 462c9ff9b19bec843048e405ff435f11ae3d14f1
SHA512 f5d6b1d14c8c2abc03ab9dd7a9b9570c4b49a1221ab2d1f8d8f9f98f9f7c51b9724490cadb72a224d730986f75ae78fa9c43ef9f53364696a9a021cef45fe469
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHpj:qUEtQevvqc2W1cpV2tI32
TLSH
T16E474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1d4215a65f1d79df15d3b0e3c1d53d093c8b634237351183f62acc021b98213e
MD5 3485db2f9d912b0fbf88c3b75fd7aa4e
SHA1 da2c22c3c25281d91961b666d6f91762356adf8e
SHA512 fc2144f53b15781382f0772548af649e7c959b022c257bc643cc768a5c85e869c2244cb86022e043d2512c1ec9e8c1b5b1910f2e9d487bd7f824e1184bfe062d
SSDEEP 49152:ICbRquA/m2yL5zTfFiV+XenmE3/zyAQgAT76sQuE:hoquVjnmgqGsQr
TLSH
T143D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 087bf5403b96e21351598b66b4f2ffbf5b66b9a0604dd25baff1fb6307481c85
MD5 0c36a00c3253fffc1e4bdc2e6fe64148
SHA1 4bf18078eb0fc839686c67a05ad50c74badf031a
SHA512 60bc7e9d570fd299ab5cbcdb1dfe76b7964dbc9775ade39fcddd811fc68c4c071d6647c6cc1edb7d73d83741743aa7bf46bc549059628e31d496117c4dd40706
SSDEEP 24576:6AhGL3IFoiwtA5l7S53bAfYLH8AcevDN0FImbwQuq3Wia7gD:6AMUFoiq5LAQgAT76sQuE
TLSH
T14F359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 745ca300dd7e1dfa5b5e84902b76f23ea4cdb6db7761881548f1d3115807ea86
MD5 0d2e559e885a29f5c693ba4bfefe7e38
SHA1 bd1f1fae73faa975950060bbb34cc8cbe2399a57
SHA512 9586be5918ede212f31741e83313bb644cd4ce13f93aa321651e8cd4138b56e0b6f8f07460204e7e9ff8218bf0f39414cddbcb69e5707820915d3105cae107e1
SSDEEP 24576:Pwu4OWGAfYLH8AcevDN0FImbwQuq3Wia7gD:PwvOfAQgAT76sQuE
TLSH
T1F365F14A76A81CF9E9A781398597C136F7F2BC152A21D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0bb79935670f8d2dafbaf4188ef6f33fdfbfbea0380b95f30da0abe28be37482
MD5 befc74953d8fe34354dd0aef76224a8f
SHA1 41368f9722a9d8d6ef70461512f582c466fd1c9d
SHA512 d58c2c90cde72c9e1a0eacb657efba7fce8924a3c2a857532f36da781d448b9ce4531fd9dc3b5b5e1e3685ac8b043fc5cbc8950f2bb0367e9b95f401b309df97
SSDEEP 24576:RZu9AfYLH8AcevDN0FImbwQuq3Wia7gD:AAQgAT76sQuE
TLSH
T13255129B239830FAE5A7C139CCF25659E3B278A6532183CF0115079A2F37AC59D79B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 56594fc8c27aa13faf38e90e0ac0b0b87056831a5402cce46e56b19fa9e648be
MD5 206641a852605d6c78ffe256368338e0
SHA1 02d0b7e622a54210a9e3046250d4c4535a338e0e
SHA512 d26486a44238aa76d21b465f7db040285e9d59ce570020a585ed4edb69072d1a02be5414063b4e844cf194ba7747ff57676706e3202a3deb531ae2ee1fa0fd54
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UD:2QRQyi36YOcPbLvw2gAf+PN35qGsQr
TLSH
T197667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 782244415cbb1fead29c64cd1424481a69ffed78f381de562815e2b7e8be410f
MD5 2e37c906e24c31182c5a20e573a873ca
SHA1 7b48d5d6a495167cca717dcd43477d10fd909c7a
SHA512 501754d243e5cfb039a3eda986b251535efc4f7c7e49a328bb4e84feb396549caf51ca5f7700e88a0db1647904065524dcfba2d8a113ffea26f82d80ea36fb1b
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UD:yQRQyi36YOcPbLvw2gAf+PN35qGsQr
TLSH
T1B7667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4a895e044997d8e92e137096c84f560504ae666523daa720bc3dd822b947ae19
MD5 35b8643390bd9c6c2c11b3caeec7b01b
SHA1 30f1ad09ff34655e1560992dbc03e9f18ffe6015
SHA512 4b7a0821213fb48c32b4c35c5451d579a80a0a7e7c67beb1ffe3ad02746cb13afa1951c6229d3ecf9749bbf9f9e657f2bd78f636cfc53d931c33ad008d68d497
SSDEEP 24576:4wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0tAfYLH8AcevDN0Z:e68Qg55nhceWu7PNU3/CAQgAT76sQuE
TLSH
T11DB54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8fbc257e06656f33dab2de5282b0c35755dafe4caadd844780974155131d81c5
MD5 0be46eb4f0320e13bc5e5c0012d3d96d
SHA1 e287b45d2a42148ad0a0c96d3b94afb765581c01
SHA512 a7bcf63b45bb2c15e9a422c0ee8cbf8d79fafbd937e4005b14c61eede5b3dddd2233795b750d0e914701b8e3fac89f10cd75b01c3774d7e958acc9931af595c5
SSDEEP 49152:Q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk999:dy5112gYy5azzVvt69nLKnhZaqGsQr
TLSH
T1F2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fc87b2a54e6a1a824984d461b127e6baeca3b025d1e0770ed57b0401bf42c210
MD5 2fd48e7167c53a48b38aca0b7dc9b973
SHA1 50e133590f54f48ac42950dad31812f297b79244
SHA512 b3746e548d34a4ab169508d56304f2448f0d76f04406f3bee3b72b37188975e6b4b35e9564332a53ce1d29f62dc9ffa87074e2ac68ba72cc1d74e03fd321e390
SSDEEP 49152:1B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glsAQgAT76sQuE:7u6Jmdxd2dRqGsQr
TLSH
T173D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3b579e6206c83eb465ea244a606ba9c7628e604d1e3c6b60f777abd0e5dbdb0f
MD5 5aeb13729fb0ce091de44d9a0f5b27b7
SHA1 d9733b0831f18e4225fff68d1c09cef997f21205
SHA512 466f9ecfa6ccbd3a0befdeaf543397bb0f88a491c1c0931e2768b3a06c8d372910fe76933172a92feb13cdbe89f79e0a6b145169ab205fd6a0297d26f0a01c50
SSDEEP 49152:a1hpsNoJpF1A63U44CwH7R4xQAQgAT76sQuE:amifPWRgqGsQr
TLSH
T167B5BE13F2D900E8D06ED17887569232EA62BC450B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 98c64b16794c9a1da6fc26a4b9f628baf585b549453d104299132c6e5a75cee2
MD5 564b996d7fdf21f792a7c6810d098dda
SHA1 61f75cf9f5b4f4e5ddaefdb1d668586084de7d79
SHA512 cd43a0570eef99d569eadd1279d4c690b081d2df5a9abdaab6024c58aac12d523f5837ee29293fc3b702573a4f56f2eed8bcb024edf3f5d654d4a8b348db93c7
SSDEEP 49152:uSuZQIY0Be2KcRVtOnks6NMHq9AQgAT76sQuE:g5dKii61GqGsQr
TLSH
T124C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7b11234a519f724be77bf929a73ec7daab657558cf3c69c75e5bdecd7bef1de1
MD5 651158a6c61fdf263b2b30533583d184
SHA1 97c8801c709c31e0766533bb52b1297154222001
SHA512 9b2acdfa534f78333cef1097e5c6b6857aa5e5ce89ae2b37a88ba18dc6e459da8bf596b511042df420f014a2f90f88b74f2694c29f8f7e2957efeb8745fbd3ed
SSDEEP 49152:chtSn8EApI0fig3giDn0AP5w8AQgAT76sQuE:dX2imphEqGsQr
TLSH
T12795BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e5c78b90cf9be5c9048dbf6ab169ddf5b69f371bd68073dc1d5a5b9c924d47e0
MD5 6877706c6c63b8e3a9eb696a12e83450
SHA1 8d697cb7d4b24f3436a1fb96740e280e809dbfb0
SHA512 d9fe60cd50f8bd220bdbdf33d3e714bf332644cf43f40ec7582c71a1b09fcaac93a4736fd6b815110db387ce30de6702fc297550b7cb785cae6419059b5d918d
SSDEEP 12288:PJAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:PJAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17555235B494C30EFFCBAC1368CB791B9A3D07CBD9346939A110A2B8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 404efbbe19e1ea2f6da6f17393a4fbf8cbd948df33b5190b5df3eccd60125e2d
MD5 df1f950d254a5831fe2c3fa7d02769e0
SHA1 4b012c2ac536e199dfb22add87ce4394dee9dd1d
SHA512 6431f24b9b098386224fb8807c95dd67c1cd67ec2f24c738773a72db2880a6e8344202defbd628448c1dbef1a92985c0f56138588500ee016439b4ab958befef
SSDEEP 12288:xuAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:xuAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1DC55235B594C30EFFCBAD1328CB791B8A3D07CBED346939A150A2A867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 84df9c453b8d25fd18df3aaa802bf608814499581ae07002b457b6d2cd55ad78
MD5 6aa3552595381b280cd08cc8c19235f6
SHA1 d697e73dc47d66d5d7fc9370b25015043755d23d
SHA512 919d5db6ffe6438bacdd9966f1838833763150abf65d303e7423a9fe3d6613ac2bbaf5431c79f283a3dced456f78cbe51ebed23d871e2f52cb100da530e20af4
SSDEEP 12288:nIAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:nIAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T16455235B594C30EFFCBAC1368CB791B8A3D07CBE9345939A154A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 5af2b7e01d069aa49fec367fa06a0f4d88e4dfe8ad6590e976ac36d0adc33769
MD5 51e4ddbcc49f5bc67113c95e5285d131
SHA1 c0241ae496b9ace6f37cf79da0d2e0d93530aab2
SHA512 c1e6fa6ebc48dc8ba33d10c948ae372964255d4b2e5437b6a71c6838ba0afc9eb604006e1ccf320e1ea017d1b0d820c7c5986ecb2e95d2b2535e4b2e7d0bb1b5
SSDEEP 12288:IV7AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:oAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F3552357169C20DAECBBD135CCB79179E3E1BCB9931293DF06011A8A2E3A25891F4E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1440bb31f00d8d3e36e80f8a90d9c92d184b12be36926c4658b8fe7757446656
MD5 644fb0e037bc9f50099b6f15328318b4
SHA1 3554060bc6f8ad7e5c053a7b00889e3664062e6a
SHA512 fadd1bd98f9b6482173871a74f504144b8546b03fbfae87f8d9748b9dd1d0032d61d94ec211f71aea63cf9f06d68a9c8b4da4b1388f32708c95999e0b2417960
SSDEEP 12288:rjAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:rjAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T10955235B594C30EFFCBAC1368CB791B8A3D07CBE9345939A150A3A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 86bf207daf59bd211afb09d9723bdabeefcc3af6341c635170a80e9c3fe06451
MD5 2971fe8a0b1abb72d755902ad9390d8d
SHA1 3a2e084342b0ab95878484652aa271bab89db0b9
SHA512 6144a5b57f1239c7e9bbac290e9fcd7891b6f0bd70c47ecd141ab9cd96653681f5d1db9fe8a1896410f9a5505ab1c2ef1886f0636dd3146d52aeb8beafe22391
SSDEEP 12288:YKAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:YKAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1EB55235B594C30EFFCBAD1328CB791B8A3D07CBE9345939A150A2A867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b0e79bfbf36d22d0a16f6551ce624c8276882b32f2fbf0962487e35a61c96a5b
MD5 90d88aeb1a8f4f30aafeed98ea69cd9f
SHA1 3d95c0918b4f77ee406741d36ba9c1c7911ec5af
SHA512 a5df915dbf1b2de9689f73eae42e7438d8539b53ef0339686a6278dc6d3c36c1108808bb507c4ec93c8cc357f0e112595c36dffd5fb472bd374b3c493a6c1207
SSDEEP 12288:N2AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:N2AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T12655235B594C30EFFCBAC1368CB791B8A3D07CBED345939A150A2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 af3154d2973be465e8178ce10c71833e18e344e4c217fb12230f7822503b5c49
MD5 e10720af041bb79d5e7a94dec63c393b
SHA1 7381076a41ea9a0fab6177b33b91294a52109d73
SHA512 19cdf232a2da95a1e913277706ac500dbf97b47c8360c4403d3b8824156ba7cfc6eb99cdae2075891cfd15be9c41f4f5dbc7be7efb3bc84376fff134a19b7e98
SSDEEP 24576:YZMRzFVSOOAfYLH8AcevDN0FImbwQuq3Wia7gD:YZMRzfaAQgAT76sQuE
TLSH
T13E750195B39018F8EC67813ECC668916D2B27C6A0760C65F03A4366B6F373A15C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 3e36873e889b14d95e091353c83580724233d68b992d71544a58e49ab0903e87
MD5 5dd6394e47c1747b73cba48a7f1e89b0
SHA1 87420da50c72f2493529a66a2d6e6a10f961a5c7
SHA512 fab1040f35d54f9788ceff7216597a872ccc96e76f8954501cc4a47d30eeacba8b128cbe8f206165aa254587dc75e120e894f7ce6f9de474e81efb867126f6be
SSDEEP 12288:INAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:INAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15D55235B554C30EFFCBAC1368CB791B8A3D47CBE9346939A150E2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a8f2083a8e0d6e480deae99719f5df6f1479aa4fdb543d77d458c01c19306a3d
MD5 e4827206f7fa0e81e2d01c29ccafbc13
SHA1 bf009f600abc8b16acd775fd693fb18031ca784d
SHA512 70db519f4b5072fd63567808d4a031e9fff8a8f841b4cb8da2e512ca1617d7faccd8cc1b491feffa6f88f8752ab3f8f2718c3534f5feb2be7d49a9952bb80cf2
SSDEEP 12288:RhAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:RhAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11155235B554C20EFFCBAC1368CB791B8A3D07CBED346939A150A2B8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 ef01d8afd55aaf577c8adc132786a77fe4a0d1494a4b8c1f84dd107c5ecd63ee
MD5 0c29467ffdbb909819070e6e380c7d0c
SHA1 e0adb71b0744d0a877f954b8a4c66d3517399037
SHA512 fc4122f0ceffcfe95f5b7e749cb26bed9cb47897e1de98d70d0229aeeee6b4bef4e6d99d08dedd42f8d11f7efcae18fb37fe0425ecfbc40561249d98ae7ce6ef
SSDEEP 24576:dzyiAfYLH8AcevDN0FImbwQuq3Wia7gD:d/AQgAT76sQuE
TLSH
T11465015763A530F9E477C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ee97bda5e452b4db2db73527d1fab5a6df4f718c53a0fb542092e1fa0deebf34
MD5 7d29ab88abcffb7692a5f7ec965a39c0
SHA1 05bcd01e3da2c090b27903fdca239a1c3ec64ab7
SHA512 da4a354c8993b2eb2a0ca0ea9014520961ae6c2fc6999295c1e1db59b18f17c87e438dd2ab2c54e2df36ce77cb52b5eb73d2357878fd1d507c46a0aaef140c8f
SSDEEP 12288:qNAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:qNAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19F55235B594C30EFFCBAC1368CB791B8A3D47CBE9346939A150A2B897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 50d2668bb7b72f0f4ecc2b08a7b088719217badb34acdc37922090a3b6b606da
MD5 db24ee63180e493830e3c7bc623af95d
SHA1 4138b083f140deae413f7d5b63081417a8aa315f
SHA512 02ab889ec9fb5a0c8b50d038c940058439259ad60b618427b84ee98e0bf1fa7cc76bed21360a50a741689b257ea5a5005cd9c3f368235f84551ae7654fb0a252
SSDEEP 12288:2NAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:2NAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1E755235B594C30EFFCBAC1368CB791B8A3D47CBE9346939A150A2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 8747aa772514bfc4159c135bcf2decf3281394b8373033612b1a76ae3592beae
MD5 de97b0f811176e69df80b90e3c30b531
SHA1 abaf16ea27a767674d4c4c198a6d4322842e93e8
SHA512 fd1f341ba2b51cb9782feba27890942286f96692d64525c531d0afa53b5fa0f7b1c1842efc0696ec37dd27df3289dcc0e4b23fab7944d27648e9b4b8f966f7ab
SSDEEP 24576:yzyiAfYLH8AcevDN0FImbwQuq3Wia7gD:y/AQgAT76sQuE
TLSH
T16F65015763A530F9E477C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 77de81d42aa3c85b7d724aa2dbd9b5f913577d4d07e05f65b2543c51202d08f7
MD5 76161c990c1c6747d295e6479123896b
SHA1 d748af8f53ed87e536462669723b1473e7dc4949
SHA512 dbefe2a6787d4ea8f6c0d664f8827db3bc557d5fe1c6f949e93a072724ae5b4fd6f868f08af9e7cf5ed3e63dc3695f176238b80e2bd793b80e09f30a280dded9
SSDEEP 24576:dTDaLl3z0zD4AfYLH8AcevDN0FImbwQuq3Wia7gD:dTuLljHAQgAT76sQuE
TLSH
T14D7501A5B35018F8EC67813ECC668916D2F27C6A0760C65F03A8366B5F373A05C6DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 dfa8d47a2fe9cc693ee0026a68e7242d78aa4c37358cbfcbee65054a44c00124
MD5 6e1af54787668b381f48fb37c74a4fd1
SHA1 bc8bd9761d38f60066449ca5155e0dd241920f34
SHA512 8b71a6c5bbf9f44aad59ab8a3c9b1d768a9de90dde87a55b7c6a66a1a7c3ffcfa9a6ad29a78741f13fad5d0e1884138ba726a0b3f1d603d35a1ef331d5c996dd
SSDEEP 24576:G3vd9CHKy7GZ0AfYLH8AcevDN0FImbwQuq3Wia7gD:ovd9CHKyaaAQgAT76sQuE
TLSH
T15885CF91F3E810E8F0B7DA358D765511DAB67CA91B21DA8F03A4265A1F336D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 90ee408afbe9629dd3fba942365cd633bce115d51e3601a4a1c94fcffc0d5599
MD5 2e5306a42ecb89cc7189f9ae1f2db838
SHA1 36f5b9de1adf236d99e0777673bcc405e0adf08b
SHA512 85c9b4c6ce7694995fc692009f9754b8e22121689a1d76afe3d4891dab6aa8e414e2300defa1a8f0791cc759ac3eb7d5662e16d3b0081ed2e76e5aa427e9c195
SSDEEP 12288:loAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:loAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1CC55235B594C30EFFCBAC1368CB791B9A3D07CBED345939A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 2090fc28b92919a87500fe40d9013e0120d7daf6998458dedee5d6c026f66e61
MD5 244f93e17ac668c2b6de3a44b1323690
SHA1 383c3ed513b396f2140600e66f612588d4eaac19
SHA512 4482fc66d7991429b7eae98c2f0f5d7fe9a46c4fab615576b4ba0c22b8d76828219893c3fb4637f8dd8752224443aa0219d197349ffa0ca22f58cff498309740
SSDEEP 12288:eCAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:eCAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1EB55235B594C30EFFCBAC1368CB795B8A3C07CBDD346939A154A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 466b1eaaa2503437a29e252b82f4f55dd93fa3c5e70b9beb7861e4789c324272
MD5 dbcc5f6b674eb12c8839e16bf87cebd9
SHA1 e372fb64f434b75baf1c5002b4724737528eedf5
SHA512 01a415abe5205925fae90259fc48b9d2a1d57eaf195ef074d0caac5ae2cb082b2639586a0c3b224c703a419a962c0a2d5628c53b49f77c7c1421b7906322da36
SSDEEP 12288:hPAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:hPAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19055235B594C30EFFCBAC1368CB791B8A3D07CBE9346939A154A2B897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 fef089175c70afcdfb25711e1b95ae621afef53694ed68469101640e8d4bcf28
MD5 d2aa0bcfd29388ca75a2984ec80a55a9
SHA1 f7b4af62ed105cb104aca5d5134313c2f6cee437
SHA512 618091da2d5436cf0b17bb8f5ac9940570f6a74dba95c37f6346038411e0fc30f17d8e5062eb4cd2388c4f6c821edc1231d60b1941670ebcd5c93f70e3798f86
SSDEEP 12288:NNAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:NNAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18255235B594C30EFFCBAC1368CB795B8A3D07CBE9346939A150A2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 43d9325885623ff0d9df9bf6507e0be248d06b3d12426739a37c4ae5f3463e0e
MD5 88c5fce61f29eef3331f753868300f03
SHA1 50d51d973f88cc10ffdd75765495e6803e0fbb17
SHA512 4287176342208cddd8749936cf9bc78c43eb0103a1d84aff2053941795071cd29f2499f3fb0d45bfb62835fe2063932096c581cb09aa38ba0880947c03a59ebc
SSDEEP 12288:8oAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:8oAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1EB55235B594C30EFFCBAC1368CB791B8A3D07CBE9345939A150A3A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 b0a1706f50c4471b420ee94e2d9871d744893c82625ab8857c4ee56dd2808e2e
MD5 d483beb76038ce671dc592c2a2227293
SHA1 25b99cfe50cc0c2ce68f1f45e0f5ee7ec8507c16
SHA512 73d98723c398a8696ae846ce48e023533cc097755ef1c0822d927fa4fb7b5d5e1cebf486ba53536f034d03f17964460211fc9f425bad9a5ac2d1689f7d51ff3f
SSDEEP 12288:TVAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:TVAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1FF55235B594C20EFFCBAC1368CB795B8A3D47CBDD346939A150A2B8A7A3E408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 e08fbbe9b6eef499af33348543596cd52517ffb5e27ee10296daa21501dcec71
MD5 d0b9d0d8281cf34238e6c2e56c890e90
SHA1 4f7eb4ad5f433648753b37c0290f77c46ec885d7
SHA512 f7969da051be50f309dcd5097a64bc241edacd4f6b5ace45cfa95de8fe150d7418d28f5050cdeff050cac75eb913458cf40a79f3fee4fa0cbee456c8fde75ae1
SSDEEP 12288:bjAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:bjAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T12055235B594C30EFFCBAC1368CB791F8A3D07CBE9345939A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 a86b12180675af0518fc7ff88c1acc688837ad4aacbb4469300713ff6789171c
MD5 3919358f13a0a750fc447cc7e5d6cad8
SHA1 f2610cc27a0e2a71102515bf71493f6aa66e19ff
SHA512 fee19aa0c1225e30b95f6b034310db7d8fcd375ae96f7f74323b60a9e13a0e22da806fce1eb560786bb3be5344989f90ae8ebe4d6806b9f436785a7441c1542e
SSDEEP 12288:2AAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:2AAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1A455235B594C20EFFCBAC1368CB795B8A3D47CBDD346939A150A2B8A7A3E408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 aa9522ec621eadc3f589752167b013fabe1cabf007e177fa9d17ed46a76c0e6c
MD5 ea350362638aa475fc19a0ce77028e2f
SHA1 a6ea29a8e52d07af126df599d80bc8ce9d1985d0
SHA512 a1b935c84ba6b97080d84e68c73564ae2e8963ebf3d76c29a6dc5f8647285ed07481f74db1d2a123f6d231b525e9153061eeff495655e4052b870646686a7789
SSDEEP 12288:wjAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:wjAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15255235B594C30EFFCBAC1368CB791B8A3D07CBE9345939A150A3A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 ed25ca9156766494ce849f5ed58feecb60083790a4168e1b34e58ca410fcc928
MD5 8a575e55e4dc5663b8bad056b79b6946
SHA1 a56b05a3e4f919bb1d52fd7f0638f16074781348
SHA512 8a778f87002f0a558e96450c41cd307106ceefec4557fac92e5e8dcf3559d444a4b0a7041d709699d8eee18dd5b93b095ff1fdcf5a78f6c0f7bfb9bd7fd90fc3
SSDEEP 24576:JfwvUk9RX6wkyAIxAfYLH8AcevDN0FImbwQuq3Wia7gD:DMnYIxAQgAT76sQuE
TLSH
T12B85CF2AEBDC44E5E1B7913C89B7460AF2B178691B31C2CF025A53AD0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 07b464ff1b36f25ead642f0e2ede55523393980cd6b8e02b07dd6dcec0988dad
MD5 6c5be7d3d1bca449ce2ea0cca79d88b8
SHA1 5f80733a5903580b80410524dd936c4c3b44bb43
SHA512 47356b1f6785e7575ae3c63e51496d21e4f94d81fd314a73d51c6ef52be6f6304b1e625950041a62dcbec305264cd211971ae44ca635597aee2b3ebb4b50e0e3
SSDEEP 49152:AYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0cAQgAT76sQuE:HySzPZqGsQr
TLSH
T125066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6258c64ecf9564eaf2efbcefd02c103c954d8586ba3e8f293f13413953236fe7
MD5 f63c7260a45321251ba9946582ef29ba
SHA1 e77a8d7a244568b0407cd18b81f684f10dbd2f24
SHA512 847674b4d13bbcb97720b38428dbb33aa95c0a6cba743e88849fd5c560d1479c7f4af0563090fe3ac3eb4e287b522105bd973523c42380a4e692585fce175456
SSDEEP 24576:n47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYeAfYLH8AcevDN0FImbwQuq3Wia7gD:n47JUQjTirIhCnDHUPfF/sAQgAT76sQr
TLSH
T1E9659D1EA3EC01E5E1BA923885154A5AEA71782D1B31CACF1270437D6F27ED49F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 3cb066dd0f67a364a7b94c41dd05c05a25883ef9191463b6de0bd7693e171940
MD5 a98528d5dd96ab72603c9b9ae7ae67c3
SHA1 043c49cb42db4a8fb4c6651a812dbb23630f0bcc
SHA512 c05f9eb87f0cb08a1664c69e39ade2c6cdd914f91cc5828dd82bab425979664859a24f435c0775ea5158f3998058bc7ae33921e68f7e3ff1f976b804d176bf10
SSDEEP 12288:/bsf9AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:S9AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18F65011AD29811E9D46EA135CB664650F3737C6983E1D3CB12C0F67E2F3A6809DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3f214d2ea6acc14e01c0cf45e19956cceb54d7da1d8973e85fa61139bafb0c1f
MD5 27c3ed21a38e206446f60039bc7cf45c
SHA1 8145887465fe1e84b9e0fe8aef36fc9cec35a607
SHA512 a5f424493a01474ee7dfb025feb5669a9da72c543f2d7a3f30f5452bfad7142344caa6d6237e60dad3eb01bc0ae0731ec29b1a34fa1b81ea36a923516532a444
SSDEEP 12288:p07FAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:6FAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D5552357878C64DBFCBAD135487B91386399BCBC870092D7640A27CA793D8C8D9F4E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9e5376c625f70809c44c25e91afa2380e6eb81902160ebe4e5e539b518a62820
MD5 4cf970ede379149f93b5d98dd8fcf7e7
SHA1 ad0b3b611d4022805599e0e0e33cf4d4645f89bf
SHA512 cbde82a9f3d77acd483d5acbb7d98e7ad8952e0a405abcc4213f799486cbd4c3eb44833d95d852545e4b513e1fe2e653ff8120f1310c857ba819d21a50cb5670
SSDEEP 24576:Tgb6bmBIi49WNNFpg1rSvFv7bYHAfYLH8AcevDN0FImbwQuq3Wia7gD:Tgb4mBIBhGFeAQgAT76sQuE
TLSH
T10F65AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 9ae38e32cb9db4ef33794c9f065b1790fc0eac8950749319464bf36be872ff3c
MD5 3e81fefbc5cf38ded5788273c1601306
SHA1 ea020b5948543f9e654f9b07b242ed0b6f488e63
SHA512 fdcb0eb3aff32f8568e5451a00239153607846e712f5e3f1fada02df75c738898c8825e8d3d11e5079c05772c97e9d668a67c4eabbe2b2e437acd67d1274bb8f
SSDEEP 24576:3G88u8FpJqH1bzria7/mOAfYLH8AcevDN0FImbwQuq3Wia7gD:27ZFPqVea7/vAQgAT76sQuE
TLSH
T1E785F16667E401F1D47BD13889924663F6B2B8250364EBDF06A88B551F33AE44B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 88fe72bac1a3071659ca8cb72358fce4750745680c4bc323471f316803b06d9d
MD5 62bee5c99b02d8df6bc6c7ca4682eb87
SHA1 e50dcc68b869c38de50ddbe8ea16a487501b7375
SHA512 5a1d8b7c668a4b83f7f829ec02f81c9c8f18575e6143ae21a42fd5f7ab6fa634a5c74685650e787582fd0b5df90c07104911d3ec563b2729ee7d5e3331c6fc4f
SSDEEP 24576:jPUr+NQaAfYLH8AcevDN0FImbwQuq3Wia7gD:jJQaAQgAT76sQuE
TLSH
T18B65E12F22AC18E5E67AE13D89968619F771B866031192CF0291817E5F37DD8BD3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e714fe185f2c8ffa6607e869d93a07f5a41498e5cf53bd6a8b5ea836746eb251
MD5 59af3f31f2cdd1360a4733c297707b98
SHA1 fc4169be0dc1ed48f183fe2dd20a2df4943b6a8a
SHA512 ed08bc06a7598e9721172a495ebf10eee3527f77a7738e442478e84a40882e84828f77e82e6bdc2585fe16a33bcf2685515b26b052c6db0eb98190e786fe71e2
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKAQgAT76sQuE:FG05lO43bCqGsQr
TLSH
T152D5CF6E62EC11F9D0BBD17CD9C64A0BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 eed79ab28cd78bfd44c71c9c202b3575c02a60432199330203dd107798b155cd
MD5 627812b8e7f3db5a495edf261787789f
SHA1 8cc5fc4492395b644d7e496e56c9eee5b5df1f89
SHA512 b05a39ab9b233cdee98c14a8a9e30fba84f95e02529abb8d5a7c10ea75b6d4ff1490e833c71786fd81340fee2a2264f43928a12aa48b36e448ebd38770056a00
SSDEEP 24576:lfa5POZ3dpuWVM50JicR2hG0lasx2+47eidncAfYLH8AcevDN0FImbwQuq3Wia7E:la5POZ3BJt2pasx2+mCAQgAT76sQuE
TLSH
T15165AF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 682a1886f3868cbde983652ced11b00ef24bba920a4367968120bf5dbd9f7b25
MD5 3fd536e8cdc119b3621898870bd3b981
SHA1 e0891f47d80d0b6bcee2c80f0fbaaaa37b9afbd2
SHA512 aec8f1ba893d14707aa7cfb13744a163856ec0e826ed7a595b668bf99853bddf94526a0289bc602b156a265f6de23d3f2731f0a2049629348dad19d54d15910e
SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7FkmAfYLH8AcevDN0FImbwQuq3Wia7gD:3Nc/zEOVHFPAQgAT76sQuE
TLSH
T114857B1623E901E4F5BBE1BE89779546FAB17869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 468c3e3e702fc9a5e13f51cfe2d75bb4aad3b915cc96c6fe26defe45be16fd4d
MD5 f749bfacba99044697f0901ff9fd6218
SHA1 b7d1c41e5f56522dfe798836ffde00cb74b0d36b
SHA512 0d24b18a36655767e094ea69dde888f939241ff2f2756dc6e2c7bc38f34a5b176843b1fa4a486286ebfb5f8d645780eaec0f66409754147da108b6a6f39ef278
SSDEEP 24576:zTkNvNnaFeYhJNtmZBmAAfYLH8AcevDN0FImbwQuq3Wia7gD:zTMwBtOmAAQgAT76sQuE
TLSH
T15655AF6EBAB805E4E1FEC675CD238512E6727861073293CB5290C13F1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 d070ffda3460e702df728ee5271f03177d2eba70aa1dd54183c42cba52d10da4
MD5 7d84078f9d0506bb4f4903f1e0919be6
SHA1 9c3ff1ae9cb5fc35c30e0636eb2f79707837bdd0
SHA512 c713daaacaf2da45f5e156c781d8f3bc5687fe5286ef9adad3566de5469a8e5d26336bcc00f19b2b85e73fb14a2bc3be0a3f7aae522ac9c0a910cb00860301e3
SSDEEP 24576:aD3FHshBIYQgApAfYLH8AcevDN0FImbwQuq3Wia7gD:aDVHeBIAApAQgAT76sQuE
TLSH
T19475E17EE65C04E4E57BD17CCA638606E7B138AD032256DB029481BA5F3BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1092-50-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/1092-40-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/1092-52-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1092-46-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/1092-39-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1788-392-0x0000024A23000000-0x0000024A23183000-memory.dmp

Download

memory/1788-366-0x0000024A23000000-0x0000024A23183000-memory.dmp

Download

memory/1828-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1828-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1828-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1828-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3424-362-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3424-114-0x0000000000A90000-0x0000000000AF0000-memory.dmp

Download

memory/3424-108-0x0000000000A90000-0x0000000000AF0000-memory.dmp

Download

memory/3424-107-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3428-14-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/3428-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3428-22-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/3428-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3428-21-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/4220-77-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4220-304-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4240-9-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/4240-311-0x0000000140000000-0x000000014038D000-memory.dmp

Download

memory/4240-1-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/4240-80-0x0000000140000000-0x000000014038D000-memory.dmp

Download

memory/4240-303-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/4240-0-0x0000000140000000-0x000000014038D000-memory.dmp

Download

memory/4340-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4340-363-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4340-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4340-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4448-359-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4448-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4448-101-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4448-95-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4448-361-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4468-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4468-56-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4468-54-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4468-287-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5048-125-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5048-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5048-119-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5048-130-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5048-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5588-73-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5588-66-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5588-67-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5588-302-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5848-88-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5848-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5848-358-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5848-368-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5848-369-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5848-82-0x00000000007F0000-0x0000000000850000-memory.dmp

Download