6413206dca0e63d1d8e23daa2a85c86b7f36c2b1765ec69686fdf9df9b1aaca1

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_f4bcbbb5e731575979afe2de2a60f67d_icedid_mespinoza_njrat_ryuk.exe
Size 1.5MB
Sample260818-txf6wsdp71
SHA256 6413206dca0e63d1d8e23daa2a85c86b7f36c2b1765ec69686fdf9df9b1aaca1
MD5 f4bcbbb5e731575979afe2de2a60f67d
SHA1 d923c08e80c0c681b9d7135459ee890d7e795a0e
SHA512 46ca606d33df5f4cec44ba6db4271e1be3ac19cb11b0f84f83a348a47c5907a0b85f93cfb9fe594b70348d5fdb24d9956cfd8414850bfc3728fdc5063c0cdc14
SSDEEP 12288:0yVOd/2mcJAmfPNsA9LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:0y+3cSmf1sAiNyBo4kx929bL3Hnx
TLSH
T1E775CF0163E801A9F5F7AA7899F68526DA337C855F38C68E0354416A1FB3F91CD39B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3232	elevation_service.exe
4500	elevation_service.exe
5180	maintenanceservice.exe
1536	OSE.EXE
5404	PerceptionSimulationService.exe
1904	perfhost.exe
4620	ReFsDedupSvc.exe
6088	SensorDataService.exe
2760	ssh-agent.exe
2900	AgentService.exe
4648	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-18_f4bcbbb5e731575979afe2de2a60f67d_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\de42446a763f1d8f.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-18_f4bcbbb5e731575979afe2de2a60f67d_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-18_f4bcbbb5e731575979afe2de2a60f67d_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-18_f4bcbbb5e731575979afe2de2a60f67d_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-18_f4bcbbb5e731575979afe2de2a60f67d_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000059da29502e2fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c393e04f2e2fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b29bd84f2e2fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009717de902e2fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001cc726512e2fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3232	elevation_service.exe
3232	elevation_service.exe
3232	elevation_service.exe
3232	elevation_service.exe
3232	elevation_service.exe
3232	elevation_service.exe
3232	elevation_service.exe
4500	elevation_service.exe
4500	elevation_service.exe
4500	elevation_service.exe
4500	elevation_service.exe
4500	elevation_service.exe
4500	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3260	2026-08-18_f4bcbbb5e731575979afe2de2a60f67d_icedid_mespinoza_njrat_ryuk.exe
Token: SeTakeOwnershipPrivilege	3232	elevation_service.exe
Token: SeBackupPrivilege	4620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4620	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2900	AgentService.exe
Token: 33	4648	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4648	SearchIndexer.exe
Token: SeDebugPrivilege	3232	elevation_service.exe
Token: SeDebugPrivilege	4500	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 4512	3260	2026-08-18_f4bcbbb5e731575979afe2de2a60f67d_icedid_mespinoza_njrat_ryuk.exe	90
PID 4648 wrote to memory of 4364	4648	SearchIndexer.exe	103
PID 4648 wrote to memory of 1772	4648	SearchIndexer.exe	104
PID 4648 wrote to memory of 4944	4648	SearchIndexer.exe	105
PID 4648 wrote to memory of 904	4648	SearchIndexer.exe	106
PID 4648 wrote to memory of 5280	4648	SearchIndexer.exe	108
PID 4648 wrote to memory of 5596	4648	SearchIndexer.exe	109
PID 4648 wrote to memory of 5032	4648	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-18_f4bcbbb5e731575979afe2de2a60f67d_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_f4bcbbb5e731575979afe2de2a60f67d_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Users\Admin\AppData\Local\Temp\2026-08-18_f4bcbbb5e731575979afe2de2a60f67d_icedid_mespinoza_njrat_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-18_f4bcbbb5e731575979afe2de2a60f67d_icedid_mespinoza_njrat_ryuk.exe" uninstall
  2⤵
  PID:4512

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5180

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1536

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5404

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1904

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4620

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6088

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2760

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2900

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4364
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1772
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2788 2764 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2548 1768 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:904
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5280
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2788 2764 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5596
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2548 1768 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0202b0a14881956fa9eb0d254df3fecf2fd7ace85895b110d9ff3cf322c9ebf1
MD5 e61228f3abd9c419dceb1a19bd2f3f6d
SHA1 5d9134f0bcb5e0b4d0783a2fa0b3d4ed8cf7608e
SHA512 27eae89cc62b6b6f0ea3deabafb81a9bc58f407a3cabe123ddb2865f7a7b322abddca6e0f995e2923a281a7d15db8c3c7474e7bf95344b39ab6d26a6e70d4ec3
SSDEEP 49152:xb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnHB+kn3Hnx:33q6sjBm+k
TLSH
T13AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 75a00d419d303d3d329f0bdac554bcc8943cee35f4c20911be7b2b1027a71b7e
MD5 6e647044b4e80d34eca33a3523551058
SHA1 6b5e9713c8127dc800ba0191a9331094b3e67b58
SHA512 d58e5265b34a90b16339efac6ec62baddcbdbe8487c15c246415fa6d4eb0b52eaedf6ec813491de5fe45980c3d9b82cc5b845b82d2383b1469b9838caf858d79
SSDEEP 12288:h1XLsswWkxy2lRq2czAszLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVo8:PXYfDtczAsgNyBo4kx929bL3Hnx
TLSH
T10D65012867D409F9ED6B9278C8A2C511EA33BC454760E7DB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 53cf2463c09b74cfcce87d44b095bc668b0ae1ea5f7ac2974937b194aef03a44
MD5 aea1d970ea779f685ec008af968619f4
SHA1 6341d695b014b03de6d60950f6a647d709d1f34c
SHA512 edb15ad5f7518630025b42253d2880575f0f9cc51445108feef675a05b6febfb7c1ee74a0c3444c789ff06a8abbf357d67f9124de4b0bec5f7c6fe15b324c21f
SSDEEP 24576:s0Le5ji0hmxfrMbgNyBo4kx929bL3Hnx:sPji0AdcB+kn3Hnx
TLSH
T183859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ea64335979292902b0d8ff7ba413ba87369c50169ab7b90aa35a0ec8ab9ab9b8
MD5 ee2ae3be56e6032d3d9f966d0e3d9d0e
SHA1 56d97247375a120cae03bb7783e75ec3058cc52a
SHA512 d60e7d9c013e5a21c97cfa72b0ea4471a8a5cfea6bad094a0b3a9776f21ecc96634cabab0a4fbb1b3318c7332988cd5fe647d0cd70b5cce7e0bf43481b70aea9
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWn6q8wyuZgNyBo4kx929bL3Hnx:U/ezSC6vUzPveHjyQB+kn3Hnx
TLSH
T1DE755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 26f6d9eb7906ab08c94bdab4fa530703467dd2907d80af1a38c3500bddf93629
MD5 59b8ded0f9cc15984d3fbf80a7bf8209
SHA1 e1f1aa4522d053cc4d1bef9c2c2a9b4b4f34b24e
SHA512 ba536664b0f3909b2a0266146eed40489bc217ae9c4bb757fe1239f92bacf0ab47e022596fa8b336beeb36ece0810ceb4697a35f42ff9410e721c11689cf20ba
SSDEEP 24576:8VbqPb88hv/l+YwgNyBo4kx929bL3Hnx:8VO88hXl+VB+kn3Hnx
TLSH
T150559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 cd2b35b06074fb5637569554ddbb9c1806448dfff6a87e387b0c02381bfe19bf
MD5 6733c8991cc2c2b0827b6653f742fc36
SHA1 ea01038d9366b75a1e4cfa47f445b34126648ef8
SHA512 9f1342ae972bcf5199e5d879884c60ea295a91a1f84ad4509cc00ea8a2ab56dbe01cd274c79974d5a193e14de420af2000f859f9d3d51bbbdcb63723b7d76d57
SSDEEP 12288:smvzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:smvgNyBo4kx929bL3Hnx
TLSH
T1EF4523124B0C627AFBBD3E70745E8454CC35BC8D0D95DB98DE62ACBB58BCDA2DA21103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 ec73f3552283440638d8efeb204f21e0bb4a5c2f4333c14f2ce65f50c7a84d13
MD5 e48ed49e9b8cbf48a727f4a8ff703233
SHA1 552bf325d235e5cc38ca16dc33ec5f12edf1608f
SHA512 5b9391f3528bd31e365bdaa6992688e3c40f4c472c1a5f0d81525a55b07bd49c472cf7c620f9298fa1bc0a03b9992681ed0671b56e87277dd18c74f77e5be167
SSDEEP 12288:PeBNUbTVO86U4zLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:PJIU4gNyBo4kx929bL3Hnx
TLSH
T16A65CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 21badc8ac2632555956ad41d323cf2e0ab44a1bb96684dceb8fb8e508473c4aa
MD5 6b384d331c35e3c440aedcc8ffa71fd2
SHA1 ba4ec3a2e79e9031848c957ef78e820066bd801b
SHA512 46c3b8655770158fe278fc4e9582ecf41ba7d61c75598ada553193d95de1665ed0b479d267c8fda33a69d06d4567eb167bbb742b2ab990bc0d1d3663b25ce070
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THI:UQvGAdlCEL8c/DRNw5C7+k
TLSH
T1C2266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 206e172d77afbebbf593f29f6a4b994ed8f2f2b3574ed6f906fef0aff2953c53
MD5 2f4d1966b671905b557f10640f77fd08
SHA1 ee7ebc2672ec61a56d8913f87dcb3604d71056e7
SHA512 bbdab4884fe642ec57eeea591800fbcd88a6e5b0d9e5156de5878a4f793bc919649b3209537c297cc454769b898d5261dca13b27d5c7236c78d118d8dc1f79a1
SSDEEP 12288:CAwSfxL/2Dc3XDLLmt0LDQewsAjWzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbP:HOewsAjWgNyBo4kx929bL3Hnx
TLSH
T11C75E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e8623636c9b2abf43d075f9854b6a9f258d9b666d44fad9688eb7e018519bc72
MD5 b9429c6a063e8fcb42f57a5e31e4b4cd
SHA1 df46a5fb096a0ceed82e38330f257ad0168af100
SHA512 b8712a8e4b1bd4cf2b344c66f53791300a85f0814717e43c3ac990fd728b2d8604c78b6fcb52a5dcbbc9a6d712de8aa9b5242b655a3d0e4f1a0c722105b718ce
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHo+k:mUEtQevvqc2W1cpV2tI32o
TLSH
T120474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a0300aacc71d79ff5edbf4d6dcef646a4ae559e4285fc5c8c4e20026ac8447cb
MD5 8882ab9a3c05f3e729aa11e8cbb9a591
SHA1 5bd68a632c6eb3e5fb04e424a4e016a17de73921
SHA512 ce5b9f8346a234730df7b5b1106d70ba1b5c9ec86f7b2b197aa37d96274ce9a370b62360fd0ce1e9c5398e94d4a1c03dc963f8ceaf0bafef6e8c422befe8bf8e
SSDEEP 49152:gCbRquA/m2yL5zTfFiV+XenmE3/zMB+kn3Hnx:poquVjnm3+k
TLSH
T1D9D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 489ba25a92beb560f99a5bfe442eaa2f305e1449240c605d21b5f45a55b2c222
MD5 a9287ab667ba5a0a580f2b8c82c8ba7e
SHA1 6a28c1da2f4c6bfa7113dcd1522a7054358f012e
SHA512 16d8b67743be53ecbb34a50965fc0131b605f592e3c16e81541741823ac5edd272e24dc649c5b9b07c2e6bbf4d57e7c0036d16c372ad087414f92e3df9329fae
SSDEEP 24576:pAhGL3IFoiwtA5l7S53VgNyBo4kx929bL3Hnx:pAMUFoiq5BB+kn3Hnx
TLSH
T122359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 28c6e256fb5d5d32295ce03f8622afe340a4c3ec56372e858253a1e381b72901
MD5 b2b47da37fc4a2d5986c91472cdfa81a
SHA1 0cd1a549670871072acb0217aaa801931e564ddb
SHA512 8046d0d880225c2c006cfefdfa87c23c2b499cc392b5bb8558d847ea0ab44b326998154dd25d94747b65fc4e64fcf9145a6d721a0dcc7197b76a58533462ba1d
SSDEEP 12288:tmw5HEjsChNzBFgl0WDm+C5zLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nT:Iwu6OWigNyBo4kx929bL3Hnx
TLSH
T13E65F10677A81CF9F96756388547C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ef2e2a2125ca9f02c826ebd6a55bf5f49be5ba5df5682c6b02ec002d53597206
MD5 5defb3f202a8a7f3191cf8aafcfca4d7
SHA1 e7e7eb7de527aa9d3a7b9bcfa7bfe2652db6ed6b
SHA512 a438e3fa5dbf4f4c66d115aec61f7d736999935ebc91fc81a388a982b4bf75e31f06aedbe9faef3a2c54bad6fdfe1039fcab8ed53fd4ce811f69395c373e3e26
SSDEEP 12288:dgZ1IymzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:mZuDgNyBo4kx929bL3Hnx
TLSH
T168551216239831F9F2AB2678D8E58544CB32BC461B7283CF5A2146BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 dc568b1b797f9bc82aba5443a3044307c2e510f0a3d52e24baf3e80f976570ae
MD5 57d4b98ba11df526a72e4af3caffab64
SHA1 fa60a4ced2a231971fbb344326c30bcf18492818
SHA512 22ecac4f8b4e38f2b28ce062494ca86aaf0ac5a519ae63b6ca16eaaf5c9f0193c835bee314be882b2f5ee6d2db3166aa0ce3280fc1e2dd2e0f416aa88ee4416e
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UU:DQRQyi36YOcPbLvw2gAf+PN36+k
TLSH
T1CC666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8d6b592e6ffce4f5057d8b2263f501fde0802a47333eddc624e0f901b2d4fd0d
MD5 fabfb20cf352c9f662c86c079ac6e741
SHA1 61152446372b280bec1b363c60ae763223d39e3c
SHA512 daa59b04b589bab7629a1352ad9c4d89ccec422cb6b9e29be65b5ebc0fc22770e69646e13595f8d7eb7e9592d85307d7943901f4606f6219bcf49fcc6c692a31
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UU:qQRQyi36YOcPbLvw2gAf+PN36+k
TLSH
T13A666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 801004960fb1aa28e7e8165e5efbd6ed302690841011863b86e7300a242624ea
MD5 a87b66f9d142fcbc80775a30f61d0ae5
SHA1 aeeb5c9f4cffeab19394e56915988f20b34440f1
SHA512 ba1d80bebaabacf1cad42d8ba2d234b677d239549f463942d9cdabc8ac8d338d0224f5ccdab67e3fd98d094dae28236338c95fc7a69a057db564e0054e49950b
SSDEEP 24576:9wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0zgNyBo4kx929bLh:568Qg55nhceWu7PNU3/cB+kn3Hnx
TLSH
T196B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3717d9d699b0ce0aa26956b08533430ad14cd1c4fd312691a5642f981f32bdbe
MD5 40fe5b6c504f7c42bfe4f7efd807acde
SHA1 1d7e3bcc5bdc0b9a3ebaf580559783c19d26e7ff
SHA512 df44e34cc881d8221dc12430bf5b14be3e4883e258fcd8487236fa0490f25ff47bf7d5bb5c2c6cfa839c3c1f604676847bc346e9b0a13268e1e0c6459f64f4d5
SSDEEP 49152:a3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99W:Ly5112gYy5azzVvt69nLKnhZ9+k
TLSH
T152167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d7a655e50d5f1007cb188ce28071eea3c996c71fc995c242b2f2f766576de9aa
MD5 61f1437ecd6486f1a3925c32ea0f9c32
SHA1 52c7d5b0ac30ceeedb1447bca2dd37b1d96b7921
SHA512 d9b82beb1e090f20f3c73d834f9d4bbb8781ad44026ccbe55b6ad22278be8cc78757203bb70da10e86155ecc495d651c808403b24dd574ee067199cab0a9de38
SSDEEP 49152:kB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glDB+kn3Hnx:+u6Jmdxd2dl+k
TLSH
T193D5AD13F1DA01E8D06ED578974A9233E962BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b0087bf03214f3ce7725f8790e6c4c9343024bc831aeaeb4f8e5f44701c2ad0e
MD5 f10581be5817530f215d692c2dd50fed
SHA1 0517bf8213bd3e6ea770fe441e3db5c89ccdbdd8
SHA512 c3e7b8782c17f116e10f2728001ca964fb492d8d08ed6739a1d7b390c6e204cdbf344e58ef8d3212df0f4dbb95ee6b7576422b59777a4a6ef7a0b6e52df0c60a
SSDEEP 49152:E1hpsNoJpF1A63U44CwH7R4x+B+kn3Hnx:EmifPWR3+k
TLSH
T198B5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0e82c584357514fd8dcc2d618497280ee10c32121d726185384ea39e68f99b41
MD5 3900b38550661fce71f7be025688d03b
SHA1 6426c0e85a7b5a8d7f4264b185a5d4f75e7203fb
SHA512 18667990f233c7738bde7704d77582c7b397639ffe8b263b1dfcbf4807882c170e336ec158d48e32f0c5188d62ab621e635ea4dea46e2b52be6140ffead78efd
SSDEEP 49152:FSuZQIY0Be2KcRVtOnks6NMHqXB+kn3Hnx:L5dKii61R+k
TLSH
T1A0C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 352c016c527f54e0d617eb7958a932760e8c9153039ada991ebb012853cf9a51
MD5 f70ba4a60764c89568caba2feb8963fa
SHA1 b135fb32b25a307dbfe9b463369df262ee0d34dd
SHA512 130ef243a91cd0e36c5aa25ca56c6eb7c1b127eb013a2a5a3d2c1e256974c08740843e6ea030d701c1265bfc0e8b5c1522c0dfad4efff3d7e349655998f296fc
SSDEEP 49152:jhtSn8EApI0fig3giDn0AP5w6B+kn3Hnx:CX2imphz+k
TLSH
T17D95BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0b3dadc9efcf266ce3d6c3bfad3d4c97e94aba0341d08f019af08698ccdaf348
MD5 7aaff1a018cd45104abc930861cecbd0
SHA1 0f34ae10716ce858c7430869e08277f3b5c629b5
SHA512 db6a511bb7184c98cfba36ea64c516c580fbacfde95e4b3b08e8b17e475d2bda390564b7f4d1592b12167992b57d5f9c4406b3ec20ad8da0405974d519a42bff
SSDEEP 12288:PXzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:PXgNyBo4kx929bL3Hnx
TLSH
T1E64523025A0C637AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA25A21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e1b9abc42531c7714e89e8ea7326c707f39f5f888b72af59adc9420e159e1dc4
MD5 ffaeabf78ce0c42aa80d6a47a668077b
SHA1 eadffd748cef998b70ccfbe6dd1994e551026f19
SHA512 de56c831e2d0211a1e6f25f5915f2f87ca67dc364da19d73424a3436a61d52f36401164eed510c2bce17276bf5d4f5015ad17e92d7b6d8835c450e9a6b347e09
SSDEEP 12288:dazLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:dagNyBo4kx929bL3Hnx
TLSH
T15F4523125A0C227AF76D3FB0644A8098CC34BC8F1E9597D8EF27987759FCEA25B21147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 fc7c52a88c5257327bfcae2b28b53d05f914db56bfae6b13d02e542abbf2e8f3
MD5 2db728978fc2a63732d133048b9959dc
SHA1 4bc33974fbf6ac79ca3a27e8636d49f82bfe75c5
SHA512 ef13eaaa7ce27d57743ae2aa4ef1e519659bf200621b589a651947ce335ce63e4693908c92c939e4fd7f1b06b39b2d4bd99af4ac3b8f936aa240c39027f0e244
SSDEEP 12288:kgzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:kggNyBo4kx929bL3Hnx
TLSH
T1A14523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 781b708567c14812f780a4649529137d0ecefc264b3c1379509a795a108213ba
MD5 330d3ab1a9e681068ba80a7c17b6dff8
SHA1 23df34e06cecf40753174418a7ac5c5bf0681c87
SHA512 244ac7077f5766232d9e8d38b0870bc23f545f968a7b57e21c559c12533137ebe9866bd9fa7f4f3bfa02943ea3b2b05d0664f42698f9fb48ddf8650d158a5f1e
SSDEEP 12288:LV1zLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:zgNyBo4kx929bL3Hnx
TLSH
T10C4523026B5C12FAF9797BB098568054C835BC8A5F7197DFDF1248BB0DB9BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 dfbfda605ba23b8346f292b036b710849d50b7493192fe01a090597ec2e497c1
MD5 b6b5de568b0136b7dda5120b164ce646
SHA1 0aca88bc6363d36c6db2bd7a61778866b1253347
SHA512 e40fa70ddfe5bb77489f968afbc3bf3fef0419a02c71b03ae400e8698f92ffee87a731a9fc569011eb01b5cfbd1c22e916c485e233caa2ba957a4e892476ad60
SSDEEP 12288:SNzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:SNgNyBo4kx929bL3Hnx
TLSH
T1564523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 bdd01f3ae9514825761c1d6a980faa9748c0bb28ad1290a1e4b58ee6d05d012c
MD5 c6b70b36923e00e144af2746dd180806
SHA1 55ee726e023ce83d7814a3dbba68c379e8d7a51a
SHA512 342e476e9eb9524bca08589dcb7087fd6e49ed26155f3b68a47b760d4b74caa2afd5b9637a60303b3442bc2e5aece045964c07453a9efc33a922c053917a770d
SSDEEP 12288:I+zLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:I+gNyBo4kx929bL3Hnx
TLSH
T1AE4523125A0C227AF76D3FB0654A8098CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 490424f9b8b53a17eeb48f6f67f54c708b6027f850234bf570a389c08f134a4b
MD5 78bd6f4946773f095a96e7e1ea49437e
SHA1 20a0977dc24b48e1bd8675bd21af59b47b9f9c1a
SHA512 e6581a0209e6873231c388480addc16a456c3f36a9dd9432ad48dd45e99883201b92172ad671f149141644cb3f59a1268eaec11cbcad2386ee5720b02867942e
SSDEEP 12288:ESzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ESgNyBo4kx929bL3Hnx
TLSH
T1134523129A0C233AF76D3FB065498498CC34BC8F1E9597D8EF27987759FCEA25A20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 e53277f0e74a6bcd307745491398c1aa9a25f292438aeb33649643db6ea7ed5f
MD5 86a59b35bbf2d7b642d3804b337f0970
SHA1 021f68817a58ebe27fc4e288d5a7b0084528c12e
SHA512 87e00af09ea1a57fd15437438ed195fcd3f20b35bb7547cfc2ea7438dab40bf94af7fa67d3905556401039f20e8b85ba34ec255ce38125d075a1daa0a9d8905a
SSDEEP 12288:9iZwbjzzFEoS2cPvy6zLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOz:AZMXzFVSO6gNyBo4kx929bL3Hnx
TLSH
T178650195B39418F8EC67823DC8158906D6B2BC4A0BB0C65F07A4367B5F773A10D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c31f94e15b2f47086ca2bdab208f99211bdd6cbed5ee4aacd80ed1699f268982
MD5 f2a11af7f28618792516fe57c3d51a4e
SHA1 29ef073f38a1531b94292fd5aafe6ad52dd0b76d
SHA512 fa4013251c9a0d9a93b5f9297afb617f3b5da23dfae155124b944511d417205a731686a75a8e463f62047aea6f77497b59fd8722373fdec547dc4ba12f387aa3
SSDEEP 12288:ATzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ATgNyBo4kx929bL3Hnx
TLSH
T1964523025A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 9360d0bf4a627d2593cbc50cd763db42a3872438e33d96919514e79c724c4867
MD5 5661f3832801f1fe1dcdb0a9b1b0614e
SHA1 8a4b088f13cd3007cda8f93d59d61c5f8747f4e6
SHA512 5701792c3a5569424d7cf3979a0eac0b28ae27bbbed8f5aec6537fa3fd33368e37b0d8ff4246ac72620f8c1297c9f89d2d184ec65e58f6d9d518250d783bce75
SSDEEP 12288:n/zLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:n/gNyBo4kx929bL3Hnx
TLSH
T1FD4523125A0C227AF76D3FB0654A8498CC34BC8F1E9597D8EF27987759FCEA25B10107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 68ada1a155d1443c7683fd3ffab3b0a713a2c9fb4b492f7d2ffb40499a77c204
MD5 089bbe62fad72e34ac89ce938180b085
SHA1 5cf53d81e7b6b918f88317eee2530b9bbbfab70a
SHA512 a59faca7099988bd24b4507d16d753c8a0d59cead033fbade832d53d4099ffec1ea5011865c7d7c4f78f6ad5eb05ba01f99b4f638f7ed810c36adef85d6b3937
SSDEEP 12288:3yPz5L8mzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:6zymgNyBo4kx929bL3Hnx
TLSH
T18455120773A931F9E17A6234C8960901E771BC360B608BEF576046772F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 afa758aa7e32d0015d065db0196b073283e77e0d17550f88c55616f6c3606fd5
MD5 e7df9e0d4d3672308eaa77c48f5afff5
SHA1 8be534af42a11e4455085d33c6495fdf7e96d32f
SHA512 111bb37af2e41b3bb3e814baf2e168633f28f7596b4f77bf12e0f169604138faa4e1df4b2f7644b6924341b404674e52aae2119e3ef4328710c9d8512a9ac10a
SSDEEP 12288:QTzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:QTgNyBo4kx929bL3Hnx
TLSH
T1FD4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 821cee1254f92c20e689fd58ab48ecb2986d32fd3fe2c735027889420b99d10f
MD5 3d46e0aeb50dc2dfe6aaa543c38e09ff
SHA1 af4e4a95d9a0bc65095ea37ea4ca683ebc6b5b70
SHA512 70e9274934467902e31ada43518105b5bdbaf8a5b53014d8481e34c1969e3a0bb7dd1b99a9a79278912c2a1e7d18c0a8472fcbbaa2ba741bd1dce7f5601ea9cd
SSDEEP 12288:6TzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:6TgNyBo4kx929bL3Hnx
TLSH
T1014523125A0C227AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 a14c5385d7b4d1bbfebf1cf2a331de14f598a1c3660a0d4602c6adb9e14fbf84
MD5 79ab43c18206965503fa860e2a727fa5
SHA1 7cc25072c558ce024da8e1c0391ab49b48e42e9c
SHA512 cdafcbc88dceb1e9c3c4f4c61cade18e00bfa212e6289796ffd9627f736b14e1cde1db3dd2f5076eccba87f5f8d3deb8c4ee34b1cfe20260ebe7a009c2b59418
SSDEEP 12288:3yPz5L8mzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:6zymgNyBo4kx929bL3Hnx
TLSH
T16655120777A931F9E17A6234C8960901E731BC360B608BEF576046772F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 f1d47451d45b29626eaafe1a73ff52be37ade7493311305a5dff36d6cd9cfc5d
MD5 bb133c4d0b45d9746de3cdd982e3e5c9
SHA1 a80edd1a8346bfca7dfdc03634336321412cabd0
SHA512 5b4e3c70bb1d9e420220d4fe4e5faf6a70a5f8c5a286d69ff6bdba5470d4ed195e663db2eb0767ad8d3242aa223222445eeaab8d8a36e5707c9b58fbef5a5771
SSDEEP 12288:kCd98WYoaLHF3z0z04PDvhQzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nT:dTtaLl3z0zDQgNyBo4kx929bL3Hnx
TLSH
T1B16501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 61ee46044a87c25c8650741fcf910d0d381cf2bc57b0418a10e3129f7fe44dbb
MD5 732569c5d5c7864fd3393ee56ecc4aea
SHA1 dcb69c70086960cfac75d971d953c496f3ebb226
SHA512 daba4be56206d5197ef7c2eb87f6ea7c41e1ae6412b07b1c7398485629e0dee1661af1a64afd134b2ee1a769030f93a17d7a3da209b50c5ab575de30560bf527
SSDEEP 12288:Ei4e7ARdTfgwCHKy7GLbbdIvRzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:E3ld9CHKy7GZ0gNyBo4kx929bL3Hnx
TLSH
T14975CF90F3E810E8F1B79A3489764511DA767C9A1B31DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 736afe3a790fc03d61ac605a364bdc48ef47e76899028cd6708498c3c7c0edc1
MD5 e8c5fce02b933622a9145f25503c121b
SHA1 cd9961e4a59a7b570cc8c131df599a8382ddff9d
SHA512 a0556fd22e8d721ade7f853b2cde6548570d7d4284db2eba9b6bb5edbf037eed5ea30ab96d5c18e1bddd70cc17856abb2b52f9f5727a7eb076481b03bdf91469
SSDEEP 12288:LAzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx/:LAgNyBo4kx929bL3Hnx
TLSH
T1B74523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 0d0f6ffe56eca726a4068688b4442724e60c7bee43389c0463a8d88ca3ae047c
MD5 9fe6de3bf4057674c0dd3dc163e9543a
SHA1 17f227c1fcd791ae15a9b7017661a33101986c47
SHA512 a1e286b88d9d35f68f319bf7d1ca1fbb57761e8a2d8a21ff08a37401ac9c7158bb743cbb03b20dd4ce13888390f635aecd45c0c363d3bea6facf9ab6b836adeb
SSDEEP 12288:FGzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:FGgNyBo4kx929bL3Hnx
TLSH
T1434523125A0C227AF76D3FB0644A8558CC34BC8F1EA597D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 33b204c0623f561db59a2f1617ff66992737064bb4c90968e8bfcd6ca034ffca
MD5 601b37f4e649ceea00a0f55f7ba27911
SHA1 136f378a711945e14291bbc9bfcb7e767710e78c
SHA512 b8c35aafe6c6bed4cf41ebe9ee5dc46f9bf87369073697980f45349383cea9bab558fd97660d615f2dcb66f0183b721fa9345182bf9c3d624640d1dc3c70df95
SSDEEP 12288:URzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:URgNyBo4kx929bL3Hnx
TLSH
T1164523125A0C227AF76D3FB0654A8498CC34BC8F1E9597D9EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 226648ed941d42caba1e71a738b33cb476a55795412601b3602070b0b1d4a3bf
MD5 279d563cc526047c8bfdcd2dfe972637
SHA1 1b13ef99ba4a83125b200d0dc2074550067c0c19
SHA512 67b521dc4f423b4d9c69347d60f4e8ef355e3ece9ffbc6405d82bcc0366766a1a2da20f86dd98894bee4e61970df5fa7fdb10e1c91df3c6ee1d3832f2acdbc5c
SSDEEP 12288:fTzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:fTgNyBo4kx929bL3Hnx
TLSH
T12A4523125A0C227AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 bb0f15a31589757a4e7d7f1e9b9885cc6feda179d177ebeab51d68791c8af0f3
MD5 b3efbcb19a585843909cc548469346c9
SHA1 1b5bc83320565553dfec865dd6cfd1c2a7baf3b0
SHA512 ef89bc08237f5350125c10d2a81ea6525cb0ac7a191127248dabde3c7b2c6b3382bf6f0b28620e16224ee763e42aaa983b0c5d51750a9cb84c1770d599f5eeb6
SSDEEP 12288:9AzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:9AgNyBo4kx929bL3Hnx
TLSH
T12C4523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B21147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f80414a15f8535027d47e8e44ae42a2b4079a134fb641bb4aae2c17724b2ff72
MD5 706dae39622eff1c41065d0d87ba2f90
SHA1 d3271fab6f3963c95e7ebc84a1a0815b796685a8
SHA512 31e87aaa242dedc91594d7d6d1150278177f86f5b423e42863c80878efde37486816f18f10df33d96d138ee9f9a95911160c85b3a60494d3a3d13061984c0491
SSDEEP 12288:jLzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:jLgNyBo4kx929bL3Hnx
TLSH
T1D44523125A0C227AF76D3FB0654A8554CC38BC8F1E9697D8EF27987B59FCEA34A10107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 ba364d91523667267a84751e6f526ef801a61a33f43db86b6dc005a472949373
MD5 c86f8a81db9319a5bcb25c5cc146f5c3
SHA1 d4b41b99437c50c647ae54ca193ad22215758f1f
SHA512 d226f39c7468b4752fcac42a361698176f3a3214a9ed5ef9d4d55757981c76c3aba9c535f12877ee1a21200f9a6b7bd82b328b5dded95678124b2d02b1a329d0
SSDEEP 24576:Nfwvqk9RX6wkyAIPgNyBo4kx929bL3Hnx:xMnYIrB+kn3Hnx
TLSH
T1A985DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53BE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5f0396ce12468a6dd344da352849ade205ef3366463ee0033575a4bcb2f4ff3e
MD5 97180c5796b6c91aefeaabe93fcfeec6
SHA1 18eb16257028c280dfbf63621af71a2ebe099321
SHA512 a1b6e16da0bd720765e84059d05700c9f598b31ccc173919108de9547d3b88c3c738e1e49384aa0dde2f1aaf8991dbfeea6ea472b5808b06f24bc1011f7d98b8
SSDEEP 49152:qYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0aB+kn3Hnx:RySzPa+k
TLSH
T172066C56A1A801D9C1B9C1B98F0BCC1BFA7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 550913de122c7610d5142904a392cea2731a85f96659f5b453b855fd43c74c3e
MD5 4c2702690e5f03be8240112dfa3d6c01
SHA1 96f2abb577d8dcc97fd993df936244e82d228988
SHA512 54b524479674a9459317f6e86d2b435d6a529cf0a2c8a6f228c463249b07d16b6abeb1041d93c29b154289aed70bf4383c9eb1f038fe747efa8f61421d95b603
SSDEEP 24576:W47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYKgNyBo4kx929bL3Hnx:W47JUQjTirIhCnDHUPfF/qB+kn3Hnx
TLSH
T1B065BE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 b157a6727651ebf211a11242df26c136a9528dd860438c7ff79c2399582220dd
MD5 212b938a9c3daa3627ed2f2f103a7a08
SHA1 5f395b4343a1a2444321d163a173ef4c19170b1d
SHA512 717cb76ca674d3888ad03c23e4860ace87510a1174260ea0cf386993da0353c18ab0a2342e4158b7ba8f9e282288c420dc93ae0224d292bdc5450635b6d3fc30
SSDEEP 12288:OpsfDzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:/DgNyBo4kx929bL3Hnx
TLSH
T11255F00AD25812E8D16E6274CB468A40F7337C5947E1D3CB97D0F87E0F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 bd924183575df87fcb2890c23b5b2dcb6c8bfbbed8e327d96319aca71f743d74
MD5 2fc3419e1febe8c6d28e0a9884e38c4c
SHA1 df7c3a1ec4a072d9437a2636d86968ad828abffc
SHA512 852e77485c15ee76c45ae3f223d8e8c84c6106b33d977512bc7e76798c96530de4b62c059e21c9ca650843e729b444a40447cb8c742b705c7de7e3192539c9ad
SSDEEP 12288:VVRNU3fJ9vKjBL7JU5X6qw9hM3eJlBWeafLDBcqR0387kjk:VV3UPXvWJUJhqMuJTWeafLVZR0387kQ
TLSH
T1A8452750B62AC75FC6A940325E32D5CCA7707D05FE44AF0773C8873F9576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 f9bb6ac85e6d030c984d45cf5831cfb819a276b9ee3102cac3be30a65679a253
MD5 766c5e79c850fe96e19b8116334197bb
SHA1 3f0ef8ddf5b78ea0bd5d225eb6d15268e652c169
SHA512 ed508f83f4d6edf7f3a77f6683fa2f6a7b06337fdda2c69af57f7ef2294614443da1ba5c4da5a21a5c75987a7fd593ca0225c981e5f95b988f3ae209e278f171
SSDEEP 6144:FeelhF0WntBZKZUZTlHll25v5M5FGNszhMytMxgVrKXMytMxzpCII2W4uCVN0oUD:VIeZZT2ZOiNGaaMJJXH8a+A/
TLSH
T12A750B816137D28FD5FB503207265B8CB7B4AC067B456F26B3D8453AD82AB25B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de42446a763f1d8f.bin

Path C:\Users\Admin\AppData\Roaming\de42446a763f1d8f.bin
Size 12KB
SHA256 b8d22043977f51b291bf5cfbac7c148da3c2049dddda934333068486446ddc19
MD5 3787e02f58f8754f00456051b31f9c73
SHA1 9b62b005b3db8021693fbbc85fe7b3a3cf2dee9d
SHA512 a708514af6755093cf66f458c877a870eb0446ccaa17070b664ba36539d24e8e2824278f42efae11a576f25f78fab0914f38cbf94fb16a0e9b0997348d08fc9b
SSDEEP 384:rsyFF4e6dr5KopwlWS8+NE2PD6Nus/1S+P:rbyecooml/NLuN5L
TLSH
T19142B05ED5B5A3A65CD340CCA3E98AA529489A52CE0AD2E7EC90737F54C30F941C0EC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 32aae0acd28ce97df2e18583a0babaff21b71a0539a5ddfb574fbfd4b9f353a1
MD5 be32cd24313c5ffc924d9dd0e70c291c
SHA1 b3ae90813156aa5143ce9f8213200b0a2cfdb397
SHA512 a11851bf1725c4945aaaeeccac5f3ecd8a6cc9d56f3e4e344a42a01d943c4995cd5cf8261d48b67de5044b69772203009f768c78cc4d42ae7ce8382aaab60e79
SSDEEP 12288:Zy77zLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:47gNyBo4kx929bL3Hnx
TLSH
T152452312974C663AFA7D3BB0645EC024C839BC490F54D6DBEE1258BB59BCED28E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2aea3699315d96d03e910f239e0c210eddcd53b90554d72cd72682b1d99680d5
MD5 4d9a8f9100e9d5f12177282dafd03914
SHA1 cadf23cefa448b748e0d35b2e611a0eedcb08c67
SHA512 70c5c7658ee2e2bb0fd1b49430698a8aaaa510e5f9e2a15cbb8db7cb3f3d2f2a25cfaab4a47218cf7dfcdc8f119560026054d299b6fc0fa597ed58e6d384d623
SSDEEP 24576:Dgb6bmBIi49WNNFpg1rSvFv7bYZgNyBo4kx929bL3Hnx:Dgb4mBIBhGFIB+kn3Hnx
TLSH
T1E665AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 026f947a7bad089fdba1b43de0d37ee4d6428ac06200be63411cb8bb9db82280
MD5 65773457d499844fc99cabf720fdbe54
SHA1 1dd6ff572f277994f1b669f179e762687e323ff4
SHA512 7f52e4d938812060aa9d910432a6a31c8373375fd17aa3d5df3ec1ecc36cbe69aa2a9ea1bc4f08e94f5aebf5d53303c8dd809b365e6a0cdab3d450f4d199ba01
SSDEEP 24576:MG88u8FpJqH1Jzria7/m6gNyBo4kx929bL3Hnx:v7ZFPqVAa7/VB+kn3Hnx
TLSH
T15D85F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 849ea4bb196f9ebf825b6794d598eacb70f26113d35cfba2ae1add23f2377335
MD5 18958b2106b1fec3e9b17083ac9ba4a5
SHA1 d05937a9d16a79d2cd9aa6c62b03607421a14ba5
SHA512 7cacece8ac9e90535ddae7f3a7612911f744faeb26ee95af53b973a6f62f457e651a8a52b0e858e19f658ce0a7165e1c54306b465c370d89ebe9daef5163ef27
SSDEEP 12288:vHvUrBFrEjwaQOzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:vPUr+NQOgNyBo4kx929bL3Hnx
TLSH
T13A65F11F22AC18E5F67AB17C85868609E771B8560712D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c86313827300ccc67cf2e72485d23b91c5e353a0fe40481559638c04d2490101
MD5 0e91eef97e9b0fb189915bebdba917de
SHA1 e594934fd388724c6a66b13dc9936674c869f1f6
SHA512 ef7d82b4b7037612efe5d06981eb89591ca036479556e3dff973f2426f8c2393da705af8698860d74a8f3e7d6eb3ea5522c550a902f7554cc61452939794da16
SSDEEP 49152:HBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkB+kn3Hnx:4G05lO43bV+k
TLSH
T1B3D5C06A62EC11F9D0BBD17CD9C6460BEBB23815033556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1d0340733245daaabe520c541e65e1991cdab79135482dd9809623ec1b0bcd02
MD5 326c3a3b86374f5141750c0a00b03d61
SHA1 1a4d96a522b04faa808c537d73119baf30a1b86b
SHA512 af33999bb764ade281ed82ae8951245a48521f553d1097878be07acfead584c91cfab337e7c66e1b9231fc5ac9c8fb9814775cc224aabe0d4d55eac4e758c8c1
SSDEEP 24576:cfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnMgNyBo4kx929bL3Hnx:Ea5POZ3BJt2pasx2+mcB+kn3Hnx
TLSH
T1E365AF5EA6FC01D5E579D17CC583861AE5B1342653319BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3ac3c54b8f8a1fd9d2a304e88ed3de74c550ca58f6dd574eccf20adf55691310
MD5 a601d3ba9be795a6176203512c94fc16
SHA1 2c00e014f1e6b6e6c8afa8f017d4ebf4d0260254
SHA512 962a524321a7a320272c43e8cad4f2bd687516125ff03f897d836adf2e24767af094d8d9d5b1f2e1f68725fa99050360a26a1a22c2218a4e6dcaecd462a2a2a2
SSDEEP 24576:qNcwHdjbyQ4nLC18lb/EOjowL7FkCgNyBo4kx929bL3Hnx:qNc/zEOVHF1B+kn3Hnx
TLSH
T106858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1a8c3ffbe1b8f5f2a6fa054f7d2f71dc8c3bc1e20bb0f26172cbbf6f7735a0aa
MD5 9c6473677d83b00f0de9e0fc2ffd4855
SHA1 9802e5612267b0a7f5920b1d2ec6f3dde1cfdaa0
SHA512 5703b54d0359157a1771e813cc5660ae98517635c52dfc5a2700ee0bb1a87b0435d10bd08a331f45922a5f926102ec2f1b7232cad2d2c2b483099922c6df24b1
SSDEEP 24576:RTkNvNnaFeYhJNtmZBmENyBo4kx929bL3Hnx:RTMwBtOm/B+kn3Hnx
TLSH
T1CD55AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 1aae88d9d62eb97d6abe783a8613301516ffa2c1d99c6b8004ccef35ffdb1032
MD5 b4ec6a0f42cca642152727fef9e017cf
SHA1 ce56ebcc3e7b8a19436f33ea693cf9905455944a
SHA512 ce8c301c7db041b1738ad67d8506fa9eaf34f33bf612d57d6abf6526a08ddcedbc5b1e58815ae04dee45f3ffdba7e123862dc0b34e8627c38cfd98d1a2f3932f
SSDEEP 12288:qQcMxWDXN1Dp/fshBItT1IQgA3zLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxfJ:4D3FHshBIYQgA3gNyBo4kx929bL3Hnx
TLSH
T1A275E13EE65C00E4E57BD1BCDA538906E67138AD072266DB06D4C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/904-336-0x000001A0FA3E0000-0x000001A0FA5AA000-memory.dmp

Download

memory/1536-72-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1536-78-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1536-71-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/1536-260-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/1904-94-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/1904-304-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/2760-124-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/2760-130-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/2760-123-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/2760-321-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/2900-143-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2900-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2900-141-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2900-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3232-24-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3232-109-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3232-27-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3232-18-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3260-0-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/3260-9-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/3260-1-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/3260-13-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/3260-17-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/4500-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4500-45-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4500-52-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4500-173-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4512-37-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4512-36-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4512-40-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4512-15-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/4512-30-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4512-42-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/4620-104-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4620-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4620-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4620-339-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4620-337-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4620-98-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4648-325-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4648-157-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4648-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4648-150-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5180-66-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/5180-56-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/5180-58-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/5180-63-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/5180-69-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/5404-288-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5404-82-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5404-90-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5404-84-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6088-116-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6088-118-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6088-110-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6088-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6088-322-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6088-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download