c97fdf1cb0fe1d893da8e81a009c05289c52ffe979321e26b71b65c01d82e163

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_b9b8eb6a9838d6e734fcf483f656fd35_icedid_luca-stealer_njrat.exe
Size 2.7MB
Sample260910-dnr9ssdr6s
SHA256 c97fdf1cb0fe1d893da8e81a009c05289c52ffe979321e26b71b65c01d82e163
MD5 b9b8eb6a9838d6e734fcf483f656fd35
SHA1 7bba7415fac2fbd3014b2720c48ad3f98a1b84ad
SHA512 b2f9ce53433fa263bafa7241454e61e7878f8558b91ed0b36810ccf8a7a1a6c514f6cf698ee2716f841609b5f30c2efcb839999701c02070257ef1171d84e5a8
SSDEEP 49152:kaL8mYieCx+YLn+LY3pfyff9kuQD366Q84bqpnJaQX22LlOpbeZB7m:mdycv
TLSH
T1E2D58E6E6BA845FCD0EBC2BACA45DD13D772740E4371B64F069185A22F5F1208A7DB23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
760	elevation_service.exe
2000	elevation_service.exe
1712	maintenanceservice.exe
1884	OSE.EXE
4560	PerceptionSimulationService.exe
4868	perfhost.exe
2748	ReFsDedupSvc.exe
5724	SensorDataService.exe
4244	ssh-agent.exe
4152	AgentService.exe
3844	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-08_b9b8eb6a9838d6e734fcf483f656fd35_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-08_b9b8eb6a9838d6e734fcf483f656fd35_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-08_b9b8eb6a9838d6e734fcf483f656fd35_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_b9b8eb6a9838d6e734fcf483f656fd35_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_b9b8eb6a9838d6e734fcf483f656fd35_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-08_b9b8eb6a9838d6e734fcf483f656fd35_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bf12b956e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_b9b8eb6a9838d6e734fcf483f656fd35_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-09-08_b9b8eb6a9838d6e734fcf483f656fd35_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-08_b9b8eb6a9838d6e734fcf483f656fd35_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_b9b8eb6a9838d6e734fcf483f656fd35_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000ab723addd140dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000039fc7edcd140dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000359019dcd140dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aaa741dcd140dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bddeec1ed240dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e7636ddd140dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
2000	elevation_service.exe
2000	elevation_service.exe
2000	elevation_service.exe
2000	elevation_service.exe
2000	elevation_service.exe
2000	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1272	2026-09-08_b9b8eb6a9838d6e734fcf483f656fd35_icedid_luca-stealer_njrat.exe
Token: SeTakeOwnershipPrivilege	760	elevation_service.exe
Token: SeBackupPrivilege	2748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2748	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2748	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2748	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2748	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2748	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4152	AgentService.exe
Token: 33	3844	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeDebugPrivilege	760	elevation_service.exe
Token: SeDebugPrivilege	2000	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 1228	3844	SearchIndexer.exe	102
PID 3844 wrote to memory of 1876	3844	SearchIndexer.exe	103
PID 3844 wrote to memory of 2192	3844	SearchIndexer.exe	104
PID 3844 wrote to memory of 876	3844	SearchIndexer.exe	105
PID 3844 wrote to memory of 6088	3844	SearchIndexer.exe	107
PID 3844 wrote to memory of 1220	3844	SearchIndexer.exe	108
PID 3844 wrote to memory of 1704	3844	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-08_b9b8eb6a9838d6e734fcf483f656fd35_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_b9b8eb6a9838d6e734fcf483f656fd35_icedid_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1272

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1712

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1884

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4560

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4868

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5724

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4244

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1228
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1876
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2192
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:876
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6088
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1220
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7000e647ea3921a5097f6e27349e50efaeb3379ea16577886f3dcd65313c1a5a
MD5 fc47c14df07ffd375b1d88a649849268
SHA1 fa09821cf2a79829bad2dbf9adaf8cc6a1af0901
SHA512 bb0c35f14b09875d6d58bf52e05f4a6e967ff2b4d5e438ac9d83239a3abd5be93228b2f7b307aa143d9b2a1a3ec0a3bd198516ae74e2a55f148f53f1dfb66bb9
SSDEEP 49152:rb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnx2LlOpbeZB7m:53q6sjBYycv
TLSH
T195D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 9c35aa67b86380df71294587c21a78774e09cb6a1a551ef5f24bc04394323385
MD5 53195090cabc17bb376f5a63dc68369b
SHA1 dd378d532b82eed56ef0edc8d8a9f3397bd1ea5b
SHA512 5c77060626a4e69879fd149841ec07aa732b73eb2bcca40e9ac8ffcff1d3578c7efc59632f43225d303e0f6ecd133ab9d1d9dfc763e904b682a891a7f3847d8a
SSDEEP 24576:wXYfDtczAE22C9+bmOmbTk3reZCIT59z7m:Htc32LlOpbeZB7m
TLSH
T1D575016467D408F9DC6B823CC9A28411E633BC9587A0E7CB03E489661F737D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 3e53b55f22447387dcb65c73aed18592a25b957a7ec5e5281a5d6c9f1e12563f
MD5 8cfa50672dbdd1fe8d258cf2bec94546
SHA1 ee95ca0f04f05e727dec647681980d72eec4b680
SHA512 5b10379b5734596f74807aa069082f34887854ecbfa24b05302b30cb827f2b92f371de90345b18f8b3b7c879eba5dd1534210eeb775db1895a9fb50c4f81309b
SSDEEP 24576:a0Le5ji0hmxxrMu22C9+bmOmbTk3reZCIT59z7m:aPji0AjZ2LlOpbeZB7m
TLSH
T1DE95AE56F6748371D073C0B9C5D2A69EE97130865B308ACB4286C77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ab4076d9dacbfdb10a944e93a7947b9c3d8ccd27f6622edae683c29af8464eaf
MD5 0c313b7aeee61a2e607217723d39b9aa
SHA1 91da13b5c5246a6c694afb76bb8abf1794c3eeeb
SHA512 e0fca7173fc1b703a70760fc2866c014ca1fb4560a38f85ad1277a1fd064cbab2458a5906a6482174ffa47a1d169e278058812f6e9c1b843a595f87dfba846e5
SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWn6q8wyuY22C9+bmOmbTk3reZCIT59z7m:O/ezSC6vUzPveHjyF2LlOpbeZB7m
TLSH
T185755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e654e16cbe78b5bc1eafcffb259b0741f08d4fd313faac33d522761cb15273e1
MD5 691e50c097cd852f882ca97c252d6ac7
SHA1 1c03228ec94685c6f8dab8c6216e9cad92253778
SHA512 dc3b3a2a31977e24326850e1c2ad4e75315288605b0a4bfcdcdac69e820a9f4475ae98567b64c5f0e2f6831c842d04788e006d5a5f28d0751f903c65f58130de
SSDEEP 24576:IVbqPb88hv/l+YX22C9+bmOmbTk3reZCIT59z7m:IVO88hXl+A2LlOpbeZB7m
TLSH
T14A559E66F6B48331D073C0B9C5D2AA9AEE3234415B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 36e8b254f2dab385937313eff1d9d7d5f988f2099246afce25e8c25d6deb7415
MD5 f303748f5f9fec52c100809aba387c27
SHA1 478a229754832e1a7ab17f5cba5a66b17dbb31fa
SHA512 61169d97bd23bc180cf8ea05204264f11ca88d2382cb92fb6d31671f2d90ca70babbd2aae67ad066d1c4967ed54b857a0cf9b1bc848cfe31c2205c8985e3109d
SSDEEP 12288:5LS22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:5LS22C9+bmOmbTk3reZCIT59z7m
TLSH
T1145523C18FDCC8FAC6BF1230569164E52635EED8DDC6B55B81891ECF18F0AB8D04A20B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 da9173bd8e5aa9acef8bf04d82e503ba80e477508cee97624f2bcc5b696f6520
MD5 2e141fe75e627452585274292ec7ae03
SHA1 fb6ed44fe3e6dcded669f345fc109bcf607eb6d0
SHA512 aa2a8aeb78e3432c95fa1544e01cf601cdfac733f360e96812585c779b3e11a3e660af021c0c5811409bfc25bc3eb41577c01dcbfc605d8fa590dca0d61acc88
SSDEEP 12288:DeBNUbTVO86Uv22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:DJIUv22C9+bmOmbTk3reZCIT59z7m
TLSH
T1F075CF7BEE28FCE2C27E4D7857918640E772B8708F52A3CBD165820E9E235E05D7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 755a372483e28eb227d80ff1c64651c8e460ef7099a6d2dd20f835e639d35de9
MD5 8cccc48cd4cbdada8dc98047ce04a170
SHA1 6c32bc0464243b26fa8ea4fdd5f87f1874b47877
SHA512 9162bed1bd4383bdd974bcd80f5bc5921c1b456ad1ca2e4f22c820ccde0942f163b100d94f3f9256a18d427728b56f19ff771841f1a9bde474d50a8f3e5cc650
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THd:+QvGAdlCEL8c/DRNw5Coycv
TLSH
T187266C656BF880F5E0B7E134897A85B2F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 07295a5c7c39712a86546ba992530b965b80e65f43182b55dc54e63c8fc69363
MD5 f70a8eaa94efc6d47bcd31ec06051108
SHA1 07a8fc6417ecf4c18a2b16b0157a519ab8690484
SHA512 59983c875f0056d968afc6be13e88d8d737e5e779e17e1083fad9f9688650441c347433dae97848e36e34e7abe5aaa0c05b0c8d28160e51517b6d2328d22cc65
SSDEEP 24576:10ewsAjp22C9+bmOmbTk3reZCIT59z7m:Oljp2LlOpbeZB7m
TLSH
T15485E071FE74D436C2BF0DB11B26C716143DBA604F922AC3E3A84E8E59702D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 92655d90d9c92a9eca2faa593ae33d2f6c61a8dafe4a67c95dc9827f41a72a14
MD5 a36cb2b5beffeb185a92539b30b3f643
SHA1 2999f8551f21e87e3cb4cf29cd9d9aaaae5dcdaf
SHA512 27c9c62ce1f369f5a53b4f2bdd1fa9f9ed226163cbd8066efc22e09fcf3799fb7b01a766cb5d4ace69dc67c56c8408b22f0074070c9c96921913a43988fc71e2
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHHv:CUEtQevvqc2W1cpV2tI32H
TLSH
T12B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9919150adced6e5cf60ea26ff91198da510e3b95bc760fd67ad73a7569ea95d1
MD5 18cd78469cb91fb5040b147fbacb7e1c
SHA1 1951a5c9f6828393e53069353f12b79f062616f2
SHA512 0bf31ba8d5f278bea0360ecfbb1384d89b6f9189f381e94e071e0155d9e3ae7cac75b448a13533d67f282002ee4c9c8780abbc98a9fc6f9cf69e7090769e421a
SSDEEP 49152:HCbRquA/m2yL5zTfFiV+XenmE3/zJ2LlOpbeZB7m:QoquVjnm0ycv
TLSH
T15FD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8f7c1575b829daf34444e32f89103f446612db3da003d5bd15a213b89436762d
MD5 936fe73ce8754a2736dbfba5e84e9a77
SHA1 651730ee346e9f745bb5c343a746ee6816a5c369
SHA512 a3e31f4eb0abf0a73d32b53becea2949e8169be3a2c02aa4efb7ddf144ebe134ebec8de213e6443bdfaaf3885d03591684d1bb894591874762d4b22f7cbd6480
SSDEEP 24576:UAhGL3IFoiwtA5l7S53U22C9+bmOmbTk3reZCIT59z7m:UAMUFoiq5E2LlOpbeZB7m
TLSH
T11335AD81EBF945D4F5B7AA7899B69171EA76BCAA5E31C20F2150C10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 1e58d1b2f5d41e515617c40f43f02d3c2c62c97d443007638f84939ed3b23efa
MD5 097c0ed5dc5f6137d70c303a83f7350c
SHA1 3b19a265feef767c90b8faefb0c9745128a8b292
SHA512 cdfb8e6dbe06252c7f4a733fe926afd2224061b473683a4cfee896609a850236e031ad308f7c890c6825aac612bc28e3742badfa23161bd41c99890239150fa3
SSDEEP 12288:Imw5HEjsChNVBFgl0WDm+Cn22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+114:lwu4OWq22C9+bmOmbTk3reZCIT59z7m
TLSH
T18475F18677E80CF9E96B423885578136F7B2BC152A65D71F0360CA5B2F73361AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 99d9516797f229a2ae05c2eb4d9d9852d695f45a8cc406f6b2e3f96bea852a28
MD5 65c4aa8c860fd5194c62340dcd6e185f
SHA1 0e2e5a92fd1739489e514ca774a1ae4264ff9efd
SHA512 2a90e9ce5ff7d3b2e6a5feaf61033f4d8427cbe42a2e7adb36f238cd0d20e385b9c8e37bb1a24e78f80d77e64bfb5004d7d7cb633eccc4737758d545f01f18db
SSDEEP 12288:reZ1Iy522qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:KZum22C9+bmOmbTk3reZCIT59z7m
TLSH
T14C6512C627E860F9C1BB4238C9E15545E372B895ABB253CF02540A9A1F73FE59D39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6d4e2c57a04802839b392644dfff64cf04252dd829e77a33210fbfe20a5ff94b
MD5 0e14066123ac4a519d062fb23b21dbfc
SHA1 0eca3d4e8b450eaea7156137d7e6e9c8cac1b631
SHA512 8776d2be6a7f5d91c7499fb4d39c58d7712fdb9dbf747b4c52fb30e5048a75733ba1224d3495c3217e034c329c8f440f69ce8bd295a55cce0cf478846d6475c6
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UB:OQRQyi36YOcPbLvw2gAf+PN37ycv
TLSH
T18E667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b96b6d291bfc5293297507a9b4b8f365374660849f316dd93edd758bc01128d2
MD5 b3687816dbeb766f786163330946f306
SHA1 63d904e3ae01e0b42339eae953dd6658de9ec5a8
SHA512 e394768cb6d5dbe0325f2e0d6154a727dddd873dd186055a041e027ee6f3d3b08d5585bc8bee4933054984cfc563d13b79e736a2097346b4a8a4804d88316007
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UB:mQRQyi36YOcPbLvw2gAf+PN37ycv
TLSH
T16F667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6ef14387cc80a1aadbdbc309124dc51b8c344edb8e098554375dfdadef09e699
MD5 2a660c49b71f5e1c88e046798ca15439
SHA1 49a372c62cd3419781f3397c152e804b7f764ad5
SHA512 68b0fcc05c8540aca3f51ed6050f6159cb09488743db04ed75be16b5588e46f6b50fae05af082b881b209084a0a4d9751d75fb9ae00db1ceaa9437710cd7bdd7
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0W22C9+bmOmbTk3p:F68Qg55nhceWu7PNU3/Z2LlOpbeZB7m
TLSH
T17AB54933B2F600A9C44DE1769F46973196D27C758FE1E3DB8105720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a4e1adf9c6850b0224ec31a1bb9a0643cb7ee84d037a8bccceb375c04cc9ee9b
MD5 c8aa14340dd69600040a5ecbe4d11dbb
SHA1 33ef8f960eae76d884166b21167734a2de67014f
SHA512 fe31873fbc53f2c872ab916efbd6fea58c7203bb64598533cef60826af0a7d8aa1985c14187b3d53da0867730ed509169a38a95ef7bbfc83130052aee3d5819c
SSDEEP 49152:X3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99H:ay5112gYy5azzVvt69nLKnhZSycv
TLSH
T136167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1ee27756382553f9b9f490c9c8a139a19fdbd8ce2f1cb743cd60790a86fda81a
MD5 db71eb8ef7cb07cd2add7bc46d7ac9ca
SHA1 58405ee1cd45ecfdb21b995bc4f6d6b36358d2e4
SHA512 48f801f7eb15882e0af3fe24db583e4f6413f177ae1076aeecdfdb827ef05094fb6776271a1b2ebe0695ccc13cf2bfa2f0bef70fdc68e90d6b17aed1faf319ab
SSDEEP 49152:BB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl02LlOpbeZB7m:Xu6Jmdxd2d0ycv
TLSH
T1DCD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 43107581c6f1ce6c4778b4a9d10e43b7a5acd853ba6bf6931fbd1542dd6501f8
MD5 bccbb29ddb6411b41696eacf8fd507ed
SHA1 e2f0f288059588df9b4db6f95eac3e1e45634dfe
SHA512 a331060b74a85b54a4e3bbaef7eb806ef9afe47f4ae4435d42955777cd31551635053fdf2c409f47e766e3c896d644d796f09a97fcce9aab6778480a7d1e0b99
SSDEEP 49152:c1hpsNoJpF1A63U44CwH7R4xP2LlOpbeZB7m:cmifPWR0ycv
TLSH
T1F2B5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 59728a24adfcc7f35a25a52ba8048a61c8b00a1e4d7a4d6b1530976190b72ce8
MD5 cf1b62979911366c8a84cd7f1707cc12
SHA1 a2095dce046a811156c0c56f97dafe671ef43ecf
SHA512 6289cab7bac8e6d1b5bc4ad3289864b25e7cbbf9f68295324909a1f5132020523aca4014021a4e34a59a6a1adabac30fae61781629df9724391d50ee5d8ec175
SSDEEP 49152:jSuZQIY0Be2KcRVtOnks6NMHqm2LlOpbeZB7m:B5dKii61mycv
TLSH
T19CC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a6a14016c1edd7e99c6ddd41df1d966e7b42dc2fc84b9194944de5ddf9d35e80
MD5 85259e156e6a62800bbfcfd504214e13
SHA1 e3e6fb022ea8cfcc15871b77631dc1e99eb20edc
SHA512 d74ea86bee05a24767d4020ff9bc79c34b79b822826bfea79a732c545b8bdfd6d48018ebf944bc8e45ee01c479a636b449b415cbc579372e9ee11eaa46f6acdf
SSDEEP 49152:KhtSn8EApI0fig3giDn0AP5wj2LlOpbeZB7m:rX2imphQycv
TLSH
T1A095BE13F2D900E8D06ED178C7568632EA62BC150B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 b6b65132b5d7973a1a394ff2b12f722fb83d71f486991c8c709deabcb0cd9591
MD5 1372fbab36ecb3da7f8e1095ff078847
SHA1 60e0c55bb383c590cf6514d49bf91ae1732478df
SHA512 bd5efc460c4be1de1f43a8be92a4320713f57f9a700e1e0ba681a294248138ab21c7289c2ce00aced2edcdd0f7dff5eb11ddb8ba0ed016c51030cceaf0267170
SSDEEP 12288:iq22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:iq22C9+bmOmbTk3reZCIT59z7m
TLSH
T1915523C18FDEC9FAC07E5230865120E56129EEDDEEC7719B428E0D4B2AF1BF8944954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 2f08ce46a8c7a99553d28c30b6adbdd399045e86d8bd20c5fb67356960530aa3
MD5 6c8e6780b08fcdb718303dc3ef72b967
SHA1 b154b988caeac7a2f1f43ade26cebad32131224c
SHA512 826c27b8b484b84f4ad2a06b5467cfe5aa3d2eaed3fa4808d9f3a95b45cf2794d220ac069881b8479475627ac10ba5585e9f44e384b56ac6d94a9d825fb08fb2
SSDEEP 12288:DN22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:DN22C9+bmOmbTk3reZCIT59z7m
TLSH
T1045523C18FDEC9FAC03E5230465120E56529EEDDEEC7719B828D0D4B2AF1BF8944A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 065145b9ebd9c595964ed942fe321b8fb4381011b13c00c5804d97664f24f0c1
MD5 2ed31050fa05e23e5e4ec839a9aee742
SHA1 030f9b98a3741e18012ff2a990d73f0189f062e9
SHA512 138417f3d3cf0da9416aba17cd878b1b34055a5c1f66e42c64cc37c8c35cf2652fbe62c1fb35ddab1724f51f57742fdd233ee641a12c605e48e428f4d04ba6a8
SSDEEP 12288:XH22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:XH22C9+bmOmbTk3reZCIT59z7m
TLSH
T15B5523C14FDEC9FAC07E5230465120E56529EEDDEEC7719B828E0C4B2AF1BF8944A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 491bf6b8ae6354dc50269570b5c6bd59b930489ca0bf7334807f68eeb8e463b9
MD5 bf6699ae462a42d5e2b55b468234e8e6
SHA1 69fd6db238df6138846fc4f17e3b2b98964df5e2
SHA512 bc127827b8a3716ecb92a44c09d96fc3eec7627eef3016be61955430bace871b8b0845782b65db03355128b4fd21ed1eb1fc3f24338b524fed90cf78dd63944b
SSDEEP 12288:oV022qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:H22C9+bmOmbTk3reZCIT59z7m
TLSH
T1255523C11FE984F6C47E9234C55150A1A275FDD8EFE3629F82450D8B0EF1BF4A829B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 ff321195fc7122b0421c318ddaa32fa0c99fbfcd0bfb755ca8c00c7d15091838
MD5 49525226eb834a3276d5d48c7084fbc5
SHA1 9e9774bcc4ccba4280114ff58753c0b20537c3ea
SHA512 dab2c213f4f9e78f4382311d82f4038380515fd9b3f7274922d7d58146085f2933c69db690526e7a1d476f63f6f7c6b078110622ea771ac0f4f67fb0411d2c61
SSDEEP 12288:h822qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:h822C9+bmOmbTk3reZCIT59z7m
TLSH
T1105523C18FDEC9FAC03E5230465120E56529EEDDEEC7719F828E0D4B1AF1BB8944A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 b9c28883bfb91cce2b0e26dab218b31f8aa43e796b2b10fc99c5304e00240e59
MD5 ace2b8e01a35d3452d832500ef8265b6
SHA1 e08c4c5359935153146e3281c5ef67676069ebd5
SHA512 db22f6977ee6bd8cf52387f27b32a9683b7f6f128ed8318cd0d4fcc1c1962a35f36c3e35043f45e0854175e676858e49bb364a5b89dfafc436ce6a7808ce90a2
SSDEEP 12288:LB22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:LB22C9+bmOmbTk3reZCIT59z7m
TLSH
T10F5523C18FDEC9FAC03E5230865120E56529EEDDEEC7619F428E0D4B26F1BF8944954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 bcd7932b6d2705a90f62947c6995c024b5ee7e6f54705fbf485d2ad111e3a650
MD5 9c5bda29ad3c34916f9db3ca1195d30f
SHA1 7621d6394212e90a2d35f76041b16734f21aa0a0
SHA512 59c39850daad7d30b8c77fb6eed11c877f8c5acb54df020615d8a2235caba9d606adf1b87ed860bc4459f1b5071a70803b2707e61030fa5d2876f4a5d62988d6
SSDEEP 12288:EV22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:EV22C9+bmOmbTk3reZCIT59z7m
TLSH
T1FE5523C18FDEC9FAC13E4230464160E56529EEDDEED7619F828E0D4B26F1BB8A40954F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 4b28c13024ea008ec054bf1672b3a88638e20bb7ee79bd927a4724dbc1fd60e3
MD5 c93a8ba014fee085def7783d01cef65c
SHA1 aefc9a288fb001e2eefb706e50a18494bb338f07
SHA512 eea360ed4ce728d9d28b05c48309fbd52c20babde1fa6e3bef20dcb5fd06a3641d4417d6887294d3a9cb6b78901178ab3c2762bf69874cf34596653b5b921c23
SSDEEP 24576:2ZMRzFVSOt22C9+bmOmbTk3reZCIT59z7m:2ZMRzfR2LlOpbeZB7m
TLSH
T1107502D5B79008F8DC7B813DC9518856D2B2BC594BA0C65F03E83A671F733A15C2EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 f0e8b6129f224f8310cabc90a6545c39b4def71caf2e22d270627bccfa6b187c
MD5 734a35cd76990fae07146ceeb96d666a
SHA1 1424fb03fa7258df7dc1be983140669b08aaeaf5
SHA512 19cd98cbdc57a616aa24cb28ba165eb92a3978a7a2e0f487432ce7930f640e40610d5c82bd67b9e70cf6834fe4dfddea5460bb3b27c030fd0a35053641e49d4e
SSDEEP 12288:E222qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:E222C9+bmOmbTk3reZCIT59z7m
TLSH
T18E5523C18FDEC9FAC17E1234464120E56529EEDDFEC7719B828E0D4B2AF1BB8940954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 dda7dc001e623d519cc91d53959df2a6e18bd032eb31ae21a5e0abbdcf2b691b
MD5 d45e3a55f3e69cd949852a49ec9eec81
SHA1 2549c4207aa1a684b804f7577efdb62999820686
SHA512 9f0f4582bee5b31802cf863a45f66318f2c9175aebd95444e6604987e0128feff71b1e3347660a8086f816bb2719d7d04264ba1b3d71e61f37bb4a82d976f4ff
SSDEEP 12288:Di22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Di22C9+bmOmbTk3reZCIT59z7m
TLSH
T1865523C18FDEC9FAC13E5230464120E56529EEDDFEC7719B828E0D4B2AF1BB8944954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 5edc710767f40ae4af868eca8fb1f5b0c99fee120e555773393876caebe84459
MD5 6e01468a2ec7bc98e961c6bdb10fc0d0
SHA1 6e063c0a981af9cec188417c90050048507b5f1f
SHA512 2b590c4da97afa2f86b965ae9acd955ecfc1c2d2689be574be3e3cd9a87b7daa9e37569ac633cb36abcbe0f27ea4a38e3a30801d3ed1ffab0b0a1f103545ced4
SSDEEP 12288:HyPz5L8522qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:qzy522C9+bmOmbTk3reZCIT59z7m
TLSH
T19B65128367A520F9C13B8238C9521951F375B8758B619AAF03940B7B2F737E09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 aa7a685e74f526d90cb9f6288de60bd24362306958b55bf7db1de41dee5f9346
MD5 5b783dd48269ff75e567db16eab7afe5
SHA1 d88ff9e2ff877a4fd5dd9b51dd6aed672f5becdc
SHA512 5d9e5e10bd22e1c54f8051a90498a561d8719a656fd8daa2b14f2abfff22c9aa43a0b4a70571e85097722f8fc2c256211722b470f24498af919d1b01aca6d233
SSDEEP 12288:P222qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:P222C9+bmOmbTk3reZCIT59z7m
TLSH
T1115523C18FDEC9FAC17E1234464120E56529EEDDEEC7719B828E0D4B2AF1FB8940954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 a1d6721b494da99e755a2575410659f79e86713c0aef3602934ea99c99e250a0
MD5 a96d1e99b198acec2330e4af8b1b3ef5
SHA1 4febc4a5d0f5d67464a1fce1055d1e3457bf5a00
SHA512 15bc0d152e74951ef97befdec63174ae8c4e02f4aa456d2f975c8d0ebe9fd96b2a5795554adf727de5ac839441ebbfe251b84e2f587edeabfea6538e412513ab
SSDEEP 12288:Y222qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Y222C9+bmOmbTk3reZCIT59z7m
TLSH
T1CC5523C18FDEC9FAC17E1234464120E56529EEDDEEC7719B828E0D4B2AF1BF8940954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 39c4769e7160d255defe125bd4b274c2c1efca679d7f983003674d1d25575887
MD5 c2f260eccc199abfb810b2d08adffe31
SHA1 24c53a22f461a61c8d5969c6cf7982bb520a13dd
SHA512 cb2a4f2a5895dcca3ae51af5e0e9819a0d15edc5e9b3905ddddde3449dd3ade9fec96d70fb369e11018ec9f2257bf0d7c0eaf3c9a8a8386767d965fd3d2fc1b4
SSDEEP 12288:ryPz5L8522qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Gzy522C9+bmOmbTk3reZCIT59z7m
TLSH
T1A465128367A520F9C13B8238C9521951F375F8758B619AAF03940A7B2F737E09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 654a3a9929111d2837048364f93f96f99ffb96002b46b7e3950c19f2ada181d7
MD5 f238d58a6af19ae1598c6a8316cfedf9
SHA1 62d1f4f0c804e5cb02e5d2eec0644c9471e46a36
SHA512 253b2ac5da619511305257aaf07a81157a270920d798ce08936b3aaa14e47cb1ad926ceb0cbbf0fab3b13c70438bac593a7bfb1f3ebec2d75f93ec23e243dc9f
SSDEEP 24576:+TDaLl3z0zD322C9+bmOmbTk3reZCIT59z7m:+TuLljY2LlOpbeZB7m
TLSH
T1617502D5B39048F8DC7B813DC9514956D2B2BC5A4BA0C65F03E83A6B1F733A05C2EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 c166e4826dd1459ac3d6d5183ea25c7d4a8f87edb8e3985981d7a48490d917b2
MD5 8d7737b23eb3ba940cc0f67c2644d2be
SHA1 87d233d1933fc4eeafbc52a9900736ec56d3e74d
SHA512 e9e688da6a02e793adda5f9405e7a4b4bd04c48903dabaf55507aa04786af9ea5079313066502e2f33ed0f4b3dcf3ee20e60cd5d663e40198c570e3c94fa7190
SSDEEP 24576:43vd9CHKy7GZb22C9+bmOmbTk3reZCIT59z7m:Cvd9CHKyaR2LlOpbeZB7m
TLSH
T10785DF90F3E414E8F0B79A34C9725511DA76BC995B71DA8F03A8261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 11f1956f5c1256cd8a83fb94728e52aefab3067229ca0876185191faa92b30df
MD5 acf03fd45da11d7443f0911886e289fb
SHA1 f2cd0f335d1562cadb70ab2e6e323c9b0a75989c
SHA512 fe15a53beec16bf85e865499399f888e9b4939842a60951eff1c04ce17e3fb8f78571cdb687b3f6d303b8a35a192327d3e4d1ada779f0354ca885bbc4c34a1e1
SSDEEP 12288:on22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:on22C9+bmOmbTk3reZCIT59z7m
TLSH
T1BE5523C18FDEC9FAC07E5230465120E56529EEDDEEC7619F828E0D4B1AF1BF8900A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 a2a9755a00d6a8cf7539bd362c332dc7ccc9d97585664c9210c5544ae6bec959
MD5 99134912a2a8d43917604b831bb4bfe6
SHA1 1f5edca7df03c767b545ece3fc58bfa45b952ded
SHA512 2f124622adcb42386a4f46e6910a046b312bb1634fb9e86ec4dc3ebd5940d9292eb8a08bc6a57ad2396de54ec3d35f366fc10c007c95b0d85c06d65ebdefdb7b
SSDEEP 12288:vZ22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:vZ22C9+bmOmbTk3reZCIT59z7m
TLSH
T12E5523C14FDEC9FAC07E5230469160E56529EEDDEED7619B828E0C4B1AF1FB8940A14F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 bc94fdafd6a3eb9232a471af26dfff700a042310a7e7c63aa271ce60be74f3ff
MD5 43b56a4894f5d6d1fd3f24a6240b5de3
SHA1 52c1df7a46711fccca77e60cedcd79901a301ebf
SHA512 ec6bf5cb04e9cf074d8fce049378b8c78d0634a2085218d67f873d23956968e0e85806f8195d82069dfbb9bee3071ed9c12dea816b4e923774fd85290bee426e
SSDEEP 12288:Tg22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Tg22C9+bmOmbTk3reZCIT59z7m
TLSH
T1385523C18FDEC9FAC07E5234464120E56529EEDDEEC7719B828E0D4B2AF1FB8940954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 a5c9ca71216e4cfe98550c7c630c22edd9b16982e6b73e784d498d26fe2ef124
MD5 ae1b64557c76b886b35aeb25724d5242
SHA1 a109c34cf73834a49fe02d67910cbf277b18c5f5
SHA512 f621b1b78823731e953b5e85f4fe75e9466d0ec2fd8b5ef44c04efd8677306a335289fecd33b8ebe333ca96c99e0499bd810f8ed78b0c496b34819d4b52b5ca7
SSDEEP 12288:o222qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:o222C9+bmOmbTk3reZCIT59z7m
TLSH
T1985523C14FDEC9FAC17E5234464120E56529EEDDEEC7719B828E0D4B2AF1BB8900A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 e9d6076bee46308d6a82a38be405bb1368ec9c431b35be007fec04887b404bb0
MD5 a50b632bd833be2a1c0a513aa8cbf75c
SHA1 6840b182f956f9a544d219f6182bcd343424bd85
SHA512 c1bcc8882bbe8ce5a3c59c27cf641634abc2455a7df0dcf1ae6cf2c24cc60d93fcae4fe118188e6ef7d864efc47abedc1d5b1aaf1985a3ef526c27bd559fe553
SSDEEP 12288:3n22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:3n22C9+bmOmbTk3reZCIT59z7m
TLSH
T1BB5523C18FDEC9FAC03E5230465120E56529EEDDEEC7719B828E0D4B1AF1BF8944A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 c577f99da83e2db2a19abd69c7b2490f120f677899d80f87686f2683a79a83bc
MD5 3005dcd0475745ce20c1f0c18fec4b82
SHA1 6399e05dbd4cc316900627972bd50cf93643fd96
SHA512 a50bd0f9e6d075882ad78642d938f4e444fbb8fa12b6d350dc9038b337aad334b61fc5d460537d46fb7d8334ec87fa211d348d55de5db2726744d51af9bbe9dc
SSDEEP 12288:he22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:he22C9+bmOmbTk3reZCIT59z7m
TLSH
T1705523C14FDEC9FAC13E5230864120E56569EEDDFEC7719B828E0D4B1AF1BB8900954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 224ccb6cc35a287e3b16203b9bb5d188ef59d220b5b9c64981905e5e23a50218
MD5 3a3ca2f762a74fd14fdb38e1680fa754
SHA1 6ea98308095e87e005b3744acc2b29b268ad5bea
SHA512 f8267a1164d20e406583f5d692bf15dc0e2721d7503527f08eb7a4a443800653d55144fcb5aa30b2f2c43b115ed4e7871ff929abb81bd49676d796fea011efe4
SSDEEP 12288:9822qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:9822C9+bmOmbTk3reZCIT59z7m
TLSH
T1D85523C18FDEC9FAC07E5230464120E56529EEDDEEC7719B828E0D4B2AF1BF8904954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 a161da9fe36f831d44006e9925a75422d568f26676ef93af569196f4edc8009c
MD5 629005cd1d9b0d534c6acbb29e9249de
SHA1 f77720751566a0e5dd05ed4b89cb52096f894235
SHA512 47b3069d7a9124d1b0088a9f11f5745a90c11e1f3f5943c032f1e6232706fb26baa8b94dcad997ee53cf7b30135048ca37f79fe81ec410e0989a3778017f62fd
SSDEEP 24576:wfwvUk9RX6wkyAIy22C9+bmOmbTk3reZCIT59z7m:EMnYIy2LlOpbeZB7m
TLSH
T1E885DF29EBDC44E5E177923C89B3460AF6B1B8695B71C2CF029A53AE0E33ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c3b56a60672776a7c6c4c27e2980c51ebe5cc6549d0ba0e27fd2459d242e43ec
MD5 34dec2a08e6086ec5386f4231b6651f8
SHA1 370e80c4210460c7f7526ce858d8556db3da3cb0
SHA512 650756a4b1ba11bf600c28eb42e0d613ac63f7f738fc9f0c807517045f76a896efa53766ea84e6d33fe4956bcf28dc387f9c1d3a460d4e7cbf143eb49783085e
SSDEEP 49152:UYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0D2LlOpbeZB7m:jySzPbycv
TLSH
T14C066C96A1A841D5C1B9C1B98B0BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 44072797419898908bcfb741e0e2d72db16466d5e3287b3f536ccc5536436e5d
MD5 ebee38b59f26dcc35e08fccac6de14fd
SHA1 89585b549e7ac36a8ffd54d818fb3cb8932dc852
SHA512 915ae92d31be25b7cb2b9621194d039fd96febaca0a8abaf91211627157a23e8d9b42d142e74b8107c493cbe0d3265c910024b98cc31167fe0179fa8df8d9109
SSDEEP 24576:M47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY922C9+bmOmbTk3reZCIT59z7m:M47JUQjTirIhCnDHUPfF/T2LlOpbeZBi
TLSH
T13065AE1EA3EC01E5E1BA823885154A5AEA71782D5F32CACF1270437D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 0b692c34ef26e4d56fd212b7246acbbe2c8e7bd4ca028b41b76978918cc1f365
MD5 5fee8dce32bae2fb5d5658ba174407ec
SHA1 65b104ac20687cc7952163795c55672e9f603c94
SHA512 4e8b0e4cede78acec12354e91987b5968524c576e7bc051ea6b51997c4403f11781e63f7c159ab320cceb5bed3ff2328321ba654fb9349424bd8c52ff06553f3
SSDEEP 12288:Nbsfm22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:om22C9+bmOmbTk3reZCIT59z7m
TLSH
T17965F185D79842E8C06E6234C7515681B333BC659BE2E3CB52C0F97E1F766A09DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 3c88cee57caca3ccf30f529a4dbba0a81c56b07c2ce40032b06ab083731b3b44
MD5 5467f63d75fd48315717a6547279a3ba
SHA1 9c79d4764d5ca672bd91a9b3b8c0d243c1625cd3
SHA512 5668aae178f655b39427e1e5ec3624c5338b28a5abace799bfd3c4112cb194c18a35e6923c50d1aaeac98429e22ca816780a002e8a6305ae89d94336ddaa2779
SSDEEP 12288:LuMd/U3fxkIk5xxlIuaIgWox8e62a2o/kYgNtVyE5Wb/N2234Ox4NPkNpKzaOPpZ:LuMFUPOxs8IiYtm5h484NPapKzasE+5
TLSH
T1E7553841762AD79BC6A940325E36D6CCA7707C01FE056F0773C8873F9476669BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 8d0775b5cc735ecb0c95eb5260195988a94751e34328a88d592422107e6589ef
MD5 b125fc113be2fa1151734dd88022733d
SHA1 38e722c61430dd5bfbd3be2b2ecb4726435a27f1
SHA512 359fcd0740dd305a1cb83cbe0671e964e2636455bb2ce914b07bc5e20687b9c451d689d63fb3389a3b50e2446ec1efec4512c31a6f3794e08ade56759a5b694d
SSDEEP 12288:7pyATfsFpVe5vwJiQ5IuaIgWoB147IVfUqd7VB1Tzy3yBEXSak6fa:7pyATfOzAo8vsmw3SEXjk6fa
TLSH
T1FE553C01B5B7E31FC8FE90774632C6CDAB789C02BB452B0573444A2C987767EB5E6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 a8a57fd1161667d132f3794d9533f26144df4c1ad458e1fe582c9665035f2349
MD5 1a922282f87d82484ca519543e65f007
SHA1 e2fd0e895c693cccb887b4d390b9fb1bed05473a
SHA512 72403cfe4a8e75a6742b20e8e9ab500138fa8aae9f28d16761bc140dbfec15975bb331682d11870cbdec8622fe96896bdd639a835ecb8cd1f7b2c9d6f176b0d3
SSDEEP 12288:o07O22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:lO22C9+bmOmbTk3reZCIT59z7m
TLSH
T1355523C18FDD89FAC47E523045556074722EFEA8DFC2A0DB91490E8B29B1AE4DC7960B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 31bc6e9e6a4a43496700441d81f3d4b38c80c8dcbd8e0f04d774a39f29b554c6
MD5 870cac9a84d6166ad368c39ba5dc37be
SHA1 0160e2bdffbd676323456d296c25bdbfbdb08703
SHA512 0acae486a8f3aeadc1046793d2fe7e292a8f9cca06b3e3e187854f3e130b584ded3b9c795471987ddc4833743f8f2ca837dd44b49a9665d5a144f36ee1e035e9
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYY22C9+bmOmbTk3reZCIT59z7m:/gb4mBIBhGF92LlOpbeZB7m
TLSH
T13865AE1E22EC02F5E0FAD2B8CDA64417D6B278164732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 3b4c7f5c6f3f5d6f0325fb6d2d2fd1cd3d90e938c9dc9bb52a9f906c8f8f0438
MD5 1441c8ba9507da3dd38bdc2fc452f364
SHA1 68a28fc3915e07df75a112d41655da40f241bff8
SHA512 bf592f6a1fc71373a6cf08af8842e7bd542c5e42488c87e34e6af526be4d096ef6891d2d3de18fd847f5197564c57c3505badca0d6804560d70c49d23a8d3c7a
SSDEEP 24576:FG88u8FpJqH1bzria7/mt22C9+bmOmbTk3reZCIT59z7m:o7ZFPqVea7/A2LlOpbeZB7m
TLSH
T17795F16167E101F1D47BD13889824663F6B2B8250364EBDF07AC8B561F23BE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 cbad9c67a8b57888ffe5fe9287d66f9f08ec03183d550437e4015af1c94cdb85
MD5 aed84091acd83b7184b39f106f35a7b4
SHA1 6d3c7c0291cf73d4e14e528ab7f932314fd9ecc5
SHA512 eced285be67d9de9eb592abc6418171e19de9607187e1ae921a5c125d47324e25defdb5599f00926cfccab67b4a60451e41ca832344259aeb44784d25ea2d4f6
SSDEEP 24576:zPUr+NQG22C9+bmOmbTk3reZCIT59z7m:zJQG2LlOpbeZB7m
TLSH
T19375E15F26ED18E5E67AA13C85824619F771B8625752A2CF02D0817E0F73EE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 703cf73a2987375651c6eab7770dbd4339863fd49b8f08d409972611c7b41f3e
MD5 68cc6f3e9573ba9acf77c00645967498
SHA1 dfcb92b823d33fefea59ee185e1b0270303d3be0
SHA512 948fe1b7b67e09e731c964c12c82da5e70c38b513f3bb8f3a7bd2bc1855f1ba025d760241dc2891da19c71c3dab5fb7ac4a3f0ede1c360f38477ab125e662961
SSDEEP 49152:ABCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjB2LlOpbeZB7m:7G05lO43b6ycv
TLSH
T133D5C06A62EC11F9D0BBD17CDAC6460BEBB23815033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 107ec76ae6be7d918d2f921725bdb33e2ce4725503ebdfc99a6b47585243cded
MD5 e63dcbe0fb4063573e04c86cefa794c9
SHA1 fac68203f9441c0e02a653a22cfb50fe74208d8f
SHA512 0de8bc7238dbf19f3bc2b9a4a5b4816aa6c12a7ec4e7e754c7dd016df15a4bb18e6d82016f60fa89f1bfb3cf2d73e7536b80d838de2cab4588555d40a0f804d0
SSDEEP 24576:pfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnD22C9+bmOmbTk3reZCIT59z7m:5a5POZ3BJt2pasx2+mZ2LlOpbeZB7m
TLSH
T19A65AF5EA7FC01D5D1B9D17CC583861AF5B1742553329ACB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a43b18b405764d7dd62a49e92b9e99e778a05c82d7c1d8f039f148dd2214a8de
MD5 a50584250392f360452f4f4848e14b84
SHA1 22c09de592483938218bd15d7521d1a1e5290a95
SHA512 405af4cfee999ce356be2655381f2b342304d06622164d322c18bebb02e096a2ecd5449c9e7e95ea526739f85d69b93cacff4fa847c4dd3d997104f8e185aeaf
SSDEEP 24576:KNcwHdjbyQ4nLC18lb/EOjowL7FkF22C9+bmOmbTk3reZCIT59z7m:KNc/zEOVHFg2LlOpbeZB7m
TLSH
T1DA858C1623E901E4E1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a2adc70aa0b1b74dd4acd71ab74b9437f15344b1e543a54cb5ad379e487356d6
MD5 4a33741e1653b62acecd8283ff10dab2
SHA1 e562364482b11fb8087dd172d4b4aaebe76520db
SHA512 f01d320972d7c73c4f64caac2da5b75e91c24f8194502b49fe9a1ce386f3aa53b26bdcc692d0dab76702b918c668899c84b665f688a5cde5ae7c28273c183c02
SSDEEP 24576:xTkNvNnaFeYhJNtmZBmg22C9+bmOmbTk3reZCIT59z7m:xTMwBtOmg2LlOpbeZB7m
TLSH
T13655AF6EABF846E4D1FEC6748D238512E6727861073293CB5290C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 d4abc91aa5ecfe397e157cc26996a664ac036b1573fd2b5d553f67051687b11e
MD5 4be6d9bd68da41cf6c69a7cd7c22b588
SHA1 c822b3542e23b71b436cf960709868d0787ea6d6
SHA512 ed4e423536468d0279f86f8b9ff0408d2c501352ee78383c012ff13b46b84c6ee5e1478e42fcbd6b6241056442f34b7e8398379b710e7fb3ec97964d1b48a33f
SSDEEP 24576:TD3FHshBIYQgAK22C9+bmOmbTk3reZCIT59z7m:TDVHeBIAAK2LlOpbeZB7m
TLSH
T1A685E17EEB9C04E4D47BD17CCA638906E77178A9076265CB02D481BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/760-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/760-23-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/760-24-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/760-16-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/760-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1220-404-0x000001EDABFB0000-0x000001EDAC1DD000-memory.dmp

Download

memory/1272-72-0x0000000140000000-0x00000001402C4000-memory.dmp

Download

memory/1272-1-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/1272-8-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/1272-7-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/1272-0-0x0000000140000000-0x00000001402C4000-memory.dmp

Download

memory/1272-66-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/1712-41-0x0000000140000000-0x0000000140256000-memory.dmp

Download

memory/1712-52-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/1712-54-0x0000000140000000-0x0000000140256000-memory.dmp

Download

memory/1712-48-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/1712-42-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/1884-293-0x0000000140000000-0x0000000140250000-memory.dmp

Download

memory/1884-63-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1884-57-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1884-56-0x0000000140000000-0x0000000140250000-memory.dmp

Download

memory/2000-30-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2000-29-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2000-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2000-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2000-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2192-328-0x000002D697540000-0x000002D697671000-memory.dmp

Download

memory/2748-94-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2748-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2748-330-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2748-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2748-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2748-87-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3844-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3844-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3844-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3844-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4152-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4152-134-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4152-132-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4152-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4244-120-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4244-311-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/4244-114-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4244-113-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/4560-75-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4560-73-0x0000000140000000-0x000000014024C000-memory.dmp

Download

memory/4560-81-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4560-307-0x0000000140000000-0x000000014024C000-memory.dmp

Download

memory/4868-308-0x0000000000400000-0x0000000000618000-memory.dmp

Download

memory/4868-84-0x0000000000400000-0x0000000000618000-memory.dmp

Download

memory/5724-312-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/5724-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5724-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5724-101-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5724-107-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5724-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5724-313-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5724-315-0x0000000001390000-0x0000000001633000-memory.dmp

Download