a285d7f89e32959694a7f0fd7b610c0f4b94f60213b884b673121423666cbf81

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_7e851bb85da26ef1b88a327cb8d5b53d_blankgrabber_icedid_luca-stealer_njrat.exe
Size 9.5MB
Sample260910-e84n1axhlf
SHA256 a285d7f89e32959694a7f0fd7b610c0f4b94f60213b884b673121423666cbf81
MD5 7e851bb85da26ef1b88a327cb8d5b53d
SHA1 c4730250d6a6d802a77cd65fc3f4152e08afef77
SHA512 26840e3738e5f3bd02aa873b27fa75b164e7a27caee89d4ac1b36e963fb932d34ec98992c766292688c98540b8579046707373518ee22e898d7649f595b85c5d
SSDEEP 98304:IwWSlJJPia1dTIit/OcuBVz+VkH26LOI9m6R73qTrOIRycv:9lXX13/OJ3+VE2Q9Z96Znv
TLSH
T183A68EEB31E552ECC067D17BCB13ED7BDAAFB43A0221D69701A492325E57C103A2AF15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
832	elevation_service.exe
4376	elevation_service.exe
2152	maintenanceservice.exe
4368	OSE.EXE
5864	PerceptionSimulationService.exe
3356	perfhost.exe
5412	ReFsDedupSvc.exe
3844	SensorDataService.exe
2196	ssh-agent.exe
752	AgentService.exe
5612	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-08_7e851bb85da26ef1b88a327cb8d5b53d_blankgrabber_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_7e851bb85da26ef1b88a327cb8d5b53d_blankgrabber_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\66109cd624febf98.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_7e851bb85da26ef1b88a327cb8d5b53d_blankgrabber_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_7e851bb85da26ef1b88a327cb8d5b53d_blankgrabber_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_7e851bb85da26ef1b88a327cb8d5b53d_blankgrabber_icedid_luca-stealer_njrat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000079415a29de40dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dfbc5529de40dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b59c5828de40dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000372b8028de40dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003695df28de40dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053ff1a2ade40dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
832	elevation_service.exe
832	elevation_service.exe
832	elevation_service.exe
832	elevation_service.exe
832	elevation_service.exe
832	elevation_service.exe
832	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	908	2026-09-08_7e851bb85da26ef1b88a327cb8d5b53d_blankgrabber_icedid_luca-stealer_njrat.exe
Token: SeTakeOwnershipPrivilege	832	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	752	AgentService.exe
Token: 33	5612	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5612	SearchIndexer.exe
Token: SeBackupPrivilege	5412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5412	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5412	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5412	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5412	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5412	ReFsDedupSvc.exe
Token: SeDebugPrivilege	832	elevation_service.exe
Token: SeDebugPrivilege	4376	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5612 wrote to memory of 3280	5612	SearchIndexer.exe	100
PID 5612 wrote to memory of 1004	5612	SearchIndexer.exe	101
PID 5612 wrote to memory of 1448	5612	SearchIndexer.exe	102
PID 5612 wrote to memory of 2920	5612	SearchIndexer.exe	103
PID 5612 wrote to memory of 5468	5612	SearchIndexer.exe	105
PID 5612 wrote to memory of 1972	5612	SearchIndexer.exe	106
PID 5612 wrote to memory of 3008	5612	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-08_7e851bb85da26ef1b88a327cb8d5b53d_blankgrabber_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_7e851bb85da26ef1b88a327cb8d5b53d_blankgrabber_icedid_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:908

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:832

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4376

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2152

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4368

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5864

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3356

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5412

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3844

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2196

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:752

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5612
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3280
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1004
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1448
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2920
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:5468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1972
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5f4f845d929f887dbd0fe0ab30adbd560136f0421f86d200b9d1e0a823ac824a
MD5 c59c1b41f9ba98f751d951f6a9e1ce34
SHA1 165e8c9be275f0728f06fc8f514105ac7a565338
SHA512 466756d0c5200c0ca602203eda8fd995387ae3352d94564eedf3cc395299becdc1e3c387b196a8735a46fc9078fcc57cd40b9cf127c9e0f72716084bb93eba48
SSDEEP 49152:9b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnt2LlOpbeZB7m:D3q6sjBAycv
TLSH
T1C1D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 419541dd12bad8024d43308ac86944f4bb5548d28e625e968e2e07602cab33dc
MD5 292c4eeb8bf81af08bcc02095428aae0
SHA1 7d4ed770c899c6620e1f8af3f56e6222f67b57ff
SHA512 72ff94b90fc65ed3616cc376935dfedaca8a73be436a18401e651a3bc193f33785c452201d7811dabac0a3a4536b13a18f784b6b1c325513cb3e4723985178dc
SSDEEP 24576:RXYfDtczAk22C9+bmOmbTk3reZCIT59z7m:0tcb2LlOpbeZB7m
TLSH
T10575016467D408F9DC6B823CC9A28411E633BC9587A0E7DB03E489661F737D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 384c96d3ea789c562c2c2fb0592db18b656a4505c9dc177fa1907f7b60966b2e
MD5 e274a097f45131d44ae0c59f2557ec34
SHA1 dd2566378c44642ed1319c1d82010cf78f616e2a
SHA512 d4695b87df2b7e7f63b64da08e045dcc6f7d2dfa6397e0262202c7bb47301254b17e74309a5206b00b93003f5fabd7071c6e82a05b0764fc7e945f368e1ff387
SSDEEP 24576:q0Le5ji0hmxxrMl22C9+bmOmbTk3reZCIT59z7m:qPji0Aje2LlOpbeZB7m
TLSH
T19A95AE56F6748371D073C0B9C5D2A69EE97130865B308ACB4286C77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 265a95bdee153ad218632e0733fb96396b65d25aac23444351f630b774663558
MD5 700b78412abf6b56c1ca339ad4d934d5
SHA1 83c9fda377af49c5c4b77db6bb3f65d8c60d3c61
SHA512 e2c6aa8e6d1a2d365d84a866ba5e56b01187e5b8e853abed703e2482d833fe9f0970c3584103d436e7d484bd6c52299cccaefe70df954d7693c978dd14492eac
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWn6q8wyuL22C9+bmOmbTk3reZCIT59z7m:x/ezSC6vUzPveHjyC2LlOpbeZB7m
TLSH
T115755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 946f2ce4a8fd32a785c373519a2997477dfa724238eb90743ce7660c783b61c4
MD5 9068c21687209a66d36f9f72ebb362b0
SHA1 c46a31e6653d8ddb3238ab95bb093e9cc63c64c1
SHA512 c1c056e6d93fc913d1d52d045fe69097f744d567b7aba9f89c6ac9b887230f059ebe02dd0fbf45d69b4c938261bf93f8ea7f279232bb82b1da1f7e882c7984ba
SSDEEP 24576:jVbqPb88hv/l+Yw22C9+bmOmbTk3reZCIT59z7m:jVO88hXl+T2LlOpbeZB7m
TLSH
T158559E66F6B48331D073C0B9C5D2AA9AEE3234415B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 434abaaa951562a1050de211227daa7d95305f7d5d7aa2771351acb34167a710
MD5 e4d9f82fa0bb8224e16d5a01be6127c5
SHA1 b4fd64850f031279ed9be2e681f7017940a5fff2
SHA512 046f0cb891a60909ef23d80ca9c89bd973b5992c0c32819450658d8b65ed3e37c691dec013e575d9658d23c47b2c4ab8adcbf7a377ceb0c4b7e39d3901af279f
SSDEEP 12288:4LR22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:4LR22C9+bmOmbTk3reZCIT59z7m
TLSH
T14C5523C18FD8C8FAC6BF1230569164F52635EED8DDC6B55B81891ECF18F5AB8D04A20B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 1bb4c6964761587a7f0fc04a30c61094187a8cdc87e63f0021a465bb5adacbeb
MD5 e7c2d561b5bf57e02784f924b41b8301
SHA1 41f14ac608809f57f5632d794af8d39be56e9652
SHA512 a42d4b0cce3287bdafca4cdb420f361c4c820840a6d8be3fe950b663e3bea97eeb814f3d3de3bd522d772b798233d7bf77204cb17dc53168e10150fc56cf896a
SSDEEP 12288:ceBNUbTVO86UI22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:cJIUI22C9+bmOmbTk3reZCIT59z7m
TLSH
T19B75CF7BEE28FCE2C27E4D7857918640E77278708F52A3CBD165820E9E235E05D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b90a7d961f7034d50373b94050546b76fbf6f25cbd722932b373968b3c64a8c4
MD5 b74f0acd9b1270348985a6fac5557231
SHA1 a2e5995e01d0ef402bf58f93a609168837972e12
SHA512 500d8d4789bdbeb3da7e828e710cf8edcebedbd39b35a8cde98081e2b878c73072d917629acba9196ab9c64f03b38fffb5ceb5cac3f6551425fe19296b72229c
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THG:UQvGAdlCEL8c/DRNw5C7ycv
TLSH
T118266C656BF880F5E0B7E134897A85B2F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 6a4b7b1ba9fc95d926550dc3e672af88c2f45253c84a7fdc6d65cd2de4f141b7
MD5 e5943747147e771fe63a880b59884af3
SHA1 f7388c8fdbce8c78c13c5064a2e3379600858336
SHA512 bae8b398901310b7eb76fa0c60aacc37ebdee9f7330631bc84f3ef6097f265188b9bee517c2175642203dc8c8fc4ea82edda57067d69f2f8e17e15b8b88fb725
SSDEEP 24576:Y0ewsAjO22C9+bmOmbTk3reZCIT59z7m:tljO2LlOpbeZB7m
TLSH
T10685E071FE74D436C2BF0DB11B26D716143DBA604F922AC3E3A84E8E59702D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 920f96b464f6e245cac5ea9e418f7b84515ca15147e92bf8adf50d9887f574c7
MD5 8184ac1c58f7d1dfc6b59d17988c922a
SHA1 cd110a550acea025e7cc7bede45095f304008931
SHA512 9e43daf172564c228fe4e1f5238bd91e19901649937ed767c036d32ba52b833ec783bdad004bea92085ca056ca114ade9ca9618eb96f65cd5c2f2768aed5f42d
SSDEEP 196608:TUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHiv:TUEtQevvqc2W1cpV2tI32i
TLSH
T1A1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7b0efe35c6e7fcfe955c0375cf219387a1115b6640959088fe1aac593c03519f
MD5 25d87a84a4076747e188f27413d86513
SHA1 0d17bf87256e727e5ea7855f1820e9c54c113cfa
SHA512 c78c884e57145bf9a60857bdf88a7c1e16bea08c6905f25beac1cff5ee33932decf3939af6dd103c8eba76d167717d86b93f07d7c8c79796cb00fd6f8dcd8f4a
SSDEEP 49152:TCbRquA/m2yL5zTfFiV+XenmE3/zu2LlOpbeZB7m:soquVjnm/ycv
TLSH
T1BCD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d1ebc3756c42e7d8849353a67f7071c4fa130ac4270d33c40c658e1d8b4bc00f
MD5 b243c293eccc0378093338962ab48685
SHA1 65911f442361ebb113c569cd25f8537a925ac1ac
SHA512 948b89336828a418ea320b41b6844ff5827e9bd9c33e4822b0457f27f3b153ab2ee67ee575ca4a28eccbce8309c145de3fd7eb9283122dde37998417843203d8
SSDEEP 24576:kAhGL3IFoiwtA5l7S53f22C9+bmOmbTk3reZCIT59z7m:kAMUFoiq5v2LlOpbeZB7m
TLSH
T19F35AD81EBF945D4F5B7AA7899B69171EA76BCAA5E31C20F2150C10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 9797f6633269d3e08562954c8e3d3881bbe2e0c41032850d2e00da16b875ed07
MD5 6376158a5a287cb113943706c657c661
SHA1 f1f5b1d027cc86a395bd3bea948f09e57842623f
SHA512 dc2f209631ffc75b8c344fcc737cf9817ad408aff1464a1bb81f80bf82170291ab954e53a2df7c173708d336868e625c430bec0937292445eca20bf15bb20d5b
SSDEEP 12288:emw5HEjsChNVBFgl0WDm+Cr22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+114:3wu4OWi22C9+bmOmbTk3reZCIT59z7m
TLSH
T1E775F18677E80CF9E96B423885978136F7B2BC152A65D71F0360CA5B2F73361AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 b0edce4bf0170e343bf5486175f0bef7dc74e77a223d241656fa9e878b6294a7
MD5 a8fa2b47226799e5bd2fdd10555c6d37
SHA1 fc6c7a8eaebfa37cf0e7f602d00051f581acacca
SHA512 a34db73bd60f1459a3b084a104655b46cceef583e68753329e24b3d6cfbd7df2731f0ca1aa3c4ace49861ebe1f696638b740d2ec9b15f497b9384a17b3e5840c
SSDEEP 12288:jeZ1Iy+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:yZud22C9+bmOmbTk3reZCIT59z7m
TLSH
T18D6512C627E860F9C1BB4238C9E15545E372B896ABB253CF02540A9A1F73FD59D39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7abd762c414ca04c6fb7318af55d1e30e8b3b03c07cec81bda00a260ecfc4249
MD5 d1444c6529d691ab49a41a24560545b9
SHA1 2a755b8c9831e477355719e0e91feab5e08a13f9
SHA512 f5fd55e5d043656342041ec8e3289956e32c84ed6d9b88304f39c0d39369891a2cbae441a7a91e68b649524d4d5c0a002c3e34a9c41b7c0b6b6b51502751019e
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uy:rQRQyi36YOcPbLvw2gAf+PN38ycv
TLSH
T1B9667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7dfa97f4ecd5c7bbc383e8fcaa123d06d683af4f3156d7a1c52480cbe3f3235f
MD5 7ac09831964228ac2a1613740be3667f
SHA1 18a68d96e8f58cef85dd380325acc3bce0dac3c9
SHA512 6ebca7faff23304fa1ac68c66774bcfff14a15a915303c598f679ee69d13ea73b3eba344d896dc8124b2ab892885dfbc3250723630ab14ac056d1b0c602445a8
SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uy:gQRQyi36YOcPbLvw2gAf+PN38ycv
TLSH
T174667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 18facada4d9287490d2dfd8701717edd7305e642bede79ab0ed39f27ec356809
MD5 1c49e939d42b33fd3e96143a22a435b7
SHA1 69dc46c3fc2e4e1a5764d160d2a53f63ba041921
SHA512 280a753e5bae686f8c9ccb5099e804dead2ac8b2b6d1424a1a11861ef9d6c0f5d6dde741b0e04e468bb3aa5941290dac811499da90d561facce70fa3d8d42bfd
SSDEEP 24576:XwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0t22C9+bmOmbTk3p:f68Qg55nhceWu7PNU3/e2LlOpbeZB7m
TLSH
T177B54933B2F600A9C44DE1769F46873196D27C758FE1E3DB8505720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9386e3796167e7a0b9c866238e6df7c567c89afb82734f52ac77a5f552c2db5e
MD5 11a631055994219f84ad2be5277fb2f0
SHA1 ece1747d56571daa70f18e27ef1e7225e1e2ca47
SHA512 56e6aa67d73e7f7025b3ef4357d1833e2869d98d9e7bbf7a6e286e1ead3cac3d500101bc5e7b21b4efb8e97909ae0894f3d12d06b520856eaa073b52dbcfb950
SSDEEP 49152:a3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk998:Ly5112gYy5azzVvt69nLKnhZRycv
TLSH
T172167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0e849dab17798578aef5353ccde8b1d7390ae6b0fbcd1eae87367e9ea726d273
MD5 095555bcda705c5898a9b7d9a3de5071
SHA1 e90df3136f9150c0e8725128866a2f0bad46dab9
SHA512 2cc63cfdfe50f1bf0df6b68667657a0285dd75b28632c1d234d50a2869107a23ec8c267f4c5e3158aa0b20ec4b34e0e083248f7201cc59633da0e349dea13d64
SSDEEP 49152:QB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gld2LlOpbeZB7m:Ku6Jmdxd2ddycv
TLSH
T1CFD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 db03d6edc3c77256deecdbd8341f0418856fc1508af7d26ce4b3f11f256e534f
MD5 c31c0c28df6c4356907e1fb3bcf98f6a
SHA1 2dbc579595e8c71becdf48c72a6505b1684e2a75
SHA512 4f76c2f62b82c49fee311c9d9f9b5469325284349f2d49aa8c464260fd99286a961279b8daf93ce2cac7095ce7e844e2ab0453ee62ea229cb518e157d90050a8
SSDEEP 49152:K1hpsNoJpF1A63U44CwH7R4xo2LlOpbeZB7m:KmifPWR/ycv
TLSH
T19EB5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 709ec1f65fd1da6614f969b26d7e1da5901b32babf7e250777206a18c8abf2dc
MD5 8f3a229434dbec49e8c3379e7bbaa294
SHA1 6561c0e91452ea819dd75f82333aab3389d4c91c
SHA512 6548034905e4db9b575665eea4fe93dd243b695f77ddc5a71b6fcd1480e32ba66e7deebdd7215c8f13eadbb14e334caa15a7171e52380861bd5941a1f82ab2b8
SSDEEP 49152:CSuZQIY0Be2KcRVtOnks6NMHqd2LlOpbeZB7m:c5dKii61dycv
TLSH
T167C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 66be689f90d4956eaf3bfbf2eb791b9425192e13214da3bde29478af8e103fe8
MD5 c8b158e700ab83b1c00622e86d0d7db2
SHA1 0b1f978448419daa42e3367f7b611c9161f32c6a
SHA512 a00c8950916c57f1443d9999a53dfb94c95879dd36003787e260890c22d8de6592ccc9e667f382e2ed903711cff50516fe8d82c4f2c757ea106556e1e8395444
SSDEEP 49152:IhtSn8EApI0fig3giDn0AP5wk2LlOpbeZB7m:ZX2imphDycv
TLSH
T17095BE13F2D900E8D06ED178C7568632EA62BC150B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 6f82888bbbf23fa63e731c7cc21fd83e13a98504faffe67c2107988947bbda50
MD5 1730c66ebbc95050d5f7c55475913e74
SHA1 829381cf6cd9549cc257ec42ee03256056b6eee6
SHA512 847e0d2487fe59fc4ac738021310b76f025696ed069b3651ea4a5a2d1ad02308ab9779cf9639303430c4784528c94741ddcdc4928bebc2243eb9484e3dc6ba84
SSDEEP 12288:+p22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:+p22C9+bmOmbTk3reZCIT59z7m
TLSH
T1A35523C18FDEC9FAC07E5230865120E56529EEDDEEC7619B828D0D4B26F1BF8904A14F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 a7f8033a9748d193066f2472dea2c56142a7b88f0396534fbf044762614ee6d5
MD5 86b0bc92de64922ec13fea9987785c58
SHA1 0da04b996cf71931805fb8801123301375701a76
SHA512 08ba8e20b066270eecacb339b9db5fa9a64ea988071612ae9f7c78401172452bbe228e19dbf11df7e05b81976383abdce640454016aa04a893d4b79f1ab46e24
SSDEEP 12288:wq22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:wq22C9+bmOmbTk3reZCIT59z7m
TLSH
T1885523C18FDEC9FAC03E5230465120E56529EEDDEED7619B828D0C4B26F1BF8A44A54F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 0197131edb2a190809984c4ed5fd8b78d3372e23fdfd441955fb674f59d190fc
MD5 da2def533bb02101608078e662068c74
SHA1 f07d74f3f38f10b952210c450132849995a838a5
SHA512 2072f2c9fd496cda976607c9268d45b0a2615e647d36c345cb987592adfa49f5717d5cd820c61f0391897d561c36e634108843c29b19f662f70e1302dcb48b30
SSDEEP 12288:hA22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:hA22C9+bmOmbTk3reZCIT59z7m
TLSH
T1955523C18FDEC9FAC07E5230465120E56529EEDDEEC7719B828E0C4B26F1BF8904A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 9089a4205930a8004ed75a8aba782b33d64a877f5285cd9da39a20369a9c6a13
MD5 03f75ac7c43f08270506c3d775fb61a5
SHA1 838f02f8f254666b39b93ef3abcdfab6747de1ba
SHA512 5a05e7af5042839551d88ab553b4603c38c2e7663aac20c048fdedf9263489795f06e2392ac2d2801ee3325f9a39e086505d1e910c3aa71af931103c500c86a7
SSDEEP 12288:gV/22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Y22C9+bmOmbTk3reZCIT59z7m
TLSH
T1105523C11FE984FAC47F9234C56150A1A275FDD8EFA3629F82450D8B0EF17F4A42974A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 d15eda0cc0c1c7137b69d4381fd89cb7fe5e2c5757addf9d052e1806f437a5d5
MD5 2c9456231c2879d1803299975280995e
SHA1 e712f5393a6b2bede8bc4c78e5984d80426bd9c7
SHA512 3853f6bceae39d63c25dd3f2af85358873eebfda5c3bb97dc7c9b3cb673abfb39478dc10f92b11494c49528c5b02649ae054b0dabd4330e07cc44083a7826ec5
SSDEEP 12288:FH22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:FH22C9+bmOmbTk3reZCIT59z7m
TLSH
T1A45523C18FDEC9FAC03E5230465120E56529EEDDEEC7719B828D0D4B26F1BF8944A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 a0cf92fd4c04f9a0f2154071c51bfff0983212f11f6b9a10b3a5273fe999e357
MD5 f22f5b11eb24b0e67fda9d53490afcae
SHA1 81c17409ebb46a6695db5df9c284357189c86f6c
SHA512 a81ed10f0b13c468d916475576e5cf53a2a662116f23e06353ba239c6d22632ddee707196c2a34dfe53ef8b52b6e44b6474c48bc17f990627a7844fd713481b4
SSDEEP 12288:1m22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:1m22C9+bmOmbTk3reZCIT59z7m
TLSH
T1E75523C18FDEC9FAC03E5230865120E56529EEDDEED7619B828E0D4B26F1BF8904954F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 1c3233b89ba2e4efdf467b14a6af4847f7b66d9573e5b28b8a4cec30be34e613
MD5 02864e8e3d25813349e175d0a2baad1b
SHA1 ad40e2cef0864340b76e48202d6bc3df92f4bfb5
SHA512 8fa7b8fdacc3e46a97ba0e37521539e1684247020dc1901f4470b92816a8b232ce0a921dd6d25ba297d5ed05778607489767d724f37872ca4e61ad470b283695
SSDEEP 12288:By22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:By22C9+bmOmbTk3reZCIT59z7m
TLSH
T1F75523C18FDAC9FAC13E4230465160E46529EEDDEED7619F828E0D4B26F1BB8A04954F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 baa21ad057a0733586404cd68f0dbf0514b99d64c4659faf5401e339642a039e
MD5 f1171232e5b519ff59bdb79406839e23
SHA1 1b237173974a5e52fe930f215f4f13f0e056dcc0
SHA512 27f0dc99e628da091d1528e335d6887dc82cb2b5afec34d7aa8a1875bd463516284bb934e2b5150e5007a577874ed64c8a899a5373136f0a88405052e88e8cfc
SSDEEP 24576:OZMRzFVSOK22C9+bmOmbTk3reZCIT59z7m:OZMRzfW2LlOpbeZB7m
TLSH
T1BC7502D5B39008F8DC7B813DC9519855D2B2BC594BA0C65F03E83A6B1F733A15C2EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 84dc6ac25d2892dcdfbf61c3e3ced728ac216b260ca449bb56a4a87de4b2c261
MD5 a682d8a613369d32da8cf1c3a6c165a8
SHA1 37565719a49d94c2a5808f3649692e19a97f408e
SHA512 bd15cc79b892fe8d921715ad539c47d18dda8f743f092fe158bb91eb0236474552181455c803318b41d786f723c9294b4bb042d4ac9c6abe5c80b83a4cc5d04b
SSDEEP 12288:bN22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:bN22C9+bmOmbTk3reZCIT59z7m
TLSH
T1E95523C18FDEC8FAC17E1234465120E56529EEDDEED7719B828E0D4B26F1FB8904A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 c8d3816f9a011f09ba200e5f1fd825a3216273ac11927fa91a7bc3e7a8dcc5ac
MD5 266d4cc6c71806ad8a1a9022a787e80e
SHA1 ca8bd7f8d377393f3b3c67dee94cd15b42d91cac
SHA512 236eab850a5783f64f3810fd0bb90acba1fbe7e12d82392e6373a9d085a2d96cbfb8bf43c589aea4f3654a3565d6b9219487d1445940bf2757034daa76a1434c
SSDEEP 12288:OB22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:OB22C9+bmOmbTk3reZCIT59z7m
TLSH
T1B95523C18FDEC9FAC13E1230465120E56529EEDDEEC7719B828E0D4B26F1BB8944A14F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 11759126e4eebcb454902711a15ff234248bf0d8841bce20e1bcabf75ecacb05
MD5 943f62d916aec4c793d67cd427c30446
SHA1 36e74d8478cc7474bc7af0d4d7eb7de19fbe9037
SHA512 802617d826e2dbf823add73b45bae528ffa8599812d6cbd527d76a4125ad531d22401e7c8afae9639512e5ccfb8fc9ca6839a65f8618a7be6ca8c69270b0e7fe
SSDEEP 12288:1yPz5L8+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:czy+22C9+bmOmbTk3reZCIT59z7m
TLSH
T1A465028367A520F9C13B8234C9921951F375F8758B619AAF03940A772F737E09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 d1256fc37d5b0e671c7356492a85acfe34b6d4e6a83bad325575ab357c7b231d
MD5 c934d9a8aa6c521197d3cd1c98075bbd
SHA1 39f2bc54f09a1912c83c384d61c923997d1f1227
SHA512 3b835686ade8f19fec9bee900badb21d27c7cbf698df9c141826f30f811f3c748b131cf7a046741263e1de11251059e190567e1eb23d50052a591ac8d7a53c08
SSDEEP 12288:eN22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:eN22C9+bmOmbTk3reZCIT59z7m
TLSH
T18E5523C18FDEC8FAC17E1234465120E56529EEDDEEC7719B828E0D4B26F1FB8904A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 274a9141742ee8b2eb8e479b5d08af1645ed0cbd93c5e10f1f6c13e0a94bc2d9
MD5 eeac6f32d502578c6674ef46a57e090a
SHA1 162eed74591f4397951128f208006a1c085be46d
SHA512 a9e3bb4c53c4bf0a5160775be1aceff54662d64f5037b895bea4cc9f1a62339e04a54ceadc23d95dc45dd21e7d36e391e62ac24341e049abf81f114fbc83b979
SSDEEP 12288:XN22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:XN22C9+bmOmbTk3reZCIT59z7m
TLSH
T13B5523C18FDEC8FAC17E1234465120E56529EEDDEED7719B828E0D4B2AF1FB8904914E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 0eacc5ffa05fc3786c98d03d5c0fccf12fba4fa3d4a5913e3d408482f7982762
MD5 37ecde46b530b24ae90a60180e2809b4
SHA1 eb02497cc73a43ea81e74d30b3c261c16dd23584
SHA512 66fa7e75b6dc839edc6fe5cdb623e8863e8b9b2ebf1a056180ee924931a80033551fe5b66a5e7891e66543dbac052675893703b92ad63eca0ff927b059164507
SSDEEP 12288:PyPz5L8+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:izy+22C9+bmOmbTk3reZCIT59z7m
TLSH
T17165128367A520F9C13B8238C9521951F375B8758B619AAF03940A7B2F737E09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 37df8cbd2db1d9a0092faaa44d7f5d3f90d4dcd18542121edf5ddb4d9ec85488
MD5 1d1be9e28ac2ea23ff72ef0c8fd5fb72
SHA1 563e117422d7ffefb120cc1b7ed2a1cc829bafe8
SHA512 6c5a427e68607164ef0c3af8e124d17e98d71c959b06f4721e88413771bf5b8086daef7bc5027880602cf71a65522c95011fdf506a61a8535ee3747faa38ca15
SSDEEP 24576:LTDaLl3z0zDQ22C9+bmOmbTk3reZCIT59z7m:LTuLljL2LlOpbeZB7m
TLSH
T1C77502D4B39058F8DC7B813DC9514956D2B2BC5A4BA0C65F03E83A6B1F733A05C2EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 6341395551828a5f901292b0cad6f2cf3e89e2ed0dfae3a2dcd8bf5728e801b9
MD5 48aff2b1fd6d58486df6d42d6e6dba1e
SHA1 ec143bbd359eeecbc25fde39d09e541df6a90962
SHA512 fefb67f55d3a749256fd8933cf91be2dd98683159a3d253e84b9d7c8f0ab485d2363b1d0060675ef387598d3b2422852a17862a661d1813c720cd9332397bc01
SSDEEP 24576:H3vd9CHKy7GZc22C9+bmOmbTk3reZCIT59z7m:Xvd9CHKyaW2LlOpbeZB7m
TLSH
T1EF85DF90F3E414E8F0B79A34C9725511DA76BC995B71DA8F03A8261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 7fe8a38bfebbfa253620a09d1590c6abf960b50ad90fc3a8cc669098f6730e75
MD5 9c5fdc3d2b11d6fd97fd7129f69a122f
SHA1 c2d99b7956ca756971171dede67e65f62177c02f
SHA512 1da0d8cb7e693e418532fa28237fe7b9567b411ba830e1626ee967af56431040ac0da1cf7ae6d84e933bc4df92dcba684f38c24622196397e18e3527080af100
SSDEEP 12288:Mg22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Mg22C9+bmOmbTk3reZCIT59z7m
TLSH
T1835523C18FDEC9FAC13E5230465120E56529EEDDEEC7619B828E0C4B26F1FF8904A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 2a758019a5b840e1a0709ed0144cb7edc14d8103211474f39683807283b5aa70
MD5 0c8a5a1720be22e683d79d634511c208
SHA1 ed54326a33271e5fa7020c8ebeb93574cdc3ea28
SHA512 c4ba520a896b6f1a2de5103c17747809fb59a303e8dfb9ccb7a4d7bc031a58de39eb4166f116f3ca07186ebdc8deca3d03be0396154d5d07b39521a49c084177
SSDEEP 12288:Ke22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Ke22C9+bmOmbTk3reZCIT59z7m
TLSH
T1975523C18FDAC9FAC03E5230469160E56529EEDDEED7619B828E0C4B16F1FB8D44914F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 3d8b6515ad5402f99f887eb70a78f40808c24f323dc9253d626603260e62c026
MD5 0e85b68de7a26023735a683634c227a7
SHA1 9ee546f9ca887c3001e655f2a053f7fa2f3e7eab
SHA512 fbdccf2bd32935654491560eb3ed310aa1fec8e326473eb21003fd4a8bafdecb8023229c74a1315748f84d8d9f391b62da26435fc2e8dd601728c0a77f48af00
SSDEEP 12288:0z22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:0z22C9+bmOmbTk3reZCIT59z7m
TLSH
T1235523C18FDEC8FAC07E5234465120E56529EEDDEEC7719B828E0D4B2AF1FB8904914E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 5bf88a44176169c247ddb608a0e1a2fa0311c6b345edc234d8c52f1ea39458cb
MD5 d30b07117a0deb48758d1e627cb41f0e
SHA1 e9fd1d5280c35bde0497b0b8bd29e4c36dc57f6e
SHA512 cf5e6eca82d501752ce6b921ee36e4fed2d320d017121b249278c4f9f602223235c37faa43e52b57ad5b17d400686431548e4acbed7adc4ac411e20b7c505218
SSDEEP 12288:4N22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:4N22C9+bmOmbTk3reZCIT59z7m
TLSH
T1A75523C18FDEC9FAC17E1234465120E56529EEDDEEC7719B828E0D4B26F1BB8904914E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 b1a4156a8a045401e080eca7fe58a02987850638933f7b9d3ca487c516b86784
MD5 eea0b0cee6eb277a2d38bd8dead8cd0f
SHA1 2c3a3a67085cfdfd50e855a482d1a1e2d5615fb6
SHA512 2360c558dc0367ccafa418e3edaa700ccf0226c77205b9db4c3b6640a3967528b8568b8ce06f7a42c0acd3f9710582bc3e356877daee380eae9f06492fbe9860
SSDEEP 12288:Fg22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Fg22C9+bmOmbTk3reZCIT59z7m
TLSH
T1825523C18FDEC8FAC03E5234465120E56529EEDDEED7719B828D0C4B2AF1BF8944A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 50eaeb5bcfb6ed8574428c87b9d76415284a41b0d6a44c29b24411ce63132153
MD5 b77190efda57c55e3b9d631c37d27b01
SHA1 ceaa3174415b3a2788f8a459d517f6cbeb548cc6
SHA512 34b7e90907eb59fd15a23746174475b88fc9dca1b100b71bb4a7b3b1b4c4cd7eeaff36fa62573e322ce43edfdb052ddca6804f8aa705888f5045f267c6203637
SSDEEP 12288:9122qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:9122C9+bmOmbTk3reZCIT59z7m
TLSH
T1355523C18FDAC9FEC13E4230469120E56529EEDDEED7719B828E0D4B26F1BB8904954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 2fec60385dbf02e5786acd1e55762a9cce5cfddc10b6a16d1f3caa63f1237bc5
MD5 9482094881f329acd3cea78a09a9f25d
SHA1 56df1dfde7d1c2053e034c4bc398e14e5da862bd
SHA512 e0b97e7d05cd81995a7e71409401641d931fff6c55faf97f45675059370200d99dee20b456f8c57f274510cfbb8b58d650b3dc19cf9b3b9754eaf702f0957826
SSDEEP 12288:AH22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:AH22C9+bmOmbTk3reZCIT59z7m
TLSH
T1575523C18FDEC9FAC03E5230465120E56529EEDDEEC7719B828D0C4B2AF1BF8904A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 580070d557d4d1b4e88cc0064c89bc610131f76ae672c65424b1b155d92da556
MD5 3f2b5d27c08595d96135c30612e25385
SHA1 c655c209fe8986848f9b13193fdf5fa269acc13c
SHA512 687ef4c7845cff76474c9d24f2fbb272611240da990677637eb5b9c3adf90e93204a90d058d480fdc4bb47ee20558bb56c15c08b00911436fc03fbfc1ec5dad1
SSDEEP 24576:lfwvUk9RX6wkyAIx22C9+bmOmbTk3reZCIT59z7m:XMnYIx2LlOpbeZB7m
TLSH
T19085D029EBDC44E5E177923C89B3460AF6B1B8695B71C2CF029A53AE0E33ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5237d5b01196974320d768be6d4de08eba4868a8de82c32273ea6e35abe00433
MD5 413d5b360d5cac6f947e14d5ef953d88
SHA1 e5d2431c415fcad236cc8eebfa41652400ca60bb
SHA512 cc0fa125d4239084145147f132b06caeab7f6dcb280d1131843dd96ffdb58ac27d33f1c0ab636a0420928c15c5101c3920df922f6497d883017ca5a45093a8bf
SSDEEP 49152:oYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0E2LlOpbeZB7m:/ySzPcycv
TLSH
T1E3066C96A1A841D5C1B9C1B98B0BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 de51f4e8add652389cec75cab4bfdf01914b5c1cc2ca48d3b0a17bf4079309c0
MD5 20f6488a295fe762274f560e7fc0c237
SHA1 2997afdf45f3a3c92a92e55fb5a10135745ec634
SHA512 5def6eac34f2d9a0bef50e7b4c104e9cfd8ab415f57277a02ab205c4be1f51b5c505d9837ae6c6ba4143b3e23be92ed23200aecbe157499da866368dca9374b1
SSDEEP 24576:E47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY622C9+bmOmbTk3reZCIT59z7m:E47JUQjTirIhCnDHUPfF/02LlOpbeZBi
TLSH
T1DF65AE1EA3EC01E5E1BA823885154A5AEA71782D5F32CACF1270437D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 de366d7fcbbd15148084939a7143853673e012ce668b6eed09c4db22c0135412
MD5 789479a4d31e977d1eab0782c6ef7d74
SHA1 5636651fc25502d0886814c5ac1e2c581a995292
SHA512 638f08996db13f20610913a2efd2a880bdb5ac7d9dfe72262f6d18ff3f050c3184921d3d4cba4a6589ddfb3bff2dec2c7d373d59d39cc7bb6fc3f32d06ad2a75
SSDEEP 12288:Ibsfd22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:vd22C9+bmOmbTk3reZCIT59z7m
TLSH
T17765F185D79842E8C06E6234C7515681B333BC659BE2E3CB52C0F97E1F766A09DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 52e8a18da8b89b29d3193794846ce22ff037ca856a820693d6b58cb8f5421de5
MD5 b291c4d0c6ee12708cd438707284abd7
SHA1 4a100b23b484b4141ad0b7f7822fc033554e61ba
SHA512 a5a2ea2c8f7d6945bfefe03ea48704422ecf9e7ba2ff766458ca5869ac276950e2f33a04ae4084169af9350fd6630b34f1004fbe2c136f023f1b1ab778fd267a
SSDEEP 12288:JbQ+XvKU3ff9Pzf711b3IQ2O+GBDF8UBOZld55:JbjXiUP1Pf16DNGBDF8aOZldf
TLSH
T1233517417626C74BC6A950325E36D6CCAB70BC01EE099F0773C9873FD476668BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 8e7f7372d90ad875211e8596fbf1c3c266ebdaa04201a0c55b85d6028e1e73c2
MD5 b1042b6d23621738d8e8cd3aaf52f493
SHA1 359081184465174c02bf751d0bc9388bae98e86e
SHA512 fa32d0465da960f79184381d538dcb94c02e7c8c6003cb092db07555bfa9516f21a14c5cd1cbda42681a69bd94cb717a5e588da385915c8428020acd9f444939
SSDEEP 12288:M63qieVMlLeBqci0KVJsNh6KC0woxNLE5zSFczQluK1:M6BScplLYh6KCM8z4osz1
TLSH
T19D454B41A9A7E31FC8FE50374732868DBB749C06B7492B0573848A3C946797EF5E22D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 d8a0d63475caf6cc281df29ef411d8420e0d357645cc4f04254108453a960a6f
MD5 45f1039ecd3d3f1f24f0bbffcb1db235
SHA1 30b5318f0cb4c6bcda257fe8a49427023ca56033
SHA512 c30b1a85f1e9611417231d3797c6354085a383648c41e226c12830c08b6a28eff26991f477f8817dad9f6e7cc98312a8aebe492a9e3c68cf27216a4adf02c6dd
SSDEEP 12288:c07F22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:hF22C9+bmOmbTk3reZCIT59z7m
TLSH
T1185523C18FDDC9FAC47E523045556074622EFEA8DFC2A0DB91490E8B29B1EE4DC7960B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e44089422355ba50ebe949e9de564a61b9e981280adfb3b78af7a6acc6b7c5a6
MD5 f99dbed00c98212e8511c8f8618e7f9d
SHA1 24e982540c19d27090ca9729ea79f72be20c7975
SHA512 f5752ff05d2b5245d65878494d2a37a34bb9316d388b8ac0f00b965b1b1f60c776e82214f0e063e2cf5043dbf5313822b0260c108d75745e9d225fba50357b39
SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bYL22C9+bmOmbTk3reZCIT59z7m:ygb4mBIBhGF62LlOpbeZB7m
TLSH
T1CC65AE1E22EC02F5E0FAD2B8CDA64417D6B278164732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 eb1eaa45ddad3612e4dcba415ec5eeba4ec86810fd3220a088c1ae0559b364b8
MD5 bcf89390ead0d0e692a601d7c25ac53b
SHA1 a2dbf20c99bc6e1524427eb2f1bbb6b15830c341
SHA512 b1773a958a4f74adc99cf75b4fad9e9e3be5245cbe2d045750b81ac470700d592bb76858a5ff7d7d4f724ce0919d53a03728c9c382b463b3e0d567a18a4b9b93
SSDEEP 24576:+G88u8FpJqH1bzria7/mK22C9+bmOmbTk3reZCIT59z7m:V7ZFPqVea7/T2LlOpbeZB7m
TLSH
T12C95F16167E101F1D47BD13889824663F6B2F8250364EBDF07AC8B561F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 dcb7f6dd7fe8f9aa3d66090855b3e34faeec88cc1555d32ed78b54c687a272a1
MD5 74324bd0f9b105069bd4cb4698cd3afb
SHA1 c66790b2a772c609f7e6b073e7ec085fd3ce4197
SHA512 6165447305aeff0d99862299ab57776d43a3e2ebf83d9afb108904f58d723655a6d4c76493918697573186cdc6fbca8bea8fc317484516ad704c4120c10c4ef2
SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjm2LlOpbeZB7m:oG05lO43bZycv
TLSH
T1E8D5C06A62EC11F9D0BBD17CDAC6460BEBB23815033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2a1c0df45c5f548795153578713f9d446d2ddab566b5aa24deb541bc45b72476
MD5 eb2b270aa2f15ef105afddadd9ce5b58
SHA1 887b3227d9b816cc95013ef2bb1507a27a8643e6
SHA512 f1a74a89685e24c75c2a363b02085a18e2dace897a4124025eb224b0785d7b3af2ba517f7c2b63f06cd4d52a923831c5296a7511b68c5dd932007fd55bebea7a
SSDEEP 24576:Pfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnE22C9+bmOmbTk3reZCIT59z7m:3a5POZ3BJt2pasx2+me2LlOpbeZB7m
TLSH
T1F265AF5EA7FC01D5D1B9D17CC583861AF5B1742553329ACB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9c790d34df1f96abf990791e4b65393d430113b16727000ba1b871415b879f9b
MD5 04a3a43de911a35db36fb9eb54232185
SHA1 8eee631965cd7523303455386f4acb569c91e1ab
SHA512 e335c0aa12ee8a02e00b2f2b66b256396498ec4b6f562a9e8a66f73bc64eb2b7e8fddf10368f3a96aacafc8fee7691dd39bd3bddeff5fa69c80db87042238a76
SSDEEP 24576:lNcwHdjbyQ4nLC18lb/EOjowL7FkC22C9+bmOmbTk3reZCIT59z7m:lNc/zEOVHFz2LlOpbeZB7m
TLSH
T1C9858C1623E901E4E1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ee76348f8f65e97887ae7e4799d295254da560f90860ddf07961c7c490e29d21
MD5 b88c79a59e2ac8ff26ab971e8d7aaa0c
SHA1 c6b0b6b74defc524f897d1a65b60b21a35454210
SHA512 3ff93a798615be770386735fd66fc8c91d860188930dcb54d798308d80243fd12648905e1baac30fcdd76070d216999e1f9b0be7c44bd87ae15f00337da61571
SSDEEP 24576:dTkNvNnaFeYhJNtmZBmZ22C9+bmOmbTk3reZCIT59z7m:dTMwBtOmZ2LlOpbeZB7m
TLSH
T13255AF6EABF846E4D1FEC6748D238512E6727861073293CB5290C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 60746ad67bf631dbf57ef009dcd5251c52ea3a4178c14682cd9b9bce50817cae
MD5 37ac558d5cb17fc901b9e4ba984ed764
SHA1 98210219302ca7bdf1402935bdad983ad2c63227
SHA512 b51e53dd5ba0f45aaf4ce7c403df8a884dde475392aa993399de4a889bb01c3d66840a848d049c9e6ac84715ba29893b2bc1805b606537166f2b60f65e75d391
SSDEEP 24576:2PUr+NQW22C9+bmOmbTk3reZCIT59z7m:2JQW2LlOpbeZB7m
TLSH
T14875E15F26ED18E5E67AA13C85824619F771B8625752A2CF02D0817E0F73EE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 4dc3bf6a44524ccb0b6a3939b3a5ff52ae5e2940020b3363a274ef9f1541f1fb
MD5 23090cdc8359a06ea92cb03450a82e1b
SHA1 550f45dfe5bc2f2d5bf5f47c62fc7e06383a4153
SHA512 f8c0d23701afffa7326cd604b566de60f0df9edaeb997100bb52e148a29aa998c0438b0cea8892d46c4d12ec57f6806ba96e4a0fda311f4174dca4c928757ef2
SSDEEP 24576:CD3FHshBIYQgAJ22C9+bmOmbTk3reZCIT59z7m:CDVHeBIAAJ2LlOpbeZB7m
TLSH
T14485E17EEB9C04E4D47BD17CC6638906E77178A9072266CB02D481BA1F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/752-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/752-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/752-132-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/752-130-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/752-124-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/832-19-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/832-26-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/832-25-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/832-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/832-97-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/908-6-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/908-17-0x0000000140000000-0x0000000140990000-memory.dmp

Download

memory/908-8-0x0000000140000000-0x0000000140990000-memory.dmp

Download

memory/908-0-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/2152-44-0x0000000140000000-0x0000000140256000-memory.dmp

Download

memory/2152-56-0x0000000140000000-0x0000000140256000-memory.dmp

Download

memory/2152-54-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/2152-51-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/2152-45-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/2196-111-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/2196-310-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/2196-112-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2196-118-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2920-326-0x0000019219410000-0x000001921969B000-memory.dmp

Download

memory/3356-82-0x0000000000400000-0x0000000000618000-memory.dmp

Download

memory/3356-307-0x0000000000400000-0x0000000000618000-memory.dmp

Download

memory/3844-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3844-105-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3844-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3844-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3844-311-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4368-277-0x0000000140000000-0x0000000140250000-memory.dmp

Download

memory/4368-59-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4368-65-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4368-67-0x0000000140000000-0x0000000140250000-memory.dmp

Download

memory/4376-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4376-122-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4376-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4376-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4376-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5412-86-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5412-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5412-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5412-331-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5412-92-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5412-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5612-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5612-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5612-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5612-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5612-314-0x0000000003000000-0x000000000329E000-memory.dmp

Download

memory/5864-70-0x0000000140000000-0x000000014024C000-memory.dmp

Download

memory/5864-72-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5864-78-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5864-292-0x0000000140000000-0x000000014024C000-memory.dmp

Download