8da388c7f73fd839c3ea91b9829d06611a4489917ed227daf5956370c345e83a

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 12:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_afa66d4dc8d294eaaf6ecae6d5273bdf_blankgrabber_icedid_luca-stealer_njrat.exe
Size 2.9MB
Sample260910-n8lymagg39
SHA256 8da388c7f73fd839c3ea91b9829d06611a4489917ed227daf5956370c345e83a
MD5 afa66d4dc8d294eaaf6ecae6d5273bdf
SHA1 4ec1aea341f56b2cb4b4b91349b81d6c191c180d
SHA512 a55c38dc383f4a0272be499be9776186c7c1d72d17505879cf5453dc56495bf2c88dada2ed6c891a12b5baf02e1f71bcc0c572c8e069f1fa5d21d979c031d2c8
SSDEEP 49152:X42+N95fUnYyAfd/LKydunkoeby+1bK2tnp/CXjKXi0aj3JWkZTaDmg27RnWGj:I55mey++TaD527BWG
TLSH
T1FDE59E6E66A405FCD1EBC1BACA4ADD13D772740F13B0A75F07A185622F5B2208A7D723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
2644	elevation_service.exe
4312	maintenanceservice.exe
3480	OSE.EXE
804	PerceptionSimulationService.exe
4760	perfhost.exe
4156	ReFsDedupSvc.exe
256	SensorDataService.exe
948	ssh-agent.exe
4696	AgentService.exe
5904	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1b1d284ed744edbe.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-10_afa66d4dc8d294eaaf6ecae6d5273bdf_blankgrabber_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-09-10_afa66d4dc8d294eaaf6ecae6d5273bdf_blankgrabber_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-10_afa66d4dc8d294eaaf6ecae6d5273bdf_blankgrabber_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-10_afa66d4dc8d294eaaf6ecae6d5273bdf_blankgrabber_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	OSE.EXE
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	OSE.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-10_afa66d4dc8d294eaaf6ecae6d5273bdf_blankgrabber_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000035a082c91c41dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b1a71c91c41dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d451b9c91c41dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079104b881c41dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2644	elevation_service.exe
2644	elevation_service.exe
2644	elevation_service.exe
2644	elevation_service.exe
2644	elevation_service.exe
2644	elevation_service.exe
2644	elevation_service.exe
3480	OSE.EXE
3480	OSE.EXE
3480	OSE.EXE
3480	OSE.EXE
3480	OSE.EXE
3480	OSE.EXE
3480	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4596	2026-09-10_afa66d4dc8d294eaaf6ecae6d5273bdf_blankgrabber_icedid_luca-stealer_njrat.exe
Token: SeTakeOwnershipPrivilege	2644	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4696	AgentService.exe
Token: SeBackupPrivilege	4156	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4156	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4156	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4156	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4156	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4156	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4156	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4156	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4156	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4156	ReFsDedupSvc.exe
Token: 33	5904	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5904	SearchIndexer.exe
Token: SeDebugPrivilege	2644	elevation_service.exe
Token: SeDebugPrivilege	3480	OSE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5904 wrote to memory of 1380	5904	SearchIndexer.exe	100
PID 5904 wrote to memory of 1544	5904	SearchIndexer.exe	101
PID 5904 wrote to memory of 472	5904	SearchIndexer.exe	102
PID 5904 wrote to memory of 2832	5904	SearchIndexer.exe	103
PID 5904 wrote to memory of 4508	5904	SearchIndexer.exe	107
PID 5904 wrote to memory of 4268	5904	SearchIndexer.exe	108
PID 5904 wrote to memory of 5744	5904	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-10_afa66d4dc8d294eaaf6ecae6d5273bdf_blankgrabber_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_afa66d4dc8d294eaaf6ecae6d5273bdf_blankgrabber_icedid_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4596

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4312

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3480

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:804

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4760

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4156

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:256

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:948

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5904
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1380
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1544
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:472
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2832
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4508
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4268
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7151cbe9f257075912a9632779213966b79ce0b50f7e258ec2f52c4b1e467cd5
MD5 d19e8cc4676b1bfa6afc6fbcfa6b8ead
SHA1 01e9d5d6b9f83e41843c9f40e6564eac8edd0879
SHA512 9a19a7ee8d1dd9fdfb99efcca50d19e750887f1cdbf84779abfa7f640fc89d4ecd932acbab80a07894d45463edd16d4247a0a494cfe12f7e62efb38429617556
SSDEEP 49152:Qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnbDmg27RnWGj:63q6HjB8D527BWG
TLSH
T198D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 87a8085e96041d46cbe73d995fdaea5d1edc4edede614827484b31977710a8c0
MD5 0904c6d86b252e4ab85cb13e12b87403
SHA1 9202d0f261a2375488deace9ac4b2e3d291a7767
SHA512 9740758206ae5e015ab0faa1337476db10853c20e80626167e412effa0f05a6ecf5591f95821bc71a352add466059be5fa58291f036325388551ce615e6a6341
SSDEEP 24576:nXYfDtczAdsqjnhMgeiCl7G0nehbGZpbD:ytc8Dmg27RnWGj
TLSH
T11305F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 a15fa6463cc4a01ef58869d504168bafe7cde2e5589e9ad33b8f38be3c4b7009
MD5 748270948d339d1e7cb4bfa1e5dffd7f
SHA1 07c16e2d4bd29c99f60ab8158db09e8a74feb936
SHA512 40c7fdd1cf564214145e3d228b3091e7a10e788508bc1b9b1856e9bb3693ec9ce3e39f23824c4135eca6a38b346a5a6b29192bda5654277dd44e13f0dc0953cb
SSDEEP 24576:U0Le5ji0hmxirMesqjnhMgeiCl7G0nehbGZpbD:UPji0AcfDmg27RnWGj
TLSH
T177359E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 69cc3208f50182af6b333c613bd033c2bb56f7f4fba4c2bedfb46b2462ab8773
MD5 e809d460e6410db5de4f9c6429b65b93
SHA1 c25ee2d5d375e66d641ce5bc1e1adb0956d0efc8
SHA512 62096c18af4b36ebd6ee2d6dee0b28d9ab658f00d901d2cb7813e89a5f0523b3852c3845195a37e13f2306102817794d24f7b7cc4717545d2921742865a3d8ba
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWE6q8wyuwsqjnhMgeiCl7G0nehbGZpbD:9/ezSC6vUzPvxHjyTDmg27RnWGj
TLSH
T17F755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a6306de4be479fc54a958175d80470317a5bfd9cadfff072d1dc0d6bf5871ffa
MD5 bf0ccd39dcb5a4cdb9931c2d8f739abe
SHA1 fc082c6415a339a42523224f21fbee371f2ff768
SHA512 30087ac1f969c4b563bf86b982839f90f55b913518e065df0c3b623be065ef3c865113130f49be379894440edd02af2e6f57477139fa515e31c4e11ecb9a55c0
SSDEEP 24576:zVbqPb88hv/l+6ZsqjnhMgeiCl7G0nehbGZpbD:zVO88hXl+mDmg27RnWGj
TLSH
T17E559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 f189cc36e315f683bb07f355b86cfb01727efb91fa9ff7b5aadcc3361e11e4a4
MD5 8f85feb7ae3fa1920680daa938538d30
SHA1 1ac09d8caed2fba60fba495d4b5bdb5b947570a7
SHA512 8fd0c95a3ecfb7a8ab7366e19491919c9b74cf6e38c4cf2109a89fe0ec6bb7cd00eb44c9f15a536ddf9f15255c8913863d106eac76c2647c19a19c6d5220c6cd
SSDEEP 12288:cRqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cRqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14DC423BE824C11CAEA7608B5C3E9F55DAC173E5698200C43AA637DFDE6F5464CB39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 39c90157362fa197c61ab579a042e57b0e21f80a1a1f682e243b6aff83f85df4
MD5 09b7baabd6f535fd6b389d0f83a4c08e
SHA1 e63428e91a28f351996ce19a5adadec84a489251
SHA512 3eee4b74640b6ea41d866e7cc2ccc9ae455cdcee7d89bc71176d206ce73c1be082ce055afd6a3414174fe787970423d7ee7eddf83289fbc5dbaa4a2da0cccfb8
SSDEEP 12288:DeBNUbTVO86URXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:DJIURsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14B05CF7BEE28FCD2C67A8DB95791C600E77278314B21A3CBD165824EDE235E04E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5531a853cdfac661e6e1da82b605c61dfdc18accd4e3edbd7da28b1669155ce7
MD5 4688e07c685653e764491da2376f8950
SHA1 100efe1bd7f5676f34fb58e72d702bf7eb1d517a
SHA512 c0209158ff5cc563208b055341f56851d48a4836b43cb4bf011f87be37eea5d27dc44e1677e6b81b63a55e6106dbad49fddb02893e20266c087be197a18c86a1
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THQ:5QvGAdlCEL8c/yRNw5CcD527BWG
TLSH
T1D8266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 51d7a5dc95c89c4940c4b0646bd07b6506ce1b6f34ee9c79c457e1ba5045fcb4
MD5 a10a7e1568d8cccd6352acd28cec4fa9
SHA1 40ecc81cb4d3ec1ff68ea97af4997bcbbc7be101
SHA512 7c237dd8764380eeedc953b68f0a1f5fa09dbd6d4aa791d26439543fc45b513bb9c15b5b821086943a379e41cea1ca9e80f82ba502a0fd6f25f2b2302e23efc3
SSDEEP 12288:NAwSfxL/2Dc34DLLmt0LDQewsAjbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:+dewsAjbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11615E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 70a27a57a700758c54afe79d7732ae5bfa7fec1424d0ff80630b2f7e5195b9c7
MD5 852c417642f27cbc5e4a708601642f2d
SHA1 490f9109f17bbf76f566b1ae3866e44fbc179fab
SHA512 34d2d318ee1a0b02c9004c3ac9e0c153266d164c545d5eca8a6aa4f0dba73e5530db069d6e98329efd8349eea3dce3d47fc7ccf1569ad6bcc43923b369a50ba2
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHHVQBWG:qUEtQevvqc2W1cpV2EI32eB
TLSH
T10F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 912afbc91a3f4b93c4796abd68a230c8688c7a5d62447851e4203f9ce4fb5b45
MD5 bf453ccee47194d627d894cbf942ae61
SHA1 62c29abe8454fbfb29cecdd6446c56085decc8f9
SHA512 f5eb1b474fdec460640d9ff5e09e98fc54463ebbdfa5c413f466b25165c3ed5d20a521704028b7f9fba7f532e72f8e37adb3c0500916d0d3a4d946933a6049df
SSDEEP 49152:qCbRquA/m2yL5zQfFiV+XenmE3/zvDmg27RnWGj:foqtVjnmQD527BWG
TLSH
T19ED58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6217c1113d24c3d470a222cea38e8f04ed50c16a9f2f2891d462ef688977f9b9
MD5 a746be863207f14d321185e22f685126
SHA1 69d1801ae3dace62ea581bdb23685bac7631cc8a
SHA512 ee5792ed121d1f9783a980ecfcc575249f17ce293ef33ebfd4282524ada5d35bc9053a7603ce56e68f1b99b4d2d0005f23a86b6057a0a453c9ee4c223308ba67
SSDEEP 24576:NAhGLJIFoiwtA5l7S53UsqjnhMgeiCl7G0nehbGZpbD:NAMyFoiq5ADmg27RnWGj
TLSH
T12F359D81E7F951D4F5B3AAB899B69171E977BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 2216ed882b91a3b742ffad85186729d9f1e02503ed52a44235c58745eaaf21b7
MD5 b0ca114af619df274c9e709edaebc22b
SHA1 574beae9ceb2174d27b3b07aed9bcb2d25f731ff
SHA512 40d0716b3f5d097e89b33683ac76134c743a21554fc77c6d593f3bd98e42d02c931fe6af9d65fa988bc0aaf996a06b707c09c7f1c987eafee5c7d41a296f3824
SSDEEP 12288:fmw5HEjsChNVBFgl0WDm+CQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:ewuoOWPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E905F14A72A80CF9E9674139C697D136F7B3BC122A20DB1F1760C65B6F73260AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 001feee0ef29a0c28f89ec080932e53064ace9309edda8d6102099cc9f1465ca
MD5 1d4f0f1c1a0923dbf278af675705c015
SHA1 cfabd1661143881293fd440c49bba190e485ee8e
SHA512 c62c4f4fe36fa1286d8fd2116d642c54f8ae872d9eed7de72dadd6225c7bb9756f5ec87c68fb03878af05dd14af288db9cfec740d7f1cf5fea693c467d70109a
SSDEEP 12288:pBZ1IyLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HZu2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EFE412AE239820FAE563417CC6E5D609E7333C62673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ae012383e5ec6eef10641c403a6fe166798d9949376043a785ab13164a5ff57d
MD5 ebb739ebdae0cf4c339117565ed8ccaa
SHA1 e88d24d85b0d7106a13daccf2f359ef85195356b
SHA512 001de15ff94dc9e91f8d04c48eafa838f594494e77a9789e1bedf3b16bdfb9b71cf266278a6fd4f8f32844e08f6a32696b58540cd424febcd2f015175e4cc251
SSDEEP 98304:mQRQyi36YOcPQLvw2gAf+PN3pD527BWG:NQyiKayX+PN5VQBWG
TLSH
T19C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c2a129a708028c37bbff7c5423d9e21f22274cdb6b036083f7768efd191fab1e
MD5 599d1dd4f660fa8abdf2a068ba6aaa98
SHA1 71bcd308b8ef8879fd0abe8cc09e90c7696e2e51
SHA512 f96b4ba84aa946296443a8006eb067d44db434af32fc30083f7846e876bd8c6fb959676f177db229db4844bad63ddbedba4bfa4df006627069f5203d3acabf9f
SSDEEP 98304:VQRQyi36YOcPQLvw2gAf+PN3pD527BWG:sQyiKayX+PN5VQBWG
TLSH
T158667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 83aa49c07fdde49d31a6294bfa6b214c5cb935149fb6870879efa2b28b5d922a
MD5 d943bd3dcc5781906226db81c900dc56
SHA1 dd84b5994f4f858a5ccaf93e673084156c64be34
SHA512 3b0e8c3c5d8cdc82534e06453334b2a5cf364824154b78184d879cc7572160f00315ac46e97d6450d25cca6b653a9fe8bb2f68812f6109c96562641532391035
SSDEEP 24576:SwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0GsqjnhMgeiCl7Ge:s68Qg55nhheWu7PNU3/fDmg27RnWGj
TLSH
T125B55A33B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ff3f50c8adbce391f831f8f376c317f6bf3cd842b55a84e36fce5b7e87afd557
MD5 d69e34807b00d33c0fd15c660fd9f5f1
SHA1 5ab59e7e0a21dd3bdcfa209c5ef73daecf042889
SHA512 c1499608903c55cb09cbdd99ee1ddffc82fb02d1bfae76ca022d77900ca2d9d1f37e1acc0ae0477dd9ce2ef2f18cd18c5e46d39b0b8e309dd6de7e228f1e899c
SSDEEP 98304:By5112gYy5azzVvL69nLKnhZ+D527BWG:cLIHmWhoVQBWG
TLSH
T1A9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0a9d55c3a2cc4ebef0e6781b8a4938a1a2b1556e719be30ecd397f0f681e8ee7
MD5 6bdf71aae029bfc39d5700ada1001af2
SHA1 e7864de148c04b2c0b1fa8196b5e80f07ad49950
SHA512 fc759c5aea3860bcc2b0ef349b408bf375bb901fa300e0d1148005df1da76ce2467432a89ea67f1a37d1aab1f3ee28fbfd9f6fdf8fba57907aafdc8ff85bd6a5
SSDEEP 49152:TB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glgDmg27RnWGj:lu6JmVxd2dgD527BWG
TLSH
T1DED59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 88241f1e0ebfd20d04c9fe49a7a80d99222ec80b5669a3f94760c1557f5b44b1
MD5 cb5e7a9850a2e2c316d6bb43f8005509
SHA1 119ba57ca09d6c9341fac39242eb4da267c8a8cc
SHA512 a85a51c4d58edbe087216fa9154fadbdcccdb2d153e557c611861981824b058ccfe1c3b52798156453ccc560f203e14c86c0204cdb6783424f52adfc38ac1b99
SSDEEP 49152:V1hpsNoJpF1A6UU44CwH7R4xFDmg27RnWGj:VmifPbRQD527BWG
TLSH
T141B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1d2ea38015f395b69b44ee91600fd6d3fc874eb84f25eab010f84428fc2e93fc
MD5 bb4a56a78cc0deca291bd855f4a81b78
SHA1 18ff45c65b1e6a69b93d614b0b38aeed4c02e4a8
SHA512 f5cac9c6c9dfa89330a1e16d5846758c8886bb7bc44e3048489ad29a5e935e42ebaec586b87b79986acd108dd6e233f97fd914e52f41d57129385364d2c5c5a1
SSDEEP 49152:+SuZQIY0Be2KRRVtOnks6NMHq6Dmg27RnWGj:Q5dKTi616D527BWG
TLSH
T120C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9619ced411481c8dcd1e5e24bc2d3a6bbac45c13b4654b2c210cd63da9f2e350
MD5 27d2845d4cc67a7390760c2788784a83
SHA1 477c295103bfe547fd3221f4d14b6980c1429396
SHA512 acad28b3b3ade8a0341cd77f67849f722ddb5f51cad75483c8cfafeeb7910100c030fa28e82a9bd3bde3b172cf808d82c6eb68f750a8ee5f657d6c9fe7d0da90
SSDEEP 49152:YhtSn8EApI0figngiDn0AP5wBDmg27RnWGj:JX2iyphUD527BWG
TLSH
T1F095BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 466c2b7deb527e996a52d4c56ed666270b7f628c3b812d9210bb93c38bf251b7
MD5 dc00409bef045e21b161a282ccff721e
SHA1 7dd5bb878da4ba5d6d33f2a5c1f355db6cba56ec
SHA512 94b665db83566e495ed2ae02a95c4e1579930c22fa94d4eae6b58b377bff840837f2d6e5d14013f66e2ef75ce1d538c8711af8bf1950ec6b421841809028ba86
SSDEEP 12288:7iXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7isqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D6C423BE915C01CBE92244B5C3E9F15DE8173E57E92004837A5B78BEF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 530dcaace4d61c9c048f3b44b6476ea23cbc4fdfd90ad7b4206538b28c6ec9ac
MD5 05b9485ef8f0d50c31fcbcbaa071d669
SHA1 8d8d60734bf255180bd6406ec809d045792bbe2f
SHA512 9eb532399e0375c8f17eac81dd68760ff13156ebcede78e66b906e4ad84fa6401335573468d9b1558e2a954fddce5c7120019c0b89ee1003323f6c44a769b515
SSDEEP 12288:dXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T176C423BE915C01CBE92244B5C3E5F15DEC173E57E92008837A5B78BAF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 3d71b6204e0e0d4ee7a64184baf8f9528704480a84e31a8d6ddb8d53ff362eb9
MD5 13d992d7d8a2ab19fc0162989a01797b
SHA1 be8bbb9c76fcc0b15f5b97c41eab90808ab0cb7c
SHA512 1f5731fd95c56d5823ec3209babd07b3cfd555b7237c21cbf28010407092265482beb1cc70728c2405babccae9c2b415ed80b5728bc9b24f034201a92ba718f7
SSDEEP 12288:dpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15AC423BE914C01CBE92244B5C3E5E15DEC173E57E9200883BA5B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 fa3c30abddf9f9f7dd555f7c4edb687573d8141f4c6f74e5daabbb39b1155c0c
MD5 ef329621d9b3b4d41db69b8942a36802
SHA1 cb4a20b7f4ea6dca2a6c24fc86634b619a598017
SHA512 03c75d89a06f03959d6d445ebacea52839129b35c7ad0b47cf2e4f60a7725402b42017d3f9d150c8a4db9e67331d890cb4ea48bde8122dfabf189a0cc088a893
SSDEEP 12288:cV0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10CD4236E535C01C6D87285B4C2E5E11DE8337D56EB3005DB6B532CAEAFF26944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 07240c3b6d0f4dd07dd86103fc45ff71898717117ba1be3b4f04043b6c54d331
MD5 76ba4974238885b3ab17c8a3864694a8
SHA1 c3f06f311f0b36f9d6aa18f5c2f3f33c5bc6ff48
SHA512 949dd11298beba476357b095533461d6a674656d7572d4b0ef9d0be2b8ae667afa32a46e9073166f38f9352a586d5e195967838e47283e9c849e7849fda6e7b2
SSDEEP 12288:EcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F6C423BE914C01CAE92644B5C3E5E15DEC173E57E9200883BA5B78BDF7F24684B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 d32553a5de953f637efc7ee75320fcaf73bc7b3a4459531becd45e2d7091c7f8
MD5 c5b6cf96fcfc88b91745c2bc05ea572c
SHA1 9e6e99ac056f1a45d76a6d313b94a7e0088d0c72
SHA512 8128c91dd2b5b9cdae9b3872943f40d64ecf77f6ea49b8b6144ff73d6f78d33d2a943e799ddd58f329a8fc75f09c02544273d719554c397df3907b444e9daa02
SSDEEP 12288:8zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8zsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FBC423BE914C01CBE92644B5C3E5E15DEC173E5BE92004837A5B78BAF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 25f3a7ea16b8920bf3d007c454d0bfe83505ca81344425757369c1d8df2ffe2e
MD5 0a4fb2137d4b1887103ec261ede2f767
SHA1 10cde36bd8c214b4ed1f34b804cdf07401c2243f
SHA512 fdf86cfec274a5d32edf6f5bf2dc98d468f1040ac48f5da64838ba39f3271969da179a15136ea8c631884fc72d081d1ee5575d19020fb773172e58d56fd2d53e
SSDEEP 12288:7fXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7fsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12AC423BE914C01CBE92644B5C3E5F15DAC173E5BE9200483BA5BB8F9F7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 a058df7585774a5f4702af0f5decec83b30f85206199fe0341df3baeb21c3e87
MD5 abfc3bf93505d0d9403a53d6c56a6d80
SHA1 793c11259a9af2b0363a059ca25045760745116b
SHA512 d85e4336f5367ad450ce20092705e675d52afaab9435abdadbb66e6ddad4b261957bd3202e136ff08668002338ba93fa840b940832a34e36927fd5742464b23f
SSDEEP 24576:yZMSzFVSO3sqjnhMgeiCl7G0nehbGZpbD:yZMSzfnDmg27RnWGj
TLSH
T1050501A9B35418F8EC63813EC965D90AD5B37C1A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 137758e60414b65a8748e37d635350fa3601035e5f350c6474fdcbd513ef477a
MD5 10dc40b09ca7130e842600b9269aa88d
SHA1 a72cb9dc83f56a535466697e9c16a5a1e4044717
SHA512 fc1d26f0b34f23d3273475a0b2a5cd99506cb6a288397100dad6dc55b7629d7a64b9338bd5866d32b227a45d42ce880ec2a7d4514683093c0fe234921177e015
SSDEEP 12288:qmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17EC423BE915C01CAE92604B5C3E5E15DEC173E5BE9200483BA5B78BDF7F24684B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 06a54d0d9719ba2b2ccaecced0c49dfa50279f7787363dd29efc62bb209cb64e
MD5 035c15f6fb6253b8cc3b427cf774a24b
SHA1 95a130206cf5eb3eabc482cff46758e20e54573e
SHA512 eeb0dcd93ad055b2b5da7d6cc3549d4882ff72fb92d2450838926b252d03ce82408048c227fe1f5ca1dd3f1aa8e3126536292170be208f83eba97ccbd5437a89
SSDEEP 12288:+aXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+asqjnhMgeiCl7G0nehbGZpbD
TLSH
T16AC423BE914C01CAE92644B5C3E5E15DEC173E5BE9200483BA5B78BEF7F24684B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 05545277560dd942a9eed6915483d3263d168b5f9183db182857d7466032b34f
MD5 7f3ccae82e8aad59f94863f5083bf9b3
SHA1 6e759403ffdd1a539011f0698c395143843de394
SHA512 c49cdbb77bcc7fb07afc6c8083696e77d76cf0173f4e0955c2a03cea95f7e2fa874cb4cef8f7fb4425db10fb85d9796d5e9cdfab6fc9ba268aa7e93d38f11ada
SSDEEP 12288:qyPz5L8LXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3zyLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F4F4025B73A530F9D5368138C5A29A06F7337C3247204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 ca44b9e2d515e42b9b7974760a9ccd31b9367788cf51055891f71774fbe0a539
MD5 2cfbe73cd8c8969848bfaadb32e5fec8
SHA1 10f6fd7c1c34c1e35c92e881b0d941d9f4c45ac1
SHA512 8795db77baee68f343d442eac4b097dc59ffacfbe7d60c5e810a6d4e2c192c2d666403d3bed7eead824369c0735787126bc1ddcde3a9c771333a0e901e6093dd
SSDEEP 12288:TmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C2C423BE915C01CAE92604B5C3E5E15DEC173E5BE9200883BA5B78BDF7F24684B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 63d1842259e8b1b069898c12cabf74cf027a77a311f12d32d10233a3c6d99a4c
MD5 7d738c27f3c633f6178f95a85e4bb882
SHA1 7da148a98c55c79aa976828b2d97997bc393c3d2
SHA512 df42c4553010e2777ba7617ce140ff75fb7e77d5db77d461e075416ae1a09a01eb50b6e1a5dcd59bd19d3bb6ec5f089ad7e1a4afd9c2c8bf09bf2a87853c9b32
SSDEEP 12288:hmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T109C423BE915C01CAE92604B5C3E5E15DEC173E5BE9200883BA5B78BDF7F24684B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 a9485d50fb1e6d2c9f64cdb8448902fa4d85d9c0d30e0f3397c739a4778ee5e3
MD5 1240bc31f049254fc6912f354a340719
SHA1 6d7a4fa9692a544c95961d264a15a61269bfbdc6
SHA512 0a79ba0c9392b7c5e08d2a2b9f5bb01e2ee98c68c14455f2fec54976bbd81dbd68cb1bbbef305980c84f387233054a09410f3bd81a2adc1f9ba251c2e545c493
SSDEEP 12288:RyPz5L8LXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AzyLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A9F4025B73A430F9D5368138C5A29A06F7337C3247204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 7d3f5709a6a953f70c92f273e40db8f640f7fafca179dbfd3ddd8cd313eb7c2d
MD5 d3c0983a29337d5ca7c2c2ec8c7faf4e
SHA1 edc8501f637a21bd50fde3cd1f9592f0e45165fe
SHA512 f77f62894fe3b6c94db68e7b6f489caf3613a1280a33560fdba97d0255502f7f3488b48797e3c57ddc0bd5f98dcd4524590641a7e2917588136ce35726dbf578
SSDEEP 24576:ITHaLl3z0zD5sqjnhMgeiCl7G0nehbGZpbD:IT6LljsDmg27RnWGj
TLSH
T1810501A9B35018F8EC67813EC965C90AD5B37C5A0B70CA1F13A5366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 d8c09240c991da204e9117e4b1337554cd8ab4c395d68f71181ffbd3f4871aae
MD5 325b0844721878963b2dd65f1833680e
SHA1 c451068a1eaeae508409c48a77580126e5f33dea
SHA512 b170657de0488d22202fbf0c13c67ab767c87d51f678472b81930e9d1864807df829cf1613d92ef49e6dfaa4c51962172aab397b3647a917c31c7c9cce33d82e
SSDEEP 24576:937d9CHKy7GZVsqjnhMgeiCl7G0nehbGZpbD:d7d9CHKyanDmg27RnWGj
TLSH
T1D325CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 315931460082b37b0295e1283e47af9ffea69c21ff5b8ec7ccf4d313e224d4be
MD5 599c3f6a75162699dbebe712ff80d488
SHA1 23b8421c45f473348ff238e8e0b11527d5c9d459
SHA512 7349629c378c26fb15396e7bbed8d896e1748b7d7a50bd169b8ace2abec37b76d1a939fcdae538bf47d320bc9fcb1349d87a59b694971da05ad509685d259481
SSDEEP 12288:2JXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2JsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B2C423BE915C01CBE92604B5C3E5E15DEC173E57E9200883BA5B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 0ed5b3f34ab57031e8caa8fedb35648ea8d0fd7c71e28791e913456ac3f409df
MD5 b0f60e770cf460111a21f43bf13d8420
SHA1 81eee60e29ecf7c9129b13b438748eb702594eba
SHA512 861d63c6cd49becacc2e0abfdcfbb3a9a6489b8525b457389a4ba9b1754d5ff2d1f8cd4f260cf3cc8196766100bd752b9ed08b103425e128fc0f5348c5de198b
SSDEEP 12288:5rXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5rsqjnhMgeiCl7G0nehbGZpbD
TLSH
T101C423BE925C01DBE92644B5C3E9E14DAC173E57E92008837B5778BAE7F28644B39423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 7636a4d8a533e048d2958eb56e592f127a511b56222403c98079272c9db81530
MD5 6c1f1929f654ef9d7b409b8e24605bd6
SHA1 c0d37145202e3cfed49e925fa06632ba0af7bb54
SHA512 7fa38f14c25527dfdf7afe49e92c8c33e82fc8a62ddc9dd9df5ec4f71b98cf5566f073b81fc9d5cf02ebbbc7b9949636380884a260a35edc0d6bd61b0e47b580
SSDEEP 12288:TYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A3C423BE915C01CAE92604B5C3D5E15DEC173E5BE9200883BA5B78BDF7F28684B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 329edcfa3cac9f12fa9ae28e77bf1eae9b16310b01420368029e0bbe727d8544
MD5 fd4e12edb077e085f635cff413b3411b
SHA1 40316acb381d1663226190fe72ab382f999c3782
SHA512 ae8a367db4a80326f574cbe6da0b4d2117e25ca99a0ef53708267e59a0cb80787842e309de8e3bc71a78ffadff17a84339bdcf85ac32b341e519daa7ae531928
SSDEEP 12288:smXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:smsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12AC423BE915C01CAE92604B5C3E5E15DEC173E5BE9200883BA5B78BDF7F24684B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 d9750521922801193b6f885bb90fc8e7cf34f10a3a6840ac2b0a79804805ab9f
MD5 62a4ba5627f2aacc239f8728f42b1c1e
SHA1 b12396e1062b8ff6b9c95fc47ee7f288ce258c29
SHA512 f3ade912127e89727f9a15eafc9fbb4509bb76141d7ec63e6561f5347ebfd293b7e9703cbacab8a86a31b43c35a798983605c41b8c9980b759e7f87e7e070f65
SSDEEP 12288:CJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T167C423BE915C01CBE92604B5C3E5E15DEC173E57E9200883BA5B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 d5c8ddb563052971fb883da2c86c28b5e5b7a991c9931013e02033353421fd1f
MD5 9bee0c4a4ae21d1ea5ce24c92c73dfee
SHA1 11cac13cf84c85aa070cc7ec47469bbfaa576a5d
SHA512 b08bc05ded4f3286fad943fbdbad557c9988dad9aa13a9d6d51d9554ce9f2d336265fd9c724cf96fa6d17a8672292447d2b78efbd62bfc2192d3ee7d39e085a1
SSDEEP 12288:vuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B9C423BE915C01CAE92244F5C3E5E15DEC173E5BE9200483BA5B78BEF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 e388918f4da897ed7d85f31a0acb6c44a76e4f8c09e92608bbd053f9c2c73413
MD5 4cbb8a7abe2041932e8da8b3dff3cbef
SHA1 07ac5b1faf226a3f19876c0037e812801acabe00
SHA512 ae42a8f178ac28b62426864708430c205bcc91dc6d40e0ad69f4cc6f36974f570a8a39ca8af553223076d583c5607b397b347354bd7cf54815907baf86b15370
SSDEEP 12288:VcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C6C423BE914C01CAE92604B5C3E5E15DEC173E5BE9200483BA9B78BDF7F24684B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 1b3a66ddf68633eeddedf624a67663ddf65acde28832ace38509849c68fe018d
MD5 ca0d07f8099e5fa05355b3f3aeab0ac8
SHA1 69d8d401bfa2ca90af9108512bf9215b67c58793
SHA512 5eff3506ba44228b92a26e251eeed9605352c40f3819248da70bd33da45d97c53a813927bca59d390c210429adedf23839a5306449d9ba3f2d7b29f40d493d76
SSDEEP 24576:7fwvok9RX6wkyAIKsqjnhMgeiCl7G0nehbGZpbD:dMnYIeDmg27RnWGj
TLSH
T16E35D029EBDC04E5E177913C89B7860AF6B278591B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e3b81d076eff93ab6d4619734d488e5f3f6e7559f1c51729a11bd3b4477fa8dd
MD5 0c6017e4bb3770b4c2125719693f41bb
SHA1 788027889f30b1004d2b0a3f398fa9c48e063059
SHA512 376d99e1f9e47204fc6c5e03f23c08403bdd39c6e32193be6b1950b1f5db6732a98dba699960a61eee603c1de183079e40f89c242eab23e394eece43131b6703
SSDEEP 49152:dYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hDmg27RnWGj:dySzPJD527BWG
TLSH
T1E4066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e889d06f3a8c6e3764e3b53ce3d5490d7c8168e7fb433f7ff17e6f4ec4e1582b
MD5 d0ca6cfd9251239e7d9d6c556487abbe
SHA1 9e4f77dd9af21e3b08a5bbc730a455d0a1aa5479
SHA512 ac8ba5df4cf2848188adc7b7fa3b1f7c12cc8c8db6e85d15ebd8fbfed28ae776180063aed9414105112b4faa06e15dadd5c673cf1c9f31412400f6b5fb005e72
SSDEEP 24576:C47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYnsqjnhMgeiCl7G0nehbGZpbD:C47JUQj1irIhCnDHUPfF/RDmg27RnWGj
TLSH
T1C365AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 a4258c0a5628c68eb678acbef012482b295ea841f24628975bbccf6f4e00cd59
MD5 7443a0d96a1d158c1b54b58f8ae1a3b1
SHA1 05794e60c865a8ec2a3084aa826f3bff424fff06
SHA512 5f9ca18868f1407656dfe00f7ef463ae45f7f6c2081f5805ddbba34119b0a9de3bf390ea829af0f7e964a44eff1250c0ffa5de0bdc3bac8ad6ea9957541bd677
SSDEEP 12288:sNsf2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:d2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T166E4015AD29802D8C06E5179C3969605F7333C2687E093CB67D1F87E1F766908EFAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 5ee2210e3ff9100a385ecec3a43d5f6376196ef1cc09f8be552ed651eb14d73e
MD5 96f96eada639c9db71e48f1b67df3543
SHA1 09638cd206fc44635121e9b851d3621f4c751602
SHA512 7663de065ff2706ce30128ba40f9ff3f5dd827fb6839af63bb540d44cd7b2421b559e6aea4c326c06d155d21ab016d7cf494fdc5b67bcbb40f5f3e4d7fb641ad
SSDEEP 24576:lsJI0UP1EgF+vznbwE+3l8/IRB1vn0/QX3j:R0Ut7F+bhIl8/IRfvnQQHj
TLSH
T139352840762BC75FC5A940325E72D6CCAB707D01EE056F07B3C8973FD576668BAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 6c9c3d92acd2376f5667651e14040c0c1f9f36dd091192e9664a1cd5dc1ddb8d
MD5 a924a303794db88b906bbe235f19e643
SHA1 982df5d67358849653b62ecbe120e42cb2011e86
SHA512 a91b0bc51afec6041af65e8b3c44feb845a4f44a3c0bf0c7c830465309ce618118d3d7818d305a0ee8c0a769691efd8bae21af5f4ada5b5e5ac2e061048a153e
SSDEEP 24576:gdYQWyPUm2JwfdmG7k7Ai+LaxALwRAmNoga/:fm2JwfT7k7Ai+LaxALwRAm+5/
TLSH
T154651A816537A38FD0F76132072A6B8CB768DC0777055F26B389453AD82AB25A0FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 b6784783eb8749412e38d811102dddea8d56f163d70114ea48de9693f8e840f0
MD5 7f2eb45fce8047e2b15f11c44fb411bd
SHA1 8f5688fd3405a09b710397bcdf3834c42417fe42
SHA512 71268df28a5b722415271340440413c526f06f2aa0f47afa4125acb97354e51e880fe4965dcc514b017c780601399912fa2b8027656009566cb56ba23ebe3de5
SSDEEP 12288:8M7+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:d+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D0D423BE934C118AF83605B482EAE12D681B3E669F1044C3BA4779FDF6B18D48F39517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1fb6cee5d4a04494c88023b176dcb8057e1826b649c87011857453ac2098aa4f
MD5 e1e1bef317806d4c86dda0dd19bf65f6
SHA1 91f98f41bf077b73b374fb9704f5da0ba61478c9
SHA512 ffe956d7d8dcb16efe494874e6a56cf3988fbdf2404642e3596ac018bf7366473fc15fe8fcb966c1301bc57170a21c918ac496007593dc93a48e496840ef4be6
SSDEEP 24576:3gb6bmBIi49WNNFpg1rSvFv7bYwsqjnhMgeiCl7G0nehbGZpbD:3gb4mBIBhGF7Dmg27RnWGj
TLSH
T1F8659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 b33918e4a599127dcfcc427902d741f339324fd70cc3993bf10c84cf8689cd2b
MD5 b9728f665e640d5bf5357f30a02fb530
SHA1 52902f48d1cdc3ba3328874500b42c858c7e3959
SHA512 c571ef6cf4822201b30e2e14c3f5a31391eeccb757fbbdde092acd138f51e07c101560ddfaed741d59954da5bab8b60ff38f87e4511afbd9b30a9c5a05159631
SSDEEP 24576:kG88u8FpJqH1bzria7/m3sqjnhMgeiCl7G0nehbGZpbD:X7ZFPqVea7/kDmg27RnWGj
TLSH
T1DB35F16577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bfa55a46edcae94dcb3c0fc88b83f860912768f8f29c30034371db2f1a05b153
MD5 50cd8769e0c8e0aee5ea9706e010c99f
SHA1 b0ec074673c2d6c56f08638a55b9ba9d93bbdc66
SHA512 f70582926f7f38022793529ef31b9966dd80d52a1cba1994c00c7c744941b8ce3c40e1d82bc0a113a76696aeb764569824f8e973bfe7007d278a85632a0456bf
SSDEEP 49152:hBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj3Dmg27RnWGj:CG05lO43bWD527BWG
TLSH
T1A3D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 495b9047936379243d7043c00d45fe3a3fdb0a303bd451ae9b050d1ec5613d2d
MD5 394a59070eb7d0ef153a56f47af9452a
SHA1 9903470d25406a93c2cba8e1ed06cc3235561616
SHA512 bc21abeb5c887084dbba0a0bb5205a5d6231747478d7e59fecfe05ac8fbcaf5747ca8bd06e4db0742443b2d06f09c0d67ff1d2a8576b2bc6e494e0c39bee8233
SSDEEP 24576:ufa5POZ3dpFWVM50JicR2hG0lasx2+47eidn9sqjnhMgeiCl7G0nehbGZpbD:2a5POZ3+Jt2pasx2+mfDmg27RnWGj
TLSH
T18C65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d388ed666d9e61532c07c03d54b6b77528d563f30a7e5d2d53dc1a2440a73321
MD5 2c7e462f957ab8e06644805e9d6ec949
SHA1 874f8b4ddb3b5fb7f2c673300911f54be3b22d23
SHA512 ed2f29481d96fbc0eec6fbb3dae112395212054e736a5a852753f422a0bb84bb17b74bac60596f819337a8b8c085926b39280bcc860ceeb9d6d049e49e8024e0
SSDEEP 24576:4NcwHdjbyQ4nLC18lb/EOjowL7FkvsqjnhMgeiCl7G0nehbGZpbD:4Nc/zEOVHFEDmg27RnWGj
TLSH
T1CE857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d547eff0a7b5f487f8ed4f3aeaa21da1f5ab42e6b783804ee95863d67014bfeb
MD5 d7ffc9dc4db5e0a2079f9e9af9991cf1
SHA1 9c3b6d46e1dfa0a1c4d777e018d71822683be414
SHA512 a1b4df65a7ca1d2736f2251b0f9192e45279c789dc87e6cb9a9e95c508380fe3ee2b119a75171d7feb1ba62d315897de62e80227bb7ef3316b8fc26718d2fee1
SSDEEP 24576:U8kNvNnaFeYhJNtmZBm4sqjnhMgeiCl7G0nehbGZpbD:U8MwBtOmkDmg27RnWGj
TLSH
T14F55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 a832e904fe2fb16f1650f2b0e5139d9671f005f9a65da4a318348a887a07a8ff
MD5 724c8546dc80247cb9ab4f12afee9c06
SHA1 6bafa1222dca8a5f9a86c210fc3a65e52dc9f033
SHA512 0b64080363ef3657c8bed70590aaea556749f2587c3fb1cc1642d371c907f9f87b9e57560c5c23a87f24ab5101bb9472a61d8f28a33ef3c39035ee0eb079c6fe
SSDEEP 12288:oHvUrBFrEjwaQjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:oPUr+NQjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19F05F12F62AC18E5E676A17CC682C60DF6727862171192CF02E1817E5F73DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 5de1c4ecc4ac9bbd58871b7a916c650a478f0a97e1de1b617f7255ed3b2ea6f9
MD5 5fa93d9350ecaf2a393aa2b2ca705dea
SHA1 cd85ff1d4a4536c66263882c4d00d5e5672bca79
SHA512 6ee69ea4afdbe9aae6a7814de145f03e46225291886823d004eefa4a1f63bbf3893cc50eadf15bad7171da88314bd6d7aacd017a4d6b70a84ace19a75edcbc96
SSDEEP 24576:bD3FHshBIYQgACsqjnhMgeiCl7G0nehbGZpbD:bDVHeBIAAGDmg27RnWGj
TLSH
T11B25E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-96-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/256-309-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/256-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/256-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/256-103-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/256-97-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/804-70-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/804-289-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/804-62-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/804-64-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/948-307-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/948-109-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/948-117-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/948-111-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2644-108-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2644-25-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2644-17-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2644-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3480-51-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3480-190-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3480-58-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3480-50-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3480-57-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4156-305-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4156-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4156-323-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4156-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4156-91-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4156-85-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4312-43-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/4312-46-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/4312-34-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4312-35-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/4312-48-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4596-0-0x0000000140000000-0x00000001402FA000-memory.dmp

Download

memory/4596-1-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/4596-9-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/4596-31-0x0000000140000000-0x00000001402FA000-memory.dmp

Download

memory/4596-26-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/4696-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4696-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4696-130-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4696-128-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4696-122-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4760-75-0x00000000008D0000-0x0000000000937000-memory.dmp

Download

memory/4760-80-0x00000000008D0000-0x0000000000937000-memory.dmp

Download

memory/4760-74-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4760-304-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5904-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5904-311-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5904-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5904-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download