6c92fe3b8b8d4c0ce1470f07dba13e87140ef5a041709973b9a38556936bddf8

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 11:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_5f9bd91836d8ff18e7a769c9ebbbd189_icedid_luca-stealer_njrat.exe
Size 1.7MB
Sample261003-nrtxxaxdpc
SHA256 6c92fe3b8b8d4c0ce1470f07dba13e87140ef5a041709973b9a38556936bddf8
MD5 5f9bd91836d8ff18e7a769c9ebbbd189
SHA1 43f367b075dfce46ada80b5700ec0b08ea6b671e
SHA512 1630b18a278e585c4ec0892c6267dc216e39f1106d2c6c8570140b896ff4676c6650c4a47757744f9ddafd46176c2f7620fa74443cdaeb5c9d2ce0f53b1ee8ff
SSDEEP 24576:5C2GEW/qfxJaKngL2jdshRTdG1YxITqvfPkbIcbjLpsqjnhMgeiCl7G0nehbGZpv:42vsYxJarSj8RoTCCdDmg27RnWGj
TLSH
T10F85021AE7A515FDD07BD279C9939805FA31380A0360AA8B07E459FB1F6B7E04E7DB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2340	elevation_service.exe
3384	elevation_service.exe
6000	maintenanceservice.exe
4452	OSE.EXE
792	PerceptionSimulationService.exe
2816	perfhost.exe
256	ReFsDedupSvc.exe
2680	SensorDataService.exe
4620	ssh-agent.exe
1056	AgentService.exe
4720	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-02_5f9bd91836d8ff18e7a769c9ebbbd189_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-02_5f9bd91836d8ff18e7a769c9ebbbd189_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-02_5f9bd91836d8ff18e7a769c9ebbbd189_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5f47fe1ac17a6531.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-02_5f9bd91836d8ff18e7a769c9ebbbd189_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-02_5f9bd91836d8ff18e7a769c9ebbbd189_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-02_5f9bd91836d8ff18e7a769c9ebbbd189_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-02_5f9bd91836d8ff18e7a769c9ebbbd189_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-02_5f9bd91836d8ff18e7a769c9ebbbd189_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-02_5f9bd91836d8ff18e7a769c9ebbbd189_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2532-0-0x0000000140000000-0x00000001401B9000-memory.dmp	upx
behavioral2/memory/2532-76-0x0000000140000000-0x00000001401B9000-memory.dmp	upx
behavioral2/memory/2532-118-0x0000000140000000-0x00000001401B9000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104140\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-02_5f9bd91836d8ff18e7a769c9ebbbd189_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-02_5f9bd91836d8ff18e7a769c9ebbbd189_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104140\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-02_5f9bd91836d8ff18e7a769c9ebbbd189_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b38e0bc2b53dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e5ed77bb2b53dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073c9e4bb2b53dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c3fe9bc2b53dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e5f0e4bd2b53dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d5cccbb2b53dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ac423fd2b53dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2340	elevation_service.exe
2340	elevation_service.exe
2340	elevation_service.exe
2340	elevation_service.exe
2340	elevation_service.exe
2340	elevation_service.exe
2340	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2532	2026-10-02_5f9bd91836d8ff18e7a769c9ebbbd189_icedid_luca-stealer_njrat.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: SeTakeOwnershipPrivilege	2340	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1056	AgentService.exe
Token: 33	4720	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4720	SearchIndexer.exe
Token: SeDebugPrivilege	2340	elevation_service.exe
Token: SeDebugPrivilege	3384	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 5620	4720	SearchIndexer.exe	100
PID 4720 wrote to memory of 5884	4720	SearchIndexer.exe	101
PID 4720 wrote to memory of 4124	4720	SearchIndexer.exe	102
PID 4720 wrote to memory of 3640	4720	SearchIndexer.exe	103
PID 4720 wrote to memory of 4512	4720	SearchIndexer.exe	107
PID 4720 wrote to memory of 3224	4720	SearchIndexer.exe	108
PID 4720 wrote to memory of 932	4720	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-02_5f9bd91836d8ff18e7a769c9ebbbd189_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_5f9bd91836d8ff18e7a769c9ebbbd189_icedid_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2340

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3384

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:6000

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4452

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:792

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2816

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:256

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2680

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4620

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1056

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5620
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5884
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4124
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3640
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4512
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3224
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6a45279aad7c0d0dee32fcb18cca7b8825c937ff7df74116e7e80adccb58c528
MD5 3d41fef2fc8c33317f1df6a66ba1a9e3
SHA1 235044ccb1ec5613c3fc3d946ab06a878ccbec63
SHA512 e0edafcf7796e7be290ac67f75dc951346d5fc610a7f2675a8a56670d31dbcf1cbc838ccb506dfbeacc4e29c93251dabf4455ce55ff3f134f531d31dff69a239
SSDEEP 49152:jb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnhDmg27RnWGj:B3q6HjBeD527BWG
TLSH
T1E2D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 03de67e6ccff3cadf3154de96d52169ca61383c166ae577cf04d4d1dae546278
MD5 d4177b5731052a7972a216c0b3962703
SHA1 4d6cc22c3ddd7eddf797901c062f8211b1fff65b
SHA512 07feb068cd60ffdbc75d5977ae531b93d29b96f4c2e2d236651eaa207452477d764bdf6c4433b48550b01ecc6ecb6a3dd584e5829eeca40952f7f42b1f3f8109
SSDEEP 24576:dXYfDtczAmsqjnhMgeiCl7G0nehbGZpbD:ItcfDmg27RnWGj
TLSH
T173750129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 8a169ca8f240159fdd6de369495ecb5f039ca3ae56a02b0b2b7810a36582c7d9
MD5 37e99b4fb085b3e6131f480784f43055
SHA1 817fc8c3bee3aafb0715a3ef4bfca6ef1114defc
SHA512 5e7566ddf89b6b238c428b46220044d094c773f3ad41cdacd13a006a92e3f9211a077d49bcb5504a0ec27580783da4ea6a23604cc6e0ccf41697ee2d86cd7384
SSDEEP 24576:q0Le5ji0hmxirM8sqjnhMgeiCl7G0nehbGZpbD:qPji0AclDmg27RnWGj
TLSH
T1A5959E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5f74d2dec39b3ae355fdaca7e7d88d4824c75c4af61cb9657229a10cbc260c09
MD5 e71f016c63839f0f72711c2c0dc18f16
SHA1 8c7b6a66ee4f7cb1bfeec9554c5b865d06470de8
SHA512 9edaeb56b32360d201c54f36c091315db57b39d4d05d83301ee80c6194bed630a0ba05a7679b99a677a90000572494c93b1f14551a959948f74bf60c6d886ce4
SSDEEP 24576:Ya7/ezSC6vUyD/aqgrvWE6q8wyuqsqjnhMgeiCl7G0nehbGZpbD:f/ezSC6vUzPvxHjy5Dmg27RnWGj
TLSH
T1EE755C25F5788323D0B2D0BAC5D6BA9AFD7230465B3089CB0246D76C3E277E58636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9c7f6dd838505cbb9929be5f08ad43e5fecf1532f7bd85c9118b52e21d2e14a1
MD5 32471a089fdcfbeae5900f1b8f51d22f
SHA1 c4efc65cb55ca7e6511953c9af5d475c7289b427
SHA512 89df47e641906bd75598363e4f864e06e94696f1ce97024d71d2d34de7dc1d762853e4907fe3fadb5075fb180d8b9677ee6d8fb7b1a0d76133ca5af786bcfb72
SSDEEP 24576:NVbqPb88hv/l+6jsqjnhMgeiCl7G0nehbGZpbD:NVO88hXl+8Dmg27RnWGj
TLSH
T11B559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 a660a865c5d2829223af98e6bde93ccdbb3ec341647588ed7112f19802706d95
MD5 6a892931c679df3e897ad4fe3fc3911f
SHA1 a7b5ac03b172fd7af6012b5a0d95d5f32cad23ec
SHA512 c42003ac00cf6da611cc8e7deec2ab9d60fe271d5b6c0a57e8f15290e4273adb5c0a469e6b8a21439e1ef3bf661436176f60b047c0f1afc9e8058ecb2db0a7fd
SSDEEP 12288:xRIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xRIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C45523BE834C11DAEA7709B5C3E9F11DAC177D56982008526A637CFEE6B5454CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 7773c33a8e277a7db466e0aa4cb0e537e642e699ef229948cde6d8d271719d1a
MD5 7dfbb221604dc301d828578b30779a19
SHA1 377cfa6fd66ddbd4d34dabaf828775605587dfa6
SHA512 137262d7b8aa7816140a03c16bf8ff40b9314c011488eda09028a1974066962453e3e920ecaf3794947843f664f677e72ccf221282d73db62002db4abb613e08
SSDEEP 12288:XeBNUbTVO86UbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:XJIUbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16375CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7b9fd253a9a32eb81b06f52bbb4009ed6f0a15a4d3186dc175fbb42055e3b9f2
MD5 98bf87101b92e28abd71a311040f3e41
SHA1 4f3717a958a56863fe2b76ce94709cb027288e36
SHA512 36373317b2694099adf92cfa066802351e39051922b2bf3fa19a1bdded4b8db1eee6113a06e6811ec433343523ba4342a96b0f539ad2db4e8b486d5d675b5094
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THm:4QvGAdlCEL8c/yRNw5COD527BWG
TLSH
T104266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 a9175a0accf8096d00adbbc12396e409c7ea86aa3a6ad03d2eb2c051dd735b2c
MD5 cfa3caf86872d9bb55e22330775e7c82
SHA1 85920cf87aa5f4be01616c1a47e1a214782d792a
SHA512 0081e1015a7d3479fc50f62ce3f1bef632900302e56ce7d2fd0d71ad1df331211f572f39954e35b6f223dfe23acd2c843bcf0c9376a2c676a5093be4ef941bb3
SSDEEP 12288:bAwSfxL/2Dc34DLLmt0LDQewsAjhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:EdewsAjhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EB85E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7382befe1cbb0f05a16836b0ac333aba9744c5440698963ce43935f0da08eeaa
MD5 b9c52121a3b302bd34c225a69d2b9b10
SHA1 831e7e2b84c5164ae1637b6625c0e8cbb130167a
SHA512 e493d172197b684e9f0779c9e74cc7873ea30e0b3f62b4065408e5a339f7d33cf5b35fca5ebdd6def69a6ad94ca790799d2106159eba743b3ad5f6729751b154
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHNVQBWG:XUEtQevvqc2W1cpV2EI32YB
TLSH
T1F7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 92815d52221b76aec864ee39e9d4f572fad5effef61b4bf384c5b917b5605fa0
MD5 dd2eefdeceac20c081354cf62e27b110
SHA1 faa1626eba567768ab9f0a2069e89d2f84fa0258
SHA512 0576b52ece1a17bed14a14a15cf9795ad23bc98678e2d00c31badf5393b97dd3db594fed622ae0a2eeaf3748d132222a4086bc100ec66dbe6517dd240341e3f8
SSDEEP 49152:QCbRquA/m2yL5zQfFiV+XenmE3/zVDmg27RnWGj:5oqtVjnmCD527BWG
TLSH
T1BED58E1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a94962cc9d9e323c42dd9098d1c6ca9fc5710f913f852d292f866e576e6e9fda
MD5 5d9d1bbe33cdebdc1ad097bdcdf3baeb
SHA1 6c4dd640e0e4ab31211704c504710e329d40b04e
SHA512 e3408a9073a2fc33da5946f910ebe13d3314d27d3b1a7f11d7b36464dca863090f11ec99d597f5b2c0fb99adfecc411a7104db80353693f8731f59df58e505ea
SSDEEP 24576:bAhGLJIFoiwtA5l7S53OsqjnhMgeiCl7G0nehbGZpbD:bAMyFoiq5SDmg27RnWGj
TLSH
T199359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 0337b10eb9957ee2c6f65590467db4805cf42202881a965b41c76a4a8f234a1f
MD5 8255e362c2cef67fd93a74eb7587cfd5
SHA1 dfb5d2faf46cfe8054baa7144fe6c42111393ffa
SHA512 e4584de1d733508d62f51889f8fa13ed7b2f9a801363fef9cdd9543a4b76fbfc4341d9adf3304114e074002e1158ce70125a3498cb036396803d349f7eca498b
SSDEEP 12288:Hmw5HEjsChNVBFgl0WDm+C7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:GwuoOWssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F675F15A72A80CF9E9674539C697D136F7B3BC122A20DB1F1760C65B6F33250AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 d1440272acd503b7fc19b4e3686d42cfc348a81ac8a05edec15a6ba43ebb86d1
MD5 2295ae727eba45ffa6fdb012ef474e59
SHA1 661ce22d071ca5a0a89769ef28aaa90c061464f8
SHA512 964a04c6f151386367001eba1305498cc1981f66b145135123eda54e645a3e41f1049cc18ffc4cc1543fde4c357183d6aaa43f734cf3933b51de42177a45e45f
SSDEEP 12288:RBZ1IyxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/Zu0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CE6512AA239820FAE1A7417CC5E5D609E7337C62673003CF166256BA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9b17b6c6c4e96f38b9788a04bb6a526e335917a498014c1abb5554d620fe6f5a
MD5 6f70f8c9a2715ad6edb978a341dc38a5
SHA1 cea4c01ac1b3e2dc4203c1bc2aa017c197de46d9
SHA512 453e3246304b4f4da47028250a9094e9639d0212d2c4a84af85ad3d15d09ee8e3f5d7b0edf7a963d3359cf7c8043c2f3aea8750a06b9a1bb915c6fac4a20ccf0
SSDEEP 98304:kQRQyi36YOcPQLvw2gAf+PN3jD527BWG:rQyiKayX+PNTVQBWG
TLSH
T1DC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a1d6ebf9fd61ac0882708fd564a5a592ec7343c388351c992b7c7acc9cb96b08
MD5 822c9eb9a4381b99b92b5ff977f1ba79
SHA1 8a66671858441879fcb5812b3eaa97390f5de74c
SHA512 d81fb3881c7be15d0d669b82ac78a0693f57cb71d49759e941e966fa84cc8c21edc99b0909fed2916ad26698df5d37d6ee15fcdcbaad8cb3b5f26bfa1dc802ad
SSDEEP 98304:EQRQyi36YOcPQLvw2gAf+PN3jD527BWG:LQyiKayX+PNTVQBWG
TLSH
T116667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 796eeb00d53963882f81d80ccc3aac79a053548a0330f7149971822180144d89
MD5 f235dc13a7730bbd9bba528a0424b03c
SHA1 742b016369a9d603ef2c737e8900489c1a627010
SHA512 246282bf755e291f09189a34e36399d487a1cf3f67f06cfaa253f7fee16ef01fc2305df15d3573be84c694d2143248e052e2f1a9ce3c817b5728587abdaae0e1
SSDEEP 24576:RwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0ksqjnhMgeiCl7Ge:968Qg55nhheWu7PNU3/lDmg27RnWGj
TLSH
T19AB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e5409755118d571d65134dc7e92a7d3a2a005b7408eefc55870e53adac8e50f0
MD5 2e44eb4b23a4b58bb6a429fb5935fa10
SHA1 825ae8eee2383f0d39fd685592ae663bfb63c031
SHA512 21ee50f8d4be1148738a54ac75d919d580e7d0ac7ed2244b1bbceabf06fc98567abd6404d869bfa19b0e97eab2bae1c511c92d66fcbc1c92ac60fc751ee7931f
SSDEEP 98304:Jy5112gYy5azzVvL69nLKnhZ0D527BWG:kLIHmWh6VQBWG
TLSH
T199167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7c1b1585dab975dd6347840e1f3bd8968a951c738a3306f3f3f845453aeeeae6
MD5 e0683920e0bccef785db3d0619901afe
SHA1 99abfd7b5fb63a23f454a50fe85c8377c3ca1cf6
SHA512 e32e126a340e0da813707b64411aa106eabc763a1f94082be8ca29fbb86f0a8a56309349095c4b466265fd0913cf2090b27051b73375ebcf9aa0aa93376007a5
SSDEEP 49152:+B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl6Dmg27RnWGj:su6JmVxd2d6D527BWG
TLSH
T182D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a073c61bda7c62c591c8edf47abdb9411c5114fb1f55b8fb8c463a4cf349ee86
MD5 6c2e12932a900cac8dde0f47ced409d2
SHA1 7a962a9fcfe60cc32cf5b46c604d9aa82bab1051
SHA512 d0da1ef6d279df048ec4e013aed6f9a9af8e336340aba96a55981b114cf3d426d7baa8474b3d551b32beb29506649189d9f391113bd5ad0260314479edd14fb5
SSDEEP 49152:X1hpsNoJpF1A6UU44CwH7R4xvDmg27RnWGj:XmifPbRCD527BWG
TLSH
T123B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7ea279918be0376f46217fa214c207f08502851ffdf4d538ea65d025fc271b00
MD5 d68a5be57b164304da3402676dae9443
SHA1 628737d8aa54258d46a5169a0178525e0aeaa361
SHA512 e0b4ea99c1a8e84ba551d0bfcc4eef1c5ed3a550fe934b0e92e0be7dae89f157b4c981e1299abaebe414d3b5257349076241e33b3e10b32e2f3ec6a2972af143
SSDEEP 49152:BSuZQIY0Be2KRRVtOnks6NMHqQDmg27RnWGj:P5dKTi61QD527BWG
TLSH
T132C5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fb448132ae5b44be202994675c1f11c38c1732409eefc36b691496fdbb25c7bf
MD5 8897f7c97e32692be92a7855443a8207
SHA1 3cbc37ca3f2e8377733931707a956a1e5e0028a7
SHA512 cf4d384c5c1b2b300fec07645481b8cea73c94f6814098bd34aae06fb7290d60ffe4bf6c1c48baefdc1be958800e074013b26ba68a3080b588ab1f920957f937
SSDEEP 49152:mhtSn8EApI0figngiDn0AP5wbDmg27RnWGj:nX2iyphGD527BWG
TLSH
T19495BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 84ae4452816159bce2667ebe1e4da57fe97794523c9abfd0197758f5bfc0bd09
MD5 c5bbdb535b31182eb5aaabb6c839c525
SHA1 a9fd8a746cb6e8bb87248ca96253a292a07cfeb8
SHA512 4323c47aa86b62ffa241d0fd882a61aaa2c0f2c7bd6b3b77af8e2fcfe3e8fded2b96f46343a7094c2968bea29fba8859eb46c2fe4f98e57091e2704b225ee92a
SSDEEP 12288:FAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1345523BE925C01CBE52649B5C3E5F14DAC073E57E92004937B9778BEFBB24984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 7a0c4e1f2e92988878e011a085e284d8ac2847aed42a1d6d429153d6d52294da
MD5 d1da4e163702dc470f9b3d5f3a39ada8
SHA1 c3546afb9114c043778ea6777add701311942fee
SHA512 992e5de97ff921ca79b89f4db2211a31e4e2c62fec2c9189221475621dfe6a2d85adb9269905ff208d3a038d5a649d62d09b03e38a73e124e25f6dac96f64652
SSDEEP 12288:vNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A75523BE925C01CBE52648B5C3E5F14DEC173E67E92004937B9778BAFBB14984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 40274e25220ec3ba8b903714a4121a700f999aaae3e98167d6a316791a635232
MD5 162db6ee9e25bb285c6541e6d158e5c6
SHA1 06b5d5dca525a8213f74325aed2538a49d53f5d3
SHA512 f333632fff145b3b07558d19bfaaa453cd668152425c840b2898c9de0024fed6fdf601038214a0a8fa603a0e2f625a478631d5efd9286d6d0afb692144746f7f
SSDEEP 12288:CTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1695523BE925C01CBE52648B5C3E5F15DAC173E57E9200493BB9778BDFBB24984B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 abf08005966c2b81b65bcf3c4a2ae33fbe80d85617875e89de7b66c8877a4af0
MD5 7881eeef2b7e86f77b727ee69129910e
SHA1 2baf0fff817789e28d2586aabb649f4170897a82
SHA512 9407344f4b70aa127c4bd3ef28f848cf9c825619aea5a07d5201b308f374966ee6f1e79eaa4be2d9b1ab56cf8733d92cb51fd5a0c6f15514fe3298eaae3b99be
SSDEEP 12288:OVuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17F5523AA535C00C6D83785B5C2F5E11DE8277D96DB3004DB6B532CBEAFB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 fca7bfc8de90bb7b80e00741e22cbc0173671bc6b4c0f27f27a22415cb56bd74
MD5 de50e6ab0982a07ea70182640e2b9b58
SHA1 fc5b249dd20ea9fce1a6bd77da51fb3b15312f80
SHA512 32133c6310039a2eb6bcd698da3dec99fa47bed0a9310a17748e6981aa9b5da4a15f42f48e825c1b9e557caf9088ec52fcfe8e8aba52984ea6a422606015a3c4
SSDEEP 12288:9WXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9WsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E5523BE925C01CBE52648B5C3E5F15DAC173E5BE9200493BB9778BDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 c5ea346f29d277450816e7c06c728dc592fe1e6b502f5598660fb8503b8a0895
MD5 106aefe28a70a7c68fdfaecba21297ef
SHA1 3e212562853e02f21ec1661ebf6dd0615c3fa4ed
SHA512 1a7c4664128005b5c8152f06a94e99ee3df1a2bb0d0561b6380159b84fe9ebb129ef9a362267d55a34cf853003e6c3d13c6c4d1322ef5d50451546b4e3c18aa5
SSDEEP 12288:1ZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1ZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1215523BE925C01CBE52649B5C3E5F14DAC173E6BE92004937B9778BEFBB14584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 44040fe41045de550ae20c6bbb70f3be91f8b4269f5d50c881f6b9268c3f5d4c
MD5 78c192006dd0f18821ab97fa987c2934
SHA1 543bba0d67d384b418a3c40c0208129ff6653fad
SHA512 f66804fef16aaeb3563a99709f2d307aafbbaff8387418b8d5f956bd6695800748cba18927b4c9778ed3144eaba8b021f77c6b32552b4229883c59d1152b0990
SSDEEP 12288:+VXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+VsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1205523BE925C01CBE52648B5C3E5F15DAC173E6BE92004937B57B8FAF7B24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 cacc726b2607e38ad9340772246e3b71f6b023e0d191614b3b8e828639876999
MD5 18032acc584914b4ecafc30a0aecc322
SHA1 78ef71d91e6c7ab196c53fd4d249e002ae95adcd
SHA512 3456c4138585593d5d5ba83b8b81c531f65c9c28abca866fcf58460dc6d72d58ff3fe27c99edb391413b68d2b7f7e0855fb3232be9982f8d0a57c8bfa831b9a8
SSDEEP 24576:7ZMSzFVSOtsqjnhMgeiCl7G0nehbGZpbD:7ZMSzftDmg27RnWGj
TLSH
T1B17501A9B39018F8EC67813EC965D90AD5B27C1A0B70C61F13A5366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 4b505d0950e0574ed9f5c868b14b51261aa4834ad52e10201424d5a26f757afd
MD5 62d9af99521154f8be46b7cdba99f4ab
SHA1 f1e8a3c98cb1c57bbb5d21d713c6a28f824d6ab3
SHA512 7101416a37401a5300bba9784bd0f4738cb4e595decc4a1ae9775a4b73b6eac49d4cd0aef0535a0d50a881e40af38f7d75637626e36fcfab1eaa7047a25d66ea
SSDEEP 12288:pEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1155523BE925C01CBE52648B5C3E5F15DAC173E5BE9200493BB9778BDFBB14584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 27734202c89a641cec7717f2670f8e02bf8b4564b7b47cdcafcc4bbf1dbad8b9
MD5 65fdd89213a08fcf50d49969a96fe1fc
SHA1 d497d564b20454e0b99d4e7bee82dcd02f1991be
SHA512 96a34e5251b7c4fd8b3943b396ec4f0f6cf6525ead0e8741023ea56f931c9d076a345b42c4345a584ab47c046014610fa20d75ba787f8b8b68b9d445528f66f8
SSDEEP 12288:+YXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+YsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10E5523BE925C01CBE52648B5C3E5F15DAC173E5BE92004937B5B78BEFBB14584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 55be3b19db6bf52ac51a96aa92308af2a21cc015ce8a76b2ae6c7765ba052244
MD5 851ed59322479f2d2388d79f340f1bae
SHA1 9b2c0a19fd22bdbf32faa152c9351f1dde62c61f
SHA512 6050336a62f4e0bd2587567055aeda924ae52fa0a7f5f5ea7431646a968da221ce3ec39ad33dc689bd9130d0f77c4a005dfbd410b38c1cc64cf3e27396ca116e
SSDEEP 12288:2yPz5L8xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LzyxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CB65025B73A530F9D1378138C5A29A06F7327C3647204AAF17A516BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 6fa7d652f9db123160122544098151e64acb77744091a1f64db347b8ccbd424f
MD5 e8f1f64e45ceb482958b198e9e8fb477
SHA1 13cbc29187321909f82f3573f583a3a6befcd45b
SHA512 b848887a443c1c699b2d7e158f3fbab6a24b9a254373c10094839f2f515dcc06c61e3127097a994e325093b22a498fffcbd63f338195cc9e5b49dd4884681dbd
SSDEEP 12288:MEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A85523BE925C01CBE52648B5C3E5F15DEC173E5BE9200493BA9778BDFBB14584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 8c4fca227b2e4a4777363b138569ca5cade69c89805835668160d77e1fc66749
MD5 6b2e06c63dd1fa0f397473fa37db9af7
SHA1 d76d2cf7358d20e3a393695be8955dbe04907e31
SHA512 82b0f9cb0268761267cfe424af6768da51c7ad0321ea6aa482a3dda197c9854f9a6f77a57646d5e6d762d900144386c196fc0a55dcd234b28e4e84bb1cc47f34
SSDEEP 12288:sEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B55523BE925C01CBE52648B5C3E5F15DAC173E5BE9200493BA9778BDFBB24584B3C422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 ce6b0bf6c63d332fbb89fb75ed484d6d372bdd8e960b47af7b4d6c707e536397
MD5 7b341ba15292aed1af2884bd93b7e5b7
SHA1 8bc53106d1095e8519782320c32e105059106c57
SHA512 0ee1ef79033990517213ebf08380b7205d8e76f4c706b2ff7081b3ec0dc6777ed1657e6d0f181e0deef2194057ed7400be950b78759ac2e88e8d4fff8d20cd41
SSDEEP 12288:LyPz5L8xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mzyxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F65025B73A530F9D1378138C5A29A06F7327C3647204AAF17A516BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 42a1a4053431e17757487cd3853bf2127b4686bca48b22925cc7f77e40820c5e
MD5 76e9b29f529ecf4f7ff9d7c9650bbabf
SHA1 6fa351f5d66f4b50518652c4fd1b09fe23cd6845
SHA512 b77deb0daa6d73b0afd223c3f55e3bbb032321fb76c00c1f4c3f3b52f9b64092d98c6d26695ba2ebfc6132e63372086e349887fff33174dc6175b647d4a98a58
SSDEEP 24576:OTHaLl3z0zDDsqjnhMgeiCl7G0nehbGZpbD:OT6Llj+Dmg27RnWGj
TLSH
T1A97501A9B39018F8EC67813EC965D90AD5B27C5A0B70C61F13A5366B5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 0296a09b2cd6dc55cd154b065c642af2dd18ea40336e6bbcb98cfad535cc7d4c
MD5 f47a4e35634c18703c3e5a1a6bfd547e
SHA1 9ff8812da88e0f3d9ee4ed10498bd5eacf601d09
SHA512 01fa3fdc824bed2f5301823770cbcba16312c15dbd35bb6beff02a3a13a30e185fc9aea77f8423459db33d8fc4c951d4ec669cd0d3a73e28993704bca5feb588
SSDEEP 24576:v37d9CHKy7GZfsqjnhMgeiCl7G0nehbGZpbD:/7d9CHKyatDmg27RnWGj
TLSH
T1CD85CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 5bd44cea236be3abef17d438a82a7fb27b41e970ca34b556422a3b633e77a813
MD5 e15b1ba7a9c8fce150eea7921f33a4ac
SHA1 689802172d173f6e75ec40cd4b5d0ac7414b0bd9
SHA512 3d8db554c1a1978df284f9f546c4c09ae2dc52eb5ab66e30b0650c1b4ae3e4785dd702a1da1e934219f0d1ef4bd24e9acd01d6afe6f677cd4441911f4c7d5019
SSDEEP 12288:WzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1495523BE925C01CBE52648B5C3E5F15DAC173E57E9200493BB9778BDFBB24984B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 59d8fa32bc66c286a9c24a7aece65b31a6ec96534c449fbf2e4f3398e604e66a
MD5 9f53332f7f08879dc83946beb8162766
SHA1 4529bb626d46ace5daeeabbb1aefda983dcd3dd7
SHA512 7e049f919c181c0fb8eeef99cf4eb74e444ef710bfd42cd1088acde77f879be2826c91030cc03e59ef8bd02b433a58a87d04cf89c4a7281497f934aa900abd67
SSDEEP 12288:FRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DF5523BE925C01DBE52648B5C3E9F14DAC073E57E92004937B9778BAFBB64584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 5fdb7818fa350fc5a5093af2ae4ccb94ee0d24995573a72a8023bb057aad1517
MD5 d2256289b5b45122681299b78d5cb32f
SHA1 12c7a3ea22211070dae5b09efe57b178dbd013cf
SHA512 7eaeac3251b72c0b139bd7a83f6ea1e16dbb874045d06e64b83ed078ff35ef0d3d041a53403eb68e5e476c553a8a7db404ab795b443e1fdff1e64088b0d20f3e
SSDEEP 12288:fSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1035523BE925C01CBE52648B5C3E5F15DAC173E5BE9200493BB9778BDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 dad6ad6df07694d9f28ea2627d149daa8c7ffef771531049f8704f54ed3ae920
MD5 3918af5cec0e8e2c8ad66b2690592148
SHA1 6112c11ef83e790cfa5fba7ba13a9b03e730970e
SHA512 b74e3a4fda0759223dc1ac6594eccbce6eda1c33c95f04e3cdb704268644005436c470a96cd267db779fae7964b9241ffee7fb22e43962d9a765f08870e6d245
SSDEEP 12288:DEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CE5523BE925C01CBE52649B5C3E5F15DAC173E5BE9200483BB9778BDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 12bf6ec236e81abff8d6d049af38525772dff9295a8eb4d6d03ca41181be8f60
MD5 7d7264193da107701ff65925eb987453
SHA1 3729a10309f6afd3818158e2706ab483db21f235
SHA512 b9668f979ecd15f556b1f36dfbc9f146bd82677d43e6668b290af4d26ee96da35e03de7d142df07b7e85182ed90e28ca857327dbe40dccf07db5727f795eb669
SSDEEP 12288:fzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E75523BE925C01CBE52648B5C3E5F15DAC173E67E92004937B9778BDFBB24984B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 807da66ad717c4622f33aec43473d9d5259a5e420eb5a1ce1fc71c37d9a48b49
MD5 b0700004ba548a2a3e94d4b90f6a0027
SHA1 38922528f0e8f242e006b107e4293483168be98a
SHA512 9206cfc601f328a275810a519bbd0c50ec140a95b24d22479c9b556e8dec1efc4acaf827fa44336f2df7d3fda652b0ce234a29e127ffc535c02cb07c3234f0d8
SSDEEP 12288:YsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FD5523BE925C01CAE52648F5C3E5F11DAC0B3E67E9200493BB5778BEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 09f77f5c20fa8995d1111ebfbbea7eea58899128b1c1cba2e09ede8daefbdeb4
MD5 ed160d27d77186823d3de59c488358a5
SHA1 594848c44422325b4f3ef9ab581db23c4a443481
SHA512 784adf5cfb256012b5a593f853bbf758da2b394249779046167ff12655391f48c4c3509a3fc8d597a987fef9855ce017e9e8c6c739f411f81234ac08a932514c
SSDEEP 12288:IWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B5523BE925C01CBE52648B5C3E5F15DAC173E67E9200493BB9778BDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 cb2db551ac0035f8ce94aff7657e378c561ba1658ddccfed78035518f6feb390
MD5 91f5c063b57c1b8f54fc9b5805b62c1d
SHA1 624d6456f7814bc9b49f957a0606afe459795353
SHA512 4389f9dd4d3bc74ea674532d5ad34120386698819ba6278cfcf4dd3a1a2807c85efea4a29b1f02539d35f2958792fe3a407152c020eb9110db8ed6b5a8e4b761
SSDEEP 24576:dfwvok9RX6wkyAIosqjnhMgeiCl7G0nehbGZpbD:bMnYIUDmg27RnWGj
TLSH
T19285DF29EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 aab8ab62a0defd94260bb451efc8552e4b244a56dbe0d4dc025f1d1ce215b2be
MD5 bf92d102d6b74241b9dbd11ee7dda55f
SHA1 50fae0a2c4a0e0c0b375c25be2254ee029791b6a
SHA512 905d88fb9c21bcb418535cf3af7a7c3c02b6ce7c04aedf236a13e73535ca13a44f7afaebd54652aafaa8ddc34c11499a2c96d2ba73f945e4008b2780b7bd9e48
SSDEEP 49152:MYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK07Dmg27RnWGj:yySzPDD527BWG
TLSH
T128066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3192ceca64d855aa0837617c8248a6e4bb19c31f15ef677960f8be0e52c3e5d9
MD5 aa44a96ec3000b3dc0ef7c16f4495e59
SHA1 545273938b5b71c30175100cb08f78f9947fb4a3
SHA512 99653bc4535f47cb6aa39b77ea57c938b749ef4449cf2e99b05635e6c95d9084c263cbd2ae69030bc958732443e346225f4696974870d6b2df6f882402224b47
SSDEEP 24576:147Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY9sqjnhMgeiCl7G0nehbGZpbD:147JUQj1irIhCnDHUPfF/LDmg27RnWGj
TLSH
T15865AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 58591ca7e20081650db2baf030255ef1b82cb54a9bb35628542a9a3ce90edef5
MD5 141fff1b4e58a60b4a2cbde0cb50a384
SHA1 211e7fdc03342fe148a0830cdb3fc9ffe216d613
SHA512 6455b1096662deb29109e17dd7b72da11da9688f4ed60dc8a6b2f6ee182aaf8475e5f801e8e83c55f3613da69dd56d42aa106ee4062ea309a72b31d71f53a0db
SSDEEP 12288:jNsf0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:g0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11865015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 f1710cd4aa998e81ad7d39056441882cb63be55497eb939f65f63fdceed2328f
MD5 c07454e50b049c1c71b3fb07e06ec96b
SHA1 e66dce5eb61e780b1b2ffc1345bda654bfac92e2
SHA512 75c4a89bfe43ec4cf61c47437dc6f8010513fb2b6ad5fc14cb809330754387fdc09d41227c961ef7e7f8f85a69a53d1ed715ddd54aff1ba0d554376557cfd1c6
SSDEEP 12288:cLlCKU3fYYRnO5aJe+KBAZP+cAdAgheHCNf12a8dFBm1k:cRpUPYP5xlBAZPfAdAgh0CZILBm1k
TLSH
T1DD3518017666DB4FC66980321E37D5CCAB707D01EE04AF0773C98B3F9576659BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 db49d380a0616286f07accc126c654b5cab340ae8fe8cf53df52ec59aaca4607
MD5 73adc5b68413fb31aff70358cd94ee09
SHA1 52f406d281e2688f1e3db22b6f4b7191907c709c
SHA512 e74caf99133c1d978b32941d4926b4fc880e1e34d482c99efff1ba039cda49cb14c38ec40d4c14f98d37907c0e65d03e3f9996f6ab41a6eaf717d8fc6a8584b0
SSDEEP 6144:oqKd1BpdptGotkRrDWttyZPbmaZq2tIZqruZvcMZqruZYAZmU9cwy+tMx7y+tMx7:OBpht0eIZq2WZqruZvcMZqruZhmUom
TLSH
T1A955D8416437E68FD1B72032071B5F4CA7A4EC47B7496F26B389453AD86BB01A1FA3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 49257c9db47a5450dedd31c88b72c755d0da8a52e8ab0348c731758a42a122ac
MD5 7f34b94e2e8feec2bb59a7f13bb1737d
SHA1 228da3f2f7ba53ad5d3952e92bbd35e0bd831582
SHA512 c2ed01d60e32c629d8a2316d86317741812680ed984ae2af41df31bf60fe9abbdc9f86703b3c49a4d3eb83b087022593a27e90e8ab6d06fa093866f7af3ddead
SSDEEP 12288:rM7lXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12055237AC35C018AF93649B482EAE12D681B7E669F1044C3B95778FDF6B18C48F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 91a2433cd2ccd7aea0db177b8c02985137d0efb7a307baba70ed137de7e0bee4
MD5 59d8afeea99ed9375c5ab88b26b760d3
SHA1 a9d377bb8de48d2e91b909db2725621b9428ed5f
SHA512 c44b811e33ecbc6020877a3b59cafd66c337260eed22f758ef25e484781ad15c895382bfb6a6017c2d33f3e2341c0447c9690109c853523938d20af6a244b75b
SSDEEP 24576:Igb6bmBIi49WNNFpg1rSvFv7bYqsqjnhMgeiCl7G0nehbGZpbD:Igb4mBIBhGFhDmg27RnWGj
TLSH
T16F659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 7cefad195ad65179baa35e206bd2e80e1a61d879a9cfc8c2215529383a9fe5c4
MD5 855515106e49b6aafbbd1e2c3e922b30
SHA1 663549208e73a465dc03080cf99964f9fd02f61a
SHA512 1da22e92b5edbfcc68e99adc85f5df72be0c072a9c5380b9a4825d7f75377cc686722bebcb2865af9a51a1f89c35a0d1825bd14cf550f8dd8beb41916695bb07
SSDEEP 24576:iG88u8FpJqH1bzria7/mtsqjnhMgeiCl7G0nehbGZpbD:57ZFPqVea7/2Dmg27RnWGj
TLSH
T1F095016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 8c38d2bf097ca5c345954d00d36fe9cd56775293a49ed929c094d73618378a92
MD5 a449eba91d768e2cc61596d3a8cd89ad
SHA1 02328256671bfe3d5e1da4be202b17796aade234
SHA512 5f3afd23fdb942bb43ab4fdc06855a2134ec8b10fba4f8e0a6c8745f406b6f5fade165500fc9ddd0aab7747f71ddefb85020c35ddc497b2eac830835e4813579
SSDEEP 12288:fHvUrBFrEjwaQYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:fPUr+NQYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14075F12F62AC18E5E676A17DC582C70DF6727862071192CF02E1817E5F63DE8AD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ebc7fb85ecc414c5136757f24d0cb00a9ff8d6ce5f30a3a84d875269dd776bb8
MD5 4a5c29da73675bfbc2abb4b3a32e8a2b
SHA1 0e05b8c96f410bc6aa11a30e5ae6f7910d232ed3
SHA512 a46a7f4e89beca229f75a8052feca8c779d8f20052bf39a9787a2260b5081b44bc2463ec1e834d9b4fb0d9be1a4fc8fbca2ab2f1175430d38c1cb8ee6bd0372a
SSDEEP 49152:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjUDmg27RnWGj:hG05lO43bFD527BWG
TLSH
T1A8D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ab3c972a093fce9b020809c8d7daffb93fd9b3c253adbce2ae4bf46bd911bab2
MD5 2f21c6cae568af58521f54bbdeb370d3
SHA1 d0203b51df4b62fd9c8d8c0b99e66554968eba9e
SHA512 35a700e2c8aed8f98675d470b0573d399bd056b4e5342a35474a0fe3e10a38f55171b29686981d68593eb6571d1e958dc3f025d755d9180ba0cb077c1e406ec4
SSDEEP 24576:jfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnnsqjnhMgeiCl7G0nehbGZpbD:ba5POZ3+Jt2pasx2+mlDmg27RnWGj
TLSH
T19F65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 617eff6bfe970b4b8b6207ae68d554d4a2fb80b734600c5104e326ceced5724d
MD5 f7cdb61346a7e205f63e2952b0b10c90
SHA1 ae64b0edf26a03a70df24bb00e53ef2457fdff3c
SHA512 cba869d959dae013164a88c496c6b6b1e8bcf80a08129251088ee321515e87b282320f9d41a84643634bbbe2ea416f13adf343629fa369380de1044c7841a965
SSDEEP 24576:dNcwHdjbyQ4nLC18lb/EOjowL7FkFsqjnhMgeiCl7G0nehbGZpbD:dNc/zEOVHFWDmg27RnWGj
TLSH
T116857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e6022be7734ca87f84748486d3e3c766651f3423c54d73fdd5ca08437ec227dc
MD5 70623fffb3619002866339e64e7c9f3b
SHA1 cb5e0f8f0cedb5a462aaff26e6e2dce5b3417085
SHA512 cb6bab19030069e2295ea212e4b265513a205d301e1a66a0b6b7c61af684cdb1ab2d587986cd1febfd604dc6ee36e2618ba085692e06d329215f12c6648a5452
SSDEEP 24576:f8kNvNnaFeYhJNtmZBmysqjnhMgeiCl7G0nehbGZpbD:f8MwBtOm2Dmg27RnWGj
TLSH
T19155AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 d562f5da840e953731bd7887081f0a3a2b9d8fed2e890ce0ae2bab34ae9d3f0e
MD5 196aadb39265e63c45bd4c501836fe80
SHA1 994d33b8d4da336333d89535ea9b53d6a6e6cd27
SHA512 4d89107abab6584be77efe5c4a282322c7fe8e7bdb65a950daf97e2402e6b52ce8190e7890f5c87d8e3ddfc501ff7140a4e0e658df62a95b99270a446da02e5d
SSDEEP 24576:PD3FHshBIYQgAgsqjnhMgeiCl7G0nehbGZpbD:PDVHeBIAAcDmg27RnWGj
TLSH
T1C885E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-104-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/256-103-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/256-110-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/256-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/256-351-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/256-349-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/792-88-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/792-80-0x0000000140000000-0x0000000140248000-memory.dmp

Download

memory/792-82-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/792-283-0x0000000140000000-0x0000000140248000-memory.dmp

Download

memory/1056-149-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1056-148-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1056-159-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1056-157-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1056-155-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2340-24-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2340-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2340-102-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2340-31-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2340-30-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2532-118-0x0000000140000000-0x00000001401B9000-memory.dmp

Download

memory/2532-76-0x0000000140000000-0x00000001401B9000-memory.dmp

Download

memory/2532-7-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/2532-9-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/2532-0-0x0000000140000000-0x00000001401B9000-memory.dmp

Download

memory/2532-1-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/2532-18-0x0000000002970000-0x00000000029F3000-memory.dmp

Download

memory/2532-10-0x0000000002970000-0x00000000029F3000-memory.dmp

Download

memory/2532-114-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/2532-112-0x0000000002970000-0x00000000029F3000-memory.dmp

Download

memory/2680-334-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2680-124-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2680-123-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2680-132-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2680-336-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2680-332-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2816-92-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/2816-308-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/2816-93-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/2816-98-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/3384-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3384-130-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3384-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3384-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3384-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3640-348-0x000001DD91B10000-0x000001DD91C93000-memory.dmp

Download

memory/3640-415-0x000001DD91B10000-0x000001DD91C93000-memory.dmp

Download

memory/4452-65-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4452-64-0x0000000140000000-0x000000014024C000-memory.dmp

Download

memory/4452-71-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4452-188-0x0000000140000000-0x000000014024C000-memory.dmp

Download

memory/4620-144-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4620-333-0x0000000140000000-0x00000001402BB000-memory.dmp

Download

memory/4620-138-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4620-136-0x0000000140000000-0x00000001402BB000-memory.dmp

Download

memory/4720-165-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4720-171-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4720-164-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4720-337-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6000-49-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/6000-56-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/6000-62-0x0000000140000000-0x0000000140252000-memory.dmp

Download

memory/6000-60-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/6000-55-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/6000-48-0x0000000140000000-0x0000000140252000-memory.dmp

Download