d21c6b5b8e8a9fe8bb27eebe2ca344ecff149edae8ffa4a8a5875e068db56090

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_7a112ab58f0dd42b8e1c1dd5c0b3b4f2_icedid_mespinoza_njrat_ryuk.exe
Size 1.1MB
Sample261104-tthkjsdz2p
SHA256 d21c6b5b8e8a9fe8bb27eebe2ca344ecff149edae8ffa4a8a5875e068db56090
MD5 7a112ab58f0dd42b8e1c1dd5c0b3b4f2
SHA1 716cb9b22d8874bebdb7132cea05af3e2065fb1b
SHA512 346bad1fea1e8f419d4b8c6ee42adb027ba192d924b466d05b332bdaa660bead95e6a6435fa61aba8a07cdbf5c8f2f20c74ab89124899649c58daef02fd4166b
SSDEEP 24576:WlPCcvj+YYrfSOWVNcj14S5JPgdbBCZG97+dicaamo0sCBxbtbNQ0jJ+9Ms5T:i7vjMSOWVNcjeS5JPuBCIY9aFTtbNQ0s
TLSH
T1F345E155A7E440B8E1B3D674CA624617FBB338512A71CB5F03A9865B1F337A08F39722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4412	elevation_service.exe
4628	elevation_service.exe
5860	maintenanceservice.exe
4112	OSE.EXE
2964	PerceptionSimulationService.exe
864	perfhost.exe
5300	ReFsDedupSvc.exe
884	SensorDataService.exe
5880	ssh-agent.exe
712	AgentService.exe
3004	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-03_7a112ab58f0dd42b8e1c1dd5c0b3b4f2_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-03_7a112ab58f0dd42b8e1c1dd5c0b3b4f2_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-03_7a112ab58f0dd42b8e1c1dd5c0b3b4f2_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-03_7a112ab58f0dd42b8e1c1dd5c0b3b4f2_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c488a217227843b8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-03_7a112ab58f0dd42b8e1c1dd5c0b3b4f2_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000158f527e786cdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006042e37e786cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000094c42880786cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008787b47e786cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007409357f786cdd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4412	elevation_service.exe
4412	elevation_service.exe
4412	elevation_service.exe
4412	elevation_service.exe
4412	elevation_service.exe
4412	elevation_service.exe
4412	elevation_service.exe
4628	elevation_service.exe
4628	elevation_service.exe
4628	elevation_service.exe
4628	elevation_service.exe
4628	elevation_service.exe
4628	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	108	2026-11-03_7a112ab58f0dd42b8e1c1dd5c0b3b4f2_icedid_mespinoza_njrat_ryuk.exe
Token: SeTakeOwnershipPrivilege	4412	elevation_service.exe
Token: SeBackupPrivilege	5300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5300	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	712	AgentService.exe
Token: 33	3004	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3004	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3004	SearchIndexer.exe
Token: SeDebugPrivilege	4412	elevation_service.exe
Token: SeDebugPrivilege	4628	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 6012	3004	SearchIndexer.exe	101
PID 3004 wrote to memory of 1532	3004	SearchIndexer.exe	102
PID 3004 wrote to memory of 5396	3004	SearchIndexer.exe	103
PID 3004 wrote to memory of 3016	3004	SearchIndexer.exe	104
PID 3004 wrote to memory of 5924	3004	SearchIndexer.exe	106
PID 3004 wrote to memory of 5936	3004	SearchIndexer.exe	107
PID 3004 wrote to memory of 4260	3004	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-11-03_7a112ab58f0dd42b8e1c1dd5c0b3b4f2_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_7a112ab58f0dd42b8e1c1dd5c0b3b4f2_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:108

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4628

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5860

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4112

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2964

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:864

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5300

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:884

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5880

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:712

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6012
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1636 2948 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5396
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3016
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:5924
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5936
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1636 2948 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 06f8a478e7ad90671475b0de744722eb805248317367e3165587ebff1ce3492b
MD5 a2effaa87e17a0c01ac10c2f329dc3e6
SHA1 b088ec29b2bffb01b73eda41404fd7a1f836c3b0
SHA512 0baea79a4c5fffa435808279ada598593aa8c1e6acf98dd156f1b60839341a702f55f07dab28d8495afa05ca2e49cb07a8e9166be195c862d322bb886b9b7c58
SSDEEP 49152:1b+632BuPkFKRrdE6ohvstBhuXjfS4LWxn2Y9aFTtbNQ014Ms:L3q6sjBEaFxq0CM
TLSH
T172D58C03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 6aeeb0e13dbb465b4ae77466bc00bb27f89e67b350190d0332e67095082d8de3
MD5 9de0a020222c7403cad2448afd9d3aa0
SHA1 5b8dd2d2ad9bbb728c266016dc4798a68e8da7e2
SHA512 38fed8e1a0268cf6ed629f9260393c8eb478137d5d3da1da4665e644fd4ecdf6b806ebdb948b978ba0ae9ce74e7475703dfabb13f6480a13ac22d8baa134d899
SSDEEP 24576:LXYfDtczA5+dicaamo0sCBxbtbNQ0jJ+9Ms5T:OtcAY9aFTtbNQ014Ms
TLSH
T18C05F12963D448F9EC6B823CCCA29502EA33785547A0E79B03A4DA655F333D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 1c99a1e2e49d356758324b20a42f22565e4306d565347da70c8b23ddffa7d9b2
MD5 d49be82b104ba1f97060b996a5614beb
SHA1 2478ef0e93dd53c82195be732d57ec649157e382
SHA512 5873769734ab3ad3f33491c01a37a65998d03078ae6bfdb54e6d09dd9dc3e4db6029ac56102e0e333b249ea50fb9a3db6e42df528e4fdb193248b72b2cb90ad7
SSDEEP 24576:K0Le5ji0hmxxrM++dicaamo0sCBxbtbNQ0jJ+9Ms5T:KPji0AjPY9aFTtbNQ014Ms
TLSH
T100359E16F6748335D073C0B9C5D2A68AED7230855B308ACB4286D77C6F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 db6dbc35ed9254763d4faec094620f69db2f2738600c71a7764aa3c5a65689b8
MD5 ec447ce3de0cc277a911fe2c0160e997
SHA1 c6177503f408ba306b451dd5718e12e5048a6407
SHA512 7d647c35333949e7936be0f605904187eab247def90ec5bb2a22f7908dd5677d92454ad4c8a8b63bea7622bf0f1bd636f65fcd637613479172d2828c6c3b2950
SSDEEP 24576:Ja7/ezSC6vUyD/aqgrvWn6q8wyuw+dicaamo0sCBxbtbNQ0jJ+9Ms5T:4/ezSC6vUzPveHjy7Y9aFTtbNQ014Ms
TLSH
T1C8756D15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0359782395a62896932b231135f91070cf8e170c3ab346c95838ed13689dd2d0
MD5 b5f62e33da43672cd42089f6743e10a3
SHA1 176aa20440f8e2c581b3af9198d4902bffe202ad
SHA512 c128fd3ed24b4580ba019f29d5fc275cbcdb0837015d54b040f39920ce5920c8b8ea67fefdd6817e1739127388efcfb774e4e99e89e25a5132169e5cb86b702f
SSDEEP 24576:mVbqPb88hv/l+Y9+dicaamo0sCBxbtbNQ0jJ+9Ms5T:mVO88hXl+IY9aFTtbNQ014Ms
TLSH
T1B5559E66F674C331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 eacfa59d8846c7d254c9101be77f78d538c3356618d571c29f5a255c81ecbe7e
MD5 8f0593f84209b7eb44ee91c6f3dab5fa
SHA1 017cc9b7b6e8aed2084f29147c74c601c42f50b0
SHA512 59a5bc93f382fa4ea0b3c5dc1234e794b86da248fe9db2196691cfafe0c97efe294d790563cb8c199799b3a6aeeb47002280c96abc6b586e43ba8e96c96e266c
SSDEEP 12288:LL5YLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:LLi+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T126C423938788E836F12F813484F7BB874C3B4C687C85A53A4528E785CBB67DA5D4AC47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 a0eb7fd5f7e973cf1613a190f7b1758842f2e63f9d42a4b21f32a7055b0fc4f4
MD5 5e22bf9bc88acb76f9537592fa546fe1
SHA1 5e2394c402daacce6b4021b9c57a62469c15e0c3
SHA512 062c82352a20214731ff7c602b186506b8cfbeb5ab8d43f2a38acc6f6af32bb0729822f5be319077c42c18f837a36c520503c7136926da3e71d6364e5cb669a0
SSDEEP 24576:6JIUl+dicaamo0sCBxbtbNQ0jJ+9Ms5T:6JIUlY9aFTtbNQ014Ms
TLSH
T1E405CF7BEE28FCE2C27E89785A9186409B7274304F52A3CBD165C30EDE235E51E7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 71f3d007ddb735db9bcf8d2dbba13f94c482f5f3039d616c87aadc2e5d8766ea
MD5 ac71cf99418796cd636e133f73920c1b
SHA1 b3a3ce5cda6b6318f42a698342be9a45c7af490a
SHA512 705378149db101652892b8abaa94536bd397c50b984d3a08628c6a2969311e263cb897350e101f8351502ca39f76e9a5c8425408cd88ad695cf1869d07568853
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THa:0QvGAdlCEL8c/DRNw5CTaFxq0CM
TLSH
T1D0267C656BF880F5E0A7D138897AC6B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 e16a7b0421c2c7571163dc8744a6a6de08bd6fca32ab90bf69079dbbeb614c19
MD5 06579c81fe636e1e6ac921b2bc9163a2
SHA1 ccaf53a8d019fd8ebbf199ae503d9d5e0fb267c8
SHA512 7ecaa1900fd4676e6d1c0637bc9e9a9c54653420636b46e8b9ec142ab425718693dbe62195b141eaeba278c348d24fe537fc6977bd1b873b07a184d9debd8969
SSDEEP 24576:10ewsAj/+dicaamo0sCBxbtbNQ0jJ+9Ms5T:Olj/Y9aFTtbNQ014Ms
TLSH
T1FF15E031FA74E436C27F0DB61B36D716183D79204F511AC3E3A88A9E9A702D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a7c0e089a496efb6e28923fc19e287306f70063cfaadb37d0ca5ca6e1ddb640d
MD5 9523f5668ab2e4fb5e34b255a3ff80b6
SHA1 5b72ec84237aef0e4268660e78c1b0621ab5ff26
SHA512 ee5ff36fa1e97d5129b22899d6f25bc674aa8b7b132aa9edc82cbc1c544cf71b5e3a04eee6b5bea636264c1dd9c0710ea542e0fea14d9860edf915bd038de4c6
SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHiafs:4UEtQevvqc2W1cpV2tI32pfs
TLSH
T18D474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ebe008880ea444a7075980f9bad8d5a25b188a04cc8eec520ea437189794ab29
MD5 516e5865b1f36e5da486ffdb76dbfc0e
SHA1 69d88174aa2c294f29d29eea5a2af908882af2fe
SHA512 4194d968c0ac2b5506e7234fff33bcaba6d2a01c7371423320502864dcb71197e7b4ffd629f7a5a5778ce111fd8d41b6973566872d860a7c8dc196cbea2b48e0
SSDEEP 49152:jCbRquA/m2yL5zLfFiV+XenmE3/zfY9aFTtbNQ014Ms:coq2VjnmXaFxq0CM
TLSH
T10AD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f9798ad94f684d5a7881668edc2040e998f43661791ddbbe75c58712e5c71a9c
MD5 389c8dbd7690258b9537f59684b24cfd
SHA1 98ef8c12c63350113fb5ea16fcc4903ffc199510
SHA512 4c9257ad44c0e62e55a269d71510c9f83123b6494de3597d7b1f337de0b5bf5f0467c59f8eec36ed5fe7ed87789eacd44484fe2374d910d849b3a0153cd2e369
SSDEEP 24576:nAhGL3IFoiwtA5l7S53s+dicaamo0sCBxbtbNQ0jJ+9Ms5Tx:nAMUFoiq58Y9aFTtbNQ014MsP
TLSH
T14E35AD81E7F955D4F5B39A7899B69171EA76BCA95E31C20F2160C21F0E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 8ca0c2e4844f5077bd33ff59de2a3b1d1aa471b23a45d80e15f9fa498ded254f
MD5 73c8cd8d3eb09309831d740277ec9d45
SHA1 5379901324c6b7526adc6cc66b3c1240f7bec478
SHA512 86be754222b65537af3e470e37f82c585dbd404775d6d16c2f9c4536dd665dc8b8fa71cb351606a29bf9682c32f1ff385e49719aee2150cb9d35faf1097a6f53
SSDEEP 24576:Awu4OWb+dicaamo0sCBxbtbNQ0jJ+9Ms5T:AwvOYY9aFTtbNQ014Ms
TLSH
T16405F14673A85CF9E96782388597D536EBB3B8112A21D72F0360C75B5F333616D2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 e271a0140164f5e7a341cefd1ac84cb5350cb3432f65a13ba8e730c0935b06fb
MD5 bfad1fc88dc9f6165e682f82a7b687f0
SHA1 15ef5ceeae0aab4e6ceb50395f16ec9ffce23f73
SHA512 c6f8d24fb91fbe791125832a52952fa4bc3f0d9f57ea9d8c05d154afd662ce64251071dfc9034db8042890858a7aa53ab68b4a541cce673aecf8c5a156911a2b
SSDEEP 12288:8eZ1IyyYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:lZum+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T187E4129623D8B0B9E16B823CC8F26746DB327465277253DF062483965F73BC61D39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0813b51d5bec6d6c7df810efb46672a0ef082519ca4c9e044d858f5f503fe3c9
MD5 08422edcefd5c021a3d1ccdfde433f82
SHA1 45edacca7ba91e948c66e62590ed3a52176368c1
SHA512 7e8f2b5179adcd6a4b1b26a686ca2080e9c4ddb75ba8b22a05673ab46047365e40a1c3d6a90cd69b7c9ce0db6966dc05ce09c163f84cd534e99ca67bfa1d8ea6
SSDEEP 98304:AQRQyi36YOcPbLvw2gAf+PN3QaFxq0CM:XQyiKa/X+PNgafs
TLSH
T12E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e7c1e394b794904a9cdcf32a1aca507b22c4b250b0e662b60dd02a74b02b4f4e
MD5 97159e0c306e151e7be15b97515d3dd3
SHA1 a63dc643eab3effa1e920dcd591779e14027f55b
SHA512 b468949477b139e5949a64eef812c3f029705bb3be1df5e0b4d01cd39f5203fc84a7531343f5bb4de5d96e8034d274bb59c64273f1c0b352279e5792fa5840af
SSDEEP 98304:fQRQyi36YOcPbLvw2gAf+PN3QaFxq0CM:uQyiKa/X+PNgafs
TLSH
T178667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 96c7f072702bd8a84f2498cccf56aabcb38ae56984d39c8facb03df89d74f8eb
MD5 828c873bda442c56bb74851fd2ee6182
SHA1 5e420e793107e6bbeaa791a664cf600577014e5f
SHA512 a3afe653d09a8e1677842277da5683c9aaabe7b42969fa047ab44ff9b9e00b4b270cc725d91cf533bccfbef0c40e3b2e9cddc264ac2322d6eeb11503eb8a96ce
SSDEEP 49152:N68Qg55nhceWu7PNU3/PY9aFTtbNQ014Ms:LthLRc/6aFxq0CM
TLSH
T10FB55933B2F600A9C44DD1769F4A972196E27C758FE0E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ace60feacadc3e3502347034e1221c3ba72e181cfb0536a71683498a24927cbd
MD5 30e91923574dce31f14164ee8ec8155d
SHA1 a6caf35891c01da8edc23b00aecea7319c266b49
SHA512 d41090ce89f19f523aef07a3f5b2478850234703f7e80fbd4fc4dbb679838d0098df2a532756b5f22196068589438be112807da7ee2fbbb2a93fea98157d6cf1
SSDEEP 98304:Fy5112gYy5azzVvt69nLKnhZhaFxq0CM:oLIHEWhvafs
TLSH
T19F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cff71664327dc543751dbd9830204a30aa8d4ff716c79f3aad3400e94d9750ea
MD5 600988dc207cfd15671f613a716e8b3a
SHA1 522a14a6d3aacb2b818d6772038918b3bc1c1ec5
SHA512 786c3ce92dfaa9c1881ebb9e0ade45cf60bfba4ff219d811c2c1bd1d665f4dc3f05f7f7953d8a69e5176a2ef1fdcbf805262cf35d1f6b6fe18df319d5bf60915
SSDEEP 49152:wB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glKY9aFTtbNQ014Ms:qu6Jmdxd2dJaFxq0CM
TLSH
T100D59D13F1DA01E8D06ED178974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7c018bc1769450b31dda19cfe025635823411425f69852bf3fdddd57a42c7c38
MD5 5bd1bef47cfcdd1aabe2e8ad7d51b8d0
SHA1 dc05eb4f5858b8925d9a70c516cdc27566904dc9
SHA512 1e180b5d0fe22fc43841fa25839de4ae80f0f4bbf2d36f9ceb46c3fcbb372633d4547ba075e7b91300b28d4ed03708e73075326316bff652ab5bdca578046da4
SSDEEP 49152:51hpsNoJpF1A63U44CwH7R4xFY9aFTtbNQ014Ms:5mifPWRXaFxq0CM
TLSH
T18FB5BE13F2D900E8D06EC17887569632EA62BC460B24B6DF0A90B7961F7BBE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f07120c65795608906f04e640f13497d93e6f5af08eeade2e68a5dc66565ca8a
MD5 88795bfda07cfc6d78fd7cd6e3866989
SHA1 7404a8ef55af36469f85d6e9e0e6cdd0540e49bf
SHA512 632d2f94b4916c45a346df37375a6d069cdbf07c36be02cb40900117a42bcac8888daba6a283ea67db2933e605f788d44da72d207e55789ff2ef66c9e6acb2e2
SSDEEP 49152:7SuZQIY0Be2KcRVtOnks6NMHqmY9aFTtbNQ014Ms:p5dKii61taFxq0CM
TLSH
T1C2C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 308b26c7d66d07c0f0395db49207d0656fa1f2062b2fcab2668d52a879dcf73a
MD5 8033291eff7b6886ade566e685f3a581
SHA1 5f85523d136770c2b72c2b6444b94d7f46c23f82
SHA512 3d3e9fbe1e3d3a1a370c8c26046db173a4161dff9aab31e1383f72483e13a9069d9c5baafa08edfe77cc002ca4fa48a7e3dfdf9f75a8bd60282a43572e6ac4d4
SSDEEP 49152:qhtSn8EApI0fig3giDn0AP5w5Y9aFTtbNQ014Ms:LX2imphraFxq0CM
TLSH
T18095BE13F2D900E8D06EC178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 096919b63678bb66f88f95d823ea30f14dc041eca5803f0723120b951df0bc99
MD5 475e32f23918e3d647aa658ab7d3baff
SHA1 94bf7b0839b92ae49fe5ff302125961bca4f8217
SHA512 e7422f59aa79eed4aefe0efe97c5a12efca352ef151319ddbd6ca3a41d6c89624874382277c97ed52666761a5390d3dda9dfa0aaf90857a3fac132b37e3b3315
SSDEEP 12288:FBYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:FK+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T1E5C42397878DD93AF02EC17484E7BB874C3A54687C86613E462DD342CBB37DA1D4AC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 9022c9538f170fcdbdf360e1137828e22a2f8c5b75c45a0fc40715a05eb2e442
MD5 6af936158ec86f33f528a73654b866e5
SHA1 e374af018cfbc306d84ff1862b0b39e8ba15ceb9
SHA512 27d9759100bdd6d36d661bacf77770011656854fc8f9d2e5fd7049363ca427123b433970fa861b9c6210746b9f6627a77e6e6289df16a2377bb0b170cae6e016
SSDEEP 12288:XeYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:XT+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T1CBC42393878DD93BF02EC17484A7BB874C3A54687C86A13E462DD342CBB37DA1D4AC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 3f35af4aaacd54773f48ebb42429ff301ad7b93722a5eba5e61d6f26e1db7a7b
MD5 10ba9e10146e623afd93ba40ff49ac7b
SHA1 326f1f9c0cd19e4293fa2243d0cc9529d1ca06f2
SHA512 4a451d9bbdf3d040d2c9cd60b006cebf549aafd66affdf201e9d52ed110be21e3b438de9b22cf9469b434efba65959d91d7b308f4deecb201e4ad3f1fd0f407c
SSDEEP 12288:7oYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:7N+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T1C0C42397878DD93BF02EC17484A7BB874C3A44697C86A13E462DD241CBB37DA1D4AC86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 18c8b35ed44cd488b21b37862df7eb0c3d22b8c33db4650958d9e7fc027fc1dd
MD5 49a75b09dc77be615ab319762b5072d3
SHA1 d0dac10107db08767e41fda2d2530f235dfb561a
SHA512 be846d76be46b15b90878a37312ece8084dbd532070c45d44aa90d00f4ebf161da15b8dcfe90427ce0ba8b4df06b00f16680043247590274b7b318f9398dec64
SSDEEP 12288:3VzYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:K+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T1DCD42393478DD4A6F02FC278C8B3B7439D3A78687952A27F471486468FB33D92D29D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 40594826ff2806efaabc4ef769f2465184f743ae58c05240b2fe6999aa2e2a5b
MD5 f2e34885a5cdb51b51df23a716a10bf8
SHA1 3f1d54781ba7309b31ba2e61b0f29872150fa722
SHA512 f8947d73fa497e6cdb0d43ce80e2c5169de9a0646021d7dd00f43bcd288640b5ac228ebbd9e66155431b9dff51667fee6189e680e2048134a7e63e00e2640afa
SSDEEP 12288:ErYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:Ek+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T1C2C42393878DD93AF01EC17484A7BB874C3A446C7C86A17E462DD341CBB37DA1E4AC86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 d563b2811164182d5ec5fc6c35d9efd9a90eed28ca6e224359580e2189481bf4
MD5 6e3181be4ced7df08c9a57d41e58c4b8
SHA1 be6c72d164a6c351740610b98c1c7e220ee26af3
SHA512 98e14eddfca04827116c87c1dd4ea333c5a46ef2f50ff2d198360be98e8ff97e9b278e4f155ea3553531a95fc9adab2f6fd86dcd14d717765d76681210f2665f
SSDEEP 12288:OKYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:OH+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T1B0C42393878DD93BF02EC17484A7BB874C3A54697C86A13E462DD342CBB37DA1D4AC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 68ec1cfa9952141fa9ef1b8848a1f2e497e46a150b18cd4b2977fda052431d30
MD5 d4f3f3d2435853002cbfd4b476ac8d22
SHA1 b8c1efaa1ff9b732245f97d34363c9823c76c1ad
SHA512 e58a23d87eca7fa64423fc7b75794fea49c3d2a97d7c038bed08141d86014f2b6552da8d2bfa2e3dd6d100bef3994c3c96bf46164fcfe121824ea967ffef04e0
SSDEEP 12288:RWYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:Rr+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T1E5C423978789D93BF02EC17484A7BB874C3A546C7C86A13E462DC342CBB77DA1D4AC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 b3dde8045cdee84f878f1f93bc238c24e466d64d6bf030ca910e1f3c50fa6aff
MD5 eda43c35f0c169710c600b2de60b7583
SHA1 fe17c0ae2aeccc5d606169e246da7e0bf6e50dd4
SHA512 bfc913385afe0ba81ce205bfa977f74932894d3ccb6b745674942796c6bc88fb61fb0057bb0e1c117d2964cd8ce0d6389b8f2d8f9f0c60c3e4ba585e3c54a5c4
SSDEEP 24576:wZMRzFVSOz+dicaamo0sCBxbtbNQ0jJ+9Ms5T:wZMRzf3Y9aFTtbNQ014Ms
TLSH
T1B1050295B3905CF8EC67813ECC669906DAB27C191A60C61F03B836675F333A11D2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 24289293c4dc1bd9ce2a04ec28968d1a03e9dd3e1b352af8b3b3505cde40edf6
MD5 b6a2acd35fbab5a66e54d65608adcb74
SHA1 fe210fd971191f4e31ff2bc31493172ed2189365
SHA512 41a27b25e33130e3387022812e10c55aba3610d56470821a2508abf2d96f40ceede51ac10d25c5c6cad7e8b5e787d10b1da7d0337f061c2684f9eeab74c684e5
SSDEEP 12288:plYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:pW+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T15EC423978789D93AF02EC17884A7BB874C3E446C7C86A13E462DD341CBB77DA1D4AC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 b9eb24b16183b45472e226416e3dc830853458f0c260c7db3d16edb3056182b2
MD5 ca5a4bfa4e433d0300b195abd544011f
SHA1 e3893f389f8be2cc5c68c3aaa881e789eecd3e89
SHA512 8a99085f41d9a97ab7ecd0c239a2b0a907ba9316a6940c83f5c316fff5dbaf2f1db9752e84f1a76dbb916bad6ac9af810dd097f05e387ca8048887b05bcad388
SSDEEP 12288:3JYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:3S+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T11EC423978789D93AF02EC17484A7BB874C3E546C7C86A13E462DC342CBB77DA1D4AC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 4bb66ac98902d62ef978f08e2c2920473907e669765fae3cc08fff8a9e0f5338
MD5 ed0d4245f83c5605f82a4825d60878b6
SHA1 21dcdedd746893aac2cfa49fcfa06791fc2ca008
SHA512 6afdd69e4ed39da6869f4d34d6eef97d43cbbc6e628abf3c19929dc1ef86452c12e75c6a415aef4261aaf9b892c2c62d7c977e26224aaf6fb5207c423ecabb07
SSDEEP 12288:5yPz5L8yYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:4zyv+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T129F4024763A570F9E03B8238C8A22A42EB3678351B509AAF036447765F737D15E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 9ddc365d9e687414a46cdeef62f5279a8dc845cb13db6c2621d8b1b6c5e3ff05
MD5 ece4ea6c4dd2c900efd83aa4d225a5ce
SHA1 bda3deb951205d60df1b7e5ecb915b57870c69b6
SHA512 1a7b65695ccbb7051d0e85326502c4721dc400c157dee537a5f3290c7602899dcef93b8168a836b99b824660e800a369953db17e1aa87be1e7ac7437babe5826
SSDEEP 12288:OlYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:OW+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T150C423978789D93AF02EC17884A7BB874C3E446C7C86A17E462DD341CBB37DA1D4AC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 5cf9ec641a4a8590382e3cd390668769adf07cdaeea727ac5015ce5a6f8bc69d
MD5 758b892be6ca73f3dd515e929c2eef9f
SHA1 c753e1c5696134d514aa6c0058376b1a7edfe05d
SHA512 3d2c19140f5ec841aa3300b071ecfb6aa99aec192971db46784d8111a46d4a57d73f6e7f30efdafab3e0daeeb41d556b0d924fbb5837b074956bcb7b47199421
SSDEEP 12288:wlYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:wW+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T1DEC423978789D93AF02EC17884A7BB874C3E446C7C86A17E462DD341CBB37DA1D4AC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 272b760d25394994c0b7b903a9c6f6c358b09867cac0452fbc39c3bc3dfb4f4a
MD5 db1580d2a1ac61afaf8e41d9f2960f17
SHA1 a06b0ff4a5a6c4bc60524d00abb9cb1f1bf04d1c
SHA512 4ccef94cd15af0982719f60c42e09b19f44826607f21f14feb58b9a7bfcbafe2d2291d5780f49e8be2f95c507c0947f3af0f56c527c8ca6c2b1119a68f7ebc57
SSDEEP 12288:AyPz5L8yYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:xzyv+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T1C1F4024763A570F9E03B8238C8A22A42EB3678351B509AAF036447765F737D15E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 c140130e778314ab3b9a2a9930b645b9557d41cfe3c745c13cb432d269960675
MD5 28f17265e7098d52cb2b56ae058c6ab0
SHA1 4718fada494d351681ee62544fbdfc8fa58e980e
SHA512 508a508b2d78b85a3b470285ec648a776bdf9a9452b764363850cd40c3ae8564e35ea53a1841270edc38c93b2423dc61057d48e81d96b350f41ac6bf1dd50afd
SSDEEP 24576:6TDaLl3z0zDd+dicaamo0sCBxbtbNQ0jJ+9Ms5T:6TuLljwY9aFTtbNQ014Ms
TLSH
T1E7050295B3905CF8EC67813ECC669906D6B27C691A60C61F03B836674F333A11D2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 c2cc931af8d7374986ecb29fe9b6950475592fe1ac7ee02669e7c00eab0f0f3d
MD5 fd8930ae44e2538fc12dec58f3e31606
SHA1 dcd3e5699ff1e0876309e8f3d99e33c2a381d943
SHA512 969bdbadc9d06119217200c8b085f658c3ac64499c05ddbfb47d9a822d3ce817fc7f3f1c87b1baf34bc769f878ce0b8a9954552b98ab30c29120902e498f3419
SSDEEP 24576:A3vd9CHKy7GZh+dicaamo0sCBxbtbNQ0jJ+9Ms5T:Kvd9CHKya3Y9aFTtbNQ014Ms
TLSH
T11325CF90F3E814E8F0B7CA35C9765512DA767C591B21DA8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 7c7c03fbb14b34b987b8194383ee009a30235c26214949352607b24476e6202d
MD5 2bcfd33e89234a60fbe901e22c576af2
SHA1 73731a51ce7b9083a0056f6e0ab734b88283501e
SHA512 5084bda8b96d54e6ed960d74aca684932a4a3ba305cea9a98e0a7bef8fec9d246e018e2a9a79c2c4dd484beda2e8555a2544286ac9d82059e1652f632b7d03b6
SSDEEP 12288:bIYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:bt+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T16FC42393878DD93BF01EC17484A7BB874C3A44697C86A13E462DD341CBB77DA1D4AC86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 b25cc9324f2d94ee154b3a8c80fc337ffd4ea534e703a4ff67afd05bf84cc223
MD5 dd2bbc2b44007dcdf924228ccc22539a
SHA1 7d2d30f914098962abf346e5ad8b36723112dbb8
SHA512 284df3a45bad2e1d633a39b0ea42a6c0f83d79aa7759d624e4ec5ef5166247ade0fcdb71c48a4877ff7075b2c06d1af4dbd404b63cf4810b7435385093ffacb7
SSDEEP 12288:VSYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:VP+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T195C423978789D93BF02EC17484E7BB834C3A54687C86A13E472DD242CBB77DA1D4AC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 bdd87f1a48b7d7ca10fd7d808dc7909397eeb478a32c87a420b8938251e2993d
MD5 96ac6685fa1c2deb575540ce5c556ab8
SHA1 f8dabab9d8b88be3dc7e0ec96a13d7de49fefb0c
SHA512 b029d75d31b5b938f67270fe50c2e7c9b222cf71ffe4a35708aa140a055254002451f9347ccdbd5b8ef107da35256142faee7ce4f19a86c39d1da2fb0126f076
SSDEEP 12288:wXYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:wo+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T1A9C42393878DD93AF02EC17884A7BB874C3A546C7C86A13E462DD341CBB77DA1D4AC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 41ba172065393c20a94d6ddbcf24690f5bddb9a8633f228b4c107b888e29b3ec
MD5 db125ca9ee80cea247ba99b69441bb56
SHA1 6c53bbf4ead6fe966c309efc3e99c428999f5456
SHA512 aaff6c4a4cb0253ecba5188d8f96a19d704c57404ced009325511c0dc318447f864cd3703028c03f85fa152b78f11b228ef92f6fa4540181058726ac5d3fdb65
SSDEEP 12288:flYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:fW+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T10DC423978789D93AF02EC17884A7BB874C3A446C7C82A13E462DD341CBB77DE1D4AC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 e30afd6097de5ef6309fb29f5d72313e43a7cb1a0f698f686c5e23c67a69f7c7
MD5 50b84e30594d2e4f6119134741b88a18
SHA1 26612ad6dfffd660f7798f216897c4817d168c30
SHA512 353e03b47f4947e474ee4d510d7c01d2640ed82fa9fb5fc9ff774d6055f10aed2324ad06338b2277615af05766f46ac6540b7854766d483479d63c1cdb9da154
SSDEEP 12288:PIYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:Pt+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T1D2C42393878DD93BF02EC17484A7BB874C3A44697C86A13E462DD341CBB77DA1D4AC86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 a10dce8ff8f2a95d8cf8bfddfd5074b63bdd6fb9ace1801e3c34ad98807daae9
MD5 8fd5ec4f1242cd2e09516d04f0cb0736
SHA1 02892d6ebe83ee64641145cbcd7ef20e160d404a
SHA512 3062a7015af145a607fae2ce57a287d8daaa2a9281b53e822455c377676525b2dad9aeab2ea41ace8340a700e9dfd07e460409e08a7c78e22c50797cf9243cff
SSDEEP 12288:T9YLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:TO+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T195C423978789D93AF02EC17484E7BB834C3E44687C86A17E462DD342CBB77DA1D4AC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 91147036b0fbe41451107495981fe22190c2a020f0d1769fa152262cb5ff3d6d
MD5 7dd446db22700354ae8759c2e22bb06d
SHA1 5c97367eaddf5fac9dc93bfae1d950207497b337
SHA512 aa99fc11d24dfc9658b08fdf4c7e6a9bed0bb006f9781212e263871272881bac068eaac0c7856e46e14b75795c3000e00114b5f5b65e0d790eadd480f957d9f4
SSDEEP 12288:urYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:uk+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T1F4C42393878DD93BF02EC17484A7BB874C3A44697C86A13E462DD341CBB77DA1D4AC86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 8e143ed529326b0fd39a9dc33c63b45b93f800de7a7838c77b2d9fd7c96fface
MD5 c83ae9c811e229a1d9b10f20d966fb4f
SHA1 08604f7029c4aed59862a0b42b1327bee9603d10
SHA512 8945ed12d5339ee46b6126e4b9e6f0cecab3d986dd800ec63b562a59e9d74e9b7bb5c277c16fc2195871af52944354ca9fff62938e08435370eb99065972ef66
SSDEEP 24576:AfwvUk9RX6wkyAIC+dicaamo0sCBxbtbNQ0jJ+9Ms5T:0MnYICY9aFTtbNQ014Ms
TLSH
T10235D029EBDC44E5E177823C89B7460AF6B178691B31C2CF025A53AD0E37ED45E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 df9568c7123881bf2c9920942b683d0637cda0efa41e3af80dec8410895ff371
MD5 ca599beb54b1f33fc237d58701ee415a
SHA1 da57b82a5b27960cbb347f75668ac2ace4a4888c
SHA512 f0c4df3cd4a9699754be508bed5a2c798c764703a8d88128bd39c2913e99a9779b647bfeb921cd3d88064490af359e86b3a94a1e7458b007253b41d2612aceee
SSDEEP 49152:hYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ZY9aFTtbNQ01+:sySzPwaFxq0CM
TLSH
T179067C96A1A841D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0d12196bd7f39f7a2a40983c982d58f622b186794f2a565a90f0688761b52f2c
MD5 3590489f7266d5339b90292b8a2fa0ba
SHA1 c1b3138b0613c781c577d2633cf3652489f02bbb
SHA512 1e378e4a2ea57c6a10c653275bc9f28a451d4cdafc55c5fa5678c6c8363d61b90c848c95a7f57062682d98d343c0aa8d48b83ae94934f9dd1587fd887b5dc006
SSDEEP 24576:f47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYj+dicaamo0sCBxbtbNQ0jJ+9Ms5T:f47JUQjTirIhCnDHUPfF/JY9aFTtbNQX
TLSH
T15065AD1EA3EC01E5E1BA827885159A5AEA71742D2F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 c9a80bc094f040a8b7a5d373c91cc320aec538eba0a0b77fe187167007161376
MD5 785d268f187264ffdf0a4a206a8fbf0f
SHA1 c10e310be41e4673e908601a2a0aba9cdefea314
SHA512 93ac7a7c93cb48a247ea4c5cc301aa408f2a6caf6251e5a66263d8f209446a012c02bec8502522cead1c4a593533313cdb15fa94518f66d54a8c892d657f64c8
SSDEEP 12288:lbsfVYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:Am+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T1E1E4015AC28842E9D06E8239C7965A41BB373C2497E1D3CB53D0F63E0F766D45DEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 e6f4950c676bc92a556d9ca8b4f5be1be2dc784f236a9ece5aed661b6615022b
MD5 a87494d05eae6ea3f0173a8a20b4c0ca
SHA1 061a407d1f5636c90574dcf265fe624e46c44886
SHA512 f46be12ef9c04c6556ee9dac7cc51fa10fc283ba3f3f390650da4ff5c5ce98936c18f739d63943485c32d0726c76a51b1547f7c2c1c2f2e1d1b8cc1a9d9d6095
SSDEEP 24576:orTQatUPEWvcFARimc6O9RdDY9N1tURmUkf7QgTM:+tUsWvcFARimczRmNzUAJf7QgTM
TLSH
T1154517007626DB8BC6A944325E36D6CCA7707D02EE046F0773C9973FD476659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 393c7aa0865c4bbbe5cbc2cc8ae0ca5a6e126214ee4a8b5b8e76df00b62ef991
MD5 61b56aea3c771ead559726a80a77b479
SHA1 0d94eaee04571b6dabc2c969159750d4af111e08
SHA512 241881e4cb057bcd38e177039a6fc4aa3a6f4e8e5dfc93576ee5082ef5541f3f89a565c2f2c7564ff0ba5ffd7c9c2d8a1fa0a8c22faf6fd889d353f4266ca093
SSDEEP 3:OlH/lIxa2M4kglVY2au7XLl3y8jK63mCllltGlslslslslslsl62:Kaxa5gVQu7hVKcmCtEEEEEEEP
TLSH
T15F81922E0B004759C999F0714C28834D0369C182A9C1CBEB631870A28C503AA4D11B28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 a4272ad0604a08ef832d5b46c50e9fbe5cd8af69d628311343043b2b6548223a
MD5 0a5a5310aaedfc8716606a767c5a3a03
SHA1 ac4c23a0f651969bd7595f9d549feb6fc212dd96
SHA512 476d4ca142946fd56f2f0f2e24d830656e9b0f3104add4bd919e11f0911be3da4b26e3b60fe8ad5a6dcf7e8c8a1c4ae657dd9209843cc100640512fc983c4868
SSDEEP 24576:/cFARimcWnBSYO6LEMd5EWsSvXfcFARimcHVcFARimchcFARimc26rRAa:/cFARimc+bOK5EWsscFARimcHVcFARiO
TLSH
T1BD55080095B7EB4FC87A94370732868D7B785C03FB452F056349893C986BA6FB5E6392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 df1431acc58fc98a7f691ca2a7fa3c4925f119c9c314be80e224ae258b067ff4
MD5 dca44118e46d8ba82665fa070b7f3f83
SHA1 b68b19afb42219d6f360cb60f24bf560c79d3ea8
SHA512 c0b38e9231745998ae4d78d4eef8d6e88cff8ffc208781d58b05bc2ef682105ed1a5c3489349003aa84cbf36d5c86454d339699c568c29dcfbf55b65a964c504
SSDEEP 12288:0F7tYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:Ie+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T185D42393838DD92AF03E827484ABB7521C3F64787F41A1EB9518D386CB727D91D6AC07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 869b33d347f49f92fb5717cb89e3b3c4b64ed000a35efe41f37bbdd604cd3866
MD5 80536a596f5240ab273863d30bee43ca
SHA1 35ff9fd5d9db32043e30be0e1328c434b4f8c89a
SHA512 71234b60e8d1fe72b101d0a6ba7279977b0745310b1246a93602f88114ff461e5f659ec9347b50f12327cbdfd6215e84da3996565e46a4440a2263cb031b5cb8
SSDEEP 24576:ggb6bmBIi49WNNFpg1rSvFv7bYw+dicaamo0sCBxbtbNQ0jJ+9Ms5T:ggb4mBIBhGFjY9aFTtbNQ014Ms
TLSH
T1BD65AE1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 8f96a40e63cbddc476f419d815e29f7a4505918e6a501b92f79a8ff89ef35f58
MD5 9725e08420acdd031e78aacaeea5b4c6
SHA1 1ed2291e15ca2be58b9d519c3304e5bfeb784fee
SHA512 5597c684c7ef9cb8c07c7ccf690bff44187419bd50ae9eccbef0b0d9919957506d08f7ec56d38e6a2adcee4664fadf54b16545b6a5e34bc6df847b67a6e8d8e2
SSDEEP 24576:JG88u8FpJqH1bzria7/mz+dicaamo0sCBxbtbNQ0jJ+9Ms5T:c7ZFPqVea7/IY9aFTtbNQ014Ms
TLSH
T1F735F16567E501F1D47BC13889824663FAB2B4251364EBEF07AC8B511F23AE50B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bbe95d6b1995d8f4d50c2592a13b31def92d084f7b6ab2b504cdf00ef7741029
MD5 5cf93f5b934322574465ed13fb501bcc
SHA1 6a3215363cc56f64f9e20c93b23f41a540a06e7f
SHA512 86d8fcb14624502ddcb5d25affac27d28a72d3f82d1bb81e1baea778c0edf2e4b158989ebe58ab02775719e7243ee8db8faca4e6366d96884efac810063f8054
SSDEEP 49152:KBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjHY9aFTtbNQ014Ms:1G05lO43b5aFxq0CM
TLSH
T1D2D5BF6E62EC11F9D1BBC17CD9C64A0BEBB23425032556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8e6487ccec7c99ee631436716c03a98e9f73bf239fa4e131e273fee165f39d06
MD5 edb525e2a2cd675588b4aa89adcaf137
SHA1 2003756ea7f2739698fccadae60661f647ef1d0a
SHA512 c99e5962c36be6ee6addc7add6401fcf571b07038803602c6020c8fc53985d2e9478a39792060f434a104e9589e0373138cf3f46ac33fc27eaf874932c7246ff
SSDEEP 24576:hfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnZ+dicaamo0sCBxbtbNQ0jJ+9Ms5T:ha5POZ3BJt2pasx2+mPY9aFTtbNQ0147
TLSH
T1CD65AF5EA7EC01D5E179D17DC583861AE5B1342553329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3ff25b588f574731ab242da88d86ed41d095321305c849bb95a442264530520a
MD5 b655d6d664f9cd66a4d2d6d7ad3b05dc
SHA1 581b34a44ebd4eab9f1b7f11cf90f0c3fb310cac
SHA512 6c4d0f73dc0ed8d5872e49649ae3135633c9c5f114b5ef67df55ca1ca431859edd231feecc44a5c4dec02569cb1d12b73499f8cef2dfb7733dbb9837715dd4ac
SSDEEP 24576:mNcwHdjbyQ4nLC18lb/EOjowL7Fk7+dicaamo0sCBxbtbNQ0jJ+9Ms5T:mNc/zEOVHFoY9aFTtbNQ014Ms
TLSH
T1EF857B5623E901E4F1BBE1BE89779646FA717869173086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 416eba14b77f48cbe0aa5b5cd45d2f68f5773791ab02a65aa3c314aca7114932
MD5 be2bff499a30db8edf2b8720ed5fb160
SHA1 655f1b2a8a3a4b059e02e0ebeed8f73d7a35f3be
SHA512 220103dd3a4228b33d2b1f062753ba9ea46b7fb56cc3dc9064e46f102e0ccbf8d2ce3f4ada8f1a125314f773b4e54f7f5fc7d904941d34f1b2a346954af61e95
SSDEEP 24576:tTkNvNnaFeYhJNtmZBm++dicaamo0sCBxbtbNQ0jJ+9Ms5T:tTMwBtOm+Y9aFTtbNQ014Ms
TLSH
T1C355AF6EA6F846E4D1FEC6B4CD238512EA727461173293CB4290C13F4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 b18df91b7727195530fe3049f6b75dde51dda6c7c997f4ceebe8ca7018a1d899
MD5 eb2e42b81af81d6769b72e83d71824e0
SHA1 0503c0cbb9c3bd0c70ca57ad0ae55e418c9ea915
SHA512 3014d61789202a83923ddd71b33d8559a27609257b31787c879021a0f85cbf2a7e9aa3c2984bc632ab6ad08404ba4ee5c645821003e1d1f8b66534c2de6c8d26
SSDEEP 24576:sPUr+NQ3+dicaamo0sCBxbtbNQ0jJ+9Ms5T:sJQ3Y9aFTtbNQ014Ms
TLSH
T1B905E12F629C18E5E67AD17C89829709E77274621712D2DF02A0817E4F73EE87D3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 7150311a9be774d4abd983bc16669bb67158871b12923774b83aafb2e0b07422
MD5 599b6de83b97448bcd0ca0d606fa6c57
SHA1 4dd599621978b1aa195e7bd91c95b5461e1842cf
SHA512 1294b25e752c2f7aeae9495bfe9acd074aa37fb10ea5bbf80377f92a2c5ea143f4aa6a7bde635b4c74a0df9246476e68d290ecee37a09727f52374dcf0d26218
SSDEEP 24576:eD3FHshBIYQgAq+dicaamo0sCBxbtbNQ0jJ+9Ms5T:eDVHeBIAAqY9aFTtbNQ014Ms
TLSH
T10725E17EE79C04E4E47BC17CC6639A06E67138A9072265DB0294C1B65F6BEE43D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/108-28-0x0000000140000000-0x0000000140145000-memory.dmp

Download

memory/108-7-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/108-1-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/108-0-0x0000000140000000-0x0000000140145000-memory.dmp

Download

memory/108-8-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/108-25-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/712-135-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/712-129-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/712-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/712-137-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/712-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/864-82-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/864-313-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/864-81-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/864-87-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/884-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/884-318-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/884-111-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/884-105-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/884-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/884-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2964-77-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2964-312-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2964-69-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2964-71-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3004-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3004-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3004-152-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3004-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4112-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4112-308-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4112-58-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4112-65-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4412-15-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4412-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4412-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4412-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4628-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4628-144-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4628-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4628-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4628-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5300-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5300-98-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5300-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5300-332-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5300-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5300-92-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5860-54-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/5860-50-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/5860-44-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/5860-43-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5860-56-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5880-316-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5880-116-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5880-118-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/5880-124-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download