d5a9496c8174d3615da079d2385d81c319389cf479e245dc37fe709e5181d043

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 22:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_b4fb35c12767643233d10778d6f5f324_icedid.exe
Size 1.7MB
Sample260722-12rlrawbld
SHA256 d5a9496c8174d3615da079d2385d81c319389cf479e245dc37fe709e5181d043
MD5 b4fb35c12767643233d10778d6f5f324
SHA1 2fe7c126f55203824e6df6bb327f8927789cc6aa
SHA512 e008749c80df0697c6f045e6e58f0cdf813099791ed5420d86c7eac022b0a440d34c014637c149b58dde6875f6184a60ac457223ddf83a00f0489761702d4022
SSDEEP 49152:r3XiRYFiwKtZGtbOWXS9jilkKwsH8kRULYPQrYESz/38B+kn3Hnx:r3yRYFiwaWXUjiEsH8kUsEqo+k
TLSH
T18E85D00733A2C0E8DF6790F2C9395223D772780507389BDB65E0692DDFA7AA15B3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5736	elevation_service.exe
4948	elevation_service.exe
4224	maintenanceservice.exe
1268	OSE.EXE
5936	PerceptionSimulationService.exe
6060	perfhost.exe
3316	ReFsDedupSvc.exe
3568	SensorDataService.exe
6104	ssh-agent.exe
2608	AgentService.exe
5456	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4bb32f8983806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-22_b4fb35c12767643233d10778d6f5f324_icedid.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-22_b4fb35c12767643233d10778d6f5f324_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-22_b4fb35c12767643233d10778d6f5f324_icedid.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-22_b4fb35c12767643233d10778d6f5f324_icedid.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-22_b4fb35c12767643233d10778d6f5f324_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-22_b4fb35c12767643233d10778d6f5f324_icedid.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000723a7ec1261add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e6945c1261add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f0f624c2261add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7e480be261add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000acf68002271add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a0336c1261add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bbb84d02271add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c1c2fc1261add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5736	elevation_service.exe
5736	elevation_service.exe
5736	elevation_service.exe
5736	elevation_service.exe
5736	elevation_service.exe
5736	elevation_service.exe
5736	elevation_service.exe
4948	elevation_service.exe
4948	elevation_service.exe
4948	elevation_service.exe
4948	elevation_service.exe
4948	elevation_service.exe
4948	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4716	2026-07-22_b4fb35c12767643233d10778d6f5f324_icedid.exe
Token: SeTakeOwnershipPrivilege	5736	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	2608	AgentService.exe
Token: SeBackupPrivilege	3316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3316	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3316	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3316	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3316	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3316	ReFsDedupSvc.exe
Token: 33	5456	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5456	SearchIndexer.exe
Token: SeDebugPrivilege	5736	elevation_service.exe
Token: SeDebugPrivilege	4948	elevation_service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4716	2026-07-22_b4fb35c12767643233d10778d6f5f324_icedid.exe
4716	2026-07-22_b4fb35c12767643233d10778d6f5f324_icedid.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4716	2026-07-22_b4fb35c12767643233d10778d6f5f324_icedid.exe
4716	2026-07-22_b4fb35c12767643233d10778d6f5f324_icedid.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5456 wrote to memory of 2968	5456	SearchIndexer.exe	100
PID 5456 wrote to memory of 1728	5456	SearchIndexer.exe	101
PID 5456 wrote to memory of 1928	5456	SearchIndexer.exe	102
PID 5456 wrote to memory of 4760	5456	SearchIndexer.exe	103
PID 5456 wrote to memory of 4384	5456	SearchIndexer.exe	105
PID 5456 wrote to memory of 1896	5456	SearchIndexer.exe	106
PID 5456 wrote to memory of 1484	5456	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-22_b4fb35c12767643233d10778d6f5f324_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_b4fb35c12767643233d10778d6f5f324_icedid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5736

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4948

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4224

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1268

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5936

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:6060

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3568

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6104

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5456
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1728
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1928
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4760
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4384
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1896
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cca5d3c82440d1aed8763f479c757897b0823289e54d9e0146195443ccf3ef6a
MD5 0b14e3cff6f5d9c6fa61bb002f5da16b
SHA1 6ffa4f4d14d7d6ade4e8b6a53a5eea0277d972cb
SHA512 c5bd495274cbda37fa8b30ff1883e40a2c9df488f3ff2785b0cfd93f7e9e228c9e7c65c8432b033d320ed28de3eaef476fdfa85d1e8cbd72b2fbf3257e977037
SSDEEP 49152:Gb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnpB+kn3Hnx:43q6sjB8+k
TLSH
T1E6D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 b882b66aae74725c61f1fb6ce118cd656c6240d49244561400657ec2e8864e45
MD5 945a5c94b0ec71f526a01fbd3599265d
SHA1 d01b89576d4e62ce69017d5e36078716388deb17
SHA512 69bf4b39d05a7e2cb87f6b5e68b015350f77d5e3992f8b8a3020e3d5f342ba083bae9897a4638bb19d987107ddb16f07b5d878b75359064e01a9aacba1a718eb
SSDEEP 12288:l1XLsswWkxy2lRq2czAULDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:rXYfDtczALNyBo4kx929bL3Hnx
TLSH
T19565012967D409F9ED6B9278C8A2C511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 be4f308d6c7abd90b1b2ab8c3d28e7c7ecabc91ec4ef509a9ac0457c64bd56cd
MD5 e40d1fbe654ee8fb4f86dc49ddeb4d6c
SHA1 1cf5894f2aef7c42d992a81d681ed0eea4812c76
SHA512 59db6980517ecd51ef44e28485e42ba5cdc0b71341326909ef71420574a9229179d6b2021701fc99233c3e7fc8d0148f0f38700833e50745b74f16af7bc6d574
SSDEEP 12288:nXZNYVLeyUji0h90ZD0wxpGZIVuArHsdLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:J0Le5ji0hmxfrMCNyBo4kx929bL3Hnx
TLSH
T15C859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 eed211723bf9d785ec2cf61333dcf35ba57f4f205d45af982601d2b6ed8d5d10
MD5 edc13f746c550cc154f6576847fe449b
SHA1 3b009b8d9b7abac67b29500ced8b3de4650530bf
SHA512 9974cfc6e770cedfd7c29b5775c30423ac50c081f544059a18226bdd243c0ecde28d4b2b8ad82a954f3cc708795f98ec9159bd71dbdd42d257b52bf42f47f007
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWn6q8wyukNyBo4kx929bL3Hnx:G/ezSC6vUzPveHjyiB+kn3Hnx
TLSH
T125755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8f4dc077d41f1c9b7f9b86f8560d7c86a6a313747645c9f38599647d77a3e579
MD5 19c18381ee164be4b9be62c2c1dc1b07
SHA1 b46f5f116f618b75e2bd68287d79c73c64941416
SHA512 812be320d79c661d8ff7398112b4e4d2ec4a75b371ec19fd1aac40e45c948135ec4272aacbb597a7a04a4da78159afd8df97da82cb5267ce96f4a60f62b14432
SSDEEP 12288:wVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98ALDAptNyvUgXZ32dT4ePc7N29CD:wVbqPb88hv/l+Y/NyBo4kx929bL3Hnx
TLSH
T102559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2bd73293d2923ccf02696b676b40d199477dad0d8a9b89f59bedd7c5662dcd06
MD5 ffb9e7d9d780d499c4deacc99f2f7902
SHA1 47de441423fa44b4c37ba2d37df6be8f8527b6e9
SHA512 8aa13051603cb83639750aeb625db034c70d1e4ff99fd3e2b9c896d396ede19ae6466ecebc10840533936e50dc9c7e30f1457223f52270d068920365773ff752
SSDEEP 12288:wm5LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:wmmNyBo4kx929bL3Hnx
TLSH
T110452313470C627AFBBD3E70745E8454CC35BC8D0D95DB98DE62ACBB58BC9A2DA21103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 186b49b6a774094257fd7ec3afaa1172d1a1775ea6d03cc913b4253c0ac94e0b
MD5 5750de373ef13d3e7cd6c3f2afc5c923
SHA1 8327da69340b9388b94c39614d3d9fccb424ff54
SHA512 ff950731f286d5c807a870aaba6edb3b2e3ba0b3a43212c4185978c9d6e835441455dbdde5b8d218038aa368f946a99c1dbe7bb4d830d96efae04e97204d68fb
SSDEEP 12288:7eBNUbTVO86UYLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:7JIUHNyBo4kx929bL3Hnx
TLSH
T15165CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a6901197de3f46aad09a5cfd1b18584ad57c6d70866c4b8e2aee8298602f45a7
MD5 aabb6e351c58f6f37f8521d6375467db
SHA1 1c64a259b2434b86cefb336acda4f27675356955
SHA512 c1b1a7d3225ae7055731d47b61a2189a4b49b871a117d06e4c25e6027096d3c73e7250bf35c1ab571003627ac36a3f0e44b04caf8b81432d255bb6933b8cc77e
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THC:0QvGAdlCEL8c/DRNw5C5+k
TLSH
T115266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 6580cb2786c0cb9d697aef35cbe777f8eb27a964ea81c4d6e6605d6af61864a7
MD5 c3d7589b71098f892a3efa70b5234923
SHA1 05ba0df553104e006c1c8fd02ffa2e1c481237b0
SHA512 5cac29d51208ce9bbb9c20e45ce2dbfdb9aefa5077dee7d6448f3829a7debdb7b02cce09c563d6f95085ea2b57a2a77e5b456f450bad0e7cf5aef959e268296a
SSDEEP 12288:jAwSfxL/2Dc3XDLLmt0LDQewsAjCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:cOewsAjJNyBo4kx929bL3Hnx
TLSH
T17C75E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6c3c37267f1ffc4123cb797027dcf80bc6bdf2aa48cc22053efb366bfbcb91d3
MD5 5609c0474c0a67d44be2b1609581123b
SHA1 0c34ac74188ae4719b13689143a5a8e9148b9cf3
SHA512 122afed7f5237e89e0ce230b8785f062b992b37ddb01c17c8546e9620f0cb7ed471f25cf6131a74c6e2a36329764e72bb08a4ca445d921cec3f92f5186cf701e
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHm+k:WUEtQevvqc2W1cpV2tI32m
TLSH
T192474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5d280e8639d594bed7c4b9485c71f6d90980ffab7cbf3451926ff312f864bce2
MD5 24b8372968f3aca8178d818470a0ead9
SHA1 f54a96964f87f1fd0cd03ce3e23676a65b3cb4e4
SHA512 de369161ca8e3e60ea065b44cd233a36a65de99c3f6a27357c5d20770fbe9f8b7ed5ad7eff601f07ba9656ac4cefb38d80563ad5c09d68fed3053ec226c75021
SSDEEP 49152:bCbRquA/m2yL5zTfFiV+XenmE3/zOB+kn3Hnx:EoquVjnml+k
TLSH
T12BD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c3c107a6c792f1c64eb20c40c5423767d2fc0885196851632b7edb98c1652274
MD5 8ba1036a62aff2fb31ad43669b268a3a
SHA1 d65a2707030574edf9c2fbfbd70d96c241399eb1
SHA512 23f3c43aa22f4106b2daefb77a96b303a0eba2cbc9999d3cd916653b5a3f7ed26c5f61d179fadd4aabd8aa12523a3d5a848e24945d74d9476765fa9be4e3dc40
SSDEEP 24576:YAhGL3IFoiwtA5l7S53QNyBo4kx929bL3Hnx:YAMUFoiq5TB+kn3Hnx
TLSH
T154359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 c2109e5bd9c4906408c9de90f5de30b5f3e3cbce118b02a7d3a11b77fb87bf77
MD5 a2ab216072960250f0aad272edfa9df0
SHA1 e6a0ef5e94719e398719a7049943145349cf0de9
SHA512 9cd924d3b5853353764617dc7225c59149195e786fb6dc5acb11f7fc81be29c05786ce3dbb51e5b4cc7ef98e3bb082343df5ff385bc755856e255d7751490cd0
SSDEEP 12288:+mw5HEjsChNzBFgl0WDm+C/LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:Xwu6OWVNyBo4kx929bL3Hnx
TLSH
T14465F10677A81CF9F96756388587C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 17a5919150438c3e6acf20094b78e49776ddc8813d97f4d9df9f97dd04d091a9
MD5 f252926e77dca43bda58b9cfaf2904c0
SHA1 88bb67e3ccd9351baf7bc6e95645e1cc4f8a91e7
SHA512 45ccf7560fa714959c1c0deaeffd8d28290759a870fd62146639a06eff4c704d77b7ada74d732edde02c3f8feeabc6e126283e5df812490e688bde5b73550bc4
SSDEEP 12288:7gZ1IySLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:UZuqNyBo4kx929bL3Hnx
TLSH
T13F551216239831FAF2AB2678D8E58605CB32BC461B7183CF5A2145BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3f67c55a85e7a377995a0d7e01b6cc24d34f999ae2b5471e1116f21d331aeb8e
MD5 3b596c8ec78ff324dbec104cff7a18c6
SHA1 cd93d2213bbc7a71efeb0deb681764ea0a23fbd1
SHA512 6e10b800ee936c51376a0852dafd0425b0a9d7d3c5eda8c6d5baeee01d9a5201fb815dce2e26f848e982b6e802362e070383daac72f240bd10b6b72edee7e501
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UO:kQRQyi36YOcPbLvw2gAf+PN3A+k
TLSH
T19D666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3750edf0cd93239c4850334cd86bcebf5a8249e272232289f62fad462d4be0bb
MD5 84afd4b368838907fa6523c9093c707f
SHA1 3655dc3dfc73433466af6b2afba2d29fa5ec0d57
SHA512 45cbaeff5ca066490772be80963d37b380b131321a124842e1a5e7f31944cbf66d23886ae916314effade825affbb100c1d2ac0b39601a3b4128b1d3fb69b258
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UO:JQRQyi36YOcPbLvw2gAf+PN3A+k
TLSH
T1AF666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 804ecdaa19dc6cfd2d629de78f7266788228e21e99d2e380f9e5c7c041065cf5
MD5 f98e629a699bdb055679258613460c50
SHA1 8d216275c34ed372c3a2fef965de12daff1e9ddf
SHA512 de864dd440d3ee9f1f80b739b7cb0c121356bd41e5fe68aef1a8cb734cc9e540095f3f590900b1c3d27519fcc538418c9271a74c4ad7c1d14fbc84d5ccee8415
SSDEEP 24576:cwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL06NyBo4kx929bL3R:i68Qg55nhceWu7PNU3/eB+kn3Hnx
TLSH
T1E1B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 87cd33f8b50618cabf77bf7cd1cff8786300b25783c17449e12a23099c55ae75
MD5 ef91fd64ac6f6fa28cc36f21f3c289aa
SHA1 6d447be3006c7370acc6ccba6792ed066c5b3058
SHA512 32122bfa631a1169810e657613a3c6a1b8b1a5c785d1504edb8c23474758f40a92af44fb872a54b82117a25988d98ea64b49b0fc8c876fcd5fddd3f2cd0ec4bb
SSDEEP 49152:q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99Q:7y5112gYy5azzVvt69nLKnhZr+k
TLSH
T190167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 56795fea415312a55070fe53094a564c557ff571b6ca05115387e59df8c75b52
MD5 987a7a1a28e8dff75785b966729e8f59
SHA1 839dc716391cb1afe228bf2d334addda439a65de
SHA512 39d22cc76c00e4a79d23f7dbcfc8257f5b0653f22f7afac3125a4721ead870f4fdf291a0b24786a3b43e20b56e170d0beef4cf884dd150485a041912273eec7a
SSDEEP 49152:RB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glAB+kn3Hnx:Hu6Jmdxd2d8+k
TLSH
T1BED59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f039e8ff5037fa239454f4e8578ffaac3e3322171c71f01abb4d6189e7cfe287
MD5 071137da3081cc62a0904e1e29de2894
SHA1 0809244073195a5cde2645007c744caa25731680
SHA512 0abd445c1d9a79629e43a74a41956876fb1d69057ef22567b8d906c283a81a66e4904683b884e05028d0c572bf61af81bcc59d917617c94a3d9f6979cec1d819
SSDEEP 49152:u1hpsNoJpF1A63U44CwH7R4xIB+kn3Hnx:umifPWRl+k
TLSH
T1B5B5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8fb4bb18ab744e64b4855458feac0dca751383c991854948de74eb54be49a966
MD5 0bc8d8a1641034c8401b2c5cb782c4ea
SHA1 64343e382e6fe5b03791b4dd650b32e72c397002
SHA512 be6ef9f25645a0fc101a63f22d9274a92b4e7fc449f28b250156161e5215c73b2a7fda4cc4dee6d36f3ac76daa00a6e7114c67e50984cbae3de814b506ff4500
SSDEEP 49152:gSuZQIY0Be2KcRVtOnks6NMHq5B+kn3Hnx:65dKii61v+k
TLSH
T14CC5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e734bf442d5e429edefeb9608d18570eedb5b7b40decfddd5f0b4a0feed07928
MD5 0a0cdc388791719bb2bacb4277c47188
SHA1 feef6911105a3b3075005bdafdd7ac52028cd0c1
SHA512 8dd4fade8f6a947ddf395bee58b8d996a14d75836324452a61b850f26362e71fbd208c9758d790612fc32c4bd10c7bf665bd202fec12cb90d0e7dea0d27aed43
SSDEEP 49152:YhtSn8EApI0fig3giDn0AP5wEB+kn3Hnx:JX2imphR+k
TLSH
T1D795BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e489b2b49b18bfa1c058d18e3f2245ff38c0aa4065dbd5bf4dc49e15dbe36ee2
MD5 42539cd16c7189aa080ff8c052e7dbdd
SHA1 f87f7392645017a195a7d79259bcdf607c9dde22
SHA512 124c7ae132488cc456c8f87f95c91dee9b668c0f4a155ac0f2a8ec9d20c26bbc3af54c727eaf1b9dae3693e7a348fdac58383b9630dea5d8cd90486a44350409
SSDEEP 12288:+xLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:+ONyBo4kx929bL3Hnx
TLSH
T1294523125A0C627AF76D3FB0644A8598CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c7c9e0510d5f266c992178bad89c9e13c883d1dc3275b0637d5fa6cbdee44fe9
MD5 3033187ecc0f1bbeb93d3bbfb1ecbbc8
SHA1 296d92076e84222b3c2de33ad09188e392bf65e9
SHA512 10be5004d52630237847a5695eae3949703de22a003e3a1df4f6dcac327e27538a99362b0966fab2891c03768b07ce1d37cfd1ea1eb1062badab301ccba7d988
SSDEEP 12288:m+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:mNNyBo4kx929bL3Hnx
TLSH
T1E94523125A0C227AF76D3FB0644A8098CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 cdc84fb6da0d76375b791a6e25cafb386d2a2d970204ddb794be2204b2f388fc
MD5 0e6d7ab593640f2d1be96ab4ded9f3ce
SHA1 8906ae56220b6f44dea23e824fd5be089191a02d
SHA512 b905ba24d7ade67707d14c8da52f70d7ae80698e72c99ce73e0b12273745218b177c7e870d085450c686a85cbaba322aed4c22841de259b2e721370db61ed8c9
SSDEEP 12288:/wLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:/PNyBo4kx929bL3Hnx
TLSH
T1B04523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 cf5f702dd46b6645ec8ef281d7e27e9412f30e1847d2c77c2946dd1f1edcd7c9
MD5 549a721deeba26157b137403e7a15c91
SHA1 4c5f8225bdade9709a59eb83003e7feecf9da3bc
SHA512 da8368b88478876ae94b1378842289bc466f068392d92513f5c4e48aff91e22373dc681781a6de9e413daa6250b079a32999c14c0b274c4b0f3941e07267938f
SSDEEP 12288:AVjLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:3NyBo4kx929bL3Hnx
TLSH
T1684523125B5C12BAF97A7BB0D8568054C835BC8A5B7297DFDF124CBB0DB8BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7f07f8b1b8a5d1cb61f96e7f9aea8a5c721d83c48fe71aca232a0491993d5895
MD5 35d225994547c12f950bf04adfff8b00
SHA1 708ecc33d4ae49512cfb30d1232942b77bd1facb
SHA512 8bf888e2bfe72627e7bf2c0b3bc86cd0f935eadd3ec2590d7f8cb0e0ce970240a76e15bba222e7f48963a1edac8287cd0562511e175aefc7798bdf5bc4765568
SSDEEP 12288:2LLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:2INyBo4kx929bL3Hnx
TLSH
T17A4523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 58b8fafa8246aab127c91aba9f32a6393e3d9cf0adc00f519524d9220aff1b6b
MD5 8bca4ed98efd516562368c8c73a8033c
SHA1 83a9ff44c8f8c84adca0402f08d62bd3ade7eaa6
SHA512 467128bbf266c65b3fe0a227b36e737d6071068958f12dc164eebfb7f55292063f1bf8313de844ccfdcc790ff3e3d9f5af40aa8fd5f9f5ff1c27b23fd89d9940
SSDEEP 12288:waLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:wxNyBo4kx929bL3Hnx
TLSH
T1A94523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 73e9ed9f01109424388caa821a6ea0f7979f79c457ac03fb8c545499a3128ea7
MD5 4173f701e5bb06dc5ed4f07a76c571ae
SHA1 93d73ff4ed85631ce3940283606c79f1f6bce43f
SHA512 c5a0d1d687ee64988428648fb4c27a9d286d33b41bb3748c9d8da3346c1fb8bc758f52dc3428a9cf05f7867fdf80b9b2f54f3376c9f7ae749686d753611aae14
SSDEEP 12288:3mLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:3lNyBo4kx929bL3Hnx
TLSH
T1EF4523129A0C223AF76D3FB065498598CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 e3fa212b99f66a2a3d48272c72bbbb2c8fa213271ab667f6cc95d1c8c87b13e2
MD5 3425f687b5c4b26fdd1d45bedba19e05
SHA1 9436a25503d9dba531f9d6d9cc6409ccb88ee885
SHA512 0f2a8d489a7fe1255590c576d28a057476917bb35fc99f5156bb622a8f6ad177670607a464cde8b4be51a431172849b144da512f132d259c4135c5b4ab7183a1
SSDEEP 12288:CiZwbjzzFEoS2cPvyeLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:lZMXzFVSOtNyBo4kx929bL3Hnx
TLSH
T1EC650195B39418F8EC67823DC8158906C6B2BC5A0BA0C65F07B4367B5F773A10D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d166aa7731aa9051ee17759968c5b7033d65d89e35b29effba0e33c0297ddc34
MD5 c46b6e77092c31bfd68700a695418077
SHA1 053d507b79674602e88e75084faec76f2712d177
SHA512 1bce5e9b8604699fe692a40267e2d1628838f07185d17e9010c10c78119b16f7001529203c4e73f9af2ffc1c11084abaae426a96a6c22376bc2bf0197446e8c8
SSDEEP 12288:VFLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:VaNyBo4kx929bL3Hnx
TLSH
T1CE4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759BCEA34B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0bb8edc9f8cfcc52c67d2e6c4724e904634322395a6a362754843e75abbc98bd
MD5 2313840054d32ac8fb65cdeaf03b7a59
SHA1 e443afa0388bc391ca4760adde25ddeb076a29d5
SHA512 b215aa63fe46fb5aac71f398e43e33cb239c8c3647eed23820b91b2357931f54703db5d39d1453b8be184189f54ef20912a81c8d69ad48185fe1ffefd803d1b1
SSDEEP 12288:4JLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:4WNyBo4kx929bL3Hnx
TLSH
T10A4523125A0C227AF76D3FB0654A8598CC34BC8F1E9593D8EF27987759BCEA35B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 219234bee1e4c2ba30241ac67c2dcb16754921fe87253f6d73776fd760985ea8
MD5 77da9547fd900037fc35f536bc8045d8
SHA1 8241d4baeb23aa6c3ff34927bed9e7f4af27044b
SHA512 3c0ac78a73b9e6b5d953dc085248c0d52289c486d4a71750189c1faa08548d4f7e22bf6a2c23ac6df12702866c73423648a9e6d296b9cfc5aada603ac7a3b76a
SSDEEP 12288:jyPz5L8SLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:Ozy5NyBo4kx929bL3Hnx
TLSH
T1B855120773A831F9E17A6234C8960A05E731BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 75539d0e8e995d6151b4f3fbc91864f9312d60b7e603bcbfb014d47f867a293c
MD5 a47f2631e6f8734d8519728461548a46
SHA1 fc2efead10a2893248bb1bdb2ce6407c35bccc34
SHA512 a8c6c3950775111935c7d6c60a492c5cc9d200e06976b5cef35099c6db4627440cabe17e7c13b120a077cedf5759cfe4a87c920a8649a28e9f2831e00504037a
SSDEEP 12288:9FLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:9aNyBo4kx929bL3Hnx
TLSH
T1F84523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759BCEA34B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ad5da60c6ecd5feaae87fbe23887827bda126fe7d6b544b79312df4914edee4d
MD5 eff43c8aef275ed2b15876aade39ea1f
SHA1 663646039263185bd086325d8d2242127bcfb430
SHA512 62068c2ff86e4e74f33392861db9826d1a97a4a586568aef5ee6d279b257f3ad669a3f300ab87e8c536158f563a0bd6dd8b1c7f3acab5c94ef16f40e9f067441
SSDEEP 12288:yFLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:yaNyBo4kx929bL3Hnx
TLSH
T1C44523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759BCEA34B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 fe7326680c88c6c46dff84d29ca53a5d9a0bf010f2c8ec95134de6fe07b33550
MD5 a89436ed9f4963341464ef864cd8acea
SHA1 4b562988f86a2da785e4b65705cc4ed74a5f3997
SHA512 56a3f6f3a71ebd7f5f8facb04b8e00f3ca806b3adfe5257c782c41c32d0249070d43b8afea37c4203c11de32accf728da019ca4169822a09eb3c66d9fa7a906d
SSDEEP 12288:LyPz5L8SLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyExX:mzy5NyBo4kx929bL3Hnx
TLSH
T18855120773A831F9E17A6234C8960A05E731BC360B609BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 7df237eff3d94e4c63bd586fc294079fc99595a573557e86dee2c721c67f18e1
MD5 80fbcc850438db64940c1080e651e4f6
SHA1 c457126c4f26a06c6f38672d4d6f0d94c958aaa3
SHA512 254e5d69cbb2575eaa617bc91a85c8d7f8a0bbad639428c7dee9daa988462dd2617aeed64a7ec36f88a1fa327e949482c442338212c7873bd816c672d3b9350e
SSDEEP 12288:7Cd98WYoaLHF3z0z04PDvhgLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHD:2TtaLl3z0zDfNyBo4kx929bL3Hnx
TLSH
T1256501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 c4a2a483d101ebb2414c7c3c42dcee1dab59814b0d420ce019ee8bb9df22241d
MD5 0b2bbe371718a7f466399572132a5957
SHA1 76f1fe9039a37a564ec2095d44727b5fe0a7c02f
SHA512 884246c91ce54909ecb189d15680ef1a8db2db352883b6dfe606f1fd7439af4c7bb9a93f4cf3da1dbef253a70f2c558389c4b10036aa58bedc47d9771d0ddea5
SSDEEP 12288:Hi4e7ARdTfgwCHKy7GLbbdIvHLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:H3ld9CHKy7GZTNyBo4kx929bL3Hnx
TLSH
T18675CF90F3E810E8F1B79A3489764511CA767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d1245cf3b2f43accea6841c142fcd16d64b04941921fdf74fc48a418659ef436
MD5 e8262782e08d1affd8739ad55f098ce4
SHA1 07c670c9ecf4a08ee9a36edd4e9c2dd22965c88c
SHA512 b4b5a9e8a5af761c49d3d2748ff40dcdec85e3f0130147551091ca97185ac2d08c5f8c87d84d768e25a5d66fdf116a6b218b398baa2ba20c20a077ba6144cbf1
SSDEEP 12288:gQLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:gvNyBo4kx929bL3Hnx
TLSH
T1DD4523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 10dd6bdd159bfcb694afad8c0a03c419189e263a23e7f9bc7427941d4173fa90
MD5 84bb0cea63742b0b0eec0b9e547bbdf3
SHA1 f6e3ea13a6b38710416bcd61ad5f08b2d9ba7430
SHA512 ca76751f54fefcc243e48e3ea78f292d1c0fd1a449113953e868a932c73c4d23d20d9bc63a80612cc618dca3a9be6ec3ecda5edc329509bde587fc8cbefbd999
SSDEEP 12288:kyLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:kZNyBo4kx929bL3Hnx
TLSH
T1ED4523125A0C227AF66D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA34B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 9817c6b1d9a711384b788a871e40c8c055f68f38b19a51f354515d64c6dbe1c3
MD5 11f539206905f2057c5bc1d26af4d4cc
SHA1 134000a8a9e5ddc21b8a64a486fc4cdd099546e4
SHA512 eacf4295367ff86fca2727b342b7c8f41d5f29fa5269e33f265ea29b77036d4768b4c68db4d3b62b9fe19f8e4e7c3a8bf87700fcef699306ca6eec6372f450ff
SSDEEP 12288:oHLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:o8NyBo4kx929bL3Hnx
TLSH
T1554523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759BCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 222ea074a6bffba7058dbe43c445e764c642375be29816a8a3bcdb04b47313c8
MD5 3eb728c080e53ea0c78299a33d546337
SHA1 23c47b07f7df2b859ba02e148c1923ee5575593a
SHA512 616dffd328cc8edee0941307d3c7745f688c48a2f8f94e31fbc2acca055267e2e5c030e59da45af251da2dfe4dc5aaf032339e9f87f85cd41d55d960949ef144
SSDEEP 12288:QFLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:QaNyBo4kx929bL3Hnx
TLSH
T1F54523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759BCEA34B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 e1b7442f2aa54a5bf68cb4a0e088e404e1ab9c8de9cbf02df3ef1c29b617686a
MD5 88c3194b156f6b5cac7b37d2d6623b0a
SHA1 5b19443aecc56bdfc0b712d919b765bdbd520094
SHA512 587d9cd53c7957bf28a9d441224be96e64a6fdc1ffa3ad3593ccbe469d02f0e62c1b51f69aaf83d1d75c0d39ee5a3c46279a47e7d0c9a91740c9f6e66a3f7ad1
SSDEEP 12288:OQLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:OvNyBo4kx929bL3Hnx
TLSH
T1644523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8fa8bcb57d49eeaf416b5fad0b2e6a2224d902afa7ebfc0fc79505ccb24a37a0
MD5 96710d786e4e38be22e9867f21d55e5f
SHA1 702ff557c520455e59101d96d3f3bba18c7afd22
SHA512 535aaf1270c2af77bd1016d40dbd30e849688246f380f08311496646fff990a141a5ac3857c4be40a307b371c712e96c4e10e46d39b3c39ff1774c7feddb2056
SSDEEP 12288:eNLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:eSNyBo4kx929bL3Hnx
TLSH
T1E54523125A0C227AF76D3FB0654A8554CC38BC8F1E9697D8EF27987759BCEA34B10107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 28b4b29a3e6d39fd2f0454d13c83c81636d800b187ae9bfa05168b4e73c33860
MD5 9bc96c53d65871f3de16cf5a782c1843
SHA1 560729affc766aaf40fb09f99f3e8c3b99d88bc6
SHA512 9737819b7d7dbe651ad79b6733f58b53dfce07261038ea4ab3421480876ae174b1e55bb10be940ae2860f08b355b49e094690cdeb7f1f1d7bc78e0996e47e33e
SSDEEP 12288:9LLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:9INyBo4kx929bL3Hnx
TLSH
T1FC4523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 ee4f05607a51cf008f90f3e46f929f640ada8e54a4417285d15a2af8d29aa914
MD5 5f93e27bbad09398fa503d2376acc83f
SHA1 ca0012ed12552bfa309cf53159ea35ce2901ae9b
SHA512 5fd1a756369391c15c95df800aa4760ae69ed4f40f81466ed039946d8e6ed98245cfb94676bee5625d077ff36a24d5e1dda06acf66904817817e9ecb2b183b4b
SSDEEP 24576:ufwvqk9RX6wkyAIGNyBo4kx929bL3Hnx:YMnYItB+kn3Hnx
TLSH
T17A85DF29EBDC04E5E1B7923C99B7460AF6B178591B31C2CF029A53AE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 15d7bf21e7dace21727b0f2d7e55682c3f5e9aeeb80c44efc7b5933babbb859a
MD5 25704c4d43333600e016b6a905358ebf
SHA1 5b46d59796eef752fd81f5d40d2b4514fd58dec6
SHA512 4fd9b0d323ea83880058bc87db93c8f8f1b4fc5e8744ac47a512dee63c79801f523823fd8b9326f722d042d56954477822281212a01a6b8741bd3338509969d0
SSDEEP 49152:lYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0kB+kn3Hnx:IySzPg+k
TLSH
T186066C56A1A801D9C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 99465f6188f26f26051a3cc2b36283c66ba4e0e17568d56f3554d941767323cd
MD5 c28cb7dae473b44a546e42a070c9c90f
SHA1 1347167cfb9575c9ae54fab4c5eefde79855abe5
SHA512 7666a5aebdb9fd32a43590d2b7feefd40ab02df7a3b42b9b2c567c228e13434516a8fc75732cb3ad33f08b1d54fec9070d5d357f810877c42e357ae0a453b19f
SSDEEP 24576:w47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYdNyBo4kx929bL3Hnx:w47JUQjTirIhCnDHUPfF/0B+kn3Hnx
TLSH
T1A565AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 ca1e1f223aa3efc46757f610deb0f1d63171572428db009dfe380b0f8e817e0c
MD5 0ac55e436509d6b5b47f9471a30c25ba
SHA1 dae1ab68cbaf527d3b47749a7f22c1e777b493ca
SHA512 2269122edfbc176a46eae2ce1b55dc7cd3a9d31d0424c1c22edc0aedf8bd221b3bdabc44dfca1e6fa664919731798d0a91835c62596f5797af3982a2131334bf
SSDEEP 12288:Mpsf1LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:RqNyBo4kx929bL3Hnx
TLSH
T1CA55F01AD25812E8D16E2274C7468A40F7337C5947E1D3CB96D0F87E0F7AA919EE9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 80969e34203a0ab8d63c8a4c9d439a07a2bd05aa970b8401be95ada6dff8956a
MD5 624f1523af908a24b36d0927abbaa10a
SHA1 b3f1338a0c2ffa56579b43258e118d1e2ffe34d3
SHA512 20a8dbfd1b4a76f20795a91c323ba6ef46ed50c7d415b8ff38c2952c6ed9e6db78675d4c3c310abcf881e63a6f39c54156e0bef329a8a1b686a307f6ee8c6190
SSDEEP 12288:8+qdU3fbAKifxHDiNwSuB9yh2o+TZAjxgWvOMRlSgGIn:8+2UP+gh/aExg0OMRlP
TLSH
T1EC351840766AC75FC6AD40321E36D1CCAB707D51FE05AB0372C9873EC576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 3bcd6de54a892a263d42cbc68e5a602ee864b7f7dc93ed8faa5194a0fd41a736
MD5 c5223caf9eff02f3b5d98475867f5b1c
SHA1 03e4c88b146cbc589d4fb79169c9a552164aedf8
SHA512 87ee1dc380d5c98886543f9902958e3141f1a0bccb00053f6c198e999f65254dd8f62195d7a64c961592ffb82b7a0e83cc322615821e7a0a3a76945a227a97ef
SSDEEP 12288:9aiNwSuB9oiNwSuB9rB9SiNwSpB9fB9viNwSIiNwSXiNwSuB9niNwS4LA6noP7iI:jA8
TLSH
T1E455B8816437A38FD1FB6071072A5B4CBBA4EC46B7096F267388453AD827725A0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 87d40d1351f7f86deb20a61cb166e9ef3092f61ec2d49fa5ca1c3e9cdeb2fc39
MD5 e051eac6488f993103455cb428109e11
SHA1 b24fd3d00233ed2304fdb0fd0efdde1fbf76b18e
SHA512 0253abbfe24c20bc3f5f586464328a2aeb0fd676342aa8cf829768c5488e2d405be43f35d594423f2e74198a31f6a9eba3de519b71dc22006c2f59b0df430437
SSDEEP 12288:1y79LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:MiNyBo4kx929bL3Hnx
TLSH
T1AD452312975C623AFA7D3AB0645EC124C839BC4D0F50D6DBEE1658BB59BCED28E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6bd0406e6f34db8bf0af987cd03b140aa5a7c7d565f30dc353b5b210dcc8350f
MD5 00593a3ec5ec0e5f8e4f901d7f218bbe
SHA1 dbd1dccace29f08ac7b5a6978d0f93147f35b663
SHA512 6019a4eb969b751e8d6631213405e3cfc5ac403386e7a459f161278a6bae6914c1a6c2f3a9c081689023aae37b7056b6f613fafb82aeebfbbbf5fc0d91d0fe68
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYkNyBo4kx929bL3Hnx:Kgb4mBIBhGFaB+kn3Hnx
TLSH
T1D365AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 91ce45c768025aa4bbfe5e77cf98e769dabcacf264f0097da4b4fdd9ca72dc5c
MD5 b68ce0d0c809958d2cb05ec260d64495
SHA1 77d5fd82021bab61e6ed00dd69a822b37e9bb686
SHA512 381f1778f54849edcd6dbadc745de4482fec63673ce8862249444738aa4bfc6970c9f2addf59887da298feef338ad4341c7f68cf743788c70ae7440f179d1cf1
SSDEEP 24576:IG88u8FpJqH1Jzria7/mtNyBo4kx929bL3Hnx:r7ZFPqVAa7/HB+kn3Hnx
TLSH
T17F85F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 a1841f6b310440dacecdedf2fbc0b49d530207ca20c6acec2dc77f3a0c2696b7
MD5 21acad3d3d8f1b523540458f49122d78
SHA1 a3c213c4c55c1c9c821dc7caace5d4a062242f4f
SHA512 9fc918005a7fdc52eee4cdfd5f3d9f76e1c0a811ed400d6300130dd012b899efb4075db08a1afb855040bb4c1c4605dc80b7eb3207fc53744cc0c6f6fcce47d0
SSDEEP 12288:8HvUrBFrEjwaQqLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:8PUr+NQhNyBo4kx929bL3Hnx
TLSH
T11865F22F22AC18E5F67AB17C85868609E771B8560711D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 01068ed06c90d0b17d5103454bdbb9d5003bdd92386a7fa410c17263093b2b41
MD5 47b98526b8e1d17e52dc873d49ae08d1
SHA1 b0f0269cb832ad2e722f992abdbe65809be2f255
SHA512 0a442a3464fd88aea44a90e3b73e79b952116cdd4aa5072ab943829d19a75a79209d0f35359ecb33efba9c8d30222fdc394d0b79995c1b8d0f84980b06d313fd
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmB+kn3Hnx:XG05lO43bj+k
TLSH
T19ED5CF6A62EC11F9D0BBD17CD9C6460BEBB23815033556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 58ebbf2ffd754184d91ae53ca1426c66bf0a8ca8fa3c532afa9e3fb8efa0d56e
MD5 155de9898fcef9dc9d8d6544a167b557
SHA1 9d1f1a8a58ec0acf306e0fa70ed05f74ffa96454
SHA512 4e69c81915d20cac8bfed6fae8b11530961ca8534fcbfa6fd7567a13d803e811dbd29b4ca7a4b22571bc54e4c502dc22980c009bc0983544496cd66b5e74fdba
SSDEEP 24576:pfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnrNyBo4kx929bL3Hnx:5a5POZ3BJt2pasx2+meB+kn3Hnx
TLSH
T13465AF5EA6FC01D5E5B9D17CC583861AE5B1342653319BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9467faf8ef4317b5fcf76c8f58a8bf3f863ee3bf0a942f84a023d649da216dfa
MD5 255948043d376c3e52535f7f06148b2e
SHA1 8a0785ea864d8ea7bcd182c62f8fe7b7925c808b
SHA512 4cc67343cf02ea7a1fce1861200e75af50bd32f65c247524b74d1a65795f0a843bca5a6d4b6d0dbb579e2347eca543fe40b695f103b0ccaef18f6e6df17c9e43
SSDEEP 24576:lNcwHdjbyQ4nLC18lb/EOjowL7Fk1NyBo4kx929bL3Hnx:lNc/zEOVHFnB+kn3Hnx
TLSH
T154858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0c3dbb0080be04dbfddd1db7e4644242f7bf5487798f3759932190724eda08c1
MD5 33a54aff3cc27ef0fc254b35d60567a4
SHA1 989aedb6ffbc159dced5f4babd3b15f589d531e9
SHA512 64fd22d79c1e52d96c07e6fc784b16e6bf8a06e13133dd3d3f28ee358c539e5ff9eb9150c9922e524e1bd250f621e683193bbfc7ee14e0a9f6c5d6bd6e52c0a7
SSDEEP 24576:JTkNvNnaFeYhJNtmZBmjNyBo4kx929bL3Hnx:JTMwBtOmsB+kn3Hnx
TLSH
T17755AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 a6f1073421f1d14c9c27a4d463daa2bfa6e6e880d4d471d2bc23f56aa7aa745c
MD5 515a15ce204c7ecb51d919904cb5fc47
SHA1 ed95e88518b157358203a4d3136fccdfaf84890b
SHA512 e494b8fbb61057ac7c1f1c69e9d109021f8ab81ec57d2c6e10014b698fc23aff8be91d74b530d705afe0b81321e0616f7649ba71c15ee1ddda0d20fd5cd41f24
SSDEEP 12288:6QcMxWDXN1Dp/fshBItT1IQgARLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:oD3FHshBIYQgAuNyBo4kx929bL3Hnx
TLSH
T14475E13EE65C00E4E57BD1BCDA538906E67138AD072266DB06D4C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1268-234-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/1268-65-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1268-58-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/1268-59-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2608-122-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2608-132-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2608-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2608-128-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2608-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3316-85-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3316-325-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3316-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3316-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3316-306-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3316-91-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3568-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3568-96-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3568-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3568-308-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3568-103-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3568-97-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4224-43-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/4224-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4224-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4224-56-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/4224-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4716-0-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4716-23-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4716-15-0x0000000000EA0000-0x0000000000F00000-memory.dmp

Download

memory/4716-1-0x0000000000EA0000-0x0000000000F00000-memory.dmp

Download

memory/4716-9-0x0000000000EA0000-0x0000000000F00000-memory.dmp

Download

memory/4948-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4948-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4948-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4948-137-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4948-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5456-140-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5456-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5456-313-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5456-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5456-312-0x0000000002F10000-0x00000000031AE000-memory.dmp

Download

memory/5736-24-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/5736-109-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5736-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5736-25-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/5736-17-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/5936-276-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5936-69-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5936-77-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5936-71-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/6060-81-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/6060-291-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/6104-116-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/6104-110-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/6104-311-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/6104-117-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download