Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 16:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe
- Size 1.8MB
- Sample260730-vab44acd84
- SHA256 9c4b5b046e4a49419b99a3653b2b5333194e33b00ef9379ed6adbee6e3266117
- MD5 f0eb9faa31cb76dfa2d3fc73968544a5
- SHA1 71b73b2599ba1e1e1a700de89a01c3c24993be40
- SHA512 84a1b592a02699def19ae7f9d1dd09c0edb2560d8ad586ad379db274f92e850afc9412205801cf2e46b49c07da960ce9a28fe7e8862e0e848cf0fde41d6a750b
- SSDEEP 12288:g6Yqb9oaHB7DTSFi14+vt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:gADhr1VibHHufeZ1H6IFrXQ
- TLSH T1899559C02A68E9AFE353D97C5060D279D9717C634EC25109D2F0A6FD893B3B87969F20
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 4564 elevation_service.exe 6044 elevation_service.exe 3496 maintenanceservice.exe 2428 OSE.EXE 1908 PerceptionSimulationService.exe 4972 perfhost.exe 6000 ReFsDedupSvc.exe 2536 SensorDataService.exe 4736 ssh-agent.exe 5744 AgentService.exe 5148 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe - Drops file in System32 directory 57 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\c8625d0124febf98.bin elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ecde85d4320dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f09a6b174320dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf4faf174320dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd4fcf5d4320dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000059c483174320dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6830e1a4320dd01 SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 4564 elevation_service.exe 4564 elevation_service.exe 4564 elevation_service.exe 4564 elevation_service.exe 4564 elevation_service.exe 4564 elevation_service.exe 4564 elevation_service.exe 6044 elevation_service.exe 6044 elevation_service.exe 6044 elevation_service.exe 6044 elevation_service.exe 6044 elevation_service.exe 6044 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2728 2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe Token: SeBackupPrivilege 6000 ReFsDedupSvc.exe Token: SeRestorePrivilege 6000 ReFsDedupSvc.exe Token: SeBackupPrivilege 6000 ReFsDedupSvc.exe Token: SeRestorePrivilege 6000 ReFsDedupSvc.exe Token: SeBackupPrivilege 6000 ReFsDedupSvc.exe Token: SeRestorePrivilege 6000 ReFsDedupSvc.exe Token: SeBackupPrivilege 6000 ReFsDedupSvc.exe Token: SeRestorePrivilege 6000 ReFsDedupSvc.exe Token: SeBackupPrivilege 6000 ReFsDedupSvc.exe Token: SeRestorePrivilege 6000 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 5744 AgentService.exe Token: 33 5148 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 5148 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5148 SearchIndexer.exe Token: SeDebugPrivilege 4564 elevation_service.exe Token: SeDebugPrivilege 6044 elevation_service.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 5148 wrote to memory of 2876 5148 SearchIndexer.exe 100 PID 5148 wrote to memory of 972 5148 SearchIndexer.exe 101 PID 5148 wrote to memory of 5952 5148 SearchIndexer.exe 102 PID 5148 wrote to memory of 3772 5148 SearchIndexer.exe 103 PID 5148 wrote to memory of 5888 5148 SearchIndexer.exe 105 PID 5148 wrote to memory of 5948 5148 SearchIndexer.exe 106 PID 5148 wrote to memory of 5568 5148 SearchIndexer.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_f0eb9faa31cb76dfa2d3fc73968544a5_icedid.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4564
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6044
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3496
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2428
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1908
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4972
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6000
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2536
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4736
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5744
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:2876
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:972
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2936 2940 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:5952
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2972 2968 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:3772
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5888
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2936 2940 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:5948
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2972 2968 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:5568
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 8f7c9a82ae346625f73b18219f60357728817c111ec654948de594d295934110
- MD5 643016deaa98937c330074396d2fddf5
- SHA1 b235c6bee1b4e834f5254bcc307577d08a5c9c15
- SHA512 2993963ad1a92432b32fd001e276ffe8e618ed88b2379e1141b3f957fc56694cd37504ada17471d2e96ddaf541ee18418e9d364fcf21cda6fec1b07f2de8e5c0
- SSDEEP 49152:Ob+632BuPkFKRrdE6ohrstBhuXjfS4LWxnt3Vibn7ZB98:Q3q60jBmVibn7P9
- TLSH T178D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.6MB
- SHA256 b7dc57db67960d1bbfeaab9c330f460e650342640c56038b6581f645870e22d4
- MD5 af3a43ae94c2534921bcfb070406d68e
- SHA1 bb57042fb44a6343f9d25410940b6067e1e8650b
- SHA512 6a03dd9dab2c1fe904d410819928167188e4b4675f3f89a8130dde2442b7a35f91d79bdf5bc2034804d456615470fa661943b565243471231e5fcb4a7d916391
- SSDEEP 12288:P1XLsswWkxy2lRq2czAevt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:tXYfDtczA8Dhr1VibHHufeZ1H6IFrXQ
- TLSH T11185012877E408F9EC67827DC9A1C501EA73B8954750E7CB03A49A651F333D85E3EB92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.9MB
- SHA256 a217f086d392575474441eec08faea6b7431c8b51ea7b71882fc7364ba104383
- MD5 69174f4b79ee97087ad96b9804f3543c
- SHA1 9fe69c66090c9424bc960ea141e440cfea88336a
- SHA512 8f91045a30e2ae62f22506f4f8cf923bf8b0a68649a14845716ba7e9a43b200c53ddc5ec2eb0dc15bce5727161f9d0b41ed194e2a759578c34c78d81082c3c07
- SSDEEP 24576:S0Le5ji0hmxqrMlDhr1VibHHufeZ1H6IFrXQ:SPji0AcO3Vibn7ZB98
- TLSH T19495AE15F6748375D073C0B9C5D2A68AED7230865B308ACB4286D77C3E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 ea99aea944b96488e0153af25bbce0a9963b17b9dae4611231d218a813a67e45
- MD5 dff681a77409c4779cfddbd04d4adc18
- SHA1 921f783f2eee194800e8dda79865022c9ff9408b
- SHA512 7cd82010e7ab7c989c8dc62e8ac02c7a3c44485cecb44003bcff01daf5ff2296ecf98a6fb4a298f12c804da946bb4385e9154d64c57a37743070459f8e7d21b5
- SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWr6q8wyujDhr1VibHHufeZ1H6IFrXQ:O/ezSC6vUzPviHjyy3Vibn7ZB98
- TLSH T163755C15F5788323D0B2D0BAC5D6BA99FE7230865B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 26a8e468a08babcda091ac19d1acdde416b1367f8ce844b6f6798c01c7b4a619
- MD5 b76ced96994fdd78fb507eda49557e7a
- SHA1 f1e1ba4bb1c41e566ccb353090fccfab51bb5b00
- SHA512 7a7403a564edc64b2aaa48965a7890cafd95c28a6a9dd2c0f41354b64abf5e37c1632670585f8dd4f343ec0e3ebe86cfe18ba0c470c32849cdffa32d266af7a7
- SSDEEP 24576:6VbqPb88hv/l+b4Dhr1VibHHufeZ1H6IFrXQ:6VO88hXl+k3Vibn7ZB98
- TLSH T150559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.4MB
- SHA256 e44e6ecf0bde60619f96580480da9c550933e419870f22d255e16d6de2cb7387
- MD5 59f8142e253e6927ad65627c5d54a581
- SHA1 7216f8cdf7b3a9ca529cbb97bdc82c1d3c384c53
- SHA512 5370b4936424fcab9d0eaaa1ceb815e481ba1b96a32dc6b2d84f38713f8c9b03ce6ec1d70fefbe2fb49c6cf42073b0679147cbecdc026af20140ed53179a1401
- SSDEEP 12288:fMDvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:fMxDhr1VibHHufeZ1H6IFrXQ
- TLSH T17A652358BB78B0D5FDD70B71B3ECEB40FD57FDD8480A1686C325AA9020392E8D6152A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.6MB
- SHA256 7cb4c546b051df114efe959d99345df238ed8d09fd52114fd77a2490acfd6a89
- MD5 8bd7337ac1f2e9b29512b28d4495c4a0
- SHA1 deb86dd2db7baecd19b0e325bc9d6d5cb19fe266
- SHA512 eb50138d604afa4ce5da4f5629134c1a9cb66701d61da47dcbe655ddada0730b99e61b47896e3eeebff81bc67853ad652dcc8b870c7b6f24adf5c4b6f2bb86b9
- SSDEEP 12288:heBNUbTVO86USvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:hJIUQDhr1VibHHufeZ1H6IFrXQ
- TLSH T12C85CF3BEE28FCE2C27A4DB95791C700E77278704B12A3CBD165820E9E235E45E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 ed0090440c2f0c89a0565bae23d532715ffd987ecb84ea0c1cf2dd9d5cc4c1fe
- MD5 1ecfb4049a3b95d1385eb00953a4db30
- SHA1 26bc7302072f2c5445f774e81e81b279e27894b5
- SHA512 1d789c9b702f96c0034b371713b0999ca416df1261edb2fd3f76d2b0a7c810f1a142fb6bf739a3852d6f8ffd0b26f8e1b0b839463b6cf18d97e208001acb1069
- SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH0:5QvGAdlCEL8c/RRNw5C7Vibn7P9
- TLSH T159266D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.7MB
- SHA256 e94800db04acde4ce46685d5fd7a33926a05747bc04372b0833cd10797e42bf9
- MD5 4d2276220a25620232ac5c023e8e4b52
- SHA1 031ac8f14ed1b541f715e0f7ce75c70ce4543a1f
- SHA512 10ee9d7d3425025a09291383a520af3a01ec40606f2578c3423d4154f8dd7439453011cb25c6fa57cc110bc14b96035dc057e4abc5adb29afbdc7fe540ac97ae
- SSDEEP 12288:AAwSfxL/2Dc3+DLLmt0LDQewsAjAvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGv:VrewsAjeDhr1VibHHufeZ1H6IFrXQ
- TLSH T11285E031FE74E036C6BB0DB21B35D706687DB9604F511AC3E3A88E9D59302D22776A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 1efd244d21f60150d4be6174c0ebe0824a010ff445854061643c0917caa918e2
- MD5 0f40b1244b22213a4e1f6aea785675ff
- SHA1 61eb15740fb61c5b834323e6ee1b78587f51ede5
- SHA512 9324c253a2f8ce27ae2b00b4c21722deab0f502eaa2dd8929a977777b6a9ba8e45fe7cac3b486ee2e5ce0b825e5dfc38e70fb031d60c06ac389caed0522b7888
- SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHgif:mUEtQevvqc2W1cpV2RI32gif
- TLSH T18C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 f213b2245fffb1542e6b5a349e0efd9e9c2fd7fd1019e2a91102f2fc95cac613
- MD5 a10cb299efe1fba00592a9144199c6bb
- SHA1 c5eaa1fe54cebef6f60ef9f8b7d2b623e2fd8dc1
- SHA512 cfb73f51e74f1f5572bafee6ebb66b7f4bc1e6a4514608157d67b8b545c5746b31bdaa1838c7c449dd0d460e38f46f0b4225ce0e1e4899c99dece71e973d9f31
- SSDEEP 49152:TCbRquA/m2yL5zQfFiV+XenmE3/z+3Vibn7ZB98:soqtVjnmnVibn7P9
- TLSH T12CD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 577d6b5e03952d91696c229ae1c5cb1ec1c8be12235dc050334a7d9116bdee84
- MD5 c6f5fe3f1a71ee79ea455584729a7975
- SHA1 bf059790ecb6d0a638449d914cae245dcef50499
- SHA512 403142bd98b34c3be25bb08afcbf06d404ee67d1fd073ce243d2eab7c1963c144f1103f60a59dd4be2bdd06e02e1d4a343b5bc91bb09ff8f55c5c5049a09ba60
- SSDEEP 24576:rAhGL2IFoiwtA5l7S53XDhr1VibHHufeZ1H6IFrXQ:rAM1Foiq5H3Vibn7ZB98
- TLSH T1F0359D80E7F955D4F5F3AA7899B69170EA76BCA95E31C20F1260C11F1E33A909D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.6MB
- SHA256 65dd531eeab328475ef1d51decfa78c02adc6a27d4e28a8b09578d130c761de0
- MD5 a0c257f42678fc1c60acebda936fb420
- SHA1 303b5a810f5adf1a423652d82fcaf035fabf9799
- SHA512 799262e9fdd8d3e64464a88f5a5166349540023e972696847929191e9d9f93c73e0161642059fecc1393299c826994611cfb2dcf4aa00cc73a2a96c251092818
- SSDEEP 12288:+mw5HEjsChNDBFgl0WDm+Ctvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:Xwu2OWSDhr1VibHHufeZ1H6IFrXQ
- TLSH T10175F14977A41CF9E9A782398697C531FBB2BC412A25D71F0360C65B6F37360AE2D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.5MB
- SHA256 c86fa05e1694a3b72fb44298c8d3c8ce3f2bdb241b9ebfee170754c75872649d
- MD5 f89f585218cb0bdc451e7412fc1d8108
- SHA1 633971fd089bad6c85da174fb51e73400abd9a3f
- SHA512 0c182a3fce33c8b14281ae041657f238be86c40972f8c5f0298313997dd7392d6cb7249d42fed86d01a74bb591493a0954878ad7f2288d58b16854db626c0aff
- SSDEEP 12288:xMZ1Iywvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:+Zu9Dhr1VibHHufeZ1H6IFrXQ
- TLSH T19565125933A470F9E5E34378D6E49A40EB72B8E5172603CF432586A52E33BD55E39332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 9521eaca8efb21bbc75cec490c05ef7b16660f3a68b8ade74e9d4bdffbce2686
- MD5 e9c15e2b82837e71322df3dc479c4f32
- SHA1 347b6a7e474dfb3cebd2ac8aeef7609ad6f6eba9
- SHA512 d7069b243964e7e3d06d38d370962dcd9bc10d631a1e391a6893661d770cbd1e57748a9720e57859c1ba989e731f47c66a20d1d2f5ad174ec09e9dcc38adcc03
- SSDEEP 98304:LQRQyi36YOcPhLvw2gAf+PN3aVibn7P9:6QyiKahX+PN+if
- TLSH T131667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 bed640b2a86dae20c0929f79673f0ddbad90febfbd47435faaa44dc68a31e039
- MD5 18e189537af957676576fc6151fa8701
- SHA1 f69f7a05bd44946574b660ed440f982abc2acb4e
- SHA512 3f15ef41aab793fe4aa43897c8edc16449ee6f6ebba0a85d5e1bf04114fee4773eb579d5692c894d6e0a144b2cf1d37613c456827ae2d39b2daa5371e9aaf0e6
- SSDEEP 98304:AQRQyi36YOcPhLvw2gAf+PN3aVibn7P9:XQyiKahX+PN+if
- TLSH T1BC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 519e8af2185b888720c8efe82ab1b8d74368c04377abc48e835acf6e6000309d
- MD5 3c4904c14ef7ece820d7d816ce8e74d9
- SHA1 5a8b3976a39050af213b2ceae9f11b9cee7616a1
- SHA512 2bedf44756131f680da59c575efe7f712810fdbe6954dbed65cdfbe52de5c844b190b3a0903943c801cfedbfc97965b221ba93a013cd4ddf34fd78fae1e82bf8
- SSDEEP 24576:3wvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0tDhr1VibHHufeZE:/68Qg55nhceWu7PNU3/O3Vibn7ZB98
- TLSH T184B55A33B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061BB2AD07B3A71B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 9ab199fefe965b3d120e357f172216b86e277a236b96914f85eedbe9fe554fd7
- MD5 d8b0ada4290eb4f6ce241fd33cef4733
- SHA1 2ecb016e614b22658cea598859dcc3c32e8ce166
- SHA512 2b7ca02305bca1b8ccad6dec4233d735c14fdfd9ba116a7044d9e02251210babd3e58504813dca6c9d8ab8d63560aa423312289dac3b5d5e379b9e3a815591e4
- SSDEEP 98304:fy5112gYy5azzVva69nLKnhZxVibn7P9:SLIHjWh9if
- TLSH T11F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 070bd1aa3c1dae3846015de2cdccf3c4627fcd44b6f9fd58570323706052ef6f
- MD5 23b0cbce32857eaf2ad01cdb304e933b
- SHA1 573ee9fe9154da35b58f5af1f7a0161faa5439da
- SHA512 5e497649a9884db85fa3d57f83210af9285bf7e97c4264c1a86d48ddee272c382b77adda714060f9567285ea542c8dbd3b6f68f37b77d85b5c3c6244e9f5fced
- SSDEEP 49152:xB+taZ3usBWOBr4tEG20bqx0z+n217aau1gls3Vibn7ZB98:nu6JmUxd2diVibn7P9
- TLSH T10CD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 53c687dbfecc2786d42942dbc9f176668ab453479dea9b990945526a26a66640
- MD5 891067cd3f9fd7572e340ef5218167a3
- SHA1 7306375e139103d705e7b5f3ff096aab8a4bd1a1
- SHA512 d813406986f999cc68649cd66392aceb092daba72c16c317db0e3ef6ef3cbd498ca6c4419f89b312f775b992ec141e6962fe2d58ef0a618604bc2c76dbe6180a
- SSDEEP 49152:71hpsNoJpF1A6BU44CwH7R4xw3Vibn7ZB98:7mifPkRnVibn7P9
- TLSH T1A4B5BE13F2D900E8D05ED178875A9232EA62BC450B35B6DF0A90B7962F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 2505c73e7a4df184a477280a87fbf9ab216761567d800c5b7c9364e5cc0a9e1d
- MD5 d2030c423ccef255fc587d1c3b3d4aae
- SHA1 09d51b3e0ce8de31165aa25df3c76e1320773587
- SHA512 b6a6f261dfdf4ce02d838f4bd997712fc90a16e2b185979b343b6739891631cf7de3f152ceee05a9f532fccd0cf47aa4248eed20b5f70a180e4119f41ed6cd8e
- SSDEEP 49152:QSuZQIY0Be2KNRVtOnks6NMHq93Vibn7ZB98:K5dKvi61lVibn7P9
- TLSH T128C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 7cbe03cab879cbad50a85683025a716383a35331ce31b6bcfcb1ae216b6d3462
- MD5 d92082f1cde27910ee9a77491dc4d1e4
- SHA1 c84a4f9f247405da37b2acb0c33a133d610d3fc5
- SHA512 ac3fa559b0c296f0c674aaafce28ca7e963315377fd852fd2956909ad7c538ed7bd69d5fc33bcb4dbf7277c0fbab87ed78666f345bb6719deb9305dc6cc8889d
- SSDEEP 49152:NhtSn8EApI0figXgiDn0AP5w83Vibn7ZB98:cX2iyphTVibn7P9
- TLSH T13395BE13F2D900E8D05ED178C7568632EA62BC150B39B6EF0A90B7561E7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.4MB
- SHA256 6562f0e6ed3adb0d5ad78d290d01260a6dc740ba142b8f343b6aa3bfa9b6acf9
- MD5 968918023559e11f178011d7b823c2bd
- SHA1 c3497e3fdfa3cabf2b9c5974fed74683933fbecb
- SHA512 367ac562d074fbb0f33e67698c34f3c381297b8c0f0a94ba13d4fde55310dd8eb04d16eee1887808fa612f1a94fe22cc7fa374a98394797ff0a1f681cc2fed7a
- SSDEEP 12288:7Lvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:7JDhr1VibHHufeZ1H6IFrXQ
- TLSH T19F652318BA79B1D5F8C34BB1E3ECE780FD57BDDC580B128AD316965030353E866192EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.4MB
- SHA256 f91f5865767f5592d684681b6435cc9501cf034514255cb4306f0a11779de883
- MD5 d3202b25b6b0038bf352362d4cff6bc8
- SHA1 b9e38fe4528a01e44401a407c4a7e2ff6a88ca38
- SHA512 c166e2af5326e696dafbcb479d401cb8cfe641747846cc06e4436e8e1647c79279c3b7c01c7a1764434e1eadda8701daa6eec96539829934beb0648a30d76741
- SSDEEP 12288:iMvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:i6Dhr1VibHHufeZ1H6IFrXQ
- TLSH T1D0652318BA7970D5E8834BB1E3ECE780FD57FDDC680B128AD31A955030357E866192FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.4MB
- SHA256 37b00b192bc1fabe862d88c7f2b80b1c7a32f122ed84c11dcb11e02083900d9c
- MD5 c1a5ea52d791736620f89ec31ce0be31
- SHA1 783f6eb0802ab9b79ea1b3067a355957e30a6f63
- SHA512 80d295a46ed4955db8560a73a3dc2d29ea30b891651d952fa7844e68621cb3bea8847870247bcb217194c8f3c179ebec6dca9ab470c2b349f6864cd740cf330f
- SSDEEP 12288:Xavt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:XoDhr1VibHHufeZ1H6IFrXQ
- TLSH T16C652318BA79B0D5E8C34BB1E3ECE780FD57FDDC680B128AD316955030357E866192EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.4MB
- SHA256 3b4e65c4c904ccf4a41907b629fcc9630ab250e95c5f2fa5374ba76566a20276
- MD5 dcd89777e99127f24e30c59c9b5ba41f
- SHA1 c2927bb1f210130a6c4fb2226943a94590da8b74
- SHA512 3136e55594f3c92e2d400777665e2a93fe3f54b8aeccb4fe739689f7b1240d07cf078ceb01ecf9519f55423c64cb7e17e3d1abfd6e056be3d69f27844c685ed4
- SSDEEP 12288:xVRvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:jDhr1VibHHufeZ1H6IFrXQ
- TLSH T14C6523187B7960D5EC938775D3E9E640FEB7FCE8980613CF87114A5128313E86A387A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.4MB
- SHA256 9c64e8ef7793dedb60be04055408c629f1b9a983f37521ad75cc917a331b10e6
- MD5 ce768ccb51108ec7de2e76da62bdf502
- SHA1 e4e05447398b9c85cf49038230067d2e70f7c131
- SHA512 a186d7e1e555f8ab37c78f13620b9be985754565c4ad8293b909483bc59e68d5688d60631225ac065bb01152acb4c77150b8e1426559992f3e00c5a2590d47d5
- SSDEEP 12288:OJvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:O/Dhr1VibHHufeZ1H6IFrXQ
- TLSH T1C4652318BA79B0D5E8C34BB1E3ECE780FD57BDDC580B12CAD316955034353E866192EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.4MB
- SHA256 c1e9353e8bb5356dda17f65f0bcd4c5044f3a764bebac9a0d320c4e4c4819b43
- MD5 3403ed6c55d3f1ae7e05b78143841489
- SHA1 2d4719bd9c8d568260f6b6a7ae3c88a597884ecd
- SHA512 9b6746b4d195dfb4b09f323a17769364c6ef01d5b23101de8a0871cf5b2438b07cc7cfd66d844ca7b339ea9444e492f66163913bcc476643517813849e5dbcdf
- SSDEEP 12288:Qovt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:QWDhr1VibHHufeZ1H6IFrXQ
- TLSH T117652318BA79B0D5E8834BB1E3ECE780FD57FDDC680B128AD316955030353E866192FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.4MB
- SHA256 2b7a734ddabdb4644018e506132b3dabbccccaa2e2f21d5b5b0f1f428632f1ae
- MD5 8cffc652aefb9f61c2aa9b9f72a9bf60
- SHA1 8dadde26ff62f6d17c39432cb2de2a241c4bdcc6
- SHA512 adadcb96ac551cdfd6c1416b136e011f58af37ad3659b0692b133ced5437adc2409dfbb32468e988432dfef97c90dd8c5dbb9351633ad2cae89bd459fe3bec78
- SSDEEP 12288:nEvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:nCDhr1VibHHufeZ1H6IFrXQ
- TLSH T122652318BA7971D5E8834BB1E3ECEB80FD57BDDC580A128AD31A955030353F866192FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.6MB
- SHA256 7a361d1aa1c4b6fdb918b59702cc513d53780fd9440b6462e0ef75a814a7713c
- MD5 8ae2a1c0d21ea10d2db4f9e11474237a
- SHA1 71478bf3eec73fa7da0714ab94a4fe24637bd6aa
- SHA512 db815a6bff6a0518bc7e8e868c36cf0db52832a8921edae694e8af663519f63ef19d85457d293f9ba0c095b664e32e084dae2309196849e17aa60587203e645f
- SSDEEP 12288:qiZwbrzzFEoS2cPvysvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:NZM/zFVSOaDhr1VibHHufeZ1H6IFrXQ
- TLSH T1A5850295B36018F4ECA7823EC9559905E6B3BC990A60C64F03B436675F333E11D3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.4MB
- SHA256 f5a05a60b14c79a0dadae7a2ac7dd3e853eb03234818c225df5c3fc2d5cac3f1
- MD5 a7742790c82094a00e400d45e04d5b22
- SHA1 a27fe509822442a7ac7d837b2ee56746a5a738fa
- SHA512 5cfc22c67b0f5540946e4b5dffcb64a683c502d8576cce4a11b1ab7babad22c15287b264bae7c3956c96c80c80704e8711a19d9ca02129e202dde73b9f6c1424
- SSDEEP 12288:zPvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:zNDhr1VibHHufeZ1H6IFrXQ
- TLSH T1D665235CBA7970D5E8830BB1E3ECEB80FD57BDDC680B128AD31A955030357E856192EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.4MB
- SHA256 247a1767ea5e6ea201466fc156f8210ff0332937d370978ac9796e2e2b3d90b3
- MD5 2e91f7a61563f5985a52afff3f55669a
- SHA1 2cbf930586828fe3b32daa9deb3cab0d204373e1
- SHA512 2a09f93b9194677b2b6d9eea864cdb1085a09c9c6f91b6eac304b5cffcb370ed5de7e6950b3cb7778018757181d36740b76796a2ba231213703e747b35662ea0
- SSDEEP 12288:kzvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:kBDhr1VibHHufeZ1H6IFrXQ
- TLSH T19F652318BA7970D5E8834BB1E3DCEB80FD57FDDC680B1286D31A955030353E866192FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.5MB
- SHA256 b07e9a318fa60fda5821b4d8b4225d0d8809a435f3a472e38e71c4d1d1b92b4e
- MD5 5acbdbdf20305cbfccdc130b789e93cf
- SHA1 6b6d882f8e76575ed6c49219c99be01115750ba8
- SHA512 792743a52ed77ddc024d9379d17760efe5dd18b88fd9c34f3b6349202138cd6eb42f3e94fa7686a2a13bf3e2cf4d3dc19db47d9177c59690f519847b0883150f
- SSDEEP 12288:KyPz5L8wvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:XzyuDhr1VibHHufeZ1H6IFrXQ
- TLSH T1DA75120B77A530F8E4678238C5A55A01FB72B8B50B158A9F436447762E373E09E3EB71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.4MB
- SHA256 9a2e51c742c1f7da76d9fc253af889119c519918dfa0ce79df1d7bbb4e3daab5
- MD5 8b493a126f55d238bab4e5ea167bee3f
- SHA1 c9d01c53ce18653d0322f28dc4d9f6a8165b11b3
- SHA512 37d485b1001e3f9f7960ac8d42ad958224fda12c346a52c2ec8a095c21927f64b564e58e173ccfd4d96e96be5ac4fabdb7898103214abf56eabf8bdc3c98a065
- SSDEEP 12288:WPvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:WNDhr1VibHHufeZ1H6IFrXQ
- TLSH T1A9652318BA79B0D5E8834BB1E3DCAB80FD57BDDC680B128AD31A955030357E856192EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.4MB
- SHA256 386ee187835f72adeef124e7c963862422d8f3ed39c7d3645d35ca994097ab1b
- MD5 499c10d60c436fa337c535d4a3ffc85f
- SHA1 9142c6379093d45d2be2defdf20c9749abb6f579
- SHA512 5d94762c7a19e16b2008c8e6d5b46bf97f155898da90e2dc4adedd6e1e8d5fc2a13d962a3ea2755ff6a845a96d4ed60e55dd45592e2f61cde8a7e507b3b706a8
- SSDEEP 12288:/Pvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:/NDhr1VibHHufeZ1H6IFrXQ
- TLSH T16D65231CBA7970D5E8830BB1E3DCAB80FD57FDDC680B128AD31A955034357E866192EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.5MB
- SHA256 30be745bcc4c6ea0f453beb02272f2a4af457bb1c7ce9eb452560b44e62c579d
- MD5 2a8ca7583c41d6ee83d60ff271b74c68
- SHA1 8e5b30616838f72b7552cb64331104ff5e504898
- SHA512 18bd54cf367af37048ac0b0d8f4d299b0e963a7926397f14add3988ea771eac2e74685bbf14c3576921204533ac0b02429984e2d15c5a4c0903bd8be35f0a1e8
- SSDEEP 12288:7yPz5L8wvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:2zyuDhr1VibHHufeZ1H6IFrXQ
- TLSH T14975120B77A530F8E4678238C5A55A01FB72B8B50B158A9F436447762E373E09E3EB71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.6MB
- SHA256 33260f17251ecc609cf45ee5791fff96ac17955e75cda01aca60ad4571b2b588
- MD5 481f8bdb494fdef6a5aacd1625b5a2ea
- SHA1 aa7275774f2ad3153bc3854a1368792ba9896e0a
- SHA512 7e8abea0d4e062b8b0bd6ccfd066f70d6b5dc9641ae61010df6051ac7c65e7a3f7b7aeba559aea3d0bcff0ca0bb3f0c613d73144fa86d768b79e0934d2900942
- SSDEEP 24576:4T0aLl3z0zDYDhr1VibHHufeZ1H6IFrXQ:4TDLljj3Vibn7ZB98
- TLSH T1F5850294B36018F8EC67863EC9659905D6B3BC990B60C65F03B436675F333A01D3DBAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.8MB
- SHA256 70e31052b1cca47395c65740c04a19e9cf9fecaf9bf3e8c5bb6878889d1a5b69
- MD5 53d93812baaa76fb6b4a474b809cdcb2
- SHA1 80d3e3e5a1a85596cc7ae87437088eff3bba6063
- SHA512 8019adbf801bcdb3c41fc432942c2cd0243cccf890071fae04faed9476948c8d28ee3f94de36427b38bf827bc8e4c955153cd91a989ebb7212c5b8536944d174
- SSDEEP 24576:O3Id9CHKy7GZUDhr1VibHHufeZ1H6IFrXQ:QId9CHKyam3Vibn7ZB98
- TLSH T14E95CF90F3E410E8F0B79A35C9769501DAB67C991B21DA8F03A4665A1F337D18E39F32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.4MB
- SHA256 8d4651c687d8e3d49250dd72165ec54945ea48b19e748eee0844568627fa3819
- MD5 4d4218d14cb07e1a3e025ae8bb1d6345
- SHA1 b92d90cfd0dbf12393dfe40f1bc8eee1e267b8f7
- SHA512 0bee8211377fa7ef04cf893afb02f5bf2f19bc32e55203ea2b5111a3516215b6526a1c6aa7b18e5b976a91c62202c23f91e646b492e9d22e6dd61fd37f3354ae
- SSDEEP 12288:l6vt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:lIDhr1VibHHufeZ1H6IFrXQ
- TLSH T1F9652318BA79B0D5F8C34BB1E3ECE780FD57BDDC580B128AD316955030357E866192EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.4MB
- SHA256 af9889f839193afe41ff7bd50177ba8795de40bee6d8f9f14bbac2ad90efdce7
- MD5 11eda30a5ee42d547d527b8897929b6d
- SHA1 6b2e202efbe3985c24d16fbc6cd4cb3cd6595b19
- SHA512 d69ce2eae65cff227d1e733455a208f843c9f3422f6eb95acd378fd2dd01aeb531f0b77c93ed627b08e546b03c31fb8a94f512d74908bad36d8a28b64d860ae0
- SSDEEP 12288:FQvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:FODhr1VibHHufeZ1H6IFrXQ
- TLSH T139652318BA79B0E5F8834BB1E3ECEB80FD57BDDC580B128AD316955030357E866152FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.4MB
- SHA256 9dc67010d5dc6b190c22bacfb3f3a95d32fa279a93628c21b65ecc95cafbd18d
- MD5 891bf4c3fc72373cb38adb794e593b57
- SHA1 b5a32dcaa5a7931b078310f2109c88d64aed6aaa
- SHA512 58914d0af6c71264c028cc9e1dbf9c22729fd89e7b8bce3fa79adc4ff353924c8b5ba7bb07bd45b52d33d9ebad7c6b2e71b97cc60e09c144a0f3570bffd0d0da
- SSDEEP 12288:blvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:brDhr1VibHHufeZ1H6IFrXQ
- TLSH T1E3652318BA79B0D5E8C34B71E3DCEB80FC57FDDC680B128AD316965034357E866192EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.4MB
- SHA256 bc2a99912bf41790070873e943a4d82069c70f27fe01ed56068865c6b5741289
- MD5 76c1266f3b03a52df744b030a96da12a
- SHA1 d626ff3316f1dbb4c1d93e38d7bd1cd68f59acf7
- SHA512 20f65af64796afc84f4f0a249c870eb1e049613b2cb39e293bb6654314ee404e41350687174849ad146464fc05867fe6789151b7f1aa5dfbfdf43b5d43ff8499
- SSDEEP 12288:8Pvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:8NDhr1VibHHufeZ1H6IFrXQ
- TLSH T184652318BA7970D5E8834BB1E3DCEB80FD57FDDC680B128AD31A955034353EC56192EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.4MB
- SHA256 26ca9703cff5ac51a9cc772dfd4e32abd36799a1cefe3605698ff97009cc1a1c
- MD5 84bff72ea5ed62ee984e95f43c03c23a
- SHA1 56e3a98e52337b067beac61e2638b06198112775
- SHA512 f3682a31122992786537b588418aac560ba12980bafb51e66d3f4a1d1d7aab766953b38e6b36b2b7b98234b9e95ee837ce179cf896971e2044c67429c5ccc4f9
- SSDEEP 12288:d6vt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:dIDhr1VibHHufeZ1H6IFrXQ
- TLSH T1E1652318BA79B0D5F8C34BB1E3ECE780FD57BDDC680B128AD316955034353E866192EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.4MB
- SHA256 1779f04770907f4bc8c92072415853aef4ade3e2cfa7e7ce9dd57eecdb23e7f5
- MD5 47cd7bcfca8477b8eaaeb6d8539eb946
- SHA1 f4667e6b7a72bed21888e28872f7f2996a140994
- SHA512 3cf3fb094fe2326dc73e1b519f46f4c8f03b6345c186242127b9d9fae987ea458ae545e5b4eb4afb977b82ce6c1914e140a101538f264a7698c118cc73375e90
- SSDEEP 12288:lnvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:lVDhr1VibHHufeZ1H6IFrXQ
- TLSH T18B65231CBA7970D5E8834BB1E3DCEB80FD57FDDC680B128AD316965034353E866192EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.4MB
- SHA256 b7564542c359ccc6a8125406d99d98efcaadce9d26e629a4d11a9d0c77e95fbb
- MD5 781ed3f20ac23ffb740b371cb2d1196c
- SHA1 6da772373bdce0ffe5499e62d5820d941b8bbed4
- SHA512 3d8721436a3ec0ff2cf1c59abd919822317572e517053f74fc25622f55c01a3c2cc71d75344c84ab78340fae5cf5be87adaa6abd9b5f204eb3bcaf3ebc2b3858
- SSDEEP 12288:uJvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:u/Dhr1VibHHufeZ1H6IFrXQ
- TLSH T1F6652318BA79B0D5F8C34BB1E3ECE780FD57BDDC680B128AD316955034353E866192EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 1.4MB
- SHA256 620049c885b7f02b57dd9cbe295e729c34cc06516683f56e8478e80c84c7408a
- MD5 e177b7fce4f018d5beac9106a73c72ec
- SHA1 dd70a280de3ee47558c495f348bbed4879ce465a
- SHA512 5ae92dc4fb25e65ba201a1d81ee81eb37e25495ebf17fe97df3e0deab16cdd689fc94614b2032bb5e6c59f6402470caca1b381eb596a511407ec5981692cc2eb
- SSDEEP 12288:tCvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:tgDhr1VibHHufeZ1H6IFrXQ
- TLSH T19A65231CBA7971D5E8834BB1E3ECEB80FD57BDDC680B128AD316965030353E856192FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.8MB
- SHA256 edbf1a7379f2b167b205c22912d158eb667c65ba19ceb382af493f4e1b7515e3
- MD5 62f45bf88f995e8e49ea391ed7c1d15a
- SHA1 049053211a84a2a32cb81286721d44f616593f66
- SHA512 9cd68dd5f0003d46cab99fa3586c8dcb58251afcbd79f2fa664c4b5feeb2c62ea5ef70ca1ff2fd3047cdb1d3bf044bd84588dcf6c985ea574e07dcccf5aaa63d
- SSDEEP 24576:Zfwvik9RX6wkyAIRDhr1VibHHufeZ1H6IFrXQ:1MnYIR3Vibn7ZB98
- TLSH T12C95D029EBDC44E5E1B7923C99B7460AF6B178681B31C2CF025A53AD0E37ED45E39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 f97dfa12a39fd18f8039fbf9aef9e0e12d1cbbfc294503e0ca5dfa6f56fa484f
- MD5 f36e9e6468cb390b785f84fa4bbadb32
- SHA1 d9d5f8289d83e44952ff3dc0f0fa0156ac3d1a57
- SHA512 5d41f27adccc248b4a148cdd1dd7c17be52af87958b1ceb713571e6f595b0f94f400174bd40acf5ad6c0766a66f31cd3c1de9a53b1d76091108a53e2a30bb291
- SSDEEP 49152:IYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0c3Vibn7ZB98:QySzP6Vibn7P9
- TLSH T147067C56A16801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF0AE3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 dd60fb0b6ddc19d1708126a1de876fdad98fe30c59f5732ecae872d56a56487a
- MD5 faf6cb98379c4126d9e1b909976a896c
- SHA1 2778f6db8bf6e906074295e8e7ce4d8ae00100a1
- SHA512 99b4b5c55892631739701c346e16949f4f1e0c1017eadb67c565897c0bf34312c97822e8be24e9cd97113f5558dba69622b343bf57c0ee9dd4e91e9e6d6ace64
- SSDEEP 24576:N47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYqDhr1VibHHufeZ1H6IFrXQ:N47JUQj4irIhCnDHUPfF/s3Vibn7ZB98
- TLSH T12365AE1DA3EC01E5E1BA927885158A5AEA71782D1F31CACF1270837D6F23ED45F35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.5MB
- SHA256 47556928947b4b03180f6e6f23064b30a887049e18d53a76e76443a2a40df0bb
- MD5 a87c44a2f5cc63e0053fb1671c82a09b
- SHA1 24b724ade92c0caab56f20d8c10cff0b7495f953
- SHA512 bd44b512986c91f72ad092b98cd1d93485f74005900d2a717816efe392c45b64aa67c1f3e287887481818478d59923a17562ea70e803e9c67fe7cebde7cd8d92
- SSDEEP 12288:Y1sffvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:59Dhr1VibHHufeZ1H6IFrXQ
- TLSH T1B675F009E2A812E8D0AF5275C3959A40F7237CA886E293CB53D0F53E1F362D45EE9753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.2MB
- SHA256 158e5ec0d389f412d7b5c43c06d4c44bea670b3cd2f95d28eb1d1e440fe79cb5
- MD5 08bd3f295a58bdeedc9a9ca4ce79e9b5
- SHA1 848974a20c908a59a350770da82be13487273295
- SHA512 1083c215b9693ab2b47e0d17f6219dc4b63380d13463aa0eb70723c200ffaafc94c705f3d302362feeb0f8c2b945566ce77623fe702da867b8e07288778d430f
- SSDEEP 24576:6KxceblUP2hukOZfifYfiIJfpNoVLZrrBju7:L9blUeTOZ6QKIJfot1rBju
- TLSH T16A452741762AC78FC5A950321E36D6CCA770BD01EE049F17B3C8873FD576668BAB5282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.1MB
- SHA256 79eb67ce750a383476d0a935a8312396ee6bb1e229fb131ac177e9ecf78d7fc3
- MD5 46202ce97c1e33ce95a3c0cd80166c35
- SHA1 96c254bdfbdc1d0aeb9c19d54cb72dc1b230eb0c
- SHA512 0ea679a2d752c45dd23076b484d3b48a3ca28f919431536d28135665a356a9daf98c46d328a63bfac443ababf2ded2e85969eacf595983b4a3b832a2de1f30b2
- SSDEEP 12288:2QuN56Glr3ZJjVR1PhIgYgBnGBz0pqrjuE6NXbNvQNLGNSFNdDcdStcFc/:2QoJdHlulgBnC0pqrx6lb2gyjcdIuc/
- TLSH T191350941A5B7E31FC9BA90370332868DBB745C07BB492F0573448A3C986697EF5E6392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.4MB
- SHA256 baaa0a68134258ae8bc8c2e5cdd352259ae8cb7d56427297177cff97f2cd3547
- MD5 c6e8e51922dd08928fb6fea58beeab36
- SHA1 fb9ea5d17387dc602e5d33fc81c96c2a45c862cd
- SHA512 541f9f64ada2c0113ca798469f2015c3d71f7872a2b2f25244423183256264eaacd9a7f86b2f74773df24ad4af2593aa523014b7cc2f90e7ff052f348e8ee537
- SSDEEP 12288:Iv73vt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:uFDhr1VibHHufeZ1H6IFrXQ
- TLSH T177652318BB69B4D5F8A70BB0A3ACE600BD1BFDE84F0511C7D315969024357E89E347AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 ced74e7400b684b65c8f3099123dc422b3c91b5f1d0c8c20570ef2dabf6ab81b
- MD5 42752f4ddf3f04db6792c6d8bf275e5f
- SHA1 723e91e180e7ce5e087ce19418bf6991aa3a86ad
- SHA512 c83a0cf6cb44ac87cf68ecb8ec490b8d1123a053762a0ba94bbc607915586940e49ba594c68d9e77540b8b65d4964d663b6d79e7d9cab1ee8dc834ef637ae96e
- SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYjDhr1VibHHufeZ1H6IFrXQ:Qgb4mBIBhGFq3Vibn7ZB98
- TLSH T15C659E1E22EC02F5E0F6D2B8DDAA4417D6B278160731D2DF1251426D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.9MB
- SHA256 5a38a09fb66e1ca4dd1e33d389aa8fab9457750e683712b17f28038c4dfbc7c7
- MD5 c2ea9e56ea9e6d8521dcb0f6cdf688df
- SHA1 d815d992e39ec6c417637e26e0a60be593a917a8
- SHA512 c4b2a470c67e3f0c73c0983b571ea6864032290ec7af5542f5ea1533e6341ee0e0c95d69555747ba10c4ab300b55ec031df1d9406068f14c9ef674ff1f409440
- SSDEEP 24576:CG88u8FpJqH1jzria7/maDhr1VibHHufeZ1H6IFrXQ:Z7ZFPqV2a7/L3Vibn7ZB98
- TLSH T11B95F16577E101F0D477D1388A864663FAB2B8650364EBDF07A88B511F23BE54B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.6MB
- SHA256 1bfcfcdaab4e0c6c8200634d7e31e2af2daf30b8579ffbcf9a7fcea4d3114404
- MD5 b98765e843c13da497dbd51671f3707b
- SHA1 6b306caef986f035637524b2008bda20cc7a7391
- SHA512 f11d9b00fb9e5240090031bb9965f5deae8f0025e137037e911e3ec2199c4d2e59dc7b61676ac2724740cb207abcc8235af916e74a90d030095acb1d7511029f
- SSDEEP 12288:WHvUrBFrEjwaQYvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:WPUr+NQmDhr1VibHHufeZ1H6IFrXQ
- TLSH T18375F21F36AC18E5E677A17D86858709F772B4A5070292CF03A1817E1E27EE8BD3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 393dd203f0d13d6151764788a3b97ebf4de90c6825a6b89ca2ead6fe1ef9a90a
- MD5 0c6eb9fec197c2d56ee3df5b0cfdc93d
- SHA1 8af23b0e413d0c30048eecfc1112b1f808f35909
- SHA512 88029bd4939c9d7b1005d0c478db8c0ce16dbb74e447fd5e86cb8afffe6f549670e71744a880e7e4e247e7b045ea0135109e232cb430a3a264192a51722e26f0
- SSDEEP 49152:sBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjW3Vibn7ZB98:PG05lO43bJVibn7P9
- TLSH T12DD5C06E62EC11F9D0BBD17CDAC64A0BEBB23815032556CF02A486A91F27FF4557E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 1a12956aacc66f5bf59b8c471b90f12fad880162c07e44107d08656dfc307918
- MD5 e44f9783c566945b149a5e6fb2871c85
- SHA1 f309b99685923e71970d1407c459c8b73be9d131
- SHA512 a4b7aca9329cc061a7cee2983f806a140e238de3bd8e57dd105a32cba7daca2fa72109d48e9a1bdbe0572ad4b576099ee8c68a82a4312e9b1e5f69f9d3e52f86
- SSDEEP 24576:Vfa5POZ3dpqWVM50JicR2hG0lasx2+47eidncDhr1VibHHufeZ1H6IFrXQ:1a5POZ39Jt2pasx2+mO3Vibn7ZB98
- TLSH T13C65BF5EA6FC00D5D5B9D17DC583860AF5B1346553329BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 38611f3082b7d1f8fcc23499461430a40069af2b89408a82e7411d497ff58bda
- MD5 2cf68b50f2139938f2a270f2e3a5c0a9
- SHA1 d6cf3ac536c9b5dfee8ff16b7d11b75e605d1b19
- SHA512 7739cac51698ef59bf36da5d133f58b0df8972b327848a379848398c3bbccfba1f7ba7ef20e78ac1111a371fdbbc85dec5302848dbb319bf683b9f41458b6ce2
- SSDEEP 24576:vNcwHdjbyQ4nLC18lb/EOjowL7FkyDhr1VibHHufeZ1H6IFrXQ:vNc/zEOVHFr3Vibn7ZB98
- TLSH T1BB858C1623E901E4F5BBE1BE89779646FA717869133086CF0291851B1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 e0e1b356091fe44548bd427e45b6e7aae90c637488d857764cc32b5ad648ebb4
- MD5 b105c60ee409f17b0b0e8d1929f98d67
- SHA1 bbf35d9c59c60568c7181db67cfb06e9d536f2c8
- SHA512 7ce5b3a342fcb1793a8f0e856a66b1b8a7842e6cdc1368ec86eba5839c31e529612a79b274071b64d32ab12db8a7eb46d448be84674b00f5a4e418a2b1fc233b
- SSDEEP 24576:RtkNvNnaFeYhJNtmZBmgDhr1VibHHufeZ1H6IFrXQ:RtMwBtOmg3Vibn7ZB98
- TLSH T1CA55AF6EBAB845E4D1FAC6B5CE238512FA727461073253CB5390C13E1E279D89E39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.8MB
- SHA256 54d62051d91e20b64a6b1812afbbc5393ee0b981c00d2e59c289d459110b85bf
- MD5 0d920276919c3c66f514c454ab250711
- SHA1 fb7b6636a07ee2975240901dfb031a77cc8218df
- SHA512 360d638f3e7d0f7d4480eb1c5af31e111ac72e21ea70fba3fc848c012daf7f0188d13fdbdd4142d1333c10b4384ce8ebe67cb1478c47ca1799c474100ff17688
- SSDEEP 24576:eD3FHshBIYQgApDhr1VibHHufeZ1H6IFrXQ:eDVHeBIAAp3Vibn7ZB98
- TLSH T15585E17DE66C04E4E47BC2BCD6638A06E77278ED032256CB029481B51F6BEE46D39F50
- MD5 SHA1 SHA512 SSDEEP TLSH