Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 15:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe
- Size 1.3MB
- Sample260807-tctlgsgn4v
- SHA256 fdf2864b873c380e3df96c9a56f555ac34d06a5de91519c1e5ed01e9ab656e9a
- MD5 74844c83c2cc3a5c5a3ed48dc4825d26
- SHA1 d4dc6d8e78f488e2d0c5c0479749ed081c202455
- SHA512 e8768cbf6e47f1b21bdfe6c2239e479f5dbfe5857b8ad4d187ec32f7e37aba6566fcd6ce7999a1713cb97fb431201f26a9d9ad7ca3a0781757194d9ba3282452
- SSDEEP 24576:elhBh8H2hnrSN3zMatr0zAiX90z/F0jsFB3SQk:ebBhTnraB0zj0yjoB2
- TLSH T1BC557C4577A446B5F0B28A348965866DE6727C50D933CE0F21814EEEFFF39818E25B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 3416 elevation_service.exe 3152 elevation_service.exe 5560 maintenanceservice.exe 3672 OSE.EXE 2460 PerceptionSimulationService.exe 2724 perfhost.exe 1536 ReFsDedupSvc.exe 5404 SensorDataService.exe 6080 ssh-agent.exe 4220 AgentService.exe 4576 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe - Drops file in System32 directory 56 IoCs
description ioc Process File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\b5b17f8f763f1d8f.bin elevation_service.exe File opened for modification C:\Windows\system32\locator.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Windows\System32\vds.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000039fe0d2f8526dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000406c802f8526dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 3416 elevation_service.exe 3416 elevation_service.exe 3416 elevation_service.exe 3416 elevation_service.exe 3416 elevation_service.exe 3416 elevation_service.exe 3416 elevation_service.exe 3152 elevation_service.exe 3152 elevation_service.exe 3152 elevation_service.exe 3152 elevation_service.exe 3152 elevation_service.exe 3152 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2536 2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe Token: SeAssignPrimaryTokenPrivilege 4220 AgentService.exe Token: SeBackupPrivilege 1536 ReFsDedupSvc.exe Token: SeRestorePrivilege 1536 ReFsDedupSvc.exe Token: SeBackupPrivilege 1536 ReFsDedupSvc.exe Token: SeRestorePrivilege 1536 ReFsDedupSvc.exe Token: SeBackupPrivilege 1536 ReFsDedupSvc.exe Token: SeRestorePrivilege 1536 ReFsDedupSvc.exe Token: SeBackupPrivilege 1536 ReFsDedupSvc.exe Token: SeRestorePrivilege 1536 ReFsDedupSvc.exe Token: SeBackupPrivilege 1536 ReFsDedupSvc.exe Token: SeRestorePrivilege 1536 ReFsDedupSvc.exe Token: 33 4576 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4576 SearchIndexer.exe Token: SeDebugPrivilege 3416 elevation_service.exe Token: SeDebugPrivilege 3152 elevation_service.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4576 wrote to memory of 1856 4576 SearchIndexer.exe 100 PID 4576 wrote to memory of 5956 4576 SearchIndexer.exe 101 PID 4576 wrote to memory of 1968 4576 SearchIndexer.exe 102 PID 4576 wrote to memory of 5712 4576 SearchIndexer.exe 103 PID 4576 wrote to memory of 3048 4576 SearchIndexer.exe 105 PID 4576 wrote to memory of 1616 4576 SearchIndexer.exe 106 PID 4576 wrote to memory of 3436 4576 SearchIndexer.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_74844c83c2cc3a5c5a3ed48dc4825d26_icedid_njrat.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3416
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3152
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5560
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3672
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2460
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:2724
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1536
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5404
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:6080
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4220
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1856
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:5956
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2792 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:1968
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2600 2596 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:5712
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3048
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2792 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:1616
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2600 2596 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:3436
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 e9f57e29f060736db9e93da9107732ef0f1eac79f62670cf004883501236ffb2
- MD5 e99a23f3de9f1ddde26d4b1a68757564
- SHA1 131f716fda5d32a932820b2dc36c55d000d11c05
- SHA512 3f296fcd27dc940e678b58f3da035a7ee35672c2802dd51d22e80cde1698c2b8d1457528f5ae19b091c13d711968dae59412c634e712fdb5bfc94b3ecbe3e002
- SSDEEP 49152:nb+632BuPkFKRrdE6ohvstBhuXjfS4LWxntaB0zj0yjoB2:V3q6sjBXB2Yyjl
- TLSH T1FBD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.7MB
- SHA256 a91b795fe605bcd1438647da386bd41ec13bc74df63cefa8a5c9d9b87e120a1f
- MD5 7ad99e553de5030827c556c2c71a1ff7
- SHA1 3350efba827ca67a3fbc659fd0ae841ee35a19af
- SHA512 538e4664513a841239a34a6f9b219306e32df90e31162530634f0a31d81fd56016329b03ae2abcf8b4e76e186e293fddf79b4ceaeb12027aba865f7bc8430293
- SSDEEP 24576:NXYfDtczA0atr0zAiX90z/F0jsFB3SQk:YtcLaB0zj0yjoB2
- TLSH T11B850229779504F9DC67823DC9A1C502EA73785147A0E7CB03E4AA6A5F333C85E3EB91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 2.0MB
- SHA256 5799ba2ac8f7f2b5177af42daedc80066ce10d09bab36414cf61d9aa9b8a876c
- MD5 4ac84b8471eba47c3b0e3b25b2f4a77b
- SHA1 dbcb715f707a7c2b7e83bf55190c44f74bcd3c1c
- SHA512 02281912e41fc141b5548c1785cad5899422138a2215f7dbe0beb4b1dbf10033ead6186b3e64e95167d2dc6fc4177c746f01dd6c294c3defa93c8654a4790c8f
- SSDEEP 24576:W0Le5ji0hmxLrMlatr0zAiX90z/F0jsFB3SQk:WPji0AJeaB0zj0yjoB2
- TLSH T1C3959E16F6748371D073C0B9C5D2A68EE97130865B308ACB4286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 541812d0f85ad0a7d2558f850882ebef655c368c8e50c20b265e0f528e547c45
- MD5 4a34ae22b324ae39e65d09d78becc045
- SHA1 dc671bf435fedb2f17404a9628e40a6c85f9f062
- SHA512 bdc6fce26262885e2a975a137f2b5714c833decf70991933b8059b5d7f5627a76159141b491aae03517d9fca3159459c3da5389170520f8ee35b39172e9a5f25
- SSDEEP 24576:na7/ezSC6vUyD/aqgrvWn6q8wyu7atr0zAiX90z/F0jsFB3SQk:q/ezSC6vUzPveHjyKaB0zj0yjoB2
- TLSH T176755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 31ce86b52400798760ae55cdf399cd292924c29801376a52a4c90c2a724c0e81
- MD5 4fa80e5a5f1d08fbe9f0a872e974d880
- SHA1 39431417f3e5bb400cf1c014140fb4b6b8648e54
- SHA512 1940c4bfabbecfcb478d31137c9e510947236c3eb5fcc6a9ea5026402840664aebfa5901bbe199e94348620febf39570784118f300ec5c641aca35fb89cfc685
- SSDEEP 24576:WVbqPb88hv/l+YIatr0zAiX90z/F0jsFB3SQk:WVO88hXl+DaB0zj0yjoB2
- TLSH T16355AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.4MB
- SHA256 0905a745840f0e47130a34b3c0a13b594f05fde67dc4cf62f8e12e2ab5e74846
- MD5 1bc929e9d8183e3e9f3280b852b5477b
- SHA1 7bbe065cbc2e238250ad2ed9a13588f244af8511
- SHA512 912ff2ba45ba861763695f35f9bc2f84ddfdba36abb2fdd936de8b7a860804311a4248631eb7cb77447b9289d2cb68338d2a4584add84331bdfe19cfdb0f06b6
- SSDEEP 12288:k9JUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:k9Jatr0zAiX90z/F0jsFB3SQk
- TLSH T17865230B240E40F2CDC31B3566989C4B1AB96E7065D2AF85E1913F4FDD3C2C6E56A6C7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.7MB
- SHA256 61d462f764387bd7c6b1c2607122866161a4ced4099c48e668eb7f75531a287e
- MD5 c8802e4692071de31397eb761a2404d3
- SHA1 671fac52b670041ac21ea16df52ad0882ecd1298
- SHA512 af3b1753603efe7557613e3f65fae4a5b83438957ddac7c7a0e573e40734d3ea08826e4d74f8061b99a99a734a6687074518f63211772446d26e78439d8b6e64
- SSDEEP 12288:IeBNUbTVO86UgUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:IJIUgatr0zAiX90z/F0jsFB3SQk
- TLSH T1C685CF3BAE28FCE2C27A4D785B91C600D77278704B62A3CBD165930EDE235D15E7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 092e41a9b3627901b74b4fc4504579155189745337554a91457be4518b1c63c4
- MD5 b6562ce89aff644304acf41e5708b048
- SHA1 2e0ff258a884fe4c6e9b1b683cf12bb31d91705c
- SHA512 d94b3ee0ba792d93a31fbc32b80eaf30f2991fd2d66af8b56427809dd826567eef216292662c41b445e15ad9031bda9db044ab733e6901483dbefee16ecff6da
- SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THu:pQvGAdlCEL8c/DRNw5CWB2Yyjl
- TLSH T18D267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.8MB
- SHA256 041601d653ab8f1e8f70bf01a193e1e68a0eaf543b8acad32846b32ebc6e8af6
- MD5 85c6597d136d3054ea63dd0c05036260
- SHA1 95065bd915bcefbcec9174be2238f4b0cc0fb014
- SHA512 e2853af743c3b46062e2c3fa26f27164410a4d88c091a239104270d12b0d313886d20132c1d13bff0b7f84a82f2dbf8d49d11e0e507143c5c8d007c421abc9bc
- SSDEEP 12288:3AwSfxL/2Dc3DDLLmt0LDQewsAjOUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHU:QSewsAjOatr0zAiX90z/F0jsFB3SQk
- TLSH T15B85E031FE75D032C6BB0DB61B25C706147D7A204BA21AC3E3E86E8E59342D22776E57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 c4c2960f48edd29258884756380e6b5e8a9de98dae2561fb20fbf8a171dee542
- MD5 38c02c49c269038694201a179854e813
- SHA1 c61f0f38d2dd8b60ba36da62e596e6ca27831370
- SHA512 1c551ebc30e83dbc92ec4583628221c86661cda8990dd0b30c97c2493a9fef4d36e3aa70e1d0545a2ea7a59184105375e1914d0c11796ca4e4a69f8a0c51c552
- SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHBZ:HUEtQevvqc2W1cpV2tI32T
- TLSH T162474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 aa68e06fd92abad180a65952deb565fcf207c9681f1a9af2150d7beef3309081
- MD5 cdb410b3eb39d87829c03e7f96868ddc
- SHA1 321b9431a42899d54a69e6d6369d341e5c7a36ff
- SHA512 2ef1477e51c34830e8a80519a9acaddcd764efed5c2eff155bc84b0b6b498c309737f5f29cd74bc7e858f82b0ea1e79b97521b8a9d8e5c4487d7ce2911887829
- SSDEEP 49152:iCbRquA/m2yL5zTfFiV+XenmE3/zuaB0zj0yjoB2:noquVjnmKB2Yyjl
- TLSH T1A4D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 632c828049007b29b420916fb10159ddff7315695375bf041370185435b9b35b
- MD5 1b6b57ae61e27b090d9ea8744be366c9
- SHA1 5fda9092499f2cc8006595b718b05dc08dd5f86e
- SHA512 79946b85ed2cc733ec980d6e34ac19d03cde9cb758be76341237ffbba7b3eef8ccd859d15d8bd08b81c956920435e995d0ea93f9aad97fefe7ed6770447efbb8
- SSDEEP 24576:6AhGL3IFoiwtA5l7S533atr0zAiX90z/F0jsFB3SQk:6AMUFoiq5HaB0zj0yjoB2
- TLSH T190359D81E7F955D4F5F3AA7899B68571EA76BCA55E31C20F2160D20F0E33A809D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.7MB
- SHA256 9e271c0d586f90e1c3ca2e3de950272364b36c83668ed9acf1ed6a298333eec7
- MD5 2cac63ed43dedd19be3ca8770db21583
- SHA1 d8325ba8cccda6a83784beb0b137465d69b839a8
- SHA512 67c881c6dda8301e2b940e04adbc456fd5f281c24f4981f974a92c2a5845857e27ca33ba338c8ce67a5fab37a80c50f1a6ab3e7a534665ad70b481ab3e6566f7
- SSDEEP 12288:Umw5HEjsChNfBFgl0WDm+CbUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:RwumOWqatr0zAiX90z/F0jsFB3SQk
- TLSH T1F985F14A32A90CF9E9A342388697C536F7F2B8112A61DB1F1360C75B5F37351AD2DB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.5MB
- SHA256 2d4f883d69e0ed5740f8f6c5804afae3f2c3ea2cef5a5683c7145e54e93509b6
- MD5 30b0a495f4412df3c5ce2930dc8e8a14
- SHA1 7cfef435c2f3766558377a9b76f8b05eec5941ff
- SHA512 c7160ba2ea63c67bcc92a91245f124ed6aff021d6c0e51a114316c1561700364974cf84338f563779420fbe79f2891c54c1a6f5e7c0ba6556a65f415e5ebad74
- SSDEEP 12288:kEZ1Iy+UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:HZudatr0zAiX90z/F0jsFB3SQk
- TLSH T19375124B329920F6D5D3523CC9E44906E7B2786123B283CF12617B5F5F36AC25E39762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 1d5bddb5e41ce1dc0f8f639738ff1c3229a38df7acc6af10b04ca52faca445c6
- MD5 34533655dd199913466af02ad01f336a
- SHA1 c608674e5aa39e4c763f9e1d82eff78352bee0a3
- SHA512 cb9c29fb71b20f40bcdf17ee406f44a17ee9a0bda19ad84f66db0a0a4571d45084061abbae7e0449bde3ac9b60ce0f382169dc27193a5cb23e990e0bbc34ae68
- SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ui:4QRQyi36YOcPbLvw2gAf+PN3DB2Yyjl
- TLSH T1FB667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 4ba5c2bfb19e0be9276d2a6cd561d56a3dba521d5635cf9923d0da58f06dc128
- MD5 91c1fe94c65f48b12d1b77bf919860a5
- SHA1 03f4d85f49fdaab2776778a56abb0b2624443655
- SHA512 937175a8f225d719c9bb1de6019c14d9a93432cadb14c2bd7b15279c1ff8f79aa6f51d6a7ed54218320ffc693438a75e579a64377c0f65891e190ab921c05902
- SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ui:4QRQyi36YOcPbLvw2gAf+PN3DB2Yyjl
- TLSH T10D667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 bac86f06c589dbc455557debdaa0a74d46b0092e619ebe9da3288257aa07f4b7
- MD5 7c664037490dcf0ade7d141d6886ae3d
- SHA1 3bfefcf1cb88c3b4a0c6142379ae283b4e5de031
- SHA512 f441ffead04e3ce2c11e0d481ad1fede2f83456b7988afdeba664a5717d948812cf337c8bcd49c39b92fc4bbc6f1cf89e93e89744a319fa0fa8409f8321b5639
- SSDEEP 24576:9wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0tatr0zAiX90z/Fm:568Qg55nhceWu7PNU3/eaB0zj0yjoB2
- TLSH T174B55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8151720A1FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 b13cb9575e9a886afc5712dc2355226e6f86daf9c7e0fbf1d303f61ecf92b382
- MD5 09cc319406339c9a5a44f65439574040
- SHA1 909b7481e1c3ab2db0cc57d264fa5e9ec5390c95
- SHA512 acbb0a68a9bba325707b0dcb076851371cdaf181bf69f1b5caef224d234c122149e07e25464160ff50f2457890b2805b654924d0ba52bcd39882d387bd1ae4f6
- SSDEEP 49152:W3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99g:Hy5112gYy5azzVvt69nLKnhZQB2Yyjl
- TLSH T1FE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 0d28c5c02cbce52425e06925c8c1a1a7457f3cb8dd1d923a4310a2ec2f6f5771
- MD5 3aa858983e51479fb921ac5f2cf177c6
- SHA1 6d0162a05a5469c2a5c668f33e2a66d2bd6d37f8
- SHA512 4be72858cf3460dc1ddd5afd40d067a6f8edbc81be89f9e7abff52ccb9037af660c1e6df02f7fae0030c08ab09c7e69cd60c78d878e09e94c9e166afcb5a9de0
- SSDEEP 49152:sB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glEaB0zj0yjoB2:mu6Jmdxd2d7B2Yyjl
- TLSH T149D59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 2b8cce0558576119f94c705e71c6eb4ef6089c06e427337438c1c68de24678a6
- MD5 f085d650257733d291a4eb9b790129ae
- SHA1 5c39e62cc32ed0fa4d7643fe3f55c242e251c1fd
- SHA512 1a5275c39208b937c27cd93bb21e947387e22b8e673a973c0266c7d54b7e792e80a1569888393f98e5cd37f80aaa703a8af3c3945dc0bd2655cbd139fbae8c09
- SSDEEP 49152:+1hpsNoJpF1A63U44CwH7R4xAaB0zj0yjoB2:+mifPWRKB2Yyjl
- TLSH T172B5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 dda60aea392c5be3da8c927f55d5a26a739aa93ebbd509856cd417572a36d9a8
- MD5 0fc41de1ad6b8cdd433fff3df1cbdf36
- SHA1 4439c42d0ea05e9f218b73ae9e2a035598b24563
- SHA512 d9ca59d8aeef985295e19a99de6f2ad67eeba56c7731a452ed6ad3dd0e928a658a7f1a8dbc354aee7f73e1f517585d9a1f57484a86c412fc6fde7aeb124746c9
- SSDEEP 49152:hSuZQIY0Be2KcRVtOnks6NMHqdaB0zj0yjoB2:v5dKii61MB2Yyjl
- TLSH T15DC5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 218139d2627c960c0fe427e70f439a9f326e9718902c99ca2d92ee7c07080748
- MD5 1cb3dfa90eb6e4c82629a569da4afc06
- SHA1 89c83118d02fefc2c7cbad41b9578f6f84f9f63c
- SHA512 38a2185dd44d723509917efa665814755ea1ee779dc01e8823a17f13abe1d0916ad2fcb8fdbb45f1976ba1ce17fd21f62c892b79f026841aaaf0e245281a065c
- SSDEEP 49152:ahtSn8EApI0fig3giDn0AP5w0aB0zj0yjoB2:bX2imph+B2Yyjl
- TLSH T1C195BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.4MB
- SHA256 8ec1da9dd6bb152e1bdfe922bc7415aeb4c8dc7ebfc8a724990b332ea1884c8d
- MD5 c9fae9d2c3d8387fe385fe8c11448778
- SHA1 792c9a1b86b9b74df302f4c01660fa1540ed87b2
- SHA512 745f5c9939b7542b584ffa315b73106122961a5c204ca01af6a9efd4f43e2f6a8d537c4aa15a19e821200312c77f0a75bb6948c2b1ae6e53e3036d5fd08e5285
- SSDEEP 12288:PBUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:PBatr0zAiX90z/F0jsFB3SQk
- TLSH T16265230F341F40F3C8835B355688984B19B96EB476D36B85B2923F0FDE382C625699D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.4MB
- SHA256 680632a9a6df2731adfd825a1736e8e56779aba9ce56a94649e8c7ad05398af5
- MD5 bad7a42288344a1d708ba53f53de5062
- SHA1 b08de944462791a83e3849f7bf997a3688b80cd4
- SHA512 e02680005646e3ab1e1f3f1e86abc665e42c83842bef17f5405c0541cfd86f5ad2cb07b1c644b4bf01d301eeefc62162e7b88b8c0fa830f68f02eeb9a7ad7960
- SSDEEP 12288:TyUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:Tyatr0zAiX90z/F0jsFB3SQk
- TLSH T17865230B341F40F3C8835B355688884B59786E7476D3AB85B2D23F0FDE386C6266A9D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.4MB
- SHA256 c6a61240e31f706ee0bac4bfcbf7346a3d96dec7701ca0983aaf024ba0217243
- MD5 5ffca89bd85e42924ad7b790098a6b42
- SHA1 e82e435e001a6b13e861b01c65dce2c09e48565b
- SHA512 e3c5aba18c6c1332b53c7e4d322806e41f8657443d2a379683c954dc6a2ea45c461effe7a8b25129be863935788cb44b9653c955c1907bc809b0394302b1d404
- SSDEEP 12288:ZYUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:ZYatr0zAiX90z/F0jsFB3SQk
- TLSH T17765230B341F40F3C8C31B355684884B59B96EB476D3AB85F2D23E0FDE386C626699D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.5MB
- SHA256 6f8b87ac1215af0eb1178c68ef59ede360e7fe58e48d88911f11187d370ab766
- MD5 fa455af1aa79555d46cb2e86c91e06eb
- SHA1 4ed62430f92bb3e1c457ba39c59f9936bd323465
- SHA512 e118f7db402325ebdb951ff66b26dd1ac33df38f4920e955866d771b4fe5aa95393a831ec4a317e20c5162cd80ef127077670b9d58b4fb2b56d02843835c1f94
- SSDEEP 12288:xVXUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:7atr0zAiX90z/F0jsFB3SQk
- TLSH T11765230B351F00E2C893973586948846A6B57DB4A7F3ABDFA2413E0F4E343C56939BD6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.4MB
- SHA256 c189b847e0997485a95ad80a560f2cd1d1c9f850cc8a7b1f2316bc193c80c251
- MD5 f7d2dd64d7d91d172582bd8398e42949
- SHA1 b3bf6fccc19a925024f84a107bfaaf8ae05f92c9
- SHA512 448d585fd5fe88a7a12a08234cc0f0013ccfd272d6a96134db435968b5220543cd452f4608841caefe1376529212c92d004cf4038484b8cd47014071704e2104
- SSDEEP 12288:7fUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:7fatr0zAiX90z/F0jsFB3SQk
- TLSH T17065230B341F40F3C8831B355684888B59B96EB476D36B85F2D63F0FDE382C626699D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.4MB
- SHA256 b6d2441c3ebf8594ebbe77c5bb57491052055d58600be7a5abb447f93e3e23fb
- MD5 eb3daed60b90c4bc4331b61c118d5168
- SHA1 a96a16f47af7b83416913172f85ba76c424b1c0a
- SHA512 45e9ddaa2df6e6d14b20acac91a520011f60ab387eda14bb44b64bbae3ae47b4a731555ddaa1f74d441f49f704a12eb243390f8970289dfceb99d7c8daec9ebd
- SSDEEP 12288:BmUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:Bmatr0zAiX90z/F0jsFB3SQk
- TLSH T1D965230F341F40F3C8835B355684884B59796EB476D3AB85B2D23F0FDE382C626699DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.4MB
- SHA256 228db75566d70439bf51aa5bb467ce67e2e31153ac0080236bf1d82c7ad0d784
- MD5 03195d3b098cae2431441f4f5506d9c8
- SHA1 b365c8bb849780e3f3f82e954dc698f483c2a9be
- SHA512 8868a9c21714f66785eee633bae2108d25ae6c87cfe1dcf4e8de1412fed7e22baae5ce077fb0a0a28321f8009f4a3b99283c2d9e9f52987a1b3cc199e67c3919
- SSDEEP 12288:Q6UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:Q6atr0zAiX90z/F0jsFB3SQk
- TLSH T1BF65230B341F40F3C8831B355784984B19B96EB476E3AB85F2967F0FDE382C625299D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.7MB
- SHA256 baf9ba70ab3e98bbce81d29f1e15ce83f3c0f8a42220a645002e4f2c4928acdc
- MD5 67f7eb70c2ad10b2856658fd6941264a
- SHA1 5d1ad6c6d65977edcfe00856b1ee97e241ab379f
- SHA512 fb3aaaf72903f163b682d4f003e0cc68f13497297559c4264850da1f9bf432fe6ca29b512bc2a0c8bbfcf6c6c570ca75be7160a025be290b81428a234538e31c
- SSDEEP 24576:PZMbzFVSOSatr0zAiX90z/F0jsFB3SQk:PZMbzfWaB0zj0yjoB2
- TLSH T189850199735108F5DCA3823EC9548906D6B27C691BB0CA5F13E43A2B5F333911D3EB9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.4MB
- SHA256 656e4ef70a5afafb5f0af04563ec580cbdafe2f7d1245f097f78ca6b6aa3a0b4
- MD5 8ef0491002e1957b3dd6800489a86d88
- SHA1 fb8206e202d0b58feb6ca766d559af7ca93f6e70
- SHA512 524e5e24228686c769c2ec3c06e8ad500fd858b9d207723f794f266a24d06e87fcd7b8907e21be543850373e1dfc76760ca84e627e0816ee67807c18e70416eb
- SSDEEP 12288:oNUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:oNatr0zAiX90z/F0jsFB3SQk
- TLSH T12965230F341F40F2C8831B355684884B59B86EB476D3AB85F2D63F0FDE386C626699D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.4MB
- SHA256 8ecea52a85ac75020b9459f7e33e24c54b38f3fa9c74fae0db08351041b99341
- MD5 50bd0eeadc7f1e53feeccb3fd6335d73
- SHA1 bf997ffc130e359e4e7a1c3009aa476d73e21c10
- SHA512 e6e0d090bc63fb3e8994c0d54d62a1989da68bce5b2e637499977cbdb2631156955b5a4605dc9233e404d551404c42d355d4a3d1ec610f34efe8474d010acce1
- SSDEEP 12288:O5UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:O5atr0zAiX90z/F0jsFB3SQk
- TLSH T1FF65230F341F40F2C8831B355788884B19786EB476D3AB85F2967F0FDE386C626699D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.6MB
- SHA256 8241e3f2e899b58d3d2f71976fe9f99a1fa4515ae6e09d27ceb9614564882afc
- MD5 da97aa9261170ebe7b9296242543cf64
- SHA1 275bb5e41412774a32e07e75fd477bafa6358298
- SHA512 6d581a58f31589eba42ef3d41adbd4c42d2962e3089ddb74baac28d40f4a600d995bf84a040f75c57f81e36593ee08cb64c712ee0763d8c9491e11ecd365982c
- SSDEEP 12288:jyPz5L8+UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:Ozy+atr0zAiX90z/F0jsFB3SQk
- TLSH T18F75120B326620F9C4639238C9911906F775783117A19FAF53A02B7B6F372D15E3EBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.4MB
- SHA256 6a5236d4471884e418a577f100c052a0d3bf2b872b3464af3f9945161c63432b
- MD5 01437aad40830b176642f7fda930ecfb
- SHA1 e3437082a19dbe836cf92b17817206840836181d
- SHA512 c0d6895d39fd53474bbf8bcda41ccd24709b00c45f1a48c12bd5cb4588415feb97a75af07d0e3c14fd27a7b3a2a8d2dfb8ec353926451076ca92ad86c3188cae
- SSDEEP 12288:2NUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:2Natr0zAiX90z/F0jsFB3SQk
- TLSH T14865230F341F40F2C8831B355684884B59B86EB476D3AB85F2D63F0FDE386C626699D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.4MB
- SHA256 05bbd709f1aa97d14834b346ada5f6ca8641ba54b91734109bb740d89aca5bd3
- MD5 46cc457014b572899327f2723f5d8e0b
- SHA1 46d59ece4d16de2a32ccd5becd68a301db372773
- SHA512 d4752b2b05d6d820344a5c7b83a6bc10a7d8d1a2432bf8a69cd3f21c61f55260c2ed0ef211bde85dbe0e83cb526a51703e01193f50c7b5208b21f8f516e75429
- SSDEEP 12288:BNUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:BNatr0zAiX90z/F0jsFB3SQk
- TLSH T1B665230F341F40F2C8831B355684884B59B86EB476D3AB85F2D63F0FDE386C626699D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.6MB
- SHA256 f73963d4fb29ccba395f7a3fcdad9a079f88bfeb317ca9e90b57207c4711445d
- MD5 fb7dcd23097b672b522c7a5c3d346ffb
- SHA1 4bb3fb8f89138cac6899c96e647b0c66449e79c0
- SHA512 37cc78dcbc5ec5e9132580e11e5affbdbd6122c5d4b80ec219a41efc62bab6d16057b9e60a317e34d4f94983ccdd2e75fc71941e322350435e4ddfd1ee42fa90
- SSDEEP 12288:SyPz5L8+UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:Pzy+atr0zAiX90z/F0jsFB3SQk
- TLSH T15075120B326620F9C4639238C9911906F775B83117A19F9F53A02B7B6F372D15E3EBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.7MB
- SHA256 7d0399bcaae0d08e560f3eb0d9f763f4a94a573a0d533374a7b5b8d0d6e7c9a1
- MD5 857b6622bcd45280d98ac1361cd4feaf
- SHA1 520f62a0337e70acd4542cc6aa9361dbfe0ee394
- SHA512 c2a864565e05f4b89723382842cab08c56756db37beac6e3a87c72105011239f508a1d41424381d466599b4403d53f2ec326eff222c30c265b007ade917be173
- SSDEEP 24576:eTBaLl3z0zDoatr0zAiX90z/F0jsFB3SQk:eTcLlj7aB0zj0yjoB2
- TLSH T182850199735018F4DCA3823EC9558906D6B27C6A07B0CA5F13E43A6B5F333911D3EB9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.9MB
- SHA256 6cfc15eac17a4fe1b469824cb4f8de9d07079eab59a63651dbed839cf398e4a2
- MD5 4830d75b33d09ed7011b33a69a35d7c4
- SHA1 71aa9ae83e5c107886b487ce864afc89a85e96d6
- SHA512 f35fa7894a8f7fb05dfd5e97b7a4eb7317216077f578e23d13a415f04263aa8d0619119060e234533a96101a7b8dc3687e14272da66b26716fe76f1eca7e0154
- SSDEEP 24576:y3pd9CHKy7GZsatr0zAiX90z/F0jsFB3SQk:Upd9CHKyaWaB0zj0yjoB2
- TLSH T1A795CF91B3E810E5F0B39A35C9758512DAB67CA91B71DE8F03A4261A1F337D18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.4MB
- SHA256 4b5a056f09f1bf9bc9a1b0dc079edfbfd0ac3b0ac642dbacfcd08a7ab0b747e6
- MD5 0fdc25372313cdd816581d573666113e
- SHA1 5102f1babb53470f087dbf7612d4fee7d6bf7e51
- SHA512 3532cb4cdd3337b5bf0b00583fea6e4c837d6f625c015db5ff33fe346b53a52cf84280d07788de2b244bf2511b70982bdf08082d64f787d19770899974c203f0
- SSDEEP 12288:Z4UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:Z4atr0zAiX90z/F0jsFB3SQk
- TLSH T13565230B341F40F3C8831B355688884B59796EB476D3AB85F2D63E0FDE382C626699D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.4MB
- SHA256 21a8aed0a73b64ecc32809104cfedd2632b0df9b4c8270117d1b764723f4bf76
- MD5 cb7dd477e18c65bcbe0c003edfa87f5b
- SHA1 70996e846748b3feb6f76762f15c274577bd03f1
- SHA512 e84522828863835135f0c6286c8ce531d7477573f9b355cd65f3aa3af0f4183264707d309c008e83c36c4cca8a98926fad70c553db6515f3130a042ee8e4e946
- SSDEEP 12288:UeUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:Ueatr0zAiX90z/F0jsFB3SQk
- TLSH T1A765230B341F40F3C8831B755688884B1AB86E7475E3AB85F2D23E0FDE3C6C625699D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.4MB
- SHA256 193de1cdb4c2eb796b0188c2f3ed0213985580d076b54ade0d7470feca8695db
- MD5 275e61d966c86852ca8572f72022b513
- SHA1 4bfef517d64630392a82c396ef1f7f5b7b13f826
- SHA512 be8817c311aaf1b2ab54e3b2c3da118431acae4ac587802a3f624a4e93b5142c49f61c1599d2f123fd7eef4430cd1687033a31c5f7675ec3902f2ae5ce77dbb1
- SSDEEP 12288:IjUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:Ijatr0zAiX90z/F0jsFB3SQk
- TLSH T14565230B341F40F2C8831B355784884B59B86EB476D3AB85F2D63F0FDE386C626699D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.4MB
- SHA256 bb89b9a26efcd4c3e735aa0e5860c3b403de3b72a56e2df522c63b9a9430882c
- MD5 c53dd77fcd6b76118c84856eae5dee49
- SHA1 4b931ae93524f55ed395fbca3a99bec7747ec9b0
- SHA512 ae334129f7c8888b51c98ee123cfce30bae17b3a9b3b8369b96ca220d11337fa4368a6692344f9356db22b984256cf68373a3e9d706559c620959ae7251c52db
- SSDEEP 12288:0NUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:0Natr0zAiX90z/F0jsFB3SQk
- TLSH T1D265230F341F40F2C8831B355684884B59B96EB476D3AB85F2D63F0FDE386C626299D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.4MB
- SHA256 a445dfdbf6d0a8b33f66eedb0cd037abe931ae6a5fc5ac6de8a882795d2f5e8c
- MD5 6fc6f00abb2c860f53ec8246d89b3f33
- SHA1 e071790377521ab7abb31da1eb40a402be584294
- SHA512 8baf04864cce81ae382a161811b1b7720effa684e7414df1496a1cb5344a793aafdaa559828838c2361ab22cfd55b0b098a2e421789b24c9f6d17e0d16b6e56d
- SSDEEP 12288:H4UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:H4atr0zAiX90z/F0jsFB3SQk
- TLSH T18665230B341F40F3C8831B355684884B59B96EB476D36B85F2D63F0FDE382C6256A9D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.4MB
- SHA256 e67522102c20313956c1e2e779710d2360b5c6c2b58196f830b3548378b16e3f
- MD5 500ad114134ac4539190547bb9049b5f
- SHA1 2bf04fab98bbd87d2bd5495f9c3153ad4bc84485
- SHA512 bb4da98a8bcefe964c3ed45cfddcd3272a61a1c1aaecd8be20425bbd1bbc11eec1a4cdf955d74cb1fac4b67a7c0aec2437ffe6359d8fca40c5c74e1ea1f67938
- SSDEEP 12288:p1UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:p1atr0zAiX90z/F0jsFB3SQk
- TLSH T16565230F341F40F2C8835B755684884759B86EB476D3AB85F2923F0FDE382C725699DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.4MB
- SHA256 c5a2a304dabfe0452c0f858f77f2ddb5f48f5009b6ae14a31d49242093131914
- MD5 d950cbf7d9bf45e0c2bedc9041e35812
- SHA1 297007760f952c957b94a1e12a0578684947b3be
- SHA512 aeeba64e3e1d70e235e4d76e9dc9e0ae2efaabc8f9907037b1a12952e4d2efae2a827cdd19d37f66237ee3322225bc0d0826061d6c09d870094bf2db37e8f35e
- SSDEEP 12288:FfUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:Ffatr0zAiX90z/F0jsFB3SQk
- TLSH T17765230B341F40F3C8831B355684888B59B96EB476D36B85F2D63F0FDE382C626699D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 1.4MB
- SHA256 d22ec3951a4fd12f08bdd43f86c67891998055927c676a6f6e1b99309895fe39
- MD5 474acff005c78d2d0042da99d3b00b58
- SHA1 1f19aa5d143f6b7eec03ea7e53d266ee26703d12
- SHA512 931ec61fae7f99bd9b98864fcd58e27da73717a439725b71365c041d5edcfe6ea7f213c7cfacf4df0bef4a99cfb0d72fbf2831ecf3b5e597c97147daa3074c21
- SSDEEP 12288:qQUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:qQatr0zAiX90z/F0jsFB3SQk
- TLSH T11165230F341F40F2C8835B755788884759B86EB476D3AB85F2923F0FDE382C625699DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 1.4MB
- SHA256 e54512934a41e945a93fb0260971a43426af13e9d5b333af935a1f1b453be2ea
- MD5 26dd24de33a29ce61cdb8728544205e1
- SHA1 25761828fbb90f2ada168af4f8697e5c05b3c941
- SHA512 fdb0770b106bfc0bc351c05cb8a3c8365a5a026688ba7c2097169fc3b4139d4f671da6c42182e8297fb07e5fa12423a8b5c40de226e5d6787eaedd98bd558cf1
- SSDEEP 12288:+fUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:+fatr0zAiX90z/F0jsFB3SQk
- TLSH T10065230B341F40F3C8831B355684884B59B96EB476D3AB85F2D63F0FDE382C626699D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.9MB
- SHA256 d716e6755b9abeed48556d5364886cb4e58c1a41de757d5bbb894a904df611f6
- MD5 f48382ce45e93086d176130cc8f3dda4
- SHA1 b68d03609437495ea9a59841872940d7dcbb9fe4
- SHA512 aa3e517e513457198714a14962cc8f1a58928e62d9375b75d25af6f07428d3fffc045189231036fb56f992ccb37c8421ac2ad6464abb12c855170c882d39d431
- SSDEEP 24576:Gfwv2k9RX6wkyAIpatr0zAiX90z/F0jsFB3SQk:sMnYIpaB0zj0yjoB2
- TLSH T18295D029EBDC44E1E0B7923C89B7460AF6B178681B71C6CF129A536E0E37ED45D39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 27d8d48aa8c0013cdfb8ef58dc886c742533c4e2c504de44bf1ec3724ad913c7
- MD5 cfca26aaeea8ebfe3b9e6ca8cede7522
- SHA1 3c7afbf8c0b9f1e167c88adfb8366b955d83e10b
- SHA512 c2d76ad55e122a61633b81fc5cbed703261afad3c0af1794a2f3dd7abe3afa8a68e331c9010a9fbc3f6e8b42a5b2461893b450b492744d760c1c4a740a353f03
- SSDEEP 49152:0YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0UaB0zj0yjoB2:DySzPjB2Yyjl
- TLSH T1E8066C56A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF0AE3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 67f48ce9fcc6d6c0861ad6779adde5c675c943344dba62cefdf2f8740628ee13
- MD5 58f12d6bc9f1b6fe989f1b6a560f95df
- SHA1 295beeaa556080bff985accbc99f697b08f5e59d
- SHA512 95381da54aae06a11cb66b673c45d235d3fe66755f2fbcefcc0fe9fb8025df69a9d9c1070b14d3557fcd849b52543848307814a2482da9a9396d77a458fc0038
- SSDEEP 24576:T47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYCatr0zAiX90z/F0jsFB3SQk:T47JUQjTirIhCnDHUPfF/EaB0zj0yjos
- TLSH T1E565AE1EA3EC01E5E1BA927885154A1AEA71742D1F32CACF22B0537D6F23ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.6MB
- SHA256 06db9efd3982326fc46b082b29513134ea88c6047c6306277505fcfc873c6cd1
- MD5 663a6eb1f72737f14cc09edfa60dbde7
- SHA1 93798ab485882d4b85bdeee2836ae262f1b27597
- SHA512 5883b3d151a0c1af83dc5eb17c43305f0e63b9115895feb3bced48b47322ffff69db9e958707f7998feb4119f9fcea9b8b77418b1b9aca74e8f28bffe9edcbab
- SSDEEP 12288:NVsfdUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:2datr0zAiX90z/F0jsFB3SQk
- TLSH T10975F00AE25801E5C0AE6235C7444A42B7777C6593E2D7CB62D0FA3E1F396C15DEAB83
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 05164e915ebad359870b85896bee1e7db83242078945ccd4dd66bcd5a51f1394
- MD5 d4b32e778f3a153eeb2f828abb03075b
- SHA1 2530086fe7898c5c0111988a9821f99ec94c51ec
- SHA512 e8464ee019e5fe5336fc9710874e1558c22630da9c145117a221117c1bdf14bb8d19aaf7dddd0a42a52656b5f155352b669ae798b06acfdc7ba0d76e6048e5ff
- SSDEEP 12288:RkRoU3fGaoqAlHLgRI8Adp97KBcXze744fLRpcW50zEte:RkyUPGaUERIR5KGXK744fLLV50zEI
- TLSH T11A351750B62AC75FC6A840325E32D5CCA7707D45FE45AF0773C8873FC576668BAA2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.6MB
- SHA256 3afa4afe0946deed709e4a079444a5e3b4e9389d69981c6c2d64a38294c74b06
- MD5 e54da799b98ac8f5754a028795babb19
- SHA1 688f2b69ae3747ffa8416a39dc1f60adb6f8b14d
- SHA512 60f4a8b03fa1a6c96d10558cfd8535fc8c0cffa464dfe7a63bf0605ecc9c44d554ee5544f11939bd74eafb52113d5da9dba144e45850aa8fb132bce48b674edc
- SSDEEP 6144:h9m8HeLMlsys7shWJWyxJyJdJrv4kdgYMytMxPretLMytMxBIj3HZ/ZST4XCKI2Z:9nCcC9xAzF4PKrBNqJsHb4+B
- TLSH T143751B816137E28FD4FB507203295B8CB7B4EC477B456F22B3D84539D82AA25A4F93C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.4MB
- SHA256 a8af234456d27a166896530d87590b9d882d11c31a3396436084a9a2d54cb169
- MD5 44ee389aaf25a6afbd1672cd7e40d7a4
- SHA1 b6c304350c8a393683e2d5ff204c1a5067adfe9b
- SHA512 248fd6d8c13964a5c14f37ba9610d1e5a16e37784259b20fc6c6e6a6da3534113442fa525b1541ec6d541fe97839175e395b12d5c761eaec49fde01f27dd42ea
- SSDEEP 12288:pO7FUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:MFatr0zAiX90z/F0jsFB3SQk
- TLSH T15E65230B251E40F2D8E31B3452988806267D7A746BD2DAC7F1813F4F9D386C65D79ACB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 536daaa424aa7a7a4ea22af2feb8faf4a7371efa96bc0ccb91e44c74d0ebbde3
- MD5 0f7f9399fb3ce66f7acac8bd5cb8cf87
- SHA1 c1f3f40a10324e17df923a40d614d004365b9d76
- SHA512 e2bfafdb7ff67c2b1e7f1d2212375aa3ab033b180d015b8142d7cd14a377fa3eb49a222c10b1a72b19723bcefde6bf40794479eae4cff9e591358395a19a33fc
- SSDEEP 24576:Ugb6bmBIi49WNNFpg1rSvFv7bY7atr0zAiX90z/F0jsFB3SQk:Ugb4mBIBhGFCaB0zj0yjoB2
- TLSH T17865AE1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 2.0MB
- SHA256 1601ea9c3ca5f1e515809f669b33df01924e787142b8cbdfd2f00d8dac3a95e5
- MD5 f572bd87cee34f5379439de35a8f8697
- SHA1 b3d120ad38a7a558ef6289b8c29dca22ab9c2022
- SHA512 9f4697e6f77144c0e66354d7d13ba8823b5dfa7af0962ccdb8203680fc3264e99ab0a82c1a510e4dfb0d3d62b2ce422c39a8aff4b77ae1007880ee321fe6430c
- SSDEEP 24576:SG88u8FpJqH1Nzria7/mSatr0zAiX90z/F0jsFB3SQk:J7ZFPqV0a7/DaB0zj0yjoB2
- TLSH T15E95016676E101F1D477D1388A864663F6B2B8250360EFDF07A89B561F23AD50B3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.7MB
- SHA256 b229c2deb208a67255498f3a5ba7b0aeaf8ccfbd6fff15084552ef698ea52bda
- MD5 8cd60221ee8279fa655595c9dfd6ed13
- SHA1 7d6e0c349da363ab86b3421ed3f6110f35191011
- SHA512 ef02ee91a2211f03d6c377326f75482252e09f9253dca6550c0bfa860c1e4da910294f663d8b56609762e0723a41980a1fc2fc755b701c66a0ad6a516bda0945
- SSDEEP 12288:2HvUrBFrEjwaQWUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:2PUr+NQWatr0zAiX90z/F0jsFB3SQk
- TLSH T11185E11F22AD18E5E677A17D86818609F771B8621352E2CF02E0917F4F27AD8BD3DB50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 34bc399f7128b4dff682b208e7e9c3d6fc2be5d6c7a84193dcc2592a05d7b3e5
- MD5 fdf661d25233c53eac90306a66541d96
- SHA1 1029c239f978b446c90e3f9899b6a5ab87323400
- SHA512 eb4aa196d38f6f8c51bf58afd9c45a04f73dcc0ea3296396db3643cf33c11715935c58e3936fc23719e3a2ebb3e2fdaf540546355acf32b233cc25f0961ba2db
- SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmaB0zj0yjoB2:nG05lO43bYB2Yyjl
- TLSH T115D5CF6E62EC11F9D0BBD17CDAC64A0BEBB23425033556CB02A486A91F27FF4557E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 67895917ea4cce9a38b839485defbbd98bfd1fbbbc9e47938098e2a5ed1630f7
- MD5 5c9bd2c444bb816203efaad18a0532eb
- SHA1 45904e24c1e8146797f57f24f5d53717889e9b18
- SHA512 65b41d2c04dd40526f9629295ac743c33deaa4c0812d21769e90ca3098592afee9f538b43d1466b543bca6e459130e4079c33065b0bb97588b39cf8aefb238ba
- SSDEEP 24576:Gfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnUatr0zAiX90z/F0jsFB3SQk:ea5POZ3BJt2pasx2+meaB0zj0yjoB2
- TLSH T12D65BF5EA6FC01D5D5B6D17DC583860AF5B1342153329BCB122182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 4adfe1065d9680c94610dda9b73213b057b3237cba117d8562a67c7b494f103b
- MD5 277cc1bf8103ce533562875a6ac8f78e
- SHA1 08e4eea46eca0a70de12b9321cb2f0302e1ac7c5
- SHA512 f0f2864e8c18233e51f3e99c70301ae3dc937f04d6dfc8736b606ecb01f308e26c8567aa0d7251cb1e1076bdce66f0a09479170f58ad0e402f2671f6350d4f9c
- SSDEEP 24576:qNcwHdjbyQ4nLC18lb/EOjowL7FkKatr0zAiX90z/F0jsFB3SQk:qNc/zEOVHFjaB0zj0yjoB2
- TLSH T1D5858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 091752ebc7664eaf828a32dbebda952fe5dc1541ba4ec983b06c8b008cacbe1e
- MD5 956611f17f6c12e06ed608308f6002ce
- SHA1 7339d0913b1b897206d2b4e20832cff3aed32276
- SHA512 997ea98a83bfeb19193b496da8e1624900b77e78d6345d384066bf640cff4a2023ff22aedebc0ae7ceffc704317ee7249a4efc7477d8b6daf2c213a3f5dc7166
- SSDEEP 24576:qTkNvNnaFeYhJNtmZBmQatr0zAiX90z/F0jsFB3SQk:qTMwBtOmQaB0zj0yjoB2
- TLSH T10655AF2E76B846E4D1FAC6B4CD238512EA727461173293CB5390C13F4E279D89E7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.8MB
- SHA256 e3d47cc29f2d128d8af13ccf415f0069b17f7c331196846fd1702893b981d07e
- MD5 35ba08303ec8893d075670a9f634276b
- SHA1 4734d05d636d2e622419a576259180760048a29d
- SHA512 495685777ca66997cdb29d36eb0e9e0318910fc1b8f4f769a9d0df24fe5ba6f14532b0c3e50782bbda88742901e7dec07a9a5690df6f264dfa6e6b2743b20753
- SSDEEP 24576:hD3FHshBIYQgAhatr0zAiX90z/F0jsFB3SQk:hDVHeBIAAhaB0zj0yjoB2
- TLSH T16895E13EE65D00E4D47BD2BCD6538906E77138A803626ACB12D091BA5F2BEE47D39F50
- MD5 SHA1 SHA512 SSDEEP TLSH