7e4bbeae0bbd6cf78405151ba1ca500ba565ffc59496fb30989420b2698d438c

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 00:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_6293dd281739bff95d2996608363252f_icedid_ryuk.exe
Size 1.3MB
Sample260810-babc1sgm3s
SHA256 7e4bbeae0bbd6cf78405151ba1ca500ba565ffc59496fb30989420b2698d438c
MD5 6293dd281739bff95d2996608363252f
SHA1 9f8493315f9f232760670f1c1a3d9b43bebb5eae
SHA512 978d22f98d56140ad0cd7b71c6f7b29694a137a6cbc038dd46bfbb0587e4ae869e33984a5a00e9d42a7085ac19c67f2193a51e668b01c77154cb77d8ff049c51
SSDEEP 24576:U9nJAfYLH8AcevDN0FImbwQuq3Wia7gD:UJAQgAT76sQuE
TLSH
T1F455125762D824EAE877C2358C735669E7B5FC794311DB6F024906863E3B181CEAAF30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4400	elevation_service.exe
2532	elevation_service.exe
6120	maintenanceservice.exe
2928	OSE.EXE
260	PerceptionSimulationService.exe
5392	perfhost.exe
1596	ReFsDedupSvc.exe
5564	SensorDataService.exe
5068	ssh-agent.exe
5632	AgentService.exe
4492	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_6293dd281739bff95d2996608363252f_icedid_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-10_6293dd281739bff95d2996608363252f_icedid_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\70fffcc983806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-10_6293dd281739bff95d2996608363252f_icedid_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_6293dd281739bff95d2996608363252f_icedid_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-10_6293dd281739bff95d2996608363252f_icedid_ryuk.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-10_6293dd281739bff95d2996608363252f_icedid_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009269680e6328dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e865950b6328dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000046b19b0c6328dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000965c7c0c6328dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7e6510d6328dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7fed20c6328dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cae0210c6328dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4400	elevation_service.exe
4400	elevation_service.exe
4400	elevation_service.exe
4400	elevation_service.exe
4400	elevation_service.exe
4400	elevation_service.exe
4400	elevation_service.exe
2532	elevation_service.exe
2532	elevation_service.exe
2532	elevation_service.exe
2532	elevation_service.exe
2532	elevation_service.exe
2532	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4224	2026-08-10_6293dd281739bff95d2996608363252f_icedid_ryuk.exe
Token: SeTakeOwnershipPrivilege	4400	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5632	AgentService.exe
Token: 33	4492	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4492	SearchIndexer.exe
Token: SeBackupPrivilege	1596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1596	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4400	elevation_service.exe
Token: SeDebugPrivilege	2532	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 4788	4492	SearchIndexer.exe	100
PID 4492 wrote to memory of 2132	4492	SearchIndexer.exe	101
PID 4492 wrote to memory of 2724	4492	SearchIndexer.exe	102
PID 4492 wrote to memory of 6092	4492	SearchIndexer.exe	103
PID 4492 wrote to memory of 2380	4492	SearchIndexer.exe	109
PID 4492 wrote to memory of 2348	4492	SearchIndexer.exe	110
PID 4492 wrote to memory of 2404	4492	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-10_6293dd281739bff95d2996608363252f_icedid_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_6293dd281739bff95d2996608363252f_icedid_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:6120

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2928

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:260

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5392

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5564

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5068

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5632

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4788
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2132
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2724
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2836 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6092
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2380
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2348
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2836 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 07d84568ce730cd055a0d74d2a7c18d6d07afad8b2687f1a816be35f5bb0c91c
MD5 52b5562e0122f8bd4dbc51d59381c100
SHA1 193b3249690f631e841e177e540c559df9161922
SHA512 0b712e585f4dde17a769830a7672a9d599d74afce2475f22fb0e103a4dab40d22d9dd9d809fb059a198f23beaaaf4426ce0363b3954fc7d0c4b290f7492919c8
SSDEEP 49152:Ab+632BuPkFKRrdE6ohvstBhuXjfS4LWxnNAQgAT76sQuE:q3q6sjBFqGsQr
TLSH
T1FBD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 2eff76c0c15c8e3fa5381926c7c7f43846e7f6752459a6906eefa5b4be3bfdc3
MD5 a9e230924dd4a81e6d5573600d740525
SHA1 c480695823a656568e1fb0d4b01728ae947dbd7b
SHA512 1c071e2ba736ec1aae42a41278a0cf6505950f08191071bff38496140e28796d916e3db8fdd6fd9c278477dd4e76dd84995199a08dfc6314fc2310c0f60aecd4
SSDEEP 24576:nXYfDtczAtAfYLH8AcevDN0FImbwQuq3Wia7gD:ytcqAQgAT76sQuE
TLSH
T14375F12963D408F9EC67813DCCB28525E673B8954360E7DB03A49A6A1F332D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 c03077124d8eea1855efef5c0889b1653de5fb8e740ce5ce5d7a5c5ef57b28c7
MD5 b5ce9d4255ca2a504a0b25200475a26e
SHA1 8dcf883d8c3544a4af837b5988fce4b2d0d47b2c
SHA512 4aafc3046e3606321823f0829439e8f2e2a55924a6dc9ad1a9c5b833e5d5b8d2247021e82894b034625258b670668b87c4b06d5c76a6648865761137abe1014f
SSDEEP 24576:w0Le5ji0hmxxrMwAfYLH8AcevDN0FImbwQuq3Wia7gD:wPji0AjTAQgAT76sQuE
TLSH
T16585AE16F6748335D073C0B9C5D2A69EEA71308657308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 556e22a1438d82f3a7d8e324f3ed12bfebb0b96584d4d6ab4b5ebe1cd594168b
MD5 265866a9f7c3e91521c6108d63c6e469
SHA1 067ada0a743a19541dca12013b8ae1e60b9c6cff
SHA512 a9d0ca6fbb8db590ae56872613c719f63553f1bf2e901848189f937c25aabd32a205e743d4bacc769f2d3522be61a9ddea26d393a361941ac11864afa61815af
SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWn6q8wyuaAfYLH8AcevDN0FImbwQuq3Wia7gD3:O/ezSC6vUzPveHjy/AQgAT76sQuE3
TLSH
T17C755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 43321e7f1e140490dbf02198375ff01534676273a9392d83850dfdbdcafeb3a7
MD5 6536329790b19cb65240609648ea18b3
SHA1 b30f25274ddad0b7790d907e649dd92deba4b36d
SHA512 78ab57e2771170ad3a2ff8d583784bec47bbfed3c6be49faf7d66a39331f1a7c1ccf6cf875b7b81e0c15beff71aad3864c2b82bb41b45635b2265bb53f994d48
SSDEEP 24576:qVbqPb88hv/l+YRAfYLH8AcevDN0FImbwQuq3Wia7gD:qVO88hXl+iAQgAT76sQuE
TLSH
T14A559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E676D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 cc68b4fc1a726ddcd04621a14de1f88ea302ac37e679089ad169db535162ee9c
MD5 24b947ed2973dba10c04f7349a21da4e
SHA1 88a733e0422ed596d032d9ce94edd4bebe3db7a9
SHA512 0e0da53b51385c7867cde8576cd709a93dc37337a856e98ce35faedecb5afe6ffe61437f7d16a21ea412a850a806daaa8642746f2231f97050d5ca14bc6de68b
SSDEEP 12288:4LUAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:4LUAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1555523574A4C30EAFEFBD0369CBBA5B963D1BCB88249979A05463BCA793D408D0D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 c5a33d0df1c0cfdbb6b4d1ac4668579bfdb607ff245f24928e5b21a62c3016d1
MD5 303cd620a6aa31e36ab39058e3eb9148
SHA1 0150d219fd29287aaf7714bb7458be8cb8f28440
SHA512 fdd80efa7ee540cf1bd9fa6da61bfcb7811d2c7805c5f27cd31eec38c3630b581c2da60747f086182ddd4d74b90939f2a6910450b92a68d9ea306ef40523009c
SSDEEP 24576:gJIUpAfYLH8AcevDN0FImbwQuq3Wia7gD:gJIUpAQgAT76sQuE
TLSH
T1FE75CF3BEE28FCD2C67E8D795A918600E7B278704B51A3CBD165830EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a58c7caaddccd8d0d85506fd370de81ad39b1d8469da5025222ae4bbdfde80e5
MD5 000ebf5834aef359a04d61018350719c
SHA1 36c6a09d8168516a5975c7c7a8c8890ea3c83339
SHA512 8d51d817b1ee8e0502f6b541d9b10e9810853c2f5092fb6a2746a602b782948c0f771e166d5bada1984b95b183b3aef3e0d08900d8b64254cd94b90a4c37499d
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THy:IQvGAdlCEL8c/DRNw5CjqGsQr
TLSH
T160266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 ad32949a0bca5bf5a8094c0d930dc4ffd92d774e696e7e931ade051440944ea4
MD5 3b1470860340efc99d4912aea50113ed
SHA1 69eb43cef899f027c6c9546504d90fdb6105401f
SHA512 e2b074e949475905e92cf8f78945f8427c31846bb6ead4f13a2ede0c8caa92befce85fd5fb4f4f8094bbaa35f4fda5db0bfff79b31ed1cf6c0efd5595975f421
SSDEEP 24576:s0ewsAjDAfYLH8AcevDN0FImbwQuq3Wia7gD:xljDAQgAT76sQuE
TLSH
T1EA75E031FE74E036C6BF0DB21B36C716146CB9204B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9e4a0b12e9651d98ca266c89b92a658c08e3485e025ef023a4f9573b1cfc0baa
MD5 98645b410d997b84365861b4e4dc840b
SHA1 3c3dd2af4139b8b543214d5d23e3fe7b7147c3ab
SHA512 1fd60bd6f571b76c3b07d071a20032d17834c93f5afa7020c02f27c3c9c62c482ebf72ab4d43472466383e3fbec91cd5a74a0be055c369bdf9c27dc7cd4b905b
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHij:eUEtQevvqc2W1cpV2tI32
TLSH
T19E474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b1b312c1caa413d0dc9e5e3566965c3fa10ba0e30d4e1788469ced5566653e0e
MD5 0943165d947e067bd711163cbb8302ba
SHA1 48ddbf70ca3fa0c53dcdce72c5e7acb150b6d2f9
SHA512 10422010c6b460ca20ed0a3edd2eec91dd010a8d32f1cdf9de9a5635b89554093baf00fbc457e2fefc908fe700b2f923744a35280dbf0f1bd62f1b19f966de43
SSDEEP 49152:GCbRquA/m2yL5zTfFiV+XenmE3/zjAQgAT76sQuE:roquVjnmfqGsQr
TLSH
T1FCD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ab25bdc1e55f4aaedd231979931debd573e13a9c6b03c18fdd9e8f9e6434b8f9
MD5 e56938533f186e6f1f4415dbfd454b9b
SHA1 906c42f981d779d9e5ddfdc36ec9cb1784a565e2
SHA512 0af69f64ce1efbb330ebb6224d61be4c2657645b4b7cd5f644ac8358fc064b79a3c61fea4a2185f1c927ea59ca0f5702d75fe4d8e508cc7aa61ca9e9f775e313
SSDEEP 24576:wAhGL3IFoiwtA5l7S53mAfYLH8AcevDN0FImbwQuq3Wia7gD:wAMUFoiq52AQgAT76sQuE
TLSH
T1BA359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 a688285bc53743c15ff24238e7898a8850d68ed5beca418471bf3c5a5662660a
MD5 2f1c289683ce4dcefec6fde81fcee72c
SHA1 db2f705f96bb2a10f46b33e58214e14e48163f5e
SHA512 bab7482960ec2caeab51f38a00e615990bea333f3628a3c843853bcfdbc77cb1e1cd666e1eed49297f3c6061d29dce59b827cc5df92fc8269d8b2211c231162e
SSDEEP 24576:3wu4OWfAfYLH8AcevDN0FImbwQuq3Wia7gD:3wvOyAQgAT76sQuE
TLSH
T11E65F14A76A81CF9E9A781398597C136F7F2BC152A21D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 17229844780fd5c697428e7e454cfa8ef7a3a2b14eb6054cfe6e31582da0e11d
MD5 ed82bfcbcc5979eb08769c73a02ae701
SHA1 a96ef8fd67c74af926f6e9eb830a1a98523b5ba1
SHA512 062ef03d5f838a4279718a90deadbf4bd3e46a49c14c85d7e564a9403c8da5d79568668af04d9dfd67f807a6495a5be8a66008673cc4e8ac8679f421bac2cdf8
SSDEEP 24576:UZuoAfYLH8AcevDN0FImbwQuq3Wia7gD:mAQgAT76sQuE
TLSH
T1B055125B239830FAE5A7C139CCF25659E3B278A6532183CF0215079A2F37AC59D79B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ad220ef850842aa2448578dcf18696b48d5ca0461edfb82e9a6f17d80c850db5
MD5 911c56ee326269b29c1b30cbf27a7125
SHA1 35610c13b184e2faa0b0d1f72d0982dec6cb80db
SHA512 41dbfedf561103b40052f8795495ecb726e163e4dfb977137bd4612ab6bc9666cc53b0528eb6d38aa6d828e045959554af25b1d7b2c7bce780c6409bf1a4cebf
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U2:aQRQyi36YOcPbLvw2gAf+PN3uqGsQr
TLSH
T1ED667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5295a6d82582aa87e5d246ef46ec593f23f05e731b14c1fa7f61a219ca7959c3
MD5 a8d3db61805f42a098acdaee5234fa64
SHA1 f916f1b24ad594dfcf7d715901320117d5c2217c
SHA512 f3c8ff4cc6a1ef10aea6ff784aa0c96a75237ec401ed66abea7714932a1e3f148d2be772747451db513329cb876842110e46787749a5c029c4e6245e41ccdf48
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U2:9QRQyi36YOcPbLvw2gAf+PN3uqGsQr
TLSH
T1FF667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8a80631121805240bcd82e1c3dbbb2198893b65849aca9d680c2b829e7a873a0
MD5 d6e1061a2961ec03c348a6bc4721aecd
SHA1 5664fa76fe2f454ef7872184ad5c485fbb1daf59
SHA512 b5dc34637bc5c0b3daa0c19b7091086abfe3b7fce08b7af7023070adfd605ab35b35578d47b18112a847a036aaa26a48c7298ff4cd469ce9af4615736dc737aa
SSDEEP 24576:qwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL04AfYLH8AcevDN0Z:E68Qg55nhceWu7PNU3/TAQgAT76sQuE
TLSH
T182B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5d28be302b2f4475edf8e6a12c59493102312f7f4581dcafcba6ad8b2fd8e154
MD5 dcfa9bfaf88981e95f0418b861dde305
SHA1 6b1bbcb0f7b86c6f378a0044dce4545833850730
SHA512 cd67801a5eca837e22d9e9df6b94bced9ab33672a2b131fbe256c21e4fc039882201a932f553b19018d2817a81e366b0b773047ef1ebc6f36a4b2f5a4a1cc939
SSDEEP 49152:d3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99I:My5112gYy5azzVvt69nLKnhZ5qGsQr
TLSH
T1B5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e3d9ec901aa6e16431afc27901524ca5724f981dc17bb911d9b7eaab533e4a13
MD5 11edb907c5ee68da4c0bece875497326
SHA1 a667a9856ea83d27539d384a131afdf7f94d6805
SHA512 c99b449d132e0c3f4e916450529fbd74a79b80a2802497be150e8eb292d9841b597b41390f0ab50be7c08b340d15500132dc7fa093b03b768000c4542f60c010
SSDEEP 49152:7B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glUAQgAT76sQuE:tu6Jmdxd2d5qGsQr
TLSH
T1ACD59D13F1D901E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0951f1f3e33accf2dc5332c1b00a61405173d1896bd7830b0da118ddfbf2181e
MD5 9bf24de488deb8d4a3c35fbb6ff6343d
SHA1 bdd59bafcc7a1087fe8b57096ddec6406dd5129f
SHA512 36a39eff876ec3289a77d211cecde8cf696e89d7a841c6af6d67beee13a0467d79d47d3144c8f5d19bb083a99ea7c9aef0bd94e43b106668dadef0fddea7b6eb
SSDEEP 49152:I1hpsNoJpF1A63U44CwH7R4xJAQgAT76sQuE:ImifPWRfqGsQr
TLSH
T133B5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A9077962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9954cb600213f7e8a232754146202399844836a7e99afe163f023fcc614fd2ff
MD5 d8e5063cf5794514c2b400ad70fe8c85
SHA1 ebf0d7f72ca3c5bb0f48714e8972ab81357d83ec
SHA512 ab9d1c63e402c904ee462e1e45abebc963118093bbeeb9c64522a40d3c3bc35022fc85a2a7ae25c1c52459b31686d66da48adfcc1af69aa7eeacd1c233e072f1
SSDEEP 49152:xSuZQIY0Be2KcRVtOnks6NMHqoAQgAT76sQuE:f5dKii61dqGsQr
TLSH
T1D3C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0c67148b54570af42788b854c2452bef6209c5bd9035272f5270831335577cdd
MD5 50ee336f612b1a0d6edd8081593e6a76
SHA1 4c81fa3d2cbb0888b9b58d1b370a3f5044be0f14
SHA512 f6dec40499572505b706c01ea0bf056d34a0bb52c488f13bc5df166c0126186dc4f3b71a24665ee583dea778c65f44e5dff9f2bd8326fa0ccdca3099ff7f760e
SSDEEP 49152:khtSn8EApI0fig3giDn0AP5wtAQgAT76sQuE:lX2imphLqGsQr
TLSH
T14595BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 132d293b39ba6e385430946f9cb6ead7936d458bb97605db34400b5d1032298a
MD5 15b44dc9a1da996ef84127981d41f6cf
SHA1 9087856f63927772c6a13a1bb76b2cdf99611bbd
SHA512 924e20677efe390071ec559141c17ddabd901cb815cdf7c1fd7b3d2f72c0a264f84558fa080b11616fd386975c40600500bf74268ee26d14fcdcfac28e0ca815
SSDEEP 12288:dMAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:dMAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1FC55235B594C70EFFCBAD1368CB7A1B9A3C07CBDD346939A110A268A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 48a9092a1f77b52953ff3946f6db30fedea6aae35cb78adf73641d7bb6e1686e
MD5 24e85b4b30c687c8d01c211b319621b9
SHA1 324b7db9de37ec0873e4ac91ec3e561b7eefb131
SHA512 41344aa3b1cebd67665f59df2811af376de2f2461ff0c42b7215dd4bfe71c78e40a8859878984bf4bbf1b8a2717dfbac805aaf7e32126fd8150cd219116f88be
SSDEEP 12288:mnAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:mnAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1C555235B594C30EFFCBAD1368CB791B8A3D07CBE9346939A150A2A867A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 1c1334fa0ec944375ec66e65c94c393369f65ed02b315e1594bfc5a80e2112eb
MD5 688d780b3a75e2432ab357edb27f3a72
SHA1 209158705f3b7c2bb3d1d26062b7e0dabe99bb1e
SHA512 ff97ec598306e8b1a576ef9b8ec69c76dcf0b65f2dfd8763bf9c0fac0daca898bf0b0942d30305b64320c2311170b6ce8c8449d2b42d3da03fcaf42ee4f8a5e1
SSDEEP 12288:VhAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:VhAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F655235B594C30EFFCBAD1368CB791B8A3D07CBE9346939A150B2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 320290cda7f649bed7bb4a98aea8033b051a4fe1d3370378d41c55f2f2a8b6d6
MD5 f501c2ceda288cd72ef26da9c0e513c3
SHA1 afd0286a3949792a7b11eea730c8cd80da9e6ccd
SHA512 ab4d88f63c6abbe3df3e88bba93cf84f5421e7a3e64f6e7b0b5abde83637cf290a665b6f94bd466f1e8631f17fcd12b8f1ff7896ec0bfb111f2b3652cccfd156
SSDEEP 12288:ZVGAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:iAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T163552357165C20DAECBBD135CCB791B9E3E1BCB9931293DF46011A8A2E3A248D1F4E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 eade789ebf620c9af5b685049f7349db3757dadfe80c5bfeea5c016dced158f6
MD5 7842dbb6fd8b57a23630152447259101
SHA1 b0165035da11d80d55a544ba94a3b38478287989
SHA512 31ae1dcfc9f53d758bdef08cef9ffd0ae599c299bdbda8dc87064ec67797177546547575a072dab52a3f0672ef51574c15044c1fa69b3c4f14374f7a10df5c2e
SSDEEP 12288:wOAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:wOAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11755235B594C30EFFCBAD1368CB791F8A3D07CBE9346939A150A2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 952abb955ad53cb7d0f16c418eb1693c82698f2d8be211384d6d6d173c862907
MD5 79d11b15dde8a7ca061d01bdea25ae97
SHA1 2febebac6e38b05ab9955da8e40b4e957f7b8897
SHA512 adb6a5d521ae861fa7129efcb4ad0533082a8a2c800dc0903abcfa77d2cbb500cb39b28ddc63fb3bd63c39a384a5c7ced10666ccfc9c46888b41784961630c8d
SSDEEP 12288:I7AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:I7AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14B55235B594C30EFFCBAD1368CB791B8A3D07CBED346939A150A2A867A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0b39c7f150a9ff9e1ff0fa529ef7c989c6ca19a179b7e72cef515be80c632dcf
MD5 b536020abd6f3d427418e0e4c272f88d
SHA1 1eb45cbb4f06eeb9a325db608398de89a39c01f3
SHA512 52fc7bc60280abdd0c16e772c26ce67d7240204fdea1116d8fdb860d11f2ee3c29118b836c453eb63f5836b63cf2df7f79ca630c9fb57d95d24eb623a56f3435
SSDEEP 12288:0vAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:0vAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1AF55235B594C30EFFCBAC1368CB791B8A3D07CBED345939A150A2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 916a0be6085cb2ce6d795880a268305a611a11fcaa03e9c2e9fd4efd84700a18
MD5 eaa1c754d0664b1064c50fa2cacb7435
SHA1 f4c01d1e4772488f9f04b20a561ab92489a4a97c
SHA512 53bbd47f478c3e8773193df4fe393735676021a10d3979bb187f6962b419058a6e5038aba9c50f7520131b3b917d88d218428288d18d8361f4bcac8695f4f866
SSDEEP 24576:lZMRzFVSOHAfYLH8AcevDN0FImbwQuq3Wia7gD:lZMRzfrAQgAT76sQuE
TLSH
T1A0750195B39018F8EC67813ECC668916D2B27C6A0760C65F03A4366B6F373A15C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0c2c1872d26a9ded9bf62eb0ee962004a775fe181edf23cf142eeb8575c80aac
MD5 e935adea971caf9ab2c3ff5f637220b5
SHA1 7df222fe6a0eb02d7b14f984f285a143052f3c85
SHA512 dea582c25b44df50ad25fb64fe768cd392a6676718fbf0fb80992dd4ecd1873ad09d0138b8ec420f21376835b6d113c8765adde1a4a0049a056427e0e248523c
SSDEEP 12288:TYAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:TYAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11655235B594C30EFFCBAC1368C7791B8A3D47CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a20c583220c959d6eedc86341f5538cbdf5600d2d69e0bea2c69cdd29136722e
MD5 b2bbd6cf85d992560a0e5b469b2d8e17
SHA1 be6d553a7993b9dc2bfe00507631a00422a772fd
SHA512 4591e6171e6dc824ac5560199ffd7215d2c7cdc062accfcf99db51e4ee5cd97ed87027166f57e7e76e9df226eeedce639c4f9a39a9af877a3a18310cfee69aee
SSDEEP 12288:hEAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:hEAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14055235B554C30EFFCBAC1368DB791B8A3D07CBE9346939A150A2B897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 fb604e72d5451c5db3c56a67c2ceea428d89d2140d2fbe0759b0513ae0d6390e
MD5 a337def7fdfde1b57e505c784494b4d8
SHA1 bc68368076fc39be8acd549e96b0deb72ab2718c
SHA512 91d6ec52e62d076cd7a41cf7d66738f1f52d690182113aa873ded468b85cf391e42d49b47db47a4cc549e9b055b4fd2fae2a79bcecad4a267b3d71f13879a543
SSDEEP 24576:AzyzAfYLH8AcevDN0FImbwQuq3Wia7gD:ASAQgAT76sQuE
TLSH
T1F565020763A530F9E577D239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 6eda0c16d398092bca652c2e3febb060d35d01a507977ec6d817fc5331917369
MD5 8da4e58a69c2ae94abe236f6eda90d7a
SHA1 20df54588a8ef893d2698265027cca77758fc84c
SHA512 7d153fad4566386c84682cd456ae0dce716c788f4157d6bf00c28f5aa12371e2b36865d76d8af6a8a53b3ea606ee0d87f8a2730a82c60e9ac151b46c7ca749f4
SSDEEP 12288:7YAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:7YAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1DB55235B594C30EFFCBAC1368C7791B8A3D47CBE9346939A150A2B897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 64aa0099f909db2111377764c86b18c45609606ed00749effd12aa9b112ea46f
MD5 e696884eae5fe79c27ba2f4ba88653d7
SHA1 e8d0ba30e592aeb753927e87377026967bd7a74f
SHA512 cf199d152c3c00286d6524e59a7269831a4f792551a29a2248c5d67f4c8503c7a2b74a697368ad9fd554d7bf8b7cb4dc88bcf7bc6df830a29152ba5f9589ba0e
SSDEEP 12288:lYAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:lYAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T16155235B594C30EFFCBAC1368C7791B8A3D47CBE9346939A150A2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 466fb7b4f74e1aba8eb95683712101a130e84cfe5e44b6c2e8dac212351c31f4
MD5 a53647e9f8a57b5cfd492aa0b5b34f2b
SHA1 f3421148ca8b21bf2552089656a238e158a28040
SHA512 a2b98bcb3c3814f54dbfe783bf0cda0256bbb4d8f367a0b7647fb4a03025f745ef9e6a06ddfa9648d4e68afa16d2543067f68f2a7eaf42c321ee0cacb4873936
SSDEEP 24576:ozyzAfYLH8AcevDN0FImbwQuq3Wia7gD:oSAQgAT76sQuE
TLSH
T12F65020763A530F9E577D239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 692c2e714f1a904874dfae49a37114cfc9d8f91bbf281233b2b959badd06ac10
MD5 15e9d39dbcb81c2907a7ba4fbd158760
SHA1 a5db564c75bf0f7f522b1346a5eb5c145a807f3f
SHA512 620ed3c8fe2a4fdd5c011026d8ef96e3ffd8de809ac7b6115a3cc62ffb8bb4c0fe52973063f9b105892c52eccf6c9d3c2098eff818a9e6d1beb91ccf7ef01188
SSDEEP 24576:ATDaLl3z0zDxAfYLH8AcevDN0FImbwQuq3Wia7gD:ATuLljaAQgAT76sQuE
TLSH
T1A97501A5B35018F8EC67813ECC668916D2F27C6A0760C65F03A8366B5F373A05C6DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 f67fe2fe8c36b54a5bfa610c92af83c62f137ecdb6e33fe6dab58cee7bf5d81f
MD5 721057b4e9a97a76ee7c7e6697032f80
SHA1 12174031213fe66efde070ed8f739b3027bfd98e
SHA512 9c6f114a0cb728286a0b950161fdcadd7d52525831e73c10af8f38e5e0cf090da65ef1674fb4a1171c19f08aacf643b26c865978fb58f60372cb0d4a5ad0c846
SSDEEP 24576:a3vd9CHKy7GZFAfYLH8AcevDN0FImbwQuq3Wia7gD:8vd9CHKyarAQgAT76sQuE
TLSH
T1FB85CF91F3E810E8F0B7DA35CD765511DAB67CA91B21DA8F03A4265A1F336D18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 abf7d325ff3dd5322aa6b264ac8c3bd0ec17483f08589a2cf55e37263e994bfe
MD5 2d9287dfbdcc31f2ac74714d0f8e1e23
SHA1 3108526f9c3890603bb9bd63a69d79682325b38f
SHA512 be2e88237f8869a4075dc0b9abcd7848e2d857ab5de7adb84f0c355f30c895444a87f215dd52069472edf06eecaed5e42d235640abed1377a4c4a72c0688c6a9
SSDEEP 12288:0BAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:0BAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D455235B594C30EFFCBAD1368C7791B8A3D07CBE9346939A150B2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 b2a6db91dd08c11f01c2ba0fd8967a4c0be9fa8c63eb457e08115526aefc5c2a
MD5 c93e61e9fafc774653b5f0f0b5b4b082
SHA1 369189e9b6306d7f9374137d7217629086ba1afd
SHA512 9921e870c911c5b198cdcaf7529bc41df2d4466cb46cbc8cdcad6213ac1c872985e03d79c8421a7aa3ddde6dce02278dfdd34950a98858e6613f06300fbd4ff8
SSDEEP 12288:WTAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:WTAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18C55235B595C30EFFCBAC1368CB791B8A3C07CBDD346939A164A2A867A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a471db9085a0295b7c9f905aa472c921a86191843c45d40c251380c45b3904e6
MD5 8d07795ca0af6cedd39fc874be66d042
SHA1 4db43c4c728a972a04cb5973c6ce1ce2bd28c76c
SHA512 4feb0b3b806b9a52ba49c7b6430bd1e88d7043170120ac3add4ec59e3d9d46da86e8651b7e691c9c36fb32d6b77f35d094f32d551731c80c92537e23440c71f9
SSDEEP 12288:CCAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:CCAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F355235B594C30EFFCBAC1368D7791B8A3D07CBE9346939A150B2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 99c6f972a14ef261372a03aa98ed92c5f2b4616f461cbaa9842420cd030c5e72
MD5 4bfafd36db4945b4c73eb4759f690230
SHA1 4146d0f50ed12634167b4041d314a4db76d80363
SHA512 8b60f9e3d0319134787f01ed6bb1c53088886285c465346bb6b3d64803a447e3a247354a3c21ca11f1ca4e275e7280aaf1db812d79671f6aa1e3c21f2ea87bbb
SSDEEP 12288:XYAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:XYAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1CA55235B594C30EFFCBAC1368C7791B8A3D07CBE9346939A154E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 7938dec98e5bd2cc14de09639d5006619a5d8ca0d0634ae2fa6285f4a3bdd841
MD5 a1c590ac387018ca800a691f8ee586df
SHA1 8bda565f13bd8af19aa1c9a5699527e840616746
SHA512 782cac67bd3370385e46e89df2a8fe9bb3d1d2346f7e912e15a35924d7c4a2255f531cbab4df90e32d4752b1ed662a69a102c09877622ffd3e3e0d4e3a289ab3
SSDEEP 12288:+BAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:+BAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17555235B594C30EFFCBAC1368CB791F8A3D07CBE9346939A154A2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 47f0cdfb3329def33923b4172c9a2cbb328550f8578030c27fcb70dcb280a0cf
MD5 f874712488cc956c7e29d7578b7bb9d4
SHA1 afbad3997f3819150de44c8990357b67f8c7ac58
SHA512 a4cf03abadb2104277f742ecfbe8fb20133851b9314f9ae247e432195f79a21ed99826f2dc4f8769837776c81de7287f3957a7d07e765a2ff1b0a7aba872cf36
SSDEEP 12288:OAAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:OAAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17055235B594C20EFFCBAC1368CB791B9A3D47CBD9346939A150B2B8A7A3E408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 05c90028e81d983aaae8001643687e56a17c51da607d3ef1fb3b3bc01c654cf7
MD5 3f00193dd5f57333d11f8c09b551e923
SHA1 9c37a88c8afc75e28490a5b4593e7ae14bdc9015
SHA512 5f793b199039fe4de20c85a1b476f1b642eb0666af8a018f3ba32d135ce5861195c30cd462f5b5d7bd3e9752eb7c3e7ce0caa1ad4d1b978c652e615cc10173e7
SSDEEP 12288:ZOAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ZOAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1AA55235B594C30EFFCBAC1368CB791F8A3D07CBE9346939A154A2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 efba4f47f2793cbabce5895a26553e48353fe25053ef4ea7505285ec00cf3abf
MD5 858899bc8ca84fa6678308e2aebc7e88
SHA1 75fd949917f37ea7e7598a3da79dfd2ee0ef6131
SHA512 9f5dd4ea53b9ea5fd40fba3d5a8fea367b0b46a7cc041f754e3bd51d28a9002ea9284bbf8896df5641c886a14f7eaa0a38acc3021c9d54ea7a37c473a50bffd0
SSDEEP 24576:PfwvUk9RX6wkyAI0AfYLH8AcevDN0FImbwQuq3Wia7gD:dMnYI0AQgAT76sQuE
TLSH
T19F85CF2AEBDC44E5E1B7913C89B7460AF6B178691B31C2CF025A53AD0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7a961156a44af1b0ddb95b94ed5275b3b8c0a881d80a482142c3d1e5b5de92fe
MD5 6aa386d2626279f4fb782e1bf1fc8359
SHA1 119e252b275451689ea164bcaf2927c7870ca9e4
SHA512 50321ab54a14b52d2071740791fcb3cdaaf111929e0d1a52ed17f0d666771e2b996b0bfa513e028d6f98f66ced7971b1c3957140d356bd4b7ea4eca51ab2d750
SSDEEP 49152:yYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0NAQgAT76sQuE:pySzPOqGsQr
TLSH
T1C2066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 10896e7bfa4be9415657ea37a1155b10ecf4045c460611944355a79ad888efbb
MD5 0614dfcc3d9711c0c6fe2f81326162d3
SHA1 e87d1f2d3f00dbfee26c5b2a3673b8b11522ca19
SHA512 cc20cdc3ccffe964ca16ccd5a42862ff4a29d7a6701fe5262d4e8cf21f2c35538c296f1d2b6f3be47aef7f248794f032c319b8100509f6f88659c57504c295bb
SSDEEP 24576:l47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY3AfYLH8AcevDN0FImbwQuq3Wia7gD:l47JUQjTirIhCnDHUPfF/9AQgAT76sQr
TLSH
T17C659D1EA3EC01E5E1BA923885154A5AEA71782D1B31CACF1270437D6F27ED49F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 7b6dabe253f786b02e916b7f1d8ecc8f7b6e6f6ef214fdfed067249f5497278d
MD5 4f012ffd2416467cdb599e4ec03c1171
SHA1 c2585275c002160c90ce735d64f92bdada84255f
SHA512 0d80a77df791d6f06acbffdd7e887a75cca788807e91e9f2f6c1b74912e8164d8c2a45d6b045409c6ff019b5913ad35cddc7cee703f62d9b86fceba607d48d60
SSDEEP 12288:kbsfoAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:boAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18165011AD29811E9D46EA139CB664650F3737C6983E1D3CB12C0F67E2F3A5809DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1016KB
SHA256 1bbc33cf5c02a23fb147cf64c3e4fe2d3342ddfcbefa9bceccf67d50d6b9165b
MD5 c78cc0ba5220d144baca1f454d8245cc
SHA1 de107eb77201e6a971b5c0f71e713a709244a06e
SHA512 3ddf22a52f786d4c8593d05699a0bb1374b747fe3a5cd1c72ff35f4dc3dde33b78f214c53d867b62322e0bd6c0e0124f45df0b5803c4d9b4cd9ece3d3ac7f057
SSDEEP 12288:RIqmU3f4bridc4LK4RWFeOF4UOoqKvB2xmSKKt:RIhUPPlW4o+UyxMG
TLSH
T103253900766BD75FC6A940325E73D2CCA7707D41EE45AB0372C8972FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 329c49fdde95dd2b8de52a56f4ae77f9298b45c884f412c7c7e30c9d06b625cc
MD5 78a19ed582b04553074df153947c0cb2
SHA1 240720986fb94d94f937fec5e8cdf71a96a85ca3
SHA512 51ec072765ec8361d299c0361be881ba54d8124166485fa29e23c0e806cb15fac565aeb0c9ff7dfbeedf65be7b374f8e948890ef395b9341b8644060673ae606
SSDEEP 6144:5v3Vvnb8623UwYGEIctwIaIzFEgJaEcbVtMxwcbVtMxnFP5xNXDM5bkp/MbfysE:HFBToM5IR9
TLSH
T14555C6416537A3CFD1FB6031072A5B4CAB64EC46B7096F277389153ED82BB25A0B83D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 131e29537c096cdf467f5716dfc3008fceb18e6aa5b3c97177f3dae32f1e8ea6
MD5 89baf07637db88f88f130ab9797ab075
SHA1 b49c5cb48600e0563ededc9518e2acaf25768eb4
SHA512 2c878a5abf525f05669fc56dcd2a521656efe36def34fd9db5b49a7e47db9376dc57a89366141cbe9bd1ffcf18060246e30f2a8658351aaf89d78f73d5a62581
SSDEEP 12288:m07QAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:fQAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F7552357874C74DAFCBAD135487B91386399BCBC870492DB640A27CA793D8C8D9F4E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ec3487a316cbfb9de989a1eebd6ed9ac2e338592517e5cbe1f28e8a0fbdb996a
MD5 c424d4744b5343695231c080228bd66d
SHA1 6f03166bd737267b02683994fdc9a19bf8c0c9c7
SHA512 41adbb4ab57f00c6b5136bf5bb2d68b21efc83b8f21d34f4e1eedcf44cd0d4b9e69a76ab2a7287c3a243f710ae4be87829d1e4e50971eb040903ac8874fdcd09
SSDEEP 24576:jgb6bmBIi49WNNFpg1rSvFv7bYaAfYLH8AcevDN0FImbwQuq3Wia7gD:jgb4mBIBhGF3AQgAT76sQuE
TLSH
T1FA65AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 d079c7686f773d25e73e414d9501f77cd1b5a6f71526ccdeddd16e2b9d034c41
MD5 12081077e03f19b6e2cf65764d344624
SHA1 2c0e077bafc2054e1513ee29d08cf2df7f3eb7fc
SHA512 692311bfdead4ea5bd72b6059c6198d97c1237f5c3f02f0c72cc24803dd16fa1040392a5dbacf49037a8148f2b9d96f4921c8919e4a93ffae385231cac214631
SSDEEP 24576:iG88u8FpJqH1bzria7/mHAfYLH8AcevDN0FImbwQuq3Wia7gD:57ZFPqVea7/iAQgAT76sQuE
TLSH
T15685F16667E401F1D47BD13889924663F6B2B8250364EBDF07A88B551F33AE44B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 5579099c6a92a6606686da1c464907510f37fecbbb38e501d5a6a72251456daa
MD5 b5f3adbd6b08f694ba0b90941d4db598
SHA1 ad027ff6c27e386310facd36c9aa5a1ba93f3d77
SHA512 dee060a85dc0ba994693cd12b9f16b927a505a13425df06151fac98d41d3547b4bcb0ef1b175199eae5fea60af4b428febcb9a5120cc0f058a74615d55ba9c00
SSDEEP 24576:oPUr+NQrAfYLH8AcevDN0FImbwQuq3Wia7gD:oJQrAQgAT76sQuE
TLSH
T10365E12F22AC18E5E67AE13D89968619F771B866031192CF0291817E5F37DD8BD3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3888eed1bf7823680ab692ba1f12b82bed8e59a0bb9c00347877402004aabd32
MD5 730cde172e078040388ba32c4e8f67fe
SHA1 c1d7d09142d178a854f3c89369de4e286a50b112
SHA512 b980869502ffae30ba452426482ecf34507c5fe722d9a5888e696b2ca4d6b9050032799d535d58988010e4a4f197cac7619684fb22a1f024e4bb32ca4108ef7a
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7AQgAT76sQuE:XG05lO43bBqGsQr
TLSH
T1B8D5C06E62EC11F9D0BBD17CD9C64A0BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ce81a9d80fc2da58eae1a791e0c57df7e5d82671e1112c351358be1722f1f5b9
MD5 3171642f5d0c758ec30de29e8b67e899
SHA1 74ab4902c9e8d35603b553048e20e4b16bd4cebd
SHA512 fd4efe70a482a1304037301581999a93ba880b39e14dad5fd54e77e0898555174e01f21f15143795bfbd0007b4f002b6e08a6e6463a8f5cbe53b14d3d2bdf579
SSDEEP 24576:vfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnNAfYLH8AcevDN0FImbwQuq3Wia7E:Xa5POZ3BJt2pasx2+mTAQgAT76sQuE
TLSH
T1D665AF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f7c9f217277834c1d9a8a3ed52c0526ae01623adf968dfc303f8b9b90762aeae
MD5 d5c9e31789a9a6549ee7530986e1d3d6
SHA1 5252224b0595342fec8ed3f4a5fa65ffe9c2b171
SHA512 35121c3a4422f38099119c3604c89a67e9e2874d83b91032407142cc7e81de87927d835401d31bd5f7df15f84f6f32e82c409637c645e39fb6b88551e4f2f444
SSDEEP 24576:9NcwHdjbyQ4nLC18lb/EOjowL7Fk/AfYLH8AcevDN0FImbwQuq3Wia7gD:9Nc/zEOVHFCAQgAT76sQuE
TLSH
T147857B1623E901E4F5BBE1BE89779546FAB17869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 040f9663b0f453ef658e74160f59cd571253e90cfc33c43e403d1bd8472d258d
MD5 30d393ecb1180cb6d9b95fddaba4fc70
SHA1 5f04244cc18683a94b326bc4bf9ae4b78db2b5a5
SHA512 a0597726aabfebe588eee561cae3467b67d31a0bed8fd2227e41efd9386791044ada12ab94db9e9a1eeee4febcf2bb1cb6d00d20bbdad11f6a4faa424ea851a7
SSDEEP 24576:6TkNvNnaFeYhJNtmZBmoAfYLH8AcevDN0FImbwQuq3Wia7gD:6TMwBtOmoAQgAT76sQuE
TLSH
T1D155AF6EBAB805E4E1FEC675CD238512E6727861073293CB5290C13F1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 3347d61907b69cc1118006b7246c3bde1e0d769423a151cc4c7d4aa7d2f2d3a2
MD5 09116012c94297f15b6761ee01e164ca
SHA1 9be969b3e91dd12c4ceba49486410a887b77f8ea
SHA512 8fffeeeca09b239ed91017498b15315aab95f566e7e93c5c60bbf20891a5b4daa3aba3f0d52cb365f69c0ae90fe48e7b04f4e29c63323a0be91ba7649194a59f
SSDEEP 24576:6D3FHshBIYQgAsAfYLH8AcevDN0FImbwQuq3Wia7gD:6DVHeBIAAsAQgAT76sQuE
TLSH
T13875E17EE65C04E4E57BD17CCA638606E7B138AD032256DB029481BA1F7BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-70-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/260-291-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/260-78-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/260-72-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/1596-92-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1596-307-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1596-325-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1596-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1596-86-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1596-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2532-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2532-123-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2532-38-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2532-37-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2532-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2928-59-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2928-276-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2928-66-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2928-60-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4224-0-0x0000000140000000-0x00000001401FF000-memory.dmp

Download

memory/4224-40-0x0000000140000000-0x00000001401FF000-memory.dmp

Download

memory/4224-1-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4224-9-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4224-34-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4400-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4400-97-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4400-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4400-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4400-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4492-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4492-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4492-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4492-313-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5068-112-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5068-118-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5068-110-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5068-309-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5392-82-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5392-306-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5564-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5564-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5564-105-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5564-99-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5564-310-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5564-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5632-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5632-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5632-134-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5632-131-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5632-125-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/6120-43-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/6120-51-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/6120-55-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/6120-57-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/6120-50-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/6120-44-0x0000000002380000-0x00000000023E0000-memory.dmp

Download