Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 03:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
- Size 1.8MB
- Sample260930-d78e5azvcv
- SHA256 83109e5420ef632e6fce1dd3f55fa6c9ded990afd4a9e38d4221f1aa0c8d3417
- MD5 2e28fe01a2b24afc42a8581ef35adbc0
- SHA1 7bc27d90e1b58f03f02b75c13b6b0e0b2785d521
- SHA512 fa98f573a009e72069e2eb7680168798c0bdc484e69066916780c72e20f8caa3acf56feb4bb6febedaf1fd1bc19676ae7f1c5daca8a1a1de959c1930e52fdcc6
- SSDEEP 24576:GnscoyyhMbB/OrhiJSTfwUnQ/tbw/2Mkjy6Fr7g0o4:GnygA/YUQ/lFTjN4
- TLSH T1C285C010B710D03AD9BB72F94EAE526DB51CAED0175151CB62C83AFE8B382F07D3525A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 10 IoCs
pid Process 2748 elevation_service.exe 2460 maintenanceservice.exe 4364 OSE.EXE 5068 PerceptionSimulationService.exe 5836 perfhost.exe 2284 ReFsDedupSvc.exe 4996 SensorDataService.exe 3448 ssh-agent.exe 2372 AgentService.exe 2652 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 51 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe \??\F:\ 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe \??\F:\ OSE.EXE File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe \??\F:\ elevation_service.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe - Drops file in System32 directory 56 IoCs
description ioc Process File opened for modification C:\Windows\system32\msiexec.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Windows\System32\vds.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Windows\system32\locator.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe OSE.EXE File opened for modification C:\Windows\system32\msiexec.exe OSE.EXE File opened for modification C:\Windows\System32\alg.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe OSE.EXE File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe OSE.EXE File opened for modification C:\Windows\system32\wbengine.exe OSE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\2c4133a5b68fd3f0.bin elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe OSE.EXE File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe OSE.EXE File opened for modification C:\Windows\System32\GameInputSvc.exe OSE.EXE File opened for modification C:\Windows\system32\dllhost.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe OSE.EXE File opened for modification C:\Windows\system32\locator.exe OSE.EXE File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe OSE.EXE File opened for modification C:\Windows\System32\snmptrap.exe OSE.EXE File opened for modification C:\Windows\system32\TieringEngineService.exe OSE.EXE File opened for modification C:\Windows\system32\vssvc.exe OSE.EXE File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe OSE.EXE File opened for modification C:\Windows\system32\AgentService.exe OSE.EXE File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe OSE.EXE - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe OSE.EXE File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe OSE.EXE File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe OSE.EXE File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe OSE.EXE File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe OSE.EXE File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe OSE.EXE File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe OSE.EXE File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe OSE.EXE File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe OSE.EXE File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe OSE.EXE File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe OSE.EXE File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0f9ff798d50dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b30a5b28d50dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b76b2b28d50dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000952700778d50dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000023c871778d50dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da5b96788d50dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c0e78b28d50dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2748 elevation_service.exe 2748 elevation_service.exe 2748 elevation_service.exe 2748 elevation_service.exe 2748 elevation_service.exe 2748 elevation_service.exe 2748 elevation_service.exe 4364 OSE.EXE 4364 OSE.EXE 4364 OSE.EXE 4364 OSE.EXE 4364 OSE.EXE 4364 OSE.EXE - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 824 Process not Found 824 Process not Found - Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1948 2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe Token: SeBackupPrivilege 2284 ReFsDedupSvc.exe Token: SeRestorePrivilege 2284 ReFsDedupSvc.exe Token: SeBackupPrivilege 2284 ReFsDedupSvc.exe Token: SeRestorePrivilege 2284 ReFsDedupSvc.exe Token: SeBackupPrivilege 2284 ReFsDedupSvc.exe Token: SeRestorePrivilege 2284 ReFsDedupSvc.exe Token: SeBackupPrivilege 2284 ReFsDedupSvc.exe Token: SeRestorePrivilege 2284 ReFsDedupSvc.exe Token: SeBackupPrivilege 2284 ReFsDedupSvc.exe Token: SeRestorePrivilege 2284 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 2372 AgentService.exe Token: 33 2652 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2652 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2652 SearchIndexer.exe Token: SeDebugPrivilege 2748 elevation_service.exe Token: SeDebugPrivilege 4364 OSE.EXE - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2652 wrote to memory of 1880 2652 SearchIndexer.exe 101 PID 2652 wrote to memory of 4420 2652 SearchIndexer.exe 102 PID 2652 wrote to memory of 908 2652 SearchIndexer.exe 103 PID 2652 wrote to memory of 5348 2652 SearchIndexer.exe 104 PID 2652 wrote to memory of 1776 2652 SearchIndexer.exe 108 PID 2652 wrote to memory of 988 2652 SearchIndexer.exe 109 PID 2652 wrote to memory of 5984 2652 SearchIndexer.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2460
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4364
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:5068
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5836
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4996
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3448
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1880
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:4420
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3000 2996 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:908
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:5348
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1776
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3000 2996 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:988
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:5984
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 7dcb0ba7a58ce86d17ebfd3199637f8a0f9549cc42e77f583d248b795d1468ea
- MD5 345363ed96ab93cc1e7111c646216269
- SHA1 701c40bb94f08b9bf73c89f52a8c15f85447bb11
- SHA512 297154768b599a0b82f3d4de2ff52b7bdc0b4ede19e856fc10e2767b809ae2a98b4459b100de3d74a82b49bc36dc461d919db0f1985ee4433bfd50d3096bd2b7
- SSDEEP 49152:8b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnlQ/lFTjN4:m3q6HjB5Lm
- TLSH T1A1D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 cee3ee85603c25b500e29f9e2ffec36e7ec10e9f21bdf3f3c0287d733e4535ac
- MD5 1c1e9d7da88ff061d9592f86e9ec33be
- SHA1 9c50127019c0398fb4054b9a1744dbc7939e703e
- SHA512 c21b10fbedf592b5f19d1295df0973020ffb6e7520b214edcd7416af9420defa82c8d5a2e3a27e52a9e893f16bcf9158f4ec9d710389b76b7f977600a62d16eb
- SSDEEP 12288:p1XLsswWkxy2lRq2czACGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:nXYfDtczACnQ/tbw/2Mkjy6Fr7g0og
- TLSH T10E65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 b4d1f5411a59ccecf89618c329aa7787d1746c6e3651346cc539e3aef5453231
- MD5 ae58697c698e486eeff150bcd7cc2d45
- SHA1 07040dce6d15bc92c053092cdf7ae86f84e057d6
- SHA512 a8406d6229b6efbc790526441305dfca34075f49611c8230facf1d899df89af7dc12fe6398c9e045ba63ca60a38fd87ead656595b531f1cc6940eec4880df8a3
- SSDEEP 24576:n0Le5ji0hmxLrMtnQ/tbw/2Mkjy6Fr7g0oq:nPji0AloQ/lFTjN4
- TLSH T19A859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7E677E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 f60917926ca749bd2d51afe18642a56af5f3cde46e27b8d84a1f6f08d8dc48f2
- MD5 e589349ef1dd3e3fcb1334267a8c9468
- SHA1 2f61808a6dda3ab883e41cd0c8dca61066c11c34
- SHA512 6e2995fba29ec894390efb40271c1258729561642938a55db302ccbd6ef4b58e0af8adc8156526d80920ffe52ee964800793956727b750faed2e783a432c74b8
- SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWE6q8wyufnQ/tbw/2Mkjy6Fr7g0o9:R/ezSC6vUzPvxHjysQ/lFTjN4
- TLSH T1D6755D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 b0779639f0ad5f2889e2cefac3edb2eda988804012b4b85cb882a9abb3d2a48b
- MD5 d0863a4cf819ef7968cccbc4abe26edc
- SHA1 f0011714982ace529f14411a0a31cd90a65fa505
- SHA512 a6bcb70ad03a6f7585039bf686e8903b65b7c6dbc3d466fbccde297a2275eb97711c041b59ee260a3d56c64e7b881d9105be20c057c120f4231c0cccd31ed140
- SSDEEP 24576:tVbqPb88hv/l+6unQ/tbw/2Mkjy6Fr7g0oE:tVO88hXl+xQ/lFTjN4
- TLSH T1CF559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 791a96cd83cbcbf0941a495a02796fd3c2ccd16cdae0d08420347c09456254d4
- MD5 a44b8dbbfa9a1964bfcc484135644c7a
- SHA1 e84aaa1ab16ccc8db6a6ef93d5d5a32778ccd322
- SHA512 50ac17480ec0249cde608631b5da1e4d75527999051bfa47cc7b19082f4719d73762b7bd662e4f4aeb1d591706d82038e201d644b582ffd2350edfcafa780276
- SSDEEP 12288:IzZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:IzpnQ/tbw/2Mkjy6Fr7g0oV
- TLSH T1125523696A24F897FF2B06B15C8384826B7B0EC1BFD4A74E6B44322D857C39446DB381
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 db869444060bf99481bea4dc2dc4ac457faa7add2a791b794acc708030741e5e
- MD5 51af613782e123dd8706c88440405bfb
- SHA1 a0327677a0a88889526123be3c6044d59536f75e
- SHA512 b0cc829202bcc5ec102d683f0eea6939d39e8e936afb2cfd40373fb2cde8a47a686ae21f9c6131bd8028fabc81ea2465d5ae33898ba50f50a7d6f8c7fa76e3e6
- SSDEEP 12288:aeBNUbTVO86U2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:aJIUWnQ/tbw/2Mkjy6Fr7g0o2
- TLSH T1E175CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E05E7AD15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 1b250c0f0217ac4fd0953b8f7d0c95b21e96f553da0f62b4d6d0521245277c33
- MD5 96022b30fadb51d585c6b349f8e3be19
- SHA1 25eb45ab5c889df21174e8a89885b1df3fe75d05
- SHA512 29de7148d80fd10553985407bc8fab5c621bdde772bc96b1ce6a81e46a3664526bfff731abbd6cbf4c8ad0013af049a9ebaae18654336ac4e7e2ffc7134aaddb
- SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THM:QQvGAdlCEL8c/yRNw5CkLm
- TLSH T1A0267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 736b5a2c175705c0bac73e95829129459bdc9e7a785fb48576d68d93d9325ab4
- MD5 a35013497d4b9dd7c2da172652a4a28c
- SHA1 0ff451043d35c3af69de3bae7d54eb55b7bb8066
- SHA512 8d776b299c36362a9a12b911bbe5d12c1072610fee7a27f580a1cd8851d2aced670ef82a4a80ebc72099a4f1fc1e3b7303f63e4cf884840bfe7c0527cfd1f870
- SSDEEP 12288:gAwSfxL/2Dc39DLLmt0LDQewsAj4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgH:1QewsAj4nQ/tbw/2Mkjy6Fr7g0o5
- TLSH T14F75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 0875c379dfd03330b9dfe307f0d8b1dda5b68f5976b15332b6106712044ad190
- MD5 90d9a1e8c6442795148636a07c562267
- SHA1 5b6c79ce95f55ff60077727410d86664c2df5e9f
- SHA512 13ddae5b1941139eb409392a48e8d63496916f6f67ab9402ff8095ea19455549288e43b5d55e03979d20e5651c2b1023b7487f54e2666a610b74e4b5b8d1f75e
- SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHjL:vUEtQevvqc2W1cpV2EI32
- TLSH T10B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 69aeae395904303ce2119bed5dc9836121f6f28a0a1c0380fbd42d1e5f0ce166
- MD5 d9c7b2fce4f2e5fd832020d88fbe5683
- SHA1 93def3156b8d9124a9dc85ed9d157aaadb11064b
- SHA512 26e2a7ce77d2d790a6c6a2f381a300dc1befaff269ebdbf528faebd7a645c5125beed1684b80641e02d99de046a4723dbfae7f54dab96385a750a174a1ccddab
- SSDEEP 49152:WCbRquA/m2yL5zQfFiV+XenmE3/zYQ/lFTjN4:boqtVjnmILm
- TLSH T1F4D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 b418278182616b4e74dfec550eb336427e51755e44519b35b5ec513223451a31
- MD5 cf6cbab39342a44014194f3803053895
- SHA1 13aa8effe735851b9d9aec3f94d126d7664564b2
- SHA512 a77099c57a69e945d01059d6b48fedac49074f2db77f4956a0bbf1d0b6ce0f21315db5a9a5fcc6ce5d024da4c102edd95fdc5255451538db71d71fa49ceb30bd
- SSDEEP 24576:oAhGLJIFoiwtA5l7S53DnQ/tbw/2Mkjy6Fr7g0of:oAMyFoiq5zQ/lFTjN4
- TLSH T17535AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 328b048acb1db456df059b7bd55dce8cec2eea570a267ca4d600020ad8ea6335
- MD5 1c1adb1a414ace240b299a5455caab50
- SHA1 9aa3b8c05aed76cb4e02081355fccb47b27b48ca
- SHA512 6f752d8c19406688aac7e7f0942d63622ff42469e063374d883d546c41ffa4450421990b29f1a49cd748d6bfc0d303a9cb2007745cc9fc5637f4438a888ff066
- SSDEEP 12288:3mw5HEjsChN2BFgl0WDm+CfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:WwuHOWMnQ/tbw/2Mkjy6Fr7g0on
- TLSH T18A65F14A36A45CF9EA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 e532a91d4aa9347c8e2ec95c8dcd4629675a77725ef8119d9c2aacaf698adf49
- MD5 63658ad76857af822d0016aab702603e
- SHA1 d643645788f5f3f748c29211b59dab343cf282a4
- SHA512 d1e5e8b86bcd31a8770cf15d84ce028612c9f2f5d95eeb93e045fff7aba05bbffff33793ec893b74af8f0179d08d6d480e1121bf38504b277bd15fe88affbac9
- SSDEEP 12288:GXZ1IyIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:WZu1nQ/tbw/2Mkjy6Fr7g0oP
- TLSH T10E55126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 498d23b94e1d17fe7db9600177f90e97fcaf27ea7dae3f50a0b0f1fcc3b56941
- MD5 b0123b615600532343be2482a8f4ac24
- SHA1 b7814046ab6331708468268c7cbd455b838e1951
- SHA512 9fee55d036d1d6d40cd03d35de80475511b0aff5e81e9647d2e773058e7bcc2428d9eba86b514c394aae8aa32018c0c12c59f016cb08484e3c74d7636ba0f244
- SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:NQRQyi36YOcPQLvw2gAf+PN3FLm
- TLSH T105667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 40b57a387644ef584b1aba43253ad979222f9a43d8877f3a32e52e08cb12f3b5
- MD5 e9d835f5588390fa277eb8179775f0dc
- SHA1 c5fea37168d370e26e9366c5a3f0cfc798bd14ed
- SHA512 d6779f77b6f58f6ef47a229c28f4809b9cb096e3bd5ea84757fadeb002862d2d34446ae3a5f44c1a6979b0429eeed3e8fd7267fecf70fac77d6513f9f80f0ec1
- SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:LQRQyi36YOcPQLvw2gAf+PN3FLm
- TLSH T145667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 3360d47708936fbe7cbe0e8cc894feea601652678a44001260d386ca6f43413e
- MD5 4833868c6a65b3d6bcd242a14c5046e4
- SHA1 1388d696db134674153ab81c031b22b15d51da54
- SHA512 f34e13608b29ebb6882a03552589581e217e29cf752b8ecc07b85c8fe8416fdfd35ecd753f941fd15581df1088963d1e14708b87e1f488e88775df544979b73e
- SSDEEP 24576:8wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0lnQ/tbw/2Mkjy6+:C68Qg55nhheWu7PNU3/oQ/lFTjN4
- TLSH T157B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 2387dd747cecfb6d4afee0132b1c7224a41301f9141bcd4c8ffdd9f026c9d263
- MD5 a5d704889cb0254c0e75db3477b2a9c4
- SHA1 ccbce941ff3562a755a6571d2be3c1af0ff7d89d
- SHA512 8330965188f323b85b76bbf9a2d6b4e033f243d65a4b72c456365d53c0cc170c0b637603a434e37f128529fc022a65e3fbc70a13595393945aa3664749bec856
- SSDEEP 49152:x3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99+:Qy5112gYy5azzVvL69nLKnhZeLm
- TLSH T1FC167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 9d3a201e7ea2b9ac20a3d4a1e109c52993d318c32890fb601907c25888b26213
- MD5 44e343133b69d1cf2d3ef762d51f052c
- SHA1 66e899be15653949442e08032e82f8b87a38cd8f
- SHA512 726d2ab4b27d6ef460ceae633fd2191dce9dd8ffbd99e2c1623d1cec4204d62896513a52e33729bafc13a2918f37ded9dc32293b66922023551a4d594548a7b9
- SSDEEP 49152:b1hpsNoJpF1A6UU44CwH7R4x2Q/lFTjN4:bmifPbRILm
- TLSH T1B7B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 faf341ac9b3b27ee52b2d7019e381bfa5c1e05fc8abb8363a12c1af713cc82ec
- MD5 edaf480389e66d645e76bac403d1012a
- SHA1 8aa502e320dcef9e2ad26d7dda33bacbd15f463c
- SHA512 b48709c457a20ef9b12f1f652c25a314e6d0d6a126dcddcce406f46fc5251770fda65836220f765385e93e5f185f3efe62d6207be2aba25b84f15e23949df045
- SSDEEP 49152:HSuZQIY0Be2KRRVtOnks6NMHq1Q/lFTjN4:d5dKTi61aLm
- TLSH T1B4C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 113b9d44e0f1c3a7ce7bb956f300c5858e90a6774495271c189fb07df25a8593
- MD5 5f1ed1b2a61e409ee7588f873219f57d
- SHA1 590b1fe1664fe8ceedae1cf76e83a3a99aceacdb
- SHA512 b9002d68675cc4a019a36704a1c5bb860683d4824a733c29dbec1d166afabd79637bac71ff20222c8406b91e27de058ce65626a4857b88352c37420399e3df2e
- SSDEEP 49152:dhtSn8EApI0figngiDn0AP5wCQ/lFTjN4:MX2iyphsLm
- TLSH T13395BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 6e198873c5a9f41b57c57437684a5ecc4a35d03e66db41ab600e50ebb1a8f442
- MD5 3ab7cd1ebb838ee31940a5b2765bf4f4
- SHA1 b7daa53dcb85144c181f4f06c0975f999a3d0823
- SHA512 093fcc20bc4b4069edc7b124fc1dfef92a23d613fff4f5a1cb81c5eed2d43beee9c51712c2a73f2be09ebd5d46b936d4f6cf01f8bc4258458db8d3e36f21848b
- SSDEEP 12288:yhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:yxnQ/tbw/2Mkjy6Fr7g0or
- TLSH T12F5523697964F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39416CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 9d169b0acdd1526f008856f4db5977b96b547f7d461a2c17e0f3b4208d59aba7
- MD5 70d67b92125583620b190d22ed052a4d
- SHA1 584c99bc9c8b39dfd3de9c147e48e30d76f68273
- SHA512 be8a2dc53ba2dcdcc518f2e39b3532fecdb3f82d5066b0364ef9e1be57555ebd6e15b567c4f1c0667201d2adc34f89a9c1df8af4b1242d7fb8b2415bda1700dd
- SSDEEP 12288:8kGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:8EnQ/tbw/2Mkjy6Fr7g0oV
- TLSH T12B5523697964F98BFA1706F14C828182973F0EC6BFD1A38F7B482129967D39416CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 a534b42475e484c00cf81d21aa9c94d2e73c282e6fc8ba1602f62cf7003214f6
- MD5 a388c0abf8554b41cc86d15d3e5916b6
- SHA1 505ef83a84a0793c24df0a61b8232c601bf8b9ac
- SHA512 5da2587cb70c383a35e7b1691aa4ec9977eaee0b702548062dcfab01e7184bb553687950b7565cdae5e7f9f5f622996718e8bec4f6a3293861c3f284df599e10
- SSDEEP 12288:LeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:LenQ/tbw/2Mkjy6Fr7g0ox
- TLSH T1F75523687925F98BFA1706F14C8381829B7B0DC6BFD1A38F7B482128967D39416DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 7be2ec8de1e633fcf24a62a042ecdd48feed47e87421e416c726d9bcd2f502f6
- MD5 2dce6f66193f96eb47d55384e105175d
- SHA1 686b2cdaf0398ba9265053ee0e446187b0563b8c
- SHA512 a2e5bed0f0237e8f4d57364ff843ec78b687098c99fde218ac5b569c35c6aef8d649d27d8d6aec417b362740ce6b4bf84e79b6a908a7865e183d8fd6e8974a25
- SSDEEP 12288:qVzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:0nQ/tbw/2Mkjy6Fr7g0o+
- TLSH T1285523693A69F4C7F92742B4CC928142E77B3DC5BBA1A3CF6B04111D4E793D41AA6B80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 5b86d52b7568005821e7efa560e527ce1099a2dba639ff4bf8495f41656772eb
- MD5 5a69012d52d1246cb5a9ef938949ec21
- SHA1 1862f2988971d16edd60b676865bfe1aa9882b9e
- SHA512 a7ef3604e4734276238a1652f09a95b279509f61d35f52eb89cafab2347df76af94451bb91943eee57e8fdbb8c1f9dd5480a890661971df6e754b239c3970a4c
- SSDEEP 12288:TrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:TbnQ/tbw/2Mkjy6Fr7g0ol
- TLSH T1BC5523697925F98BFA1706F14C8381829B3F0EC6BFD1938F77482128967D39416DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 a25389c1961f5dade9311a7a2d33742e7cae6c0bf9730a6f818f43eb96fa482d
- MD5 1b643c54681f1740090938eb731b3228
- SHA1 46598b277e348e9f6624e784afb0c99cf17bc6f7
- SHA512 c0a1b1af8cfd525fa4420a87a63256be1ddb81d0150b216a6f5e9e1b4e8774d0fb5b98aa21e1f971c70aa32d397d44d91bc8efccee57dc280536b72158784d43
- SSDEEP 12288:OAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+n:OgnQ/tbw/2Mkjy6Fr7g0ow
- TLSH T1D65523697964F98BFB1706F14C828182973F0EC6BFD1A38F7B482129967D39416CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 870caef6be82365d5f84855216d48b9063343f0b8b37aa68150bf1aba88abd86
- MD5 5f8e522697b07e69241519feae041dc2
- SHA1 a67f10138d93f0333bccf321a99d2f60ef236914
- SHA512 bb4bd4c94bab05a97bddff01242d66e854162cf686bff0c232187ecc0ceb52f6c9346d4bec0d6be27c903792444f32d1fe909e65685490adfcf00a1d2019e5f4
- SSDEEP 12288:h8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:h8nQ/tbw/2Mkjy6Fr7g0oB
- TLSH T12A5523697925F98BFB2706F14C8281829B3F0EC6BFD1938F7B481129967D39416CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 e3cfa2f2368207ff7ebf871169fefe459b60f38b916b2355d29713bf3b3867c4
- MD5 cf010bf41dc025e4950eef49ba2ad032
- SHA1 eaba5c959182c32e3b8e842fcc009ffb6028a385
- SHA512 132b9afd703a47dadbc1dc9481e89d11b09786cef9ace0d6b7d9422a13caf4545a9ac076eb36be55a557a0604a85a868b02b6f61cb00efbfe9c74e0f73c32898
- SSDEEP 12288:diZwbDzzFEoS2cPvyEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:gZM3zFVSOknQ/tbw/2Mkjy6Fr7g0oz
- TLSH T1927501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 61f23bda149cb249638ea2b7ad775c7569aa3034a7843e51f323da2da4b271eb
- MD5 3fd803c26734ed4d9dc5c9187651b84f
- SHA1 5bdf1f8b7228c409edd32e9aa59155e974abf866
- SHA512 125d8204728e0d7e6945e1a4ca8b4dc5b1ccfeb7bb142fba8f6ea8f7975997f96a3a7f78a1a562123043357045f0235a416221213ed82d5d2d0cb8cd7c4a0a15
- SSDEEP 12288:llGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:lFnQ/tbw/2Mkjy6Fr7g0os
- TLSH T1055523697924F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39416CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 4c2d79ae3b0ae47cca7ed8dfb05a313b9b45e94587f180299aa526f4e96dfd5e
- MD5 087c0064950582a2abb8a98bd60a1829
- SHA1 e56a3979b940e3dcafa65e08d0fe85967dd2ad9d
- SHA512 520100396edaa46037d044257888b76590b019190964968c1ce0f609774352bc585018e6e2f878de9e0fbf9943b0c6b0d96e14dc087a72827b3d3799eeb4b07e
- SSDEEP 12288:rpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:r5nQ/tbw/2Mkjy6Fr7g0oJ
- TLSH T16B5523697964F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39416CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 f56a7fe45f4e315fab82c0c9a0565213d5abf73ef6a8cf7baadc8f00df4d7938
- MD5 30f2e1664c07e9a347a02b05fe4be230
- SHA1 d0e5f30392743a0bb55e50a59239aaf75bdba8ee
- SHA512 051d22e7a8225e7c6a64bc97eae13568a45756bea57d7c17d02e446e8709c351075666c2d4b9df33ccc7b045f1b15700b4886b19a4a039e552133ca3522a4724
- SSDEEP 12288:JyPz5L8IGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:ozyInQ/tbw/2Mkjy6Fr7g0oe
- TLSH T13965021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 793643f9d6270b2afc97eb2e998933e8322dc0bf99dabb5c4db92bbc750903f5
- MD5 b72856a3e2048baebd176a42caca5d84
- SHA1 369424560465e2c7bb11aec13f3cd1fb596b81eb
- SHA512 ff025568cfe2a273e6ed172ed8decbc962376f978cc90b1466c6c57ebbac720ca5affb57465c944f2c5072f14f43d45867308cd5af8ea1c282e21635f6aa2598
- SSDEEP 12288:6lGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:6FnQ/tbw/2Mkjy6Fr7g0oN
- TLSH T1F65523697924F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 8979f5f3298a59d819cac46809c988a2e247e3e18450667b8d604a1713951120
- MD5 9f20309d4c4e72ed82125af086e6faf4
- SHA1 dcdffbcd2f5e3e7eebb323a350b298aeff541dc3
- SHA512 a4ae8b92827a671dffd4607c1df54c33460f8f6d98e0a9e894f1be9939435778b6b07c41a034c561273e82522df043dba17dee351f95b0859e34221cfafa2595
- SSDEEP 12288:llGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:lFnQ/tbw/2Mkjy6Fr7g0ok
- TLSH T1695523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 3a84f27b23a5c2741fa68600a92c7dd4d36ed20e8fbed1ca97acca41c9e82395
- MD5 1f924373e27a943607f057f9f766101d
- SHA1 22a175f0c35583496418568396702310b382c443
- SHA512 bbf226bcf10f167f66ab02b9e1370117fe4e3b3e19315df3704b4f6bd3561307574cd5fae464155cdf3e8b4b064a8ac4c688839051e411e69c6af3c310e1401e
- SSDEEP 12288:TyPz5L8IGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:ezyInQ/tbw/2Mkjy6Fr7g0oz
- TLSH T1B365021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.5MB
- SHA256 b68dcaf79cbd5684c52fa47ec22a5ed34a725891bc33c861a73114443e702bd4
- MD5 7399205acdb25f9a39104e418c27965b
- SHA1 0bfcae57ba6a265b582c3038be04a0e45e24673a
- SHA512 248cc4aa9ef6199f2f1a1c17df452eb65c348e0da527f3dee32548099e5088e2ba313acfd0ee4ceb4f8b676e379ba8b7b82b01751c7650647a150eb97d557004
- SSDEEP 24576:eT0aLl3z0zDOnQ/tbw/2Mkjy6Fr7g0oe:eTDLljfQ/lFTjN4
- TLSH T1537501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.7MB
- SHA256 0065a207a4fab3149e3afb90b21975a8b84804346661c653b7fae2b6bd786322
- MD5 419c3f20f5df8a36c4ea69a19994d546
- SHA1 d62497186c6e69a6fe49296a2588df450a16bb31
- SHA512 ae3cc7fc01778757d8ba440fff03b6e70b1cecbf42dec282b43610d49b40831c020aee6822b9aa2a7e9ac14deab723dc5ddb160a53b6e9a0b105a7d1408dda53
- SSDEEP 24576:731d9CHKy7GZqnQ/tbw/2Mkjy6Fr7g0ob:b1d9CHKyawQ/lFTjN4
- TLSH T10585CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.2MB
- SHA256 da3455f9d4c092848fca95a835253a2a2b19ec42b4d5a79e825171e8fa0901ff
- MD5 4b7df25b971dc59fe476d97d65f4dd17
- SHA1 69fb9895143d5fc86ea859e8b856c87d41500e96
- SHA512 e3515169cd8c571190e5c5b5dafc2735d0ccd7b4eca2d97cf4acbeada8c0797342def6edbe7f9fee63ef6d554c232e49442ca0307c829cf53023953657a8c4b4
- SSDEEP 12288:2+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:2+nQ/tbw/2Mkjy6Fr7g0oD
- TLSH T1005523697925F98BFA1706F14C8281829B3B0DC6BFD1938F7B481128967D39416DB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.2MB
- SHA256 d7ef63d8e27282efa1583725dd31f2625f13892ad015d519f436d90f6e93b7d3
- MD5 ea6563b425e20d39c8c82323aabb7a3f
- SHA1 270f4ce0742ef5a03abf17dd712523704abb7b36
- SHA512 3ad676305da556904cc357a088deb14fb73dbbe7493b5cefbf9c59e9e4336312fd94a46c7b8a64dc8088a86a942d7784c735c9cf3bf8963ad0374c4d4bec78b7
- SSDEEP 12288:soGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:sonQ/tbw/2Mkjy6Fr7g0ob
- TLSH T1D35523683964F99BFA2B06F14C8381829B3F0EC6BFD1938F7B481129967D39406D63C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.2MB
- SHA256 554d57a648c6b72236963679bfd2191413637a42589bc8e7eb5962921c7862ff
- MD5 b362b1bad1f93916165b9570c0d68829
- SHA1 18d92ef4594eb9b70f7d755798a45b4db496812b
- SHA512 6d6f64d3e323d961d8af0323a77094243953b1c8eee02e52df43ef02795a8c3a1b4002b6d1613f8650b8d392eef8901e746433fdb171aebae35a6de2f1566dfa
- SSDEEP 12288:t3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:tXnQ/tbw/2Mkjy6Fr7g0oD
- TLSH T12E5523697964F88BFA1706F14C8281829B7F0EC6BFD1A38F7B481128967D39416DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.2MB
- SHA256 57ae1d5fbae7c773cb874a13cea6e6fd5bbd1c60c47471f143dfe9cb5878229d
- MD5 69cb78fdf7fa391cf4b6acee350d5dcb
- SHA1 782be728119aea70ce405d5e857f2dbb8535e979
- SHA512 2206fea80a296595742dd7e38e0fe2215f79aa1a75618aa4da1e586a3d2811cc12032c4f3910e494d282e028b22c58ef2ddcf01ea802423fdaffe32ef4c0d0a8
- SSDEEP 12288:UlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:UFnQ/tbw/2Mkjy6Fr7g0oG
- TLSH T17F5523697925F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.2MB
- SHA256 266ca2686d0042988ac1b07ca7bee2660ad074fbf391f1f3afdad8f86f2d5285
- MD5 2540bc9daf5f90953a58fa2bb576fd03
- SHA1 8505f1c21a6bd6e107efde755abb8d89ef163d0d
- SHA512 8baec7ee259a2eb1f83ac2bebe4c58318f7dae7ba765be2638b96ee3a82bb203fc9cc9be8cf6cd3c323379504bb6d202d698912c5c8fca3ca723bfb08d5c9e7c
- SSDEEP 12288:p+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:p+nQ/tbw/2Mkjy6Fr7g0oT
- TLSH T10D5523697925F98BFA1706F14C838182977F0DC6BFD1A38F7B482128967D39406DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.2MB
- SHA256 38f1c413122ff78c5627df130b89e8445747908960223cdb21d2db1f4e1e6049
- MD5 c84fcd9a8c4340ab7824713fde07b8e2
- SHA1 721dd489a9b5f452f08fe5adf5e30e38df1be623
- SHA512 93877a108fd813c33bb610f7f3a8a1afe4301ebfa2ea447edeaf14b8f1ad0b540e4b80bbff2a033b22e45d2c4abc3a320dc1494dc7abd851e2422509d788aebc
- SSDEEP 12288:W9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:WdnQ/tbw/2Mkjy6Fr7g0ow
- TLSH T12F5523697924F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CB784
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.2MB
- SHA256 027efbb62db984e4b01c948ade5821e4db9b03f7c056a42b00cf5b56b67a44e9
- MD5 f7ce90ed22c2e37901cd378c95bef747
- SHA1 713954cc0cd5e9c576dffd07f48d4b9efe39f171
- SHA512 69cc86003b668bbc645a50f483dffb594f3489c189d6f911426e2a8b163284dbd4c589424a72bc4badde9c555ad32ecb09dd30b15516d0534c7d2ea658343bd3
- SSDEEP 12288:VrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:VbnQ/tbw/2Mkjy6Fr7g0op
- TLSH T1625523697925F98BFA1706F14C8381829B3F0DC6BFD1A38F7B481128967D39416DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 1.2MB
- SHA256 64b79c1f475d509ccf81d194eb5c4d5a11006027ef6378c7cb431f435f851913
- MD5 0f2a24fa4fc53579e7f56095f1395563
- SHA1 8423a9ceab329f61e85630bba851708b819ad75d
- SHA512 d31c1d65028711bfbdd638cd250fcd55929758fac2fd2507b1e6f214c3bae28d5914d1d1c193346b7f44b511cea0cac0b2c2d34cce9c8835136ce87050625ce5
- SSDEEP 12288:wGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:wmnQ/tbw/2Mkjy6Fr7g0oF
- TLSH T1D85523697925F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CB784
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 1.2MB
- SHA256 5b8244008fee1cfd58a559822b41a5847c3c854bd72be9a8978bc5cd9a2f7f71
- MD5 1a27fdaff8179adeeac912f3e0f7b332
- SHA1 fa1de56068f9055a5dad4923ded2168c0e62ff6e
- SHA512 1d16b742471a83df3b588eb4cff416fe09b09bcffcce6f791843a0eeff5cf8dd497ec157b5a9c1f129d1b408e73aa2021eba1053ea3bdc8b13cc02a88a9a18ef
- SSDEEP 12288:GrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:GbnQ/tbw/2Mkjy6Fr7g0o5
- TLSH T18F5523697925F98BFA1706F14C8381829B3F0DC6BFD1A38F7B482128967D39416DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 1.2MB
- SHA256 2db52a9dcbcd4af34a7039224f6810b1eec57913cfc530d7b08f507e810e583c
- MD5 43f43a99122123dacd96c755468af949
- SHA1 3d4786e3a569e7b28d6abca116ae697b3a23f13e
- SHA512 84aa49b3137004e672073903225742b498fe9e66da175e0da86d72b6eb025adde791e78f1219fe0a689c27da7a506e833fc67da8b66533c28e800dbff09cafb6
- SSDEEP 12288:5PGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:5vnQ/tbw/2Mkjy6Fr7g0oQ
- TLSH T1415523697925F98BFA1706F18C828182977F0EC6BFD1A38F77482129967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.7MB
- SHA256 28f56301a7aefd08daa0549b9fb0a14283b803dec65ff07a7755f64fd5fda5f7
- MD5 4d386c83d632f2c7275f4f05c8d6cd98
- SHA1 1eccf6ce018060e298172dc105fb1e9e6f314be0
- SHA512 c9499d61dab53419b1122a680f3a5529441ce958267558c9a56053fea8c135d848c2290f7538c689326479b2e957aa95910527c03754b2e65f6c37bf1641add9
- SSDEEP 24576:Kfwv/k9RX6wkyAIJnQ/tbw/2Mkjy6Fr7g0oH:hMnYIJQ/lFTjN4
- TLSH T1B585DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 fb8611ccfee4bfbd98c064ba3086cac4a6cfcff3a22fd7fe437254a7df9344f9
- MD5 98894889a77e5b013613baeb087065de
- SHA1 f89c591269ca962985ce35eb2b4e5e7a5f43aae5
- SHA512 2e3163e6c98967513e96adab2d026a8732b94f84aed211fc2ac0d400433f9f943cfd2f0d027c6695dd52b926d7614100826a34c90034b51784f5bb539a0670d5
- SSDEEP 49152:lYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0iQ/lFTjN4:lySzPlLm
- TLSH T14D066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 c09f159bdbd067f253c910cbcb57ea91f7d50cc2a7a35a712f0cbbef40f248b1
- MD5 cfb3f6414e6757e131c36982c6483456
- SHA1 13cd0bdaa5cc2eece38d25a5abc959197b46e4cb
- SHA512 83de2bbf116e24b8bc7b290c5f69c15024d7ebf268f64a5dcd45ae4f8bbce3580a538d2bfd61d29847ba3945b40ac208178bc550bcdb3a4c1d4eb6338e03bed8
- SSDEEP 24576:a47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY0nQ/tbw/2Mkjy6Fr7g0oE:a47JUQj1irIhCnDHUPfF/yQ/lFTjN4
- TLSH T19565AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 3d980379160482ef5c1af7e2878fa1a8c02fc3f6e6a5e26e76dc077db2c72c2c
- MD5 aff099ab01b1f0ff41357fd09c87c843
- SHA1 1705d8301cd7d52a9bf6cff23d3acdcb254a0fcd
- SHA512 be0d62c98327b557b436eacd8c4c9c534efd70d7b28cd3b31c2473fc551ea57305fb44e968194f398d743105e07dfc39c20b0fda70fc5fcc3f28eacb9ce120d7
- SSDEEP 12288:pssfVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:B1nQ/tbw/2Mkjy6Fr7g0oc
- TLSH T15465F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 05b69584898573594cf63becb288e06d5d03180211e27b39536b6fc7d6855f23
- MD5 b3b73551e12dee1179dfaf3475a469f8
- SHA1 d52aa7f1aba07dcc55018babc5e4002c51cc7019
- SHA512 d7dc52375b341e24f29abce3c7b08433ed6b9c3f32103c2be08466064fc47e6c552dbddedbfcd64e0af10d2f3f0a3f6128779fb7ba18fb562ec7a95946fa69df
- SSDEEP 6144:XQsBC2na2Nus8t0HSnotMxAeguzYhPw0AwT6sI1j7RDQNTOIvEqbevfbpse2AB5H:xEtXYhDA+6j18SvdsgBgr2cKGbvUdx
- TLSH T1FB3538117666CB4FC6A944321E33D1CCAB707D01EE45AB0772C9873FD576A58BAF2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.4MB
- SHA256 f2be37a50b33ed47d37a54e21e997fe98f987ddbfc0050972b4b920d09f25b10
- MD5 1bbae10c896a5bc64c9ff7ca93a5977f
- SHA1 d6793aad803f98ecac0ba9bff5eee550ed09b31f
- SHA512 1e623d8d9623b7135e8c61b7b20cde1b2fa813a468e5b129c587e5ca96dae9d86d509874c83e1e9e404364b5d124940a8336cb8ede75e7ff3df689e629535d43
- SSDEEP 24576:XPFYHuPMDrVbgyb6BwfsBsK3XEwsqTwX4C9kcrGun+1:4uPGrvnU
- TLSH T11B65E881A136E78FC1B65032073A5B4CAB64EC17B7056F26B3C5453AD82BB56B0F93D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 d6b92454f3cfc4e2b54fbdbf57ce96f7f32c627bb133c714757d1b82273e6361
- MD5 e4635efe67295d85835c4c125fb500aa
- SHA1 dc580e4ae5ed2515bed7e6b3623b852fab2c8d4e
- SHA512 63c93a31ce0b458f6ce59bb18f7460ace5ba46617f9164d8c6ec8a28aeb85a0d59016befb027fce6bb3afb9080fbd5636758cf0ff2913ba78a707ab72d47407c
- SSDEEP 12288:W67tGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:ZNnQ/tbw/2Mkjy6Fr7g0o6
- TLSH T14C5523696668F94BFA3B06F048828111673F0EC5AF90D3CFBB082269957D3D41EF6785
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 665c9461097b27193cddefba65022f514b6537e2ab52842720757eca80f84420
- MD5 15eb0f48d2984f185a4c77d8242fb624
- SHA1 a58223144a1bd603028c5e0e42522db6f5cfa5e4
- SHA512 7417369f7954dfe27e6bec1208bdcc2e3038bf0799a6c80ee2aee0dba22496d9f03fb88878b5ac97b7becdafbd5e78c3bc720284b76e3aaa8a90686cc839b50e
- SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bYfnQ/tbw/2Mkjy6Fr7g0oi:ngb4mBIBhGF0Q/lFTjN4
- TLSH T13F65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 85ca6894976725d074fa64bdea158acf8ce1c608539679c8aa062aa4340c8b78
- MD5 779c0e658cedd55046c979dc496c6b55
- SHA1 8122f61b003a986dee35df9911bf3c3cf7bb9e2c
- SHA512 f3865571f635242d67d6cbef17660dc96053146d299510892e13ff91fa93ff13da3c29f61efba1e3f745f857b0a3939814bd30aad4200169b8c4319b958f1c47
- SSDEEP 24576:qG88u8FpJqH1Qzria7/mknQ/tbw/2Mkjy6Fr7g0ow:R7ZFPqVva7/3Q/lFTjN4
- TLSH T13A85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 c6bb9df35598133035b61e8b2b681ef34d5a16ef5898c6e21ce1f3e9c810a279
- MD5 06b9ba8ab2461e0b99e3019e1ba1c751
- SHA1 edfd8b0a38c8df10378914613c25529671766e42
- SHA512 c221a445bc6909e544c81cb88b6cf8d3977dcb82e4df6c3e879042bff88fe64aac13a111c515cd7f924a8e6fa8b7bb065f4fb4ab6af2f38109be1ed30ebae161
- SSDEEP 12288:DHvUrBFrEjwaQQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:DPUr+NQwnQ/tbw/2Mkjy6Fr7g0ol
- TLSH T1FF65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 536d3339e0875b3201410b5b52d8755bc94ecd77dc2dc718d67a8718ff3cf641
- MD5 0938823f350715ff90bf9bea74451df9
- SHA1 8184e3d6bdcb4fe81491cee03b0fb27511381f0d
- SHA512 30e72064255fcaa4979725522d9b2a975b07bbbf5e8dbae9de145a00adee3e7335530f51a47824d5b47717cf479631240039a9fa8d3e21664eac7d03b5229f7c
- SSDEEP 49152:zBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjgQ/lFTjN4:cG05lO43bmLm
- TLSH T1ACD5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 be6b85f94bfca42eb132ac46c1f0a095e6a75d90a61d921ac4f0113adefef3ff
- MD5 cc9b3cbd4ab4ef0df4699dd9a12615c5
- SHA1 f1fd76cde212503a4184af1d99810c726dec74b7
- SHA512 8b81d252f07db354ce799b50710bd983c3eb47718108702360e2cfa7378500b5dbee03636de3a52d057dde87bd71ffa9bd6cbf23c70a4a27f1043ba4dfb441e5
- SSDEEP 24576:Cfa5POZ3dpFWVM50JicR2hG0lasx2+47eidninQ/tbw/2Mkjy6Fr7g0o/:Ka5POZ3+Jt2pasx2+moQ/lFTjN4
- TLSH T1CE65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 0ea991c461795e1d32aa34e72af11900b3e3d040b956e21495913de4895b4939
- MD5 5326acbf3e111cee6d6109a0949071f6
- SHA1 70a46f0387ea83715421b51834e8b44a0eb34165
- SHA512 c45c8d453ab647900fc48815621ce253850a0bf29a1995623e368925d243001c3ab8d3ed30c255c0cec134230ef2629729aad3a215246f98aaca633798999018
- SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7FksnQ/tbw/2Mkjy6Fr7g0of:ENc/zEOVHFXQ/lFTjN4
- TLSH T183858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 da7b54931fd94aa434976b31181665253983702e65aa5259b5cf0ad8b5dc22c0
- MD5 df7747984838f348a8d2975d011cd183
- SHA1 838f4e73e2e359e21b0c565a8b9c1af2fb7d215c
- SHA512 bd76f66633fd4427010ee4e3108833d0ab062013ee5443ff0d32b04e788206113cc39cd9321339fb05723320a4b0bc96119c79a99c48994fb245c2797d5d1c54
- SSDEEP 24576:q8kNvNnaFeYhJNtmZBmmnQ/tbw/2Mkjy6Fr7g0oO:q8MwBtOmmQ/lFTjN4
- TLSH T19455AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 385a34d4df862e462d3a75628b6afc893534e94a60e5dfe208ed58f609277900
- MD5 b20bd07461020c24d6f188a2be64b912
- SHA1 4e13bcc4b5b6452f099b96687489203736b5eda0
- SHA512 726e0cbd4d08458162dd28da64d8b1e3e9970ad9c76342b6dee4b0bad87c31bdf4b0e32ebe37fc44b5e230cf0afa41fa7b27502c9f6b8156c9b64df14e315b14
- SSDEEP 24576:WD3FHshBIYQgARnQ/tbw/2Mkjy6Fr7g0oI:WDVHeBIAARQ/lFTjN4
- TLSH T1DD75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
- MD5 SHA1 SHA512 SSDEEP TLSH