Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 04:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe
- Size 1.5MB
- Sample260930-e5m7vasvcx
- SHA256 ba7fb6ad3938467b7a0594597e52744d732c19c6a3bd6f021bd19e372d609545
- MD5 209b2f520618886b9d02073e0478bcb5
- SHA1 3db0bab2a9cbcd8573cf286327ad7536ed4f9e10
- SHA512 6434637311886339f8382a148148838097b4912d237f00290057a5be0f5b03bb6c537250cb1969596615f2562f40bfd6fbf0f5e51cddd21d90d2259d54bf31b4
- SSDEEP 12288:DAmZXuYjwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:DAhYjfHLHUvB60yM/0s+1Krl
- TLSH T11265DF1A7B5094F9E4614D304651EA6EA365BC68C8174F9B32A02FCFFFF29D14E19A30
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 4852 elevation_service.exe 3436 elevation_service.exe 6056 maintenanceservice.exe 5348 OSE.EXE 4928 PerceptionSimulationService.exe 5712 perfhost.exe 6128 ReFsDedupSvc.exe 2360 SensorDataService.exe 860 ssh-agent.exe 4336 AgentService.exe 5612 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 51 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe \??\F:\ elevation_service.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe \??\F:\ 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe \??\F:\ elevation_service.exe - Drops file in System32 directory 56 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Windows\system32\locator.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\89779204f1788cf2.bin elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Windows\System32\vds.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005681cfdf9450dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e6c0ea09450dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000854fd79d9450dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000188a2d9f9450dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042fcca9f9450dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000674bddf9450dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000893520a09450dd01 SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 4852 elevation_service.exe 4852 elevation_service.exe 4852 elevation_service.exe 4852 elevation_service.exe 4852 elevation_service.exe 4852 elevation_service.exe 4852 elevation_service.exe 3436 elevation_service.exe 3436 elevation_service.exe 3436 elevation_service.exe 3436 elevation_service.exe 3436 elevation_service.exe 3436 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 812 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 616 2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe Token: SeBackupPrivilege 6128 ReFsDedupSvc.exe Token: SeRestorePrivilege 6128 ReFsDedupSvc.exe Token: SeBackupPrivilege 6128 ReFsDedupSvc.exe Token: SeRestorePrivilege 6128 ReFsDedupSvc.exe Token: SeBackupPrivilege 6128 ReFsDedupSvc.exe Token: SeRestorePrivilege 6128 ReFsDedupSvc.exe Token: SeBackupPrivilege 6128 ReFsDedupSvc.exe Token: SeRestorePrivilege 6128 ReFsDedupSvc.exe Token: SeBackupPrivilege 6128 ReFsDedupSvc.exe Token: SeRestorePrivilege 6128 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 4336 AgentService.exe Token: 33 5612 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 5612 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5612 SearchIndexer.exe Token: SeDebugPrivilege 4852 elevation_service.exe Token: SeDebugPrivilege 3436 elevation_service.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 5612 wrote to memory of 4204 5612 SearchIndexer.exe 100 PID 5612 wrote to memory of 568 5612 SearchIndexer.exe 101 PID 5612 wrote to memory of 2444 5612 SearchIndexer.exe 102 PID 5612 wrote to memory of 4608 5612 SearchIndexer.exe 103 PID 5612 wrote to memory of 4156 5612 SearchIndexer.exe 109 PID 5612 wrote to memory of 5172 5612 SearchIndexer.exe 110 PID 5612 wrote to memory of 1616 5612 SearchIndexer.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_209b2f520618886b9d02073e0478bcb5_icedid.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:616
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4852
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3436
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:6056
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5348
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4928
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:5712
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6128
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2360
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:860
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4336
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:4204
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:568
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3016 3012 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:2444
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3000 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:4608
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4156
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3000 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:5172
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3016 3012 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:1616
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 566b2257c450ac2c320b74d7357be5971206b0813cc18d7e4beeb01de65f84dc
- MD5 94d1b4d2a4fa19e98682c44f550dd02a
- SHA1 31fc0186193fa755fc2192b66a7a1d9e629fd16d
- SHA512 4d17aac6e37b9aaf57f36e80342ba2296b99e4e9aa654639fe032df1e4df972cd30e332343389cf075047d982cc1ccaecd1f9651a469a387859ed9dccf3cc2aa
- SSDEEP 49152:cb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn6fYvBHyO0s+2:G3q6mjBWcOj
- TLSH T162D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 2e0735e39f4bc41e41fa71e8c71d5f9c1ef46ac7619aa7040a343dd8fd6893bf
- MD5 409354fde95dffb10735d3dd0ba6d83e
- SHA1 94ff0d5406b2454636b1d329aff8a81d2f008e01
- SHA512 d72542206a5b3f097fbbbc38c99e37f27cc01b062a6301021b7edce29f434e65e6f5d2c0f4d2079756e7f229bacc649b8b2d57cbbb94e089094b6fca7ab8d465
- SSDEEP 12288:A1XLsswWkxy2lRq2czANwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5Mx:WXYfDtczANfHLHUvB60yM/0s+1Krl
- TLSH T1D765F12977E009FDED67813CC9A28422EA73BC514760D79B03E49A261F336D85E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 cb2b0ed917f9aca8da78945d5e1c9618b1acc7fdf117b86bb341a822d5865b13
- MD5 aac53f6b2cbb9d4383f9febb0cde52c0
- SHA1 6b4421fb56beaf05cb20ca0bb44552932f5d1b34
- SHA512 d0ef81cc3a6e1d7ce3d00a6446828a97c0708dc6c0695bcfd15e8de4595f0e8541965834b467ebb4d268d35b131000e0cdc154319be186efd993cc7daae5bcd9
- SSDEEP 24576:g0Le5ji0hmxQrMSfHLHUvB60yM/0s+1Krl:gPji0A6TfYvBHyO0s+2
- TLSH T12985AE16F6748335D073C0B9C5D2A69AED72308257308ACB4286D77C7F67AE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 d29281991b91116325a27b36bbc6a91aabae661ae9ee485da9870603096a535e
- MD5 44aedee3af5b157b66f6b130aabf88ef
- SHA1 b3aa91dbb03140f2905120507b0583815bf2b9f3
- SHA512 351fc25a67c35290b47ca45589e938a44a08ac8934335bd2c5c453f2f8eee694bb3c59f4228fef46984e079b6c87dc04cfacba988c38583bd8cf662076f21390
- SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWj6q8wyukfHLHUvB60yM/0s+1Krl:E/ezSC6vUzPv+HjyffYvBHyO0s+2
- TLSH T1D0756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 207b3e6e7ec6701c2a5a13ac9f05d63cc92541ed6c23dcacb1b2a3ace96b2376
- MD5 7b8849fc329fb6f8fe49c38a8025d0b9
- SHA1 bad2d6c94b3935123ee10f1c91f7b8173d41f857
- SHA512 6fce8b1eca264add167499a13c73b695742649d4a6e648b71865b8afb616457dad7536e9aa3102f5cbb1e02cbc54389355ca28bd8706d03c3aa485b4260d2540
- SSDEEP 24576:bVbqPb88hv/l+BhfHLHUvB60yM/0s+1Krl:bVO88hXl+zfYvBHyO0s+2
- TLSH T17B559F66F6748331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E677D6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 27ce3977880829be5fcc2292c5ec2dc6e27a96094251abdf01c57f754b280667
- MD5 2d140e0920350a4e103eea96e5c4ae18
- SHA1 5b8bf02c616c8d64a774e60112165d2d3d864d69
- SHA512 1ca0683d66448162d139f7d5fcb5476bd6b013e9d0631721c58c9fe50edd72eeae55cf05919492299cbc4b36232f2a9898b102bf48c05b2f4c0e0729c201af98
- SSDEEP 12288:442wS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:442fHLHUvB60yM/0s+1Krl
- TLSH T1BD55234B0B546D7CFBBB893052A97CF225A38F50C554432B23B537676C3E8E9A88B705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 56df1df10e13d00d587a77e4674c16a5720947c4ba8fc63f1fd022b7ec123150
- MD5 0daa7765d4674a84c6064081b40025ef
- SHA1 6551efc5f70f1ef8abdc3846acb28df5adc93017
- SHA512 de71434f43ea3e6ef0eabe965ab4d27e38d667e5c2e4f19d0ab01c6808c2e9375b4bac3b746e6d4edfd510ee9b87a8866d39554b9c86a3c9a8adb7bd7c2b6e94
- SSDEEP 12288:/eBNUbTVO86UZwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:/JIUZfHLHUvB60yM/0s+1Krl
- TLSH T1BB75CF3BAE28FCE2C27A8DB857918640E77278304B6293CBD175830EDE235E15D7AD15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 689eb60e327056c940b42b7a6cc2cb438e87d9f8649bbf40060c59c404ccb7a9
- MD5 61596ad19c2c566412633993313bf73e
- SHA1 e7520b1b30e14a5719ccf21177a0e40c68292403
- SHA512 62ad09564b78a0d2773f9cd43faf3e359a2f357001a902336405ce57a30f7adfd5dc9ea52a7540f61f003737ce56820445cff18c73f92ad16e25baf658b25e11
- SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THK:FQvGAdlCEL8c/WRNw5CVcOj
- TLSH T190266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 e131acc58e0165b346690b36e2257e5f99daefc436d23fcdf65d6583837f6128
- MD5 44153126776f2d4336c94ee838708782
- SHA1 4c16a2151e7b8818ebe3a0d51d4142054de31aa8
- SHA512 e299e07de7c9545c66ce904c76184ae44119eafb5cb25cda928e49fc39c89bb7796d1fb78c373b0784a726c8fbc95436acd6d767c8cbca34cf3774ce11f7203c
- SSDEEP 12288:eAwSfxL/2Dc3NDLLmt0LDQewsAjjwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6G:DUewsAjjfHLHUvB60yM/0s+1Krl
- TLSH T17475E031FF74E436D3BB0DB21B26D726147DAA204B610AC3E3E84A9E59341D22776B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 f30b6b704116defde84baeb5c383ea278636b48d37364745a76a2162c0f4fcd2
- MD5 c005abfce753612432114a119cdfebd9
- SHA1 29a8c2b1b8b4648e67195f0b44c5034e3bb8575a
- SHA512 19486b82270c107661b2f1cbc416f4e3297702d7c5029d00c6ac3351bfa266676abf453dbd8d158a8000e6ad3b42bbfb4bfddd675246f4be48a0747a13d2209d
- SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHA:iUEtQevvqc2W1cpV20I32A
- TLSH T19C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 dd7e48ec2965b883a29611d24f2e505845414ddf8b6a2b3ae3aa03c5007ad1eb
- MD5 147f2f9d2ec047981763f1e77a6bdbd3
- SHA1 9c3367e2e98aefc83054d620c7eb326dde5c60fe
- SHA512 f73f45c177aba13c9cbe528c4c7e2eecd09120b91ddff0e484c853e4a4e23fb12e3361cc4badf545164f6d6b1424aac400c4b164e40c4c89a53f5fa12e522c15
- SSDEEP 49152:cCbRquA/m2yL5zTfFiV+XenmE3/zDfYvBHyO0s+2:VoquVjnmxcOj
- TLSH T111D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 9360afb6fead2110e76727945af08f39306056de5b789c2481fb1937234cee64
- MD5 e079ddc4fa5a1ddad7a49a478bf81e58
- SHA1 34ef2f0891b9aad5b9594c74754384e452ff6cc9
- SHA512 d0af0b3017d7b5583425650be7bad7a4fcc96945dfaab1768064cf72ca36d1c998fd677f28fd8daf981d973a3145d57cbc3237f555938752242a9c280a5320fc
- SSDEEP 24576:MAhGL6IFoiwtA5l7S53QfHLHUvB60yM/0s+1Krl:MAM5Foiq5AfYvBHyO0s+2
- TLSH T1E535AE81E7F955D4F5B3AA7899B69471EA76BCA55E30C20F2160D21F0E33E809D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 74bbf7717a644db9864b6298f569bd46831b4ffa1e05e89e68eb22ce25dd1965
- MD5 1f9d1c9826b4a055802ff770d4f8bf0d
- SHA1 d8fa107f40b68a0c0b7a2d036f831ba7dd8103f7
- SHA512 f73ec0ab11418d70343d6dbf92061c8751607fc777c79f5ab7ed5744aa6231d2097be02519c38c16f8e0d5f060ad90639bd91905ff2be5cf2f864bbeb40e2d60
- SSDEEP 12288:4mw5HEjsChN1BFgl0WDm+CEwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUn:1wu0OW/fHLHUvB60yM/0s+1Krl
- TLSH T1AA65E04A37A41CF9E967853886979432F7F2BC112A25C71F1360C75B6F37261AD2EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 e38d6c8198d631fdad075bbef1ce73248e1fd2c3195ff9a3399f63e63d683fde
- MD5 c85b46f1ef9af0e90d1b45bd046cabde
- SHA1 6a318bd38348b37d311d625c2ca3d6a4d17337ec
- SHA512 22b8e0c0c25f824c4f36570d5ab5eea2ed73e8aacdc4605045541754817e3d43a04ad241528f4b204a8edaed0a7acab790a593973ab65184d78b41e510727776
- SSDEEP 12288:nUZ1IyzwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:UZuKfHLHUvB60yM/0s+1Krl
- TLSH T17255124A23E430FDF2A7813889E56962E7B27C52537543CF2265036A2F37ED56C3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 b974fff5b81a7cece57fb5ca267e938d938e843fa676a7bfea80ccd0df569157
- MD5 d393502519ff1ef92591931f03d380d3
- SHA1 4f3e369099d2336929f14f37d14612c73843584b
- SHA512 9f28cb3b68c05de0c82ffa59b49017b509da0803bb04cb6d6d7fc6ad8694549f95c37ce05cc85a1e1173ea78f0c249388bd045df34aba997e810d2b556304abd
- SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UO:vQRQyi36YOcPDLvw2gAf+PN3acOj
- TLSH T1FE667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 798167880f01bc7464f23f15fe6af13ce4b5ca947ff02ceae3ece113cde90a6d
- MD5 5e6c44858784460da7984f9bf2a9ab55
- SHA1 1f2b355a777722fe0d56a80910efda6a4217aea9
- SHA512 71dc62c05b11af802bb424634b4bd5f8032d78ccfbb61b0320337d3d770670838e88306ece72f4e475eead0e7e35af56c51e11527dd2970ac05e56c217974274
- SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UO:aQRQyi36YOcPDLvw2gAf+PN3acOj
- TLSH T17C667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 bfaeb3e5aedbbc8021fcf1d9260cd1ab31390d9a485126f559a3603e94e5a82d
- MD5 a5fc0f70b9db8e8a2e124b5b2c86d14c
- SHA1 fcceb3cf2c839c5dd6d77507f879ef8afccf60ab
- SHA512 dc6a32630578577ed98047c8110931b43fba97f57deb97c019979cb63531cc30cd55a64a9a3c204ca897060e63a7d4a35873a7a619d1871904754247341f8e3d
- SSDEEP 24576:TwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL06fHLHUvB60yM/0U:r68Qg55nhkeWu7PNU3/TfYvBHyO0s+2
- TLSH T1F4B54933B2F200A9D44DE1769F4A973196D27C758FE0D3DB821172161BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 e40f014fa385878b9ec02889af072c95772b41a1c1c609ec3a12e3274d401590
- MD5 47d9fca0f02ddf4ffa954d879ebf61e4
- SHA1 55b8750e6fcaf7085c456e0e34dbe0ebd6eb4694
- SHA512 b8096cdc19a0273ba9fab28524ee97f58fe69f6cc889970a1dbfced03446dca563b2a9095c8d07ed25597c162c2e4980ed8422f33cc239f0581ef25b785d85f1
- SSDEEP 49152:i3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99I:jy5112gYy5azzVvU69nLKnhZ3cOj
- TLSH T17A168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 6a8c40b606e822a7846d1e14822d09b3eba2cf9552c8659c8ec6d15030cac336
- MD5 b8afc7cbb2abdb85f14110fe52a0e790
- SHA1 d04b9c7f5293be5228470a5e7d1b8dd5bb204e43
- SHA512 f3120215b87995be5b9650c3314418983df7e7a1d88b5339c9b13434bd2271eeb65961fdd1e840bb6bc181a55f7131fc4513dc99b287c2ed8062a6b5b57aae18
- SSDEEP 49152:TB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl9fYvBHyO0s+2:lu6JmIxd2dScOj
- TLSH T13BD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 27de4072766828f976a0eb17c2e76196e73ece0708f3853a665a7867102a6d50
- MD5 e79b09b10ee9d9dbbf1b8f0b928d8ad6
- SHA1 c94e4da58827aef1d04ca22dfb9a8cc27c45a25e
- SHA512 8c5783da9f6b4077e2bd69fd6332d550c3cd3f919ef6084604b7c1502f2cb3021aa563215acbb3fd2935815c0a268f938e21035d7057abb83f5d722446e3a93d
- SSDEEP 49152:31hpsNoJpF1A67U44CwH7R4x5fYvBHyO0s+2:3mifPqRxcOj
- TLSH T1E1B5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A9077961F7BEE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 5e33290c2ec25e78a4697ba69f6a733c4b0efb608cfc7ddb0875e7ca0326a3eb
- MD5 43d90863418417b8633fc68b63887c4b
- SHA1 a832f337396b64f88456701db2312311506e57c5
- SHA512 0d1588a652a99b60662397f3ffb99f30440f6ca0f7bc9d88f755e150351a43d09fdb5aadd55af535881fd3071de58914b3e5923ac7d91481ee9410deff47f278
- SSDEEP 49152:dSuZQIY0Be2KkRVtOnks6NMHqKfYvBHyO0s+2:z5dKqi61LcOj
- TLSH T1A6C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 f43ce06798b170ae7b28f106cec6f92bde34a3240ffa5ced9a78981395f32ae9
- MD5 80769a2d51e3a8c48aff2c04857c0f43
- SHA1 6a10c09d28aa6c0f40df61d8e9f90c2639fb6f52
- SHA512 1d11c531b5a12783e4ad4f69c50a3bda8d9722f9f041bb9f3cfc8ee4a209f7c1b23ab5825c1a83f6b220cc432322b2790f65927ab6f542b4563d10345737ebb3
- SSDEEP 49152:ihtSn8EApI0figjgiDn0AP5wNfYvBHyO0s+2:DX2iWph9cOj
- TLSH T16C95BE13F2D901E8D06ED178C7468632EA62BC160B35A6EF0A9077561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 92c2a42e74d8b063f727371251c8e5e63cf7640a747fdd8c4eef2b772365ba5f
- MD5 c6bd5fb2d601e23fd3a89f38d2ff286e
- SHA1 4fc62cf74222f82559f65f43354480d689e51296
- SHA512 8b9f8d4d3b3a0f4139633958b3b240fcd9f6111a70e12696d2624a65b91e4816ef5e2f0800c1833225eb31d306d6310d390cbee90c91f0f45cc2f2cc36fc3187
- SSDEEP 12288:pOwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:pOfHLHUvB60yM/0s+1Krl
- TLSH T1DB55230B1BA56E7CF6768570529578F264A68F91C645036F33AD23237D3BCF9288B708
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 4a94550dc1a1e7b1f8d058bb1cab6aec88f548dea56b91f5d76c3a49762abea5
- MD5 cb2aa87ff95254002ce1069d96de7523
- SHA1 5b377c200df5d31f2e5a8cbe5c1261cde4d1f76a
- SHA512 8612d034ed5e1dea51d5c1a5f9d44450fbf1cb62b3fc45c56e99219538ce3fbc2e0976b7f88a32b2aec4bca3dbe181868f544545d0039c6a2ce789edb2ac01ee
- SSDEEP 12288:tnwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:tnfHLHUvB60yM/0s+1Krl
- TLSH T1E655230B1BA56E7CF6768470529578F264A68F56C645036F33AD23237D3BCF9288B708
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 259b03de3da4feb93d93871a55441ba16dd6eb073208263786a9eba6daa1bbbe
- MD5 bd82a192259e9500ed3e1127d9eddf2f
- SHA1 9b49c3fd8c7b3c18af02b5549987a56d8d4d5b28
- SHA512 8b417c49ce9b76943cc031a882df4d4381b8d6749cec672628869be5caec383f1abbe6ed70b9ca036cbf351e39f348d50d70e6527a2ac389b2509f488b00452a
- SSDEEP 12288:ERwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:ERfHLHUvB60yM/0s+1Krl
- TLSH T1C655230B1B656D7CF6768470529678F264A68F96C645036F33AD23237D3BCE9288F708
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 4b554fb1addf7f2687efca0a5814b8244e63231940b0629ec8e0a75af4725ea4
- MD5 9a311cb5683b4f25d116d1ea5ff61d58
- SHA1 8fff525f39b665b1a96c9e7841a60e5d9679e1a1
- SHA512 d83808a23e8e47da4b5c702bb6cff666847f26d493ed7571a8cd80f67781f19d16a20699d8eb6c61120842470265eb94b3d0db07c2bf49dbdbd1932318e7f8a1
- SSDEEP 12288:FVwwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:wfHLHUvB60yM/0s+1Krl
- TLSH T12355230B27A515ECF977C570C1A668B2E2F2BE91C72143AF335417172E37AE86C69B04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 a9cbb40b4b071e43b7b9e87ab9072eb875246bba4803cb9e141a1c45a0890f23
- MD5 044660ed6ea7fb6daef3b6c5b7a5289b
- SHA1 39c75fc13909eaec79a9651cd0bd59d5155302ef
- SHA512 209bfa564bec15ebb3316c4395417fe15b80ecbd5483cb1228765b89498c773e38b04e7be1b32f119772103b3d15402d758a820f7c2401d09a8724bd64126811
- SSDEEP 12288:NYwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:NYfHLHUvB60yM/0s+1Krl
- TLSH T12A55230B1B656D7CF6768470529678F264A68F96C645036F33AD23227D3BCF9288F708
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 5d1969dae2bae463fb097295e00fdb2cfc4a2eab028830d3e332a75340ad9d04
- MD5 599c2eab4181cd3d798f557ae0e5c64f
- SHA1 88617cf6139800792298938bdd6c14fb257e16f8
- SHA512 c36f32790471124a795e7c4cf4c5fe95d75faa766edfef389d0697a7007448d6aa23e67795f4ea6b400c1e200715add9a10796859132fc853701a2d8ffe66f9c
- SSDEEP 12288:a7wS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:a7fHLHUvB60yM/0s+1Krl
- TLSH T1FB55230B1BA55E7CF6768470529578F264A68F95C645036F33AD23237D3BCF9288E708
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 d491cf302e179eb3a627e50b8356b27bdf6ffb000343eddd41185a41e0e28032
- MD5 9ac842bcb6e9ed345a861909e949f1a0
- SHA1 340913df59dd47160d6b09389fe8964162931ffa
- SHA512 6b064f0bb112809f7b04b49ce7397d04f5203bdcbd3b49e289705aab2c429b7f8736efeb329c0069ad980fdb32a985f7d5c118dd160aca5fa1da65f7bde555e2
- SSDEEP 12288:rvwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:rvfHLHUvB60yM/0s+1Krl
- TLSH T10C55230B1BA16E7CF676847052957CF264A68F95C655432F33AD13237E3BCF9288A708
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 d1924767200ad5a194f3874c0038c7340b8aed3dda6db8b9ff2048524a4f7d9c
- MD5 9571e8ffa4df1c17ef0073eb3c911967
- SHA1 db8ea094f1c952dd39ca2fe667bb5a1280b33020
- SHA512 24c32c083e9c880049ca0d1f0a58728ae67082cd870da78517140ed3c76d9656bf7517c06d28366df4abf18e0e29581c279af3ea4523be95ed6f5c04a39de00c
- SSDEEP 12288:6iZwbQzzFEoS2cPvyHwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MIt:dZM4zFVSOHfHLHUvB60yM/0s+1Krl
- TLSH T11175019973A01CF8EC67813EC9659852D6B2BC5A4B60C61F13B837275F333A11C2EB59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 926441a20f03e4e49293ba6d84c020041715ffebacd99ec94b42a42cd55f9ba2
- MD5 769d60dcde9a36cd189a5a80f468a20e
- SHA1 c5564793fa2fe2e9b5eb25e0d1b9d51a57a8ae64
- SHA512 815b44606a306f085e0cc95c57e2687d457b4a542852ea310a7aee33949b92ab414c392107d18a9b86ec12252088ca56baf88381a7294f5a021b752019f37248
- SSDEEP 12288:1awS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:1afHLHUvB60yM/0s+1Krl
- TLSH T18855230B1B656D7CF676847052957CF264A68F96C645036F33AD23227D3BCE9288F708
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 432678a2dcd2140d798ec2ab6a03b8b512d05d19c194ef70aff9244dc7c1ee37
- MD5 023e7e5d24c65f3fa47b1596bcec290f
- SHA1 87a91900e962d6fda31a01172e0f8ec92e1e1775
- SHA512 db2260f639f38ee0ff57018eaadeae4dee96e3ce2da262a272d67c8fdc07dccdd4c55ba58e75de3023788661d493e2ab4c86fe1d88c9d0cca421e259348513b8
- SSDEEP 12288:IGwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:IGfHLHUvB60yM/0s+1Krl
- TLSH T1FD55230B1BA55E7CF6368470529578F265A68F96C645036F33AD13237E3BCE9288E708
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 8cb350a0136c391ea75c45c7a526e624b5482828d74a178a3e146480a7a545c7
- MD5 9b99db8a11f0f4904bf6f487f9fd982b
- SHA1 e1ce5e3991e39dcd8498136aac1007dab03b43b5
- SHA512 72bf0a44e7e3c302043b0d4e85b94969a98281d1c1dde6c9d36a527146d80b98e6965da555dc2af995f2208eb12940257070a07c37a86234e32357bf56e8c8d5
- SSDEEP 12288:qyPz5L8zwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:3zyzfHLHUvB60yM/0s+1Krl
- TLSH T10065020777A130FDE576823489A21962F772BC72476087AF23A407762E376E15D7EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 4008dc4d0a76898b9809b75483f2b8a568199b44be7efdaf46f7c846a760f7ee
- MD5 8ae05d67ff0f9b29b6025afa90f0080d
- SHA1 b6dbbc9316d7f6f5dda6d292df71698c883bdeb7
- SHA512 bc3805dd0a70d004d811a4e118216dbcc55158151e6dd61b89152bdf7c54ed86f204ca7129c061ed2974f9f96ffcacdf69258a532fcaaf35ea86257767dee8c3
- SSDEEP 12288:AawS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:AafHLHUvB60yM/0s+1Krl
- TLSH T13655230B1B656D7CF676847052957CF264A68F96C645036F33AD23227E3BCE9288F708
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 e3e406907609b6c24bb819e695f1f25f9eccd8821f5a9fd0d59c47380888b96a
- MD5 e9805ff833db7f5d38e5d64c45b5d378
- SHA1 1936540d5cf1a4ba1393103670ce75d19485a030
- SHA512 3c77ff3b83d97d7c87b419d5763506b85f64e6648829cb66b5a73f6f382da97e12e9ecfdc0a1d37120aedd482b1a8ce2038c6cfee28241c4c165d60c02c8c59c
- SSDEEP 12288:9awS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:9afHLHUvB60yM/0s+1Krl
- TLSH T10355230B1B656D7CF676847052957CF264A68F96C645036F33AE13227E3BCE9288F708
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 051944150e5753948db044dca7897cd975a54c71b22ceacb080bb9a287aa372f
- MD5 8dc0f07a0262f487c83211879668b351
- SHA1 0f326528fa5b24da9bd11835bcab712d933c3210
- SHA512 6e2eeb24223634144f992950c0feb99ed30fad55de56400fde3d9b702c867286c92f40a7b6fd405535997a8b793907ae13a3dd7253769e230362cffe06d6f475
- SSDEEP 12288:iyPz5L8zwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:/zyzfHLHUvB60yM/0s+1Krl
- TLSH T15A65020777A130FDE576823489A21962F772BC72472087AF23A407762E376E05D7EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.5MB
- SHA256 dc89ce2f1def914af6548c2500d6f4ef0d6c6e19067432770e643272babbbd38
- MD5 9fb8de9c922548c06b692ec5ebc80d2f
- SHA1 139635ba048e54c0c0c12185b89a3f37d5e00514
- SHA512 d7ae121c6851d85ba38f66b842904bd4c034f82dcad4d2171b5efe7f9714784805aee9ae5bd18183aa1636080036fd2d4ab8c7f4f60c812315983606f2abfc7e
- SSDEEP 12288:qCd9kWYoaLHF3z0z04PDvhBwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUn:bT1aLl3z0zDBfHLHUvB60yM/0s+1Krl
- TLSH T192750199B3A01CF8EC67813EC9659852D6B2BC5A4760C71F13A837275F333A11C2EB59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.7MB
- SHA256 c57335382b1016e59f56d2b6a6dc712929976ed24a0d78eb62702ee138373ac7
- MD5 d0ac1121d060665a377d0c3ca40c240a
- SHA1 f36550532f5459ebb1a8b9a9e4bae8147244e0a7
- SHA512 a8ec662c4bfd41e81c31ef578f73b08efc87d616439a8097153fd5907883d6b14e2f8401aaba216037ce20802f20e3f6f212735e932f274356e84419863a6bbe
- SSDEEP 24576:q3Vd9CHKy7GZFfHLHUvB60yM/0s+1Krl:MVd9CHKyaLfYvBHyO0s+2
- TLSH T1E785CF90F3E414E8F0B7DA35C9765512DAB67C5A5B31CA8F03A4261A1F33AD18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.2MB
- SHA256 6a71d87a51dba82c4797683a2ba21c68c5116e36e68e99296a5b1905d25b4825
- MD5 8ec8bc0cf9ee2b77cb30fddd1e5302e7
- SHA1 13251f5b638bb1623c8e4ce832c9e817a1ceb757
- SHA512 30e16619395a79828c9572fb9e58578a50cb9e0c78fe1a90229330c6ce55dd66d977448fa64a2ecba765b1c140f67b38c0a6d173b3e9013572bb57f27582747d
- SSDEEP 12288:SxwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:SxfHLHUvB60yM/0s+1Krl
- TLSH T1A355230B1B656D7CF6768470529578F264A68F96C645036F33AD23237E3BCF9288B708
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.2MB
- SHA256 e82c3f779246714fb6f582369e3572459d35e49be7004cdd9ead8558feeb8e57
- MD5 0241309552218b2a5ea556c356f63cb1
- SHA1 be16394ca12efaf36e02040ac1725263394fe464
- SHA512 eb7b68610943fa28e8150edfb3bc29976ddf3d8996ba3b27c10d71b68bf98501eace6ce4d05f93f1793dbe620938c067f4e7c39f267de535867e0c00f1e5ae37
- SSDEEP 12288:tTwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:tTfHLHUvB60yM/0s+1Krl
- TLSH T15955230B1BA16D7CF6768470529A7CF265A68F51C655036F33AD13237E3BCE9288B708
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.2MB
- SHA256 fa3b9bd82167ad22c7771b4afe63aac8637487f80b56fadc41e3d6668a642c9b
- MD5 db54d94cbd5f591e8a538efa3274ba87
- SHA1 5630cd10b19cd433e5f9ad3f4ff7c307abf0e0b0
- SHA512 f668cd372437811335dc718764d20452bfb3a71077fbc464c0097a023884c4fbbd002976d296c22278460eb7dfe2d60aaa791036eb48ec111b45242389c11a46
- SSDEEP 12288:JMwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:JMfHLHUvB60yM/0s+1Krl
- TLSH T11455230B1B656D7CF676847052957CF264A68F96C685036F33AE13227D3BCF9288E708
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.2MB
- SHA256 3d13179eee3e392f906fa67f05ac5ab13caeec99a78c8facac798af0a7e74344
- MD5 ecf81b350f8a646e5f0745cf2c87d533
- SHA1 8fc2cc14536fa8af2fd301497b127ef9b841631f
- SHA512 cf6605991d689834dba14555a16de29ff0431e9553f8dea2aa0061679e2bbeb09ae3408960b18ce3c0339d3d8394fe8a9936c5b6ed2440d370cc6bb78ec39c93
- SSDEEP 12288:uawS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:uafHLHUvB60yM/0s+1Krl
- TLSH T18755230B1BA56D7CF676847052957CF264A68F96C645036F33AD23227D3BCE9288F708
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.2MB
- SHA256 9fd3a31737facfbda14d2c2bad7afac89bc2131f5843c5f14888064ea99d4c03
- MD5 45b1b41408dea0b7fd234ba337b23e8a
- SHA1 9506df51abdfdd177273d3d4e08b3916b6cf332b
- SHA512 0a4a8b1a3584e0b4c1fe76e7249f6b5e456436c42e34adda33d3a6eff9c4a9daf3ddb04234c5004d25bca047d7e6fdeacbec63be8113a9f1f1cee93ba14b52c9
- SSDEEP 12288:uxwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:uxfHLHUvB60yM/0s+1Krl
- TLSH T1E555230B1B656D7CF6768470529678F264A68F96C645036F33AD23237D3BCF9288B708
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.2MB
- SHA256 284040c739f9c40be7dc840281c28d28b4f4591794b9fa4956f287688815083e
- MD5 e7448a482cd47dc63367532c5752763f
- SHA1 30add8a11a65c24ac8350057b1838646fbd33d24
- SHA512 9f215a3233980309398c36d51c01ec884d2e48df4bc474e88796a0de89c17c5dd86d96488ac37631c9c9c81998e3d9cddc0ae41a92e7088e5084c46f08c9f0f0
- SSDEEP 12288:2CwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:2CfHLHUvB60yM/0s+1Krl
- TLSH T11455230B1B615E7CF676857052957CF264A68F95C646036F33AE23237E3BCE9248B708
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.2MB
- SHA256 30fcd2815544c381be99f75b01237b366d8ce11b627bf487501fae0071d2a7fd
- MD5 b09a6365a76e92ac74002c80777048c2
- SHA1 e359e53512beab7f2c3c1881a9c839927dfa8c6b
- SHA512 e69b403d7d9d34a40faa450bf32a03090da8169805335c4deae7c9fd170adc8a41af2e66d27feb6ef0de6968099afb0ececc950bec01cf6a5210d787c1026ccc
- SSDEEP 12288:XYwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:XYfHLHUvB60yM/0s+1Krl
- TLSH T12455230B1B656D7CF6768470529678F264A68F96C645036F33AD23237D3BCF9288B708
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 1.2MB
- SHA256 d053fda4dd65634ddbdf2883bf0a48cd8f023d5199b21388211268576aede24f
- MD5 fcc868622d67d1e94e31016d62c0f29d
- SHA1 b10b5bab757def905a4b2824859a8dc596036c56
- SHA512 2ab84524a9b1a6163f770223577e96851cda1eac3c065e02180a9c71fcde45abaea9e830af84f97787d0bf9c4fd868223495295eb7f9fd50cc3815e77194d3c4
- SSDEEP 12288:XpwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:XpfHLHUvB60yM/0s+1Krl
- TLSH T1E055230B1B656E7CF676847052957CF264A68F95C646036F33AE13237E3BCE9248B708
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 1.2MB
- SHA256 e5f3e9d8e9a6cbaf884e81ecbb6078d3014084547c1507f04195a44a4df1df08
- MD5 28c1ae62d9f1e3e5df543570b5b509b0
- SHA1 d2f2c0c74c7cf82f487524eb36b49f98e732773f
- SHA512 a523e67b9f76386f72bfd1f7ee86c389d214a8782826b8320e74e2a40ee07d58528bdf30120d6298952e8cccb9c42ea3211aae6990eac6c4e39a1f60b0a034f0
- SSDEEP 12288:RYwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:RYfHLHUvB60yM/0s+1Krl
- TLSH T19955230B1B656D7CF6768470529678F264A68F96C645036F33AD23237D3BCF9288B708
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.7MB
- SHA256 38e79724f084bf6b7d2ce48575b9c8eddbba3dbd85992cca20512248d63a01d9
- MD5 f055e3c5e12ee12a82bdfab1bd8827df
- SHA1 36e742b7579d9fa821b37e7923953a8bcad38e60
- SHA512 3bf51dc8e3f96c7d1d135275361c93df22d714b4df478846c9ef3cb97f447877c34426983798b5a365bd024534f28409412ed2bf68620eed594f0418ed1671e5
- SSDEEP 24576:Efwv2k9RX6wkyAIWfHLHUvB60yM/0s+1Krl:KMnYIWfYvBHyO0s+2
- TLSH T1C085D029EBDC44E5E1B7913C89B7460AF6B178690B31C2CF129A536E0E37ED46D3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 4595800a91826a1f81a3261a44c039c09a99955935778de242d98291e632ff44
- MD5 e72a2f13c881dda1367e1fbdeb7f4a6e
- SHA1 759ca47e940ae46c342f9a458ed967a8bca18f05
- SHA512 4a8f54558cdf2b2dbe0839cbb05ae35c09a1b6aeebd8d8096fbfeba21c380e34701cf4e47776d5c50fdaa7eee290ce4ca2016c98ad9858568c7ed1abe1b3c586
- SSDEEP 49152:eYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0tfYvBHyO0s+2:BySzP6cOj
- TLSH T12E066C56A1A801D9C1B9C1B98B1BCC17FBB134490335ABEB03E556935F6BAF09E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 ec2f274cbcb5a9f7216ca359e6cf8412d381ca04460c927b96300049b2bac689
- MD5 e9801988efcfdc081a40f0deef04578b
- SHA1 c88cd903c77c7a523eaa13c39782d09910e0c36e
- SHA512 49c875e2b32d7a0c8602e7f5eba6bccf323037d6577e8d8421aab66134cb05dd448c97b91ae4949bab466e5c7b885f558ac2c0aa5faee48a63cf9028afbd9e14
- SSDEEP 24576:347Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYXfHLHUvB60yM/0s+1Krl:347JUQjqirIhCnDHUPfF/9fYvBHyO0sd
- TLSH T1B865AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF2270437D6F23ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 4627b0814ca76653618b3824d4a21eab3c6744e87779f7acad2f2f91ce62a00d
- MD5 64f98331ca40310daf094056012ff06c
- SHA1 cc7480fe1ce054c62b7d54df24daec0d9b939b54
- SHA512 c0255cb56f6580e11a7af4a8db2b3b06a08a4f8671dd78ec995127939b96493998f4b8c8b9ea18dfe66eee2bde0f8d8fa3767abf2ac4f4f3513fb845b40b533d
- SSDEEP 12288:OmsfKwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:+KfHLHUvB60yM/0s+1Krl
- TLSH T17365F00AD29812E8E06EA175C7565991B3737C6583E183CB23D0F63E1F3A9D45DEAB03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 595be396b792cf1143d1a54c0e9f438323abc52e220eb045419209caea338cab
- MD5 418a2c0cbd5457e32e8f89443a388c02
- SHA1 a525cfede9be24807c71f27d949942c758a46897
- SHA512 86b69aa7c7f1838213bcf20f0eb077ec1779fc0ca9d526b8696abf396658a474609a5a811c6921c33ce7d6d97ae4a54c5cc2efcafa98573bc500f80ad5c4066e
- SSDEEP 24576:v2QTPUPXLj3CExVscdOLm7WinDqWg4zjT:dPUDeE8eOCvnDhzj
- TLSH T1C33507407626DB4BC6A940321E36D6CCAB707C45EE056F0773C98B3FD576658BAE2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.8MB
- SHA256 3852f1d7dc5168407d39eb1c1f3a16b7d9c96ea7e86721bbab92e4f1dd371b54
- MD5 c422c285b5c25d3719f5d604c8da941c
- SHA1 cffad4d024374b0c976f180d8399d4c5805836e6
- SHA512 d4ef257a3bc1547f63556110964627a8a2561676a616e9a7cdb35f9f0226ca78412c25b2c16903ea828272c4712bfeb5a6526af7dd7e5d112c6f3876497c7c7e
- SSDEEP 24576:b4xZwQ6Q/F3mP9O9vFxvTJcl6LlYsKHy5Y9FaRM7E7:s3F3mP9O9vTJcdHy5SFaRM7A
- TLSH T1548529416177EB4FC5BA8037033296CDAB64AC0ABB453F05738589399477A5EB5E33C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 6de40a46898e3fd9bfaaad2a2e419b9b951814a697be0876bb1449554beb5318
- MD5 728ba91055607266510c2bd3ebcb6715
- SHA1 3e19bc925fc1dcb85e9f6c60d03678529efd5082
- SHA512 034be919e0a68f518787cf807b2e69bdaa082641a38507ce795c236300eed185ad60f2347308c2f7cf03690495ebe2c0a75f9cdbbe5fb912dcd69502aed6ccf4
- SSDEEP 12288:OC7ywS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:dyfHLHUvB60yM/0s+1Krl
- TLSH T1E455231717A86D3CF97A8570019AB871356B9F60CB0083DB735923667D3BCE86CBA709
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 c854c4eef9f2dda73b361f6b3b1e27523d0d8ed38a7f31e1755123e42fa03983
- MD5 4457c8a8d30ee4f884b594d553eb5f7b
- SHA1 978c695c18d1f5995f1fb6a70fc53af38841624e
- SHA512 4d277f37b408c1272eeb5af1613d9c7732d18d5584c40c569bbdf72c844e60c77ca9a14719c833a93c9a3e33abfcdeff1e4cbbe1efb193f3c849315ec4ab5c41
- SSDEEP 24576:Rgb6bmBIi49WNNFpg1rSvFv7bYkfHLHUvB60yM/0s+1Krl:Rgb4mBIBhGFXfYvBHyO0s+2
- TLSH T14765AE1E22EC02F5E0FAD2B89DAA4417D6B278164731D2DF1251423D2F3BEE89D39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 94fecb9fe179151df32ed518a87e61d4de517d4fbe11b1762ffa2d0f8c2db1c8
- MD5 779e53535328dce2ee31eb904a7fc049
- SHA1 9a712d7b406a5d12f533878c51f2170e9bc727d5
- SHA512 0a5acab9f2896d5af46a0fcd5b0ba5791e2b73e210d24c2315e843fc4d635c6ae1564b27bf71a6ee033e42aac8df13f5f314717620193cbcf311fc473e3f0127
- SSDEEP 24576:qG88u8FpJqH1+zria7/mHfHLHUvB60yM/0s+1Krl:R7ZFPqV5a7/sfYvBHyO0s+2
- TLSH T13B85F16577E101F4E47BD1388A864663F6B2B8250364EBDF07A88B511F23AE50B7FB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 b6c198dfef6cd5d9e43e8baa373076c2f5c1f67de0749f5ab635fc8b88c8495a
- MD5 1cb310a77258c94f967cac4643606da3
- SHA1 0e348bdf1fc748d316edf95206bbbba914f892ae
- SHA512 ed5285fd450aec19b05b4abd3850b8e6da7dc9490239413fb170e8e8baa6ce05262403d0ec78f86d2e5954717b5c86f4605ef0079b5048b87d50701b3e5b4149
- SSDEEP 49152:BBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7fYvBHyO0s+2:iG05lO43b/cOj
- TLSH T1C8D5CF6E62EC11F9D1BBC17CDAC64A0BEBB23815032556CF02A486A91F27FF4597E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 05ada5669216768864d3da9086169b19a9f2634ca5e3e1876ea3c411eb38f23f
- MD5 9d85a8af125a7ad2e1ce280e4bcb0d45
- SHA1 a8080b96da0850affd04849bd856fd022e1ff2a4
- SHA512 ed6a6a9ba23f8dc0cd2f8e15da0ec5198227bc23c6b2ad6255e08ff426d244093080c965f9b425de34085033174badef961759d5536483e57086fb8f19b8c65f
- SSDEEP 24576:Bfa5POZ3dpyWVM50JicR2hG0lasx2+47eidntfHLHUvB60yM/0s+1Krl:Ba5POZ3lJt2pasx2+mTfYvBHyO0s+2
- TLSH T17265AF5EA7F801D5E5B9D17CC5834A1AF5B1342153329BCB122182BE3F27EE89D39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 f1de3c6367394ca4451affa155d40d0c7c180015cc71def9b11066ec0fa96c1c
- MD5 86b82daf1cf2718dcafeccd332d250b1
- SHA1 7567bc8fa29e2f8199ff1e8b28547ea847379880
- SHA512 6a38c744dd4d06d0ed74678de8d26aaa23df1b2e8ac36fdadf101325fbfab80271cd3602947a1fab0ee4e09e3f1e7ffcc2b2f5ddc9830029a7804cae7f536c13
- SSDEEP 24576:ONcwHdjbyQ4nLC18lb/EOjowL7FkffHLHUvB60yM/0s+1Krl:ONc/zEOVHFMfYvBHyO0s+2
- TLSH T1DA858B1623E901E4F5BBE1BE89779946FAB17865533086CF0291811B1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 ca3f69340d89b44cf39daa28e589ec016044260480e3225f1abc49f0b792e098
- MD5 4c219091e32f7c2d6429ab11ff9b20be
- SHA1 9e0837f7a6621cb4bba36bc64dbac641234df77e
- SHA512 f868e151325a7d66e0e571c0af9a282426764aadcabdd7c3a85d26a59b10e3d5052da7c94c8e21aad99869953e67858b827db1aa117fc4cb3a4395f88d85075e
- SSDEEP 24576:NzkNvNnaFeYhJNtmZBmpfHLHUvB60yM/0s+1Krl:NzMwBtOmpfYvBHyO0s+2
- TLSH T10955AF2EB6B846E4E1FEC6B48D238512E6727861073253CB5390C13F1E679D89D7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 29394c5ecde92fa390023b36f59a7cbc6bf6866a1ec3be2de96d5541dd700fd9
- MD5 d5484da56bd0574ffef43bcd1c3aaf7e
- SHA1 eb8cb036d9c56373169849b75dc52b4bfcd257f8
- SHA512 ac9b4105d29d46fd17c5fb0ec93642679c664ae6363ff8efad8e8c2ffa78686f198cb617f6ae1fd3c9acd958ba355c47da51f6e6497491b43e11b0f72582c96d
- SSDEEP 12288:BHvUrBFrEjwaQLwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:BPUr+NQLfHLHUvB60yM/0s+1Krl
- TLSH T19265E11F26A818E9F676E17C85868619F772B862071192CF02E1417E5F77DE8BC3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 af2c32b30c5c0bac3a383f545b74e0eed3ab36212d99cda92ea24eaf00bffbb5
- MD5 c07124ebaf77e15f31dffa046439cc7d
- SHA1 b3af415cf156bc2314dc010b3e5a419e6d59e11e
- SHA512 b6ac3751d791f0ecc9ceaf0614024bb7316abdc3397fa387aae10b2a193932db6cbc5b70a20c5395bd3a89e1c4ff3d6d85c88474a3a3419918ec6f3fb2457371
- SSDEEP 24576:YD3FHshBIYQgAufHLHUvB60yM/0s+1Krl:YDVHeBIAAufYvBHyO0s+2
- TLSH T15275E17EE79C04E4E57BC1BC96638906E77138A9032256DB12D481B61F6BEE47D3AF00
- MD5 SHA1 SHA512 SSDEEP TLSH