492a26de32e94642059fdb603db282911defe56ca2057023df7bd56989631225

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
Size 1.8MB
Sample260710-rnx2yaa16m
SHA256 492a26de32e94642059fdb603db282911defe56ca2057023df7bd56989631225
MD5 02063e376488822085d8f773a1156cc9
SHA1 86b2b568d26b1cc95a9b6ce89fda3c4b0dbb565c
SHA512 443679c509e919cd11f037c49acd4403daf1d268f8bbe65bfae1ed33784862a8f6dd7c8c25f85e993ec38a75e91ec1624388eab7fee04987639f6b90677bab5a
SSDEEP 12288:NAmZXuY8JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:NAhY0dCN/j2GLl3iFSE33b9
TLSH
T14F85DF56BA5090F5E0614E344761EB6DA320BC68D8174F8B22D06ECFFFF6AD18E25631
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
400	elevation_service.exe
5728	maintenanceservice.exe
2652	OSE.EXE
1704	PerceptionSimulationService.exe
5896	perfhost.exe
1044	ReFsDedupSvc.exe
3252	SensorDataService.exe
3988	ssh-agent.exe
2384	AgentService.exe
5404	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\69ccd8cee62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	OSE.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ea653647710dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e34e5ad7710dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb174a647710dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c12587687710dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000215944667710dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000822f72ae7710dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031a240667710dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ffadd3637710dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
400	elevation_service.exe
400	elevation_service.exe
400	elevation_service.exe
400	elevation_service.exe
400	elevation_service.exe
400	elevation_service.exe
400	elevation_service.exe
2652	OSE.EXE
2652	OSE.EXE
2652	OSE.EXE
2652	OSE.EXE
2652	OSE.EXE
2652	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3248	2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
Token: SeAssignPrimaryTokenPrivilege	2384	AgentService.exe
Token: SeBackupPrivilege	1044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1044	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1044	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1044	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1044	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1044	ReFsDedupSvc.exe
Token: 33	5404	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5404	SearchIndexer.exe
Token: SeDebugPrivilege	400	elevation_service.exe
Token: SeDebugPrivilege	2652	OSE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5404 wrote to memory of 4376	5404	SearchIndexer.exe	97
PID 5404 wrote to memory of 1120	5404	SearchIndexer.exe	98
PID 5404 wrote to memory of 4512	5404	SearchIndexer.exe	99
PID 5404 wrote to memory of 4888	5404	SearchIndexer.exe	100
PID 5404 wrote to memory of 4832	5404	SearchIndexer.exe	102
PID 5404 wrote to memory of 3880	5404	SearchIndexer.exe	103
PID 5404 wrote to memory of 3168	5404	SearchIndexer.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_02063e376488822085d8f773a1156cc9_icedid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:400

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5728

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1704

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5896

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1044

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3252

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3988

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5404
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4376
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1120
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2844 2852 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4512
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2896 2888 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4888
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4832
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2896 2888 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3880
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2844 2852 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 867faa8dcb16878c2125e114b10f16b1a3f3f885c05e228df998ae918a5b79bb
MD5 4229b78881a4768656becfa1977f8ca9
SHA1 35058687b5f85e4a62bb39e2fb96f56cb2d68d72
SHA512 d72ac44fcbe5b4742e9041858248a368094212b5b654cf348cf183475eed2381f0b0b46550d1a4ec6b577cf8b0cd422cf5c8c53baadbb50375a5d67da922b66a
SSDEEP 49152:Ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxnAN/j2U4FH:i3q6HjBpj2jF
TLSH
T1CED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 2242eaf063c48a1160079679e82fcba9bd7cc8d95a41f7c541a7927701469ccd
MD5 7300535dd1e12e1ee7ce19957a26dddb
SHA1 43fd608d953969394e731285f93c6ec7a01673fc
SHA512 e44804f4a0c170b976e2afb62e579fe99e471677cfe1644cbb09e5969fecdaada3d061e4d84a05263b250dbdd6bf51a7b559ae1c6c52f099277bb0c78196846f
SSDEEP 12288:51XLsswWkxy2lRq2czAAJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:XXYfDtczAwdCN/j2GLl3iFSE33b9
TLSH
T16F85F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 8a3471e07968fb0764ea217a8d98efac6b07a56087d8268f42b9bb9a37427d60
MD5 32ea8cac689d94afcf11c25243cea070
SHA1 ed2342bb880c4dcf10a07300b96fb84677e0fbbf
SHA512 01ab0783a34be3baf8f5e163174defa011947ae3567727e07bfe0305c3df4146d904f8855124064829dd0b20c1c3a9620cc69d3e345a27506e3608524704594f
SSDEEP 24576:i0Le5ji0hmxirMLdCN/j2GLl3iFSE33b9:iPji0AcxN/j2U4FH
TLSH
T191A5AE26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 87f11778bbf87bf5e2a385747886e05251e0037ec1a90b0ce1dfaceb2f3e4f8e
MD5 68d750d545dbec9f5f694501733be214
SHA1 b8c0f3bc3e4948ef70644a8bb2d8a5bcb905793f
SHA512 b1a73c314e8ab1923bd341f3c42f94d2d421e31578af89ea932ea8491ab6e88ca25a602053695e03bff88a0bb2f975b96f720a9d2e94bbe410074c86183eea37
SSDEEP 24576:oa7/ezSC6vUyD/aqgrvWE6q8wyuFdCN/j2GLl3iFSE33b9:v/ezSC6vUzPvxHjyFN/j2U4FH
TLSH
T173755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6d8547b6321755966ed1b74ec04c3c2753f239af8b7729951eb702441ceabb1e
MD5 21207a3ded87289d026a4f992662754b
SHA1 fdedf3acfcc2f2c8db4e32c0993651d25716719a
SHA512 4ea89acd33b8626527a56761775770a7b7a8663ee1323d759813ddacb047f39b23b74ebd8077c3a283235aac93bc2e29835331112b82270775e7ed01cf159ed8
SSDEEP 24576:pVbqPb88hv/l+68dCN/j2GLl3iFSE33b9:pVO88hXl+8N/j2U4FH
TLSH
T1AD559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 d64f565b09395caf4f4f55b0ac1e400f7ab208bdb537b6863ef03b70ab7a9b60
MD5 1bb1f53b54701a4c1184e14e9c2dd0a4
SHA1 aea1b33212a8923fe32915e6e8e1831b058d0eb3
SHA512 3086e2f97d204f4c2b1509ff6120e2f1437c56c3b13dd936a4a2c0d2b76ea338e5f1b114099761476632a50181ff1c741c9d35f200f24669df8ce186a58f20a3
SSDEEP 12288:7RnJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:7RndCN/j2GLl3iFSE33b9
TLSH
T144752360DAA5B565F66F837903ADEE615200FEE8E525884785917BEF127CFE8C033063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 3802cc664974cd30ade909268e70d9f6f3277ef4ef9047f6a055f621ec51d020
MD5 41776710dd14c4579910beb3029e084a
SHA1 83326006d2aac9b9b52dccd6676abdbae31b9d5a
SHA512 9239c05e0597901d7b13504f01d1915da7e7483cf06c911711d9b9a74111b463f6bc90c1f50f64023d6b4a476a25d850763c1b9f024b5813179b87795a3c53ab
SSDEEP 12288:MeBNUbTVO86UsJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:MJIUEdCN/j2GLl3iFSE33b9
TLSH
T18285CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 063dff017ea39971e807d1ec559d8a80fce7957b69b2be8529865c0cefbb248f
MD5 6cb829351076b8f780d959c7bd1b655d
SHA1 ea6bed0aacc4dc202ced53647bca90bbd3bd73ec
SHA512 c916a87dbc115396114bd658106017b6478d2a8fe18c8fcadd7ccacec1ee79d3ab3f6f4b460ad9bd50cb9f7cb2aed2f0bc9009ba3586d6bed9f14139c867371f
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THu:OQvGAdlCEL8c/yRNw5Cqj2jF
TLSH
T17C267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 c51fa33b07762f373c273a0bc505b0869588725f6b93d13abe6e602b2fd5602d
MD5 e95951ddfb84e41bc18dec8347adbf63
SHA1 7c033b9d8c9025613f1bee3807da41743a08fddc
SHA512 6410a18e9e444f6adae89f8cef120a150da39739b49fdbadc8a98b7bd45e6d0786394440f26c0eb48423035bf2fc60b73bdffbdf46d4fcf66530e7e4fa2ee5c9
SSDEEP 12288:sAwSfxL/2Dc34DLLmt0LDQewsAjiJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9c:RdewsAj+dCN/j2GLl3iFSE33b9
TLSH
T18295E031FE74E436C2BF0DB61B35C716142CBA608B6119C3E3E84E9E59346D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 383678992d2fa54bb631c4fbb148d9387b3015dc9b185a9a04fa487370b90c6f
MD5 a4e44f823b8b1515a1766c242edc56ed
SHA1 342b65d6b4aeb1eecd4be6102b5715a268ebce03
SHA512 71efdf21bbfd0831dd431bc15ff7dffcb09fc9df452bee773a2790d70f5648f62d831af7a215ae00ddb4db52dab02ba1e4ae515d9685114685072a641dab06f5
SSDEEP 196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHX8F:GUEtQevvqc2W1cpV2EI32X
TLSH
T104474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7e4ec421631e2118aa2c0d5fcad1a17db3eaf496ed5ce2a8aa91873f41c2ae97
MD5 eabf74a411f9d2ae5be7f08733d0d0f7
SHA1 ec0daee0345104b1a571c800a840c1443d173ce8
SHA512 96e302d97bdcff44111310afa59ec1707291c39657e0ce35b7078e0f5f685afa42cfa7449eee1e844507965d1bdfec4060cb3628fa5d10275c79dd8829ba7d11
SSDEEP 49152:rCbRquA/m2yL5zQfFiV+XenmE3/zhN/j2U4FH:0oqtVjnmWj2jF
TLSH
T12BD58D1976B8C2E4D1F6C37886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2ba1c4736cc22f384d0fcd5fc7ac948565a66c2f03e63def38db15ffb837b045
MD5 b277eb8316987228d3888c883d4d49d6
SHA1 52584a082025b9d9dec816d1166f18acbc475fb3
SHA512 34c4dc6322dbf870a7ea2c00dd47b6a5acd6139dc9250141ca9c1fd405fbcb57dc43d3bf0b6d7516efffc70341270dc7de8a4cfbebe610b26a9c1070bb5d8d9e
SSDEEP 24576:6AhGLJIFoiwtA5l7S535dCN/j2GLl3iFSE33b9:6AMyFoiq5+N/j2U4FH
TLSH
T18A35AD80E7F955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 70b974349d0076cc905178cf6d429de7d912f12240a36c3adbdbb53ba7859c90
MD5 d9c0b1a50ed1401b22cbc5ea3d8edda2
SHA1 0de8ca64c2367bece33586e08635ec409199470a
SHA512 4bebb8cddad14207400f6ed2e3cdffc4cd5b4c0b7a6892bd1a4675f5676013a10e6d20db1d7047b9c79ac8fe6a03d2d124d78542a782f37ea7f4a4d01bfc9511
SSDEEP 12288:cmw5HEjsChNVBFgl0WDm+CRJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ZwuoOWidCN/j2GLl3iFSE33b9
TLSH
T1C285F14576E41CF9E96782398697C536F7B2BC512A21CB0F0360C79B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 981395667e24ca63615af0e5f230b47d0e6b55897c9e6500ac87a6c744e0cfaa
MD5 3acb905535d0719cba9303387f882303
SHA1 6701b0cf9fbc2fa87383e53474d178909ecf82dc
SHA512 55fcf2b8eee70713cc368f93dcd305ecbee1ef4a9f45c96f3c3866471b4349ab95db8ca6e6a1657d759db104d0c6996527f210c393d874edeaf1f24d65e751b7
SSDEEP 12288:iBZ1IySJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:MZuTdCN/j2GLl3iFSE33b9
TLSH
T11275125933E471F9E1A7823C8AE59A05D321B8A5A73243CF026147EA1F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 35161e103194f8b3cad86af9390dcc7c69baf51cd35bf2ee8e0690c73b5bb6ad
MD5 dd56ac288d6fa64c6f5972473e69b9f6
SHA1 a64ab815d360b112f97e308759df28dd224a35c3
SHA512 d91ac6251137613898351b4397ab76b5df0fc52e7c5ab909511f9cc32e7d51727e4d9db30aa4271cb7a6bc333b660da3a14b4dfc6536a6a2661a4f16e1bda4bf
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ui:cQRQyi36YOcPQLvw2gAf+PN3Nj2jF
TLSH
T1A1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d721b36a7cc6be2c583a8415a9b8d9f0c3a956e5246b892184808f6a9f753dd8
MD5 2ffe11ca5b86a8bbf7ca09fa7cab5ce9
SHA1 f7abc107f1d196475a4702b713fef601c3c1d43f
SHA512 8a205f09e9b20e90692e59e05ec979ac008ee3ff9dbbfb9256c14a586e30f1f5bac7aa09d013470594634e872e77efba8f459b4821766fbf9fe6f91c7f53f169
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ui:uQRQyi36YOcPQLvw2gAf+PN3Nj2jF
TLSH
T13B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 47cb2d444bf75cc34494f5ba9a4bcd92cefe5402241b72ea7381148d2b6bbca2
MD5 be7f9e03f6d6ee49cdacdbb6b7a032cd
SHA1 57839f8613f2b3f747dc17cf4dfbd2d65f070f53
SHA512 9c7399c9b3ddd7694e0c46de3d2f1359b79aecabbcf2973284628da60dfbeedcf2c4843ff471cb7a644194ddb423720c0c2d08dcb0f556f3ff0e3c462c0ccd21
SSDEEP 24576:uwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0DdCN/j2GLl3iFS+:Y68Qg55nhheWu7PNU3/xN/j2U4FH
TLSH
T10BB54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a76761f5e4cfef7fcf13fb215f7a34f88a13666e3c68389e03f5c1c2948f58b6
MD5 f8d8abc83ed6743806ce6452658f095a
SHA1 85cf344ad245d216789e368fdc3eac940b3daf9b
SHA512 d21b60e1dc107eee5e09e8c2cd8721701b2b671eb22d9dae4a433dd2dd5397f7289edd8cee7de7405afd21e45a59a7f582aec2e4e99d70ac92146562f08eaee6
SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Y:Xy5112gYy5azzVvL69nLKnhZ4j2jF
TLSH
T10A168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7975a544b77ee376519f8ec7033899e1f48d9c4798eb2a07e8cea35b792e89e0
MD5 92675a04a308ca3d46c1e8f554831cc3
SHA1 6786724c831e1a6a8ed7cdec50d65e373f73417e
SHA512 1d12d4215232f7a907c50e54fabdb8c8c935fa3c1a4ddda690ca46fb9572af27fa02ea509d18028a6a155d1cad0e649b1ece8849de1f647cf2d86101bc0b2f1f
SSDEEP 49152:J1hpsNoJpF1A6UU44CwH7R4xPN/j2U4FH:JmifPbRWj2jF
TLSH
T162B5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 489f8a568aa24e357d76483a7e00481ffc6b7bdc99aa385166c442ad1d2a6ceb
MD5 ce479981e1c2512888e908fec1101d11
SHA1 211678809d0ea64768f474d9437c5647304097f0
SHA512 a31791877205d7856b0a3402d3416ea9fc17f5ade22ef87582c82a41440557d7b74d166a7c1cb479a9521ed0e2e6b56e3b7c4d05800fb23b6ce537e8b917edc3
SSDEEP 49152:mSuZQIY0Be2KRRVtOnks6NMHqQN/j2U4FH:o5dKTi61Mj2jF
TLSH
T1A7C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d2883ad6bbd053fe1c0ac25b797a664f178ea8ba629a29dfd0dbd9569af0a4f7
MD5 e7e303805cd23e445a4c6fa9ec6d79b6
SHA1 0ab5ef75ccf92cd0612ed679ed257861434447a0
SHA512 c2c3ba4908be46b7db7973fa6978fcc56edae2846145ae061a50bf4cbde96908c3c1e3a8da2ab678e8a31399aeaa7b89700cdfe622d19866bb3165dca3719066
SSDEEP 49152:KhtSn8EApI0figngiDn0AP5w7N/j2U4FH:rX2iyphyj2jF
TLSH
T17D95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 6a761ab9bbef05bc0a3db7d3c8389f061b74a0ee9dba4ce568fa60baaedd9345
MD5 757fee17d8bffcbe18f41c2a281ed2a9
SHA1 614c53b0a3edd00f2122609ce6152b3260319882
SHA512 50a2ec426cdd76d6a34413fdfe2e74864383d6d64f8234755c485ad4a7a3f75e4fd415c81e6be331c24129e25fc2a316948462c8aff6ccf40ef6912184c5210c
SSDEEP 12288:y/JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:yvdCN/j2GLl3iFSE33b9
TLSH
T161752364E9F6B669F15BC37943A8DF515100FEE8F6224487868156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 dbca01ab5e8325f95c2a99139a3e98f381c8c969b089a247f90a455d27e2e3ae
MD5 9b8dbe0eb77a122ab9361c29691214a9
SHA1 c64c7c2ad0c4dcca4d5bda8150ccecc6a7d047d6
SHA512 9514ce747c8438aa33215f82b76db9a8a7e8d1833068a4f406ab028c86858e736988cbcd80acd718407d595d98b3890ec6dae35062c10a2883f97c1844ca5c2e
SSDEEP 12288:/2JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:/6dCN/j2GLl3iFSE33b9
TLSH
T1E3752364E9F6B669F15BC37943A9DF515100FEE8F6224487868156EB237CFEC90330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 7c2dc5ba888eff22b94c2064af65ed62db5c6fa241ee75c444112ab296d8b72a
MD5 5ae9c923a5f36902eae149f5591af4c5
SHA1 96fcd7db0cae0aa883e23bfcbd389829857b2868
SHA512 fffb94ca2ff824c563053950e252ab5b0bc297034ad27a258375f7250b489370e10bd12da28bea81d24c8dd66ff073ce635b8f718e082bb9ccd7b102364e37ed
SSDEEP 12288:zEJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:zsdCN/j2GLl3iFSE33b9
TLSH
T19D752364E9F6B659F15BC37943A9DF615100FEE8F6224487868156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 ec5087c57ff4108373a041c27b50c6d776d6c9c99da6cdf6abea9afa46671da1
MD5 c4c9ba9c5cf247876c2e4e82a3dcdcf0
SHA1 6578f43dc37bb27a4074cefd3249bb9b53c5c46e
SHA512 870a4060e7af067830b1457c679dcf96a66206362f5e1cabccdaef737cf4ec1c60bca8bd6352b0ea60cffb31852d058da201379786c96fa62f5533a7fa07f885
SSDEEP 12288:nVNJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:fdCN/j2GLl3iFSE33b9
TLSH
T1E2752360A7F561D5E46BC37C83B9DA21E220FDE8F73245CF86400ADB1B75BE89432562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 e928db650ba7bc4fd8321248720bffb5a959990b0dbf79cf8b9ae3af3d2536b5
MD5 2cb58178a6ed4a63f99851f33474735b
SHA1 f3ba1e348711eb90cbcf643d8d9ed18c357d6ba5
SHA512 b0b550f307ecde0d033f70af041c7095849d442fe3e9f24785ee38652f4e0f6df16f8f4d85405be28ca44d6ca6e410ea122ba5f87feaf570c47a4990a2afbc2a
SSDEEP 12288:/1JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:/RdCN/j2GLl3iFSE33b9
TLSH
T1D5752364E9F6B659F15BC37943A9DF615100FEE8F6224487868156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 5e0ece43183a9be38aabbca3119af82aea1b8b811271b0ba687af4308f5ec897
MD5 8b8a83f57f265ce36ca90e062a7f73eb
SHA1 e335e5bb3e2fdf70b54224c795220d80507f2d9a
SHA512 dd8833952ddc7a1b8366bdc3c61ca0a9ba892f338a01d157d8f4602d833b93794c2b0e037fcb1135991e8801e62b7ac17e8e992ba4b2e7febd20a0fe0cc0d189
SSDEEP 12288:paJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:pmdCN/j2GLl3iFSE33b9
TLSH
T13D752364E9F6B669F15BC37943A9DF515100FEE8F6224487868156EB237CFEC90320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 111a19a8531528dfb52cb2d1afa2d9267382e4f965382ca2fc2b9031898a5cda
MD5 84dd81b7f2e8ed66daf2da37cc26fe22
SHA1 c1af96344e649d4bf3386fed18b4e4bad2658b18
SHA512 02515520f5b4aeaa2297ad4fa377ac876ac6dfe01769e92dc02b61d19b7e449129ce68088633445336ee9263cdc866e3dcda20907ca5f3a9aca587603dec8c0a
SSDEEP 12288:AeJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ASdCN/j2GLl3iFSE33b9
TLSH
T197752364E9F6B659F15BC37943A8DF615100FEE8F6264487868156EB237CFEC90320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 d0e03e458f13772ad8de143893797c20536349879ed7eff304a3e008be428578
MD5 e8f7de940b71f48e5fa5f04abd2a6266
SHA1 6f471ec9898041edf1477bb56b4c29a0fa008c14
SHA512 511b6f6e2d123dad3ddfc7e16bfbf107dbfb7bea05e563fad2cf3d57a055b97e15f48ea48d0d239e3fdbce28c8876545612bbdb2481ba0bcb0d8c57b66aa68b6
SSDEEP 12288:XiZwb6zzFEoS2cPvyWJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:SZMSzFVSOadCN/j2GLl3iFSE33b9
TLSH
T1F68502A4B3A018F8EC67823EC9658916D271BC594770C64F03E4366B1F377A15C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 7e87be52bdbbf7a805a1c6020943192d2a2e01eed0ffb29e5be8b1b5916fbe70
MD5 6bf13f11661cb42a696d01feb646321b
SHA1 5e83c84c7dcb5cbef594ca9b15e14dc583ede7aa
SHA512 fff8c33248edc3303c0dca6cc0c96a385db0ba755d8cf2e3d5f0c3dbede29acae23b346ecd6c3c3a2d210dc752794894ea9b1b5fd77c380911440a028a34f22e
SSDEEP 12288:L7JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:LjdCN/j2GLl3iFSE33b9
TLSH
T1E5752364E5F6B659F15BC37D43A9DF615100FEE8F6224487868156EB237DFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 46519948528571e86901862f80f7ecde816b4b7f2dc5512f6e8225d59ebdd2df
MD5 1a08c3996a6a2c8a4bc886212e0860f9
SHA1 a5e06e0bdad79d93191e6e999f309879e2159a81
SHA512 8081377beddac57ac9561ac1dbbbff1484dab52272b1f1fc2cbe5b043649a4f22813b2c2f179632f3108f25ed59247d3269ae32c0d2dc5da396122db3c328704
SSDEEP 12288:0XJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:03dCN/j2GLl3iFSE33b9
TLSH
T15F752364E5F6B669F15BC37943A9DF615100FEE8F6224487868156EB237CFEC90320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 03af507d3fe1cbed76ce28f09ee0eca41fffe6be49ec3b2abc5ef3209d3cbcaa
MD5 1238bb80feb96860d27bf4108210dce1
SHA1 27bde5a869a9a7f926252e7de64377064c27b692
SHA512 2bd74993909db8290d4fcc8fae93f417a73c25cbd468b48f461dbbf11d9c3c1e4aaac313f7cc6736b68536fb6f45e77ce56a8d50cf5aaf6352d7d75d7bdc45b2
SSDEEP 12288:GyPz5L8SJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:7zyOdCN/j2GLl3iFSE33b9
TLSH
T190850217B3A131F9E177823889A55A11F331B87597208A9F43A007BB2F377E49D3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 e4e63fe0787359d3a6ef0d6c6d7f7333b904dbc8df8f05bfd514a23637d81370
MD5 8f57db3d3060ffd5ae17bfc0a16e1a11
SHA1 9ba9c4b672f5f52d6344020bbb18588795bba668
SHA512 1cf017f5dded67955d963438ba27671ce3e44aeb844ad6b7f8c984816e24499d2114502f7a6bb2252ef11b511800ceccfd730096bea9035a098ad8232e73326c
SSDEEP 12288:47JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:4jdCN/j2GLl3iFSE33b9
TLSH
T1D0752364E5F6B659F15BC37D43A9DF615100FEE8F6224487868256EB237DFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 216bce9cd87deeb748046ed1e46ace0dd06e05f4b8a4d086cc6edcaa03edec1f
MD5 641d6415f143df53c6e9ff2853741447
SHA1 21c00ee704abcc3410d06cca6cabad10232cb3d3
SHA512 b7ed7f98e4c643f30c7853efbe65fc9826dab45357d7949467a89158d288b31960f4d566bfcd7db7c14b2c01428f02b05a779825f8e72a3995c957754624d3f0
SSDEEP 12288:F7JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:FjdCN/j2GLl3iFSE33b9
TLSH
T161752364E5F6B659F15BC37D43A9DF615100FEE8F6224487868256EB237DFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 fb6f05ba7855a8239c2091d057911a79a169792ce4b1c4e9fdddcb4d9a026da7
MD5 920063035629ad0b3d195f3c8908d395
SHA1 28336af9b3201ca0d8347d899817dcb2c15b74e5
SHA512 8011899651e7595a6d61323c8c6e329457b58717b78e6337dc63396483f6837c17febe1769f3ed23b332706e86e1cfb6316e94a5ef8998bdcac80bd066777a59
SSDEEP 12288:gyPz5L8SJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:RzyOdCN/j2GLl3iFSE33b9
TLSH
T17B850217B3A131F9E177823889A55A11F331B87597208A9F43A007BB2F377E49D3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 a4f16cc249a338b52e397ab6c073134b3a6d5c945ae5fb815a17c2c57513399d
MD5 44088cb64c3dd9466c4991cdefa83def
SHA1 202f468288d1bef4b2d90fc8bd7bd07be8dfc186
SHA512 8288904d9fd4cbedd0904b8ad0692983d887b306104c41071c3661705fcdd75981b96e8f0121b0a9653c3ad0f73037c499a05c4999de3ce38e01406c8dfe67f6
SSDEEP 12288:RCd9eWYoaLHF3z0z04PDvhUJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:sTHaLl3z0zDcdCN/j2GLl3iFSE33b9
TLSH
T1738502A4B39018F8EC67823EC9658916D2B1BC594770C64F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 2.0MB
SHA256 629ab42646a74f033ac12b7daebcf084c03b7b6137e04b0b61131cf62675bad3
MD5 bfc36cbcc69cdd56581c064402d72ca5
SHA1 331e1dae7f5b4ab5df74aac6665535ecd224dbc7
SHA512 394f00581370cad62775ce92cf154a32f590a17c607dd2f0a97b22cfbf380e47214ef575baf6254de4329b3a109e5b485bd5cb3d7efb7580a107573be987c679
SSDEEP 12288:Zi4e7+RdTfgwCHKy7GLbbdIv5JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:Z37d9CHKy7GZ4dCN/j2GLl3iFSE33b9
TLSH
T1BF95CF90F3E414E8F0B7CA3589769511DA767CA95B31CA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 ec1141dfc3806fb8bc1ac208bd2c7d0dc334887143f628c9528e321cbf7777ce
MD5 2d9b45e981f2999f0b4eac22aab72ed7
SHA1 ec89f0bc6757f999c08c4c76533900888b21167b
SHA512 63a581d4fff012ad7f5ae4d45a12b33b696a47ebf45778077b1a5cf9eca23870961f65730cfd2e8ff76ffb9d59f738da4a0ad4bf2bd778f789fe012559f1e356
SSDEEP 12288:BkJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:BMdCN/j2GLl3iFSE33b9
TLSH
T15F752364E9F6B659F15BC37943A9DF615100FEE8F6224487868156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 d7869457d7b69f594971a60b7bcbbe0865f098c924a496f5e63945ca44010167
MD5 c2e2a8b69cd38e3ccd7779df15e82fff
SHA1 4c1a7c49625f143d8c74566c028d851c790c88a3
SHA512 dad24c656c694bf0b7a42e760c6011a1550fe8301046dd0a23b335a496d9f4e306519d90bf6becff59eb0e75039343d18cda004e56fbc21947c225d7384f98d3
SSDEEP 12288:VyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:VudCN/j2GLl3iFSE33b9
TLSH
T1F2752364E9F5B669F15FC37943A9DF615200FEE8F6224487868156EB237DFE88032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 85aaa58b5135451d8df221db7bb99cce2283743db67571f62c92db1233c4abda
MD5 09319867b3df20f7106f135075ed33d0
SHA1 df650dae69b23f1bad43a4835a922c9096422fbe
SHA512 08a98c9af90b9e79f00f05605bc9f452f57d593e10f46d0ad91047d3c049e67456d280170a8313cf49370152bbfca1717466cbcccfe9b429e104963378bb0942
SSDEEP 12288:S5JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:SddCN/j2GLl3iFSE33b9
TLSH
T1DB752364E5F6B659F15AC37D43A9DF615100FEE8F6224487868256EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 3ac43d62c6addbdd8aadab3f12141f9561f09652a0056d1d70e09de20a8e8aa6
MD5 3f6e0825fc6afbfeb1ef19e889e7bd51
SHA1 e508aa008444f858a9e908b11e67107b95c8d1ba
SHA512 9a46cb84919b16bf877d6e4024b6b387b66612c232c3d91bcbc0244ec0735de9e86e4723d4671466504a7bb04e3e9e2f239b10302ce9559d9e10ba96ca7998da
SSDEEP 12288:W7JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:WjdCN/j2GLl3iFSE33b9
TLSH
T1DF752364E5F6B669F15AC37D43A9DF615100FEE8F6224487868156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 b09188325a250147b9570f2a78f67af821b92e79ec0149a76926ee9093a4ebe3
MD5 17c10370469e74e84a40ac277f6bf417
SHA1 9a017de66093e45b82f6ae50247f7a581afac544
SHA512 532befb08045695a76de6bc92529540014b3824b6180946f729402ee05e00f6e562aa85fdc0763f8cb7b4c42002a2dbb36b5e1990e9a3521552a8eace7cee282
SSDEEP 12288:DkJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:DMdCN/j2GLl3iFSE33b9
TLSH
T122752364E9F6B659F15BC37943A9DF615100FEE8F6224487868156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 0019820aa8ad3f1cc01cbae64f53657b47a818a7aa00776d0493b3b7b9b1a198
MD5 fd81a31174e0c2be66bf8d387a704a64
SHA1 26ed5f268b2304d83d1ba240df5f0aadc45cb802
SHA512 1bd2a4c9f897d0aaa76db7b4696182b87c9b272e428a89621bc52af003448f61b436b967157c89729e1c70eaf70d7c68e08e80881b58558d8d00fe53ad688e2a
SSDEEP 12288:kDJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:k7dCN/j2GLl3iFSE33b9
TLSH
T10E752364E9F6B659F15BC37943A9DF615100FEE8F6224487868256EB237CFEC8033062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 060122fca276b646093d80760d9d85d28f75466786269844d87d8c87e0a3750b
MD5 ae12fd994d1556660ba2a21b646b3c7a
SHA1 e87a116e4d923beea0ec1910d9d4dfe43a0719f1
SHA512 3b081d313b98fd817d9d462c44cfc623a17fdc48ff4e1202362bb420b1a0c3271651b204f57506b655e7b520dba20fc059ac4508f81949c73a43f26702e68a15
SSDEEP 12288:j1JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:jRdCN/j2GLl3iFSE33b9
TLSH
T158752364E9F6B659F15BC37943A9DF615100FEE8F6224487868156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.5MB
SHA256 ad7810797c75d04b3fe9f2f1a0c589ef971ec512a19248279f6b8d61adfc685c
MD5 7d9b0e1312b29438e128988a1daaeb58
SHA1 b3249f8835983406512f417db5df6c1b75ede8c8
SHA512 0f5b46b3bb083049d815e6aa07ba8888f9d308d0d44519141686ec98807f82dbb057e180ff6ce57723db76ebd4f1e64a365c6c8ea799670cfb6808e609795901
SSDEEP 12288:dcJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:dUdCN/j2GLl3iFSE33b9
TLSH
T15C752364E9F6B659F15BC37943A9DF615100FEE8F6224487868256EB237DFEC8033062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.5MB
SHA256 45c0a343418816a0c2580933f1bfb27c62b58d0ac63239ab32aed816b400702c
MD5 de337574273d1453326763524bb1ed76
SHA1 e3ed8ca0b7dec39d1ec2e92f6e26931ec453dbd7
SHA512 413b4402a6f395c1d0ee9d10ad071bf3acd40f9789842b4503fbc0dfa1bc45363630a43a4707d9227032fbd5792a8aea3c2cce94247a014fe65fd1ee42210359
SSDEEP 12288:N1JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:NRdCN/j2GLl3iFSE33b9
TLSH
T1F4752364E9F6B659F15BC37943A9DF615100FEE8F6224487868156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 1.5MB
SHA256 37c5ef5ba6f5ca08d8349d339be3386764a2e98ec4e747f95ac3cca03ed037d2
MD5 74de460402b9e1a1ea84f5695914678e
SHA1 007425e2ff03a6ae6f59b043827aeecc176eb8a6
SHA512 db1038757dc952764665bbb71954bcbe9b9286fcf1d6c942790a9df2950acc9eec5d9f01528514b9e581dc5fdfed61210d2b30ace8cd4bd4eee194140feb80db
SSDEEP 12288:hhJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:hVdCN/j2GLl3iFSE33b9
TLSH
T13C752364E9F6B669F15BC37943A9DF515100FEE8F6224487868156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 62d75abf34361010cc69ff1d8b13d8090197218cdfef171bd1903a5b53f934ba
MD5 1d1d0ef2451c4d5d2bff5bbaf398cac2
SHA1 3b5889af66856dfc213030ed11f49b8ec6d23e64
SHA512 6ee55c93abbf776a6ae00ac22022ee29c3c21f982c226a0b50669baddb816772da2d9bb63e7522c8ae488ad8ee873367e65d7722050c9bcec7d77974d6139742
SSDEEP 24576:Tfwvok9RX6wkyAIHdCN/j2GLl3iFSE33b9:1MnYI0N/j2U4FH
TLSH
T144A5D029EBDC44E5E177923C89B7460AF2B178685B31C6CF029A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1485506d1c1e70ea4101fe6499ec161ce1d0191f4375f0feb1e564d33d9b0d8c
MD5 97f48858d4d1e6ae23ad814802ee4055
SHA1 5035c0a4b94a8155887be010da5085099bbd5ae1
SHA512 fbc4a768a37ce4aaf3e216f8be5bf83f6701e29e63d737a8c35a2f60adecd063f152b487e89d3a3cd06daeed8a3062b75c6b67ac23b38fbfa3a0ed8a99a12e7d
SSDEEP 49152:JYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0bN/j2U4FH:xySzPtj2jF
TLSH
T186067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f3d60e43eccfa90e7274c02d038a340439f304d2e69ccc52c05db0c1df87a722
MD5 3a55250b34a7760863facde11a50a410
SHA1 516821ba829c13301bb98f792909de445774a20a
SHA512 bea8cd325194b1bbc163d3d2fa6ce0acd656ed34ab56d32f02eeb671fb5e1c351b7537a86ddeddaa987d9fa8488b11781f7e3043d0d8d8b2e3a7176a6bb6a7c4
SSDEEP 24576:b47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYqdCN/j2GLl3iFSE33b9:b47JUQj1irIhCnDHUPfF/rN/j2U4FH
TLSH
T1EA65AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270437D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 7d49a0cbc8d8ec9a2fc259cb73b6a1999d09bdead307b1d2a2a480293811b1c4
MD5 e135bd3ca21aacd0049519621da87441
SHA1 6a5c68a5af933b604d25f863b9e8865ed3faea90
SHA512 c9bf3e634dde8074819b1a35b0d408ddca84ef079727f3d1bc1e673b456e92f94b16c7a34bb0359d78f1d7475b84aa68b752c4fc00f4cf4646df78441e32e345
SSDEEP 12288:DNsfLJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ATdCN/j2GLl3iFSE33b9
TLSH
T1F7850119D2A412E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F3AAD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 a3b6c1859bfc9da772778fbd947a0bbdba243e537b93fee037884e2188a2c3cf
MD5 3b29d156261f2ef602963679e9c4bf31
SHA1 65e3a029622ce61f4b1d571ce77e7b9e0eb542b5
SHA512 5923110d784a19dab379b6ad828f603c3973ed002bc3bc31586d3579e71921d421b7aae12dd260f8ea91e77d906729e1899e3c6abc1c5e8a3c9dc93d37e12c19
SSDEEP 24576:L/hnUP1f7XSS0C6EBMuSahLKyOaXvgQhT8dKRtMRaYk:FnUNf7XSS0C64SahLKygQhTuctMUY
TLSH
T178451741762BC68BC6A940321E76D6CCAB707D01FE05AF1773C9473F8476668BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 c5d41399efba30f15b07b31bbd3639c4abf25e182f7ff8e0572fcb54f9a37ebc
MD5 14e3f5aed97ab08b7159f90c37da8eda
SHA1 3dd75c4578f1292259dcc985862670c2d5a777d5
SHA512 1e319532cbe62cb2d01e6f5ce8f892f46cf2819660104824dd74d5e49241b321dee51c37c9d09009a4d7e8e4a4124b39bba71925e079d7915a1cb770deeb7872
SSDEEP 12288:E9lcVvC1tSUExe3xtl+eF1beh9jJI6gNjbtPN0eN9xDdo:E9leEaCLkAtehvI3NjbtFRN9xDdo
TLSH
T123553B41A5ABE35FC8FE50370632C68DAB745C07F7452B0173448A3C987BA7EB5E2692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 82179b47f68f16caae9fc26ad6bf5d3768d5299c0a50d754d97bac07d20eac13
MD5 0e91bb5d3c259492e78272d7a5980cb7
SHA1 b4d89eb5934304b618d045d424ab0d2d34547a5f
SHA512 c371a38ea637eda1682dbe16c17b0c5cdccc41a563c9f4dac5d08f0acaf1fbe28597e4381b7e79afd68feaab636acb5e8568440de8cb22156f951be2b362b7df
SSDEEP 12288:bM7TJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ArdCN/j2GLl3iFSE33b9
TLSH
T16F752360D6E9AA55F47E837803ADDA316200FEF8EB1184C7C54167EB6279FD8C832563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 aee69ffcd1f1a54f40f60b0f748c5bc3c17ae75c75423cd00fec0609f9621121
MD5 cb1eacbbd792ce4a19158227327c7a18
SHA1 b146d7f4c70be0c382c1681ff752537e0ca5292f
SHA512 7b45cab54bc94527540e1ad7743406d1551f2e49752a9f3ef49dc9c3b67e1e0295cb86d4de488cbd52406c12b1b9e81480d71f9abe0ea09208ce61de858b5929
SSDEEP 24576:2gb6bmBIi49WNNFpg1rSvFv7bYFdCN/j2GLl3iFSE33b9:2gb4mBIBhGFNN/j2U4FH
TLSH
T1F365AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 be65ac28a5d1c2a190c271a617cbada6c45627e932463575b455738fbb91e84f
MD5 ff4d3bd89d53af71fdbf1f6e0ccf1d78
SHA1 23ef4ee2c2e46d2cfb2ba6e89171a993622a7d04
SHA512 a1496efbacc8061280848ed9ab994e129312f0e1c91aa35046b0d8960dae189a7d75087d91c1ac4424e3d15130d513e72388aa37de30385d3e24231f5e26b54f
SSDEEP 24576:pG88u8FpJqH1bzria7/madCN/j2GLl3iFSE33b9:87ZFPqVea7/SN/j2U4FH
TLSH
T1EFA5F16576E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 c159263b1715fd4edf2f51d948308a1c0bce4959971689a2765cef31c10928ba
MD5 3dade1fd8833dcb81ea83829a68eb127
SHA1 8246b2c91a2948890ea265302e5f1602125086e0
SHA512 f15a2a55d74f267e7c4e19a61726ca7a346d2028a9b53a5a9a6606b5a6119ad59059fb5f1b7f480a8a9f74f842b76808cae0029b1dc0a90a6b10b9af480cd83f
SSDEEP 12288:iHvUrBFrEjwaQKJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:iPUr+NQ2dCN/j2GLl3iFSE33b9
TLSH
T1AD85F22E62E918E5E67AD17D86868719F731B8615312D2CF02D0817E4F67EE8BC39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 fde2a692254d4b802901eb47751c33c55434a7ee47d64e678fa253be45772c40
MD5 e6ffe6f811d97a244087ae5baa5eb40b
SHA1 c38546b0537d42bc2f66b15ff180fc1c9fa6ee36
SHA512 99c733c7c68b8f2ea934a444be033ec8e85aa53b96ed0d2e2201f3d5269be14b58271be8f1286b3c1b9f31eed95c61c1cbea4b514abb7c140b7e38f9afe0ebbf
SSDEEP 49152:BBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjpN/j2U4FH:iG05lO43bAj2jF
TLSH
T11ED5C06A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b4ab256cf9ef467f1dec315147f4f83532bbc01b3bf73ba66ddac42fb4f245e0
MD5 145732b05be9712383951a5b54771ccc
SHA1 c95a762f78316e695777e62551c6cd5fe6e0a394
SHA512 9b1e5c9323810a0707a56ace3fef58125611ead6881c50c00baf554e1bbebeac265822188385efd312867a4d56907587eef985d9973f1b8fad1b2034b639ebed
SSDEEP 24576:nfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnQdCN/j2GLl3iFSE33b9:fa5POZ3+Jt2pasx2+mxN/j2U4FH
TLSH
T1A965BF5DA6FC01D5D1B9D17DC5838A1AF5B1346153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 757bb006deb6cfe087a6d18516bc0611a9827803e2d1f6659740d75b2029f59e
MD5 9a2236976509610634f2b0cdf5716650
SHA1 e037c60e9e67455c596f3e5759fe01a4b2c075fe
SHA512 b8f3ff39ca296f2940814bb5bf41b45bfe56e1a08b63b03f6824b3d55f072ff58dde9c78d984f6c51724eb2985ec05f74fbd65e803ce78e84cf58350a8759ee0
SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7FkCdCN/j2GLl3iFSE33b9:NNc/zEOVHFyN/j2U4FH
TLSH
T190857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cb124cd2fed61e0a52368a52e597ee571c5d6cfb92562779dd883edf4b9c6631
MD5 71183ad2b278be31daace1c76c1f49f1
SHA1 42b0a6113d7d126343d8652606405451c3c2f9dd
SHA512 b76056358342caf0d479d14cad16f91decd1f3f9248eba3747003c3980919354c6e954bce03938284a9c3455808b41f229e38a391573dc8973d501e93d741a4d
SSDEEP 24576:18kNvNnaFeYhJNtmZBmUdCN/j2GLl3iFSE33b9:18MwBtOm/N/j2U4FH
TLSH
T1AB55AF6EBAF846E4D1FEC6B58E238512E6727461173293CB4290C13F0E679D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 897f6a6b30b77fc0cc35aecd687cd09b56969677f8eb4f933b4b636df2f2a8d6
MD5 79b5bad1ab4d52ce93f5453ade704b3a
SHA1 8b5b7aaa40f711852c1b6d87481ef11e0b2d7ed9
SHA512 414cad001fef50f337f8615b2a430baa6819140f6e2fbc4b40bf74e003f2a9d68474f46f4466a3082652588441fa5562f758a9c7fd6176730e124935d92fbca7
SSDEEP 24576:OD3FHshBIYQgAPdCN/j2GLl3iFSE33b9:ODVHeBIAAcN/j2U4FH
TLSH
T1BD95E17DE69C04E4E57BC2BCC6638A06E77178A8432255CB02D481BA1F6BFE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-21-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/400-20-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/400-14-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/400-22-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/400-90-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1044-355-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1044-371-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1044-373-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1044-85-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1044-79-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1044-78-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1704-298-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/1704-57-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/1704-55-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/1704-63-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2384-116-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2384-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2384-127-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2384-122-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2384-115-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2652-49-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/2652-156-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/2652-43-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2652-51-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2652-50-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3248-0-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3248-7-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3248-67-0x0000000140000000-0x00000001402BA000-memory.dmp

Download

memory/3248-8-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3248-304-0x0000000140000000-0x00000001402BA000-memory.dmp

Download

memory/3248-6-0x0000000140000000-0x00000001402BA000-memory.dmp

Download

memory/3248-299-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3252-91-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3252-92-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3252-98-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3252-358-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3252-356-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3988-359-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/3988-105-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3988-111-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3988-103-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/5404-360-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5404-131-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5404-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5404-132-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5728-29-0x0000000002270000-0x00000000022D0000-memory.dmp

Download

memory/5728-27-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/5728-36-0x0000000002270000-0x00000000022D0000-memory.dmp

Download

memory/5728-39-0x0000000002270000-0x00000000022D0000-memory.dmp

Download

memory/5728-41-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/5896-73-0x0000000000A80000-0x0000000000AE7000-memory.dmp

Download

memory/5896-75-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/5896-69-0x0000000000A80000-0x0000000000AE7000-memory.dmp

Download

memory/5896-300-0x0000000000400000-0x0000000000680000-memory.dmp

Download