575caf1eb225c02e0bfa8c58721690d051a97ba4cb87d5ed60a33ab68db65510

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
Size 1.4MB
Sample260711-pxmapaay5k
SHA256 575caf1eb225c02e0bfa8c58721690d051a97ba4cb87d5ed60a33ab68db65510
MD5 a91298583b4e872b7ef42f993f2bee5a
SHA1 3cad6dadefe056f1bb9fb4386e6eacff96f718e3
SHA512 52fc2a248fe065618efb3d57dc97bd1a3ef793259cdaac9ee89c17f1d0e6513ddb1e7d53eb440faf8b6316c950013e9c9edd5f007882f55357f28bf78b8698e9
SSDEEP 12288:LAmZXuYpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LAhYpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12465E06A7A5480F5D0614D308651F66DA326BC29D8134F9B32917ECFFFF29D08E29A31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2652	elevation_service.exe
3364	elevation_service.exe
4084	maintenanceservice.exe
4500	OSE.EXE
4088	PerceptionSimulationService.exe
3316	perfhost.exe
776	ReFsDedupSvc.exe
2188	SensorDataService.exe
2344	ssh-agent.exe
1008	AgentService.exe
3376	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2caaabc983806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000173a57d13211dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c00077cd3211dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000276bc30d3311dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2652	elevation_service.exe
2652	elevation_service.exe
2652	elevation_service.exe
2652	elevation_service.exe
2652	elevation_service.exe
2652	elevation_service.exe
2652	elevation_service.exe
3364	elevation_service.exe
3364	elevation_service.exe
3364	elevation_service.exe
3364	elevation_service.exe
3364	elevation_service.exe
3364	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4560	2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
Token: SeBackupPrivilege	776	ReFsDedupSvc.exe
Token: SeRestorePrivilege	776	ReFsDedupSvc.exe
Token: SeBackupPrivilege	776	ReFsDedupSvc.exe
Token: SeRestorePrivilege	776	ReFsDedupSvc.exe
Token: SeBackupPrivilege	776	ReFsDedupSvc.exe
Token: SeRestorePrivilege	776	ReFsDedupSvc.exe
Token: SeBackupPrivilege	776	ReFsDedupSvc.exe
Token: SeRestorePrivilege	776	ReFsDedupSvc.exe
Token: SeBackupPrivilege	776	ReFsDedupSvc.exe
Token: SeRestorePrivilege	776	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1008	AgentService.exe
Token: 33	3376	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeDebugPrivilege	2652	elevation_service.exe
Token: SeDebugPrivilege	3364	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 1972	3376	SearchIndexer.exe	98
PID 3376 wrote to memory of 4264	3376	SearchIndexer.exe	99
PID 3376 wrote to memory of 5940	3376	SearchIndexer.exe	100
PID 3376 wrote to memory of 3180	3376	SearchIndexer.exe	101
PID 3376 wrote to memory of 3776	3376	SearchIndexer.exe	103
PID 3376 wrote to memory of 2328	3376	SearchIndexer.exe	104
PID 3376 wrote to memory of 3832	3376	SearchIndexer.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3364

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4084

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4500

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4088

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3316

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:776

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2188

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2344

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1008

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1972
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4264
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5940
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3180
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3776
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2328
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 46aefd04e52d42bd71b719722cb76690e47f3efed513bb1aa8a9b9a2d8fb0f26
MD5 5dc1b1ec1224d9340f4335986b234d9a
SHA1 8997da531d6136b87581b72d2a6503a09d98e72c
SHA512 e7d86c1ff1e932a7455d9f94bee13d724b06c847e45f16bfc3b69666a55084ea5f473dfcee669c4dff681813b93dbf0825e716cf0cab4203e47b38dc24450c9b
SSDEEP 49152:Wb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnNDmg27RnWGj:I3q6sjBCD527BWG
TLSH
T1ABD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 8a873731a9d592e8a9e412080bed397da2db3328e1246065501ac1c809c72110
MD5 ae95a4661f132801ecef5d36cb0cdd57
SHA1 3f51d0d185f2f330d1e0a941fa7ec2c2396be249
SHA512 31f71acd429fab1cc9ed18dfb977dfd6e6c99a361415e3b0eab497b001217fb57e5332de79c87c0e13e9165409cb7a5cb7b9d3be9fce8c4509d591c2ea2eb67f
SSDEEP 24576:xXYfDtczAKsqjnhMgeiCl7G0nehbGZpbD:UtcTDmg27RnWGj
TLSH
T14865F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 19da82e8d208bbc6502aeef35bd13cb32173d48aaa325030026f2c56fba132ae
MD5 07a7b228430ce490d8b9c9b1a56cc67d
SHA1 589a43c5f2bbdc8ed872230b66c6d18dadc2192c
SHA512 468ee25051041e147ffb5a898e265db26929b948941c5f8b500e75e4e58de6181118c4bec8ea2544887e7806d6cb767205402afb8c4b97d8826d61ffeb18681c
SSDEEP 24576:d0Le5ji0hmxxrMxsqjnhMgeiCl7G0nehbGZpbD:dPji0AjwDmg27RnWGj
TLSH
T1DB859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 392c868614fd762f088ee33e423f7eed395ea8b12843b4c3f81a707cbfac9165
MD5 e6d83e19040291841d80db3ffe0234f7
SHA1 3e9c8e72ab10ef1d355544bc3184612ffbfb7f05
SHA512 a2f1ec537b2b85ab8455720be27fe1b628c719f35428de4627be537010c8ad036166d3c4921b9fb4d09c8d35f46a218e0637f47dda3c4643853c908125a34a72
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWn6q8wyufsqjnhMgeiCl7G0nehbGZpbD:+/ezSC6vUzPveHjysDmg27RnWGj
TLSH
T1EE755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4a9a6c99d445c937dc56e2eb3f2ca4cf0ce9de637c6636280a56443c67b7e9f6
MD5 8c7481c604a5572984d6ef17937d4437
SHA1 6ba6575d1958997b0eee162bc638c428d09ea2c0
SHA512 f2a0b41fcea6a998b73f0336544e3f7086b445d1cf95387e47b5c9de79f596fb75eb2a2945e2460adcd99643c6f747d205c298dcda1665fdbefe5b485f573d5e
SSDEEP 24576:MVbqPb88hv/l+YesqjnhMgeiCl7G0nehbGZpbD:MVO88hXl+rDmg27RnWGj
TLSH
T1B3559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 3f6b71f22763ff7bc908747e71d1646c480b7419826767bd894c87fdbb04ca23
MD5 73ec786edf8db011e65d539afafcf639
SHA1 029b8ae77b6dc565f93e238ea2ceb221403a1ec6
SHA512 e48e7548b1547894ea7a91ae76af0cdec34a2dbb7366cb434a537f591081b515f3e082e9e2bcba70e2ac1762a8576d62f4214620020c5212f1bfe3e9fcfd1ff1
SSDEEP 12288:ULVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ULVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1254523BF875C50DAEA7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 189740a183814717e8fbf31fbef1eddf0160ea2ea76c92c37bf819e98ae93c6e
MD5 c5d4dfce7c5faa9a76e89f9d65db1237
SHA1 4c16333d533197a4b59cef6077cac87dca6b1adf
SHA512 f1e20df048275ca5fffbb45e324694803b8ec804f12db974ee15d69181d4ea48aef07c6064b74f91ad0db9a0f1bb28960556054b2f72e84cb78bc06358b9dd76
SSDEEP 12288:beBNUbTVO86UGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:bJIUGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18465CF7BEE28FCD2C27A8DB95791C600E77278314B21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 21fad884e5a51a3c101fe17126ef813ce949cd72b09e44fcb33742a755eeb36f
MD5 6c8937b990d68e2005d2606d32ee9cd7
SHA1 128c64efcddd22e41303622498778cee32fec7b8
SHA512 3fc36f370ecdfb8106e339649c63dc82c6bc680466c6b5fefaa948dd5f98f033f7a2418935db4d9dc397e36a0e80905e72020881da4ee11c76d197dd81ea68e5
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THh:MQvGAdlCEL8c/DRNw5CzD527BWG
TLSH
T173266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 f17be3121136fd2c6a067508bcdc8fa85f73cd73a9188e162df6999573f8239c
MD5 e6baab3ca357244e6363e4a0538ea15b
SHA1 c90fe58a0303792cb7d8c0c1c79ae55d4ab9a14c
SHA512 5ca7e7f9daaa2e1097f2bab8473fe33efe20c8eaf86bef9bca2629f9aaa441e48a58d3d2373b7f1ace504fac3149d8e30dece1a49581845410885f5443067c47
SSDEEP 12288:bAwSfxL/2Dc3RDLLmt0LDQewsAjEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:E0ewsAjEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19975E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 14251d7fc8de939215bfca3e304e808b59455b4915e677a09aae98aaf44c888d
MD5 64266e0b1011addfa55e077d7d4eed57
SHA1 8b3aa3fbff54b0fe13b22b5875bce4ae490cabd9
SHA512 4612562d1a9729b74bdd43dc420d6ac6765a0e994215c48f3ce4c8af811e50c7f7e1c5806e5c751744a94255e7edee00f4d28f32e0449a7f4137662398da0203
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHIVQBWG:0UEtQevvqc2W1cpV2tI32PB
TLSH
T1FA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5ea891679bae90cae2514ff8a0c59ec3e25fc57e7f5c7bd6817957ac12450ee0
MD5 788907050989631a03cdc07fc1b9eb7a
SHA1 e7a6d6a1257cdcad06d39f5187f68fb2bda948e8
SHA512 8c3cf22847ba32c102411a1c7372cb69d9d322ba057da0182e8aace99263c9141785cf878fb52520413bf0d16d96e18eb442b28de943c6392f07a316285a2f36
SSDEEP 49152:FCbRquA/m2yL5zTfFiV+XenmE3/zADmg27RnWGj:SoquVjnmvD527BWG
TLSH
T1EED58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bbe6be7ae7b65efa7eec3215c0cc6979d32ab481cc3a70f1d0c5442b6f277e40
MD5 2576df9060437537d2b0f16af945a5a3
SHA1 16b08e148806c937114f8186b0fc558c65184a4c
SHA512 d8776ba3b7ed8f151a078fee2727d554b089d58ecd16d519d0f4f94f2afab0bdb123ebf408b05bc4075eea3de2968411c1ec9b86f5d06788fd09543dff93f7f6
SSDEEP 24576:aAhGL3IFoiwtA5l7S53bsqjnhMgeiCl7G0nehbGZpbD:aAMUFoiq5fDmg27RnWGj
TLSH
T149359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2af055bea45e68b44f760126196c3a3515bb538a41d1b8a33af5335f91dba970
MD5 e5de162d220ad08ab950078eeb67ae75
SHA1 ce2b780f402d393ab3b42a2206477be554d4eaf9
SHA512 6c5e396a9e1220e269b003b89d22f05ba46527b3ab88cbabcdf058cada49972b3225949897d1590605f0672afea5caa763e9668d2043399ca4b3a5becbf01b76
SSDEEP 12288:mmw5HEjsChNVBFgl0WDm+C/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:/wu4OWQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15C65F14A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 17701b75046a41dae11a1a169ac1edab13e30df58bfdffb54f1e03538c0bda72
MD5 f06b20983f723b59a3bd621b851e72ea
SHA1 3c3bfce67684566d202073f58c02dc15a55644fe
SHA512 4f34ef59b09aa610c6559936efdfbe7e7fc4dec96ea36fe4ffae2ca2b4fc9799db231c795a49718df8391c515113594b0569e267a84b33ee3f66e316c2d709a3
SSDEEP 12288:7eZ1Iy0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6Zu5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1205512AA239820FAE1A3417CC5E5D609E7337C62673003CF166659AA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ecc40c03e4a4392457cdcba4186797f89ea3b630c0ccc14f121c18de1812944b
MD5 74f295179a08b6c7d267f59edcf1e7f7
SHA1 19c4935569af6bf6d253be19ab09db791cd71104
SHA512 1e0f37cbd1cc5de5650d545215a2631bb5a20f31c7e58ee75943679b6804f9ebce42b58ec4f5227318a43c032d159bcd8ed502112cd533a87e201aef7c8fa027
SSDEEP 98304:YQRQyi36YOcPbLvw2gAf+PN3WD527BWG:PQyiKa/X+PNmVQBWG
TLSH
T109667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0e3ba6c075d1a47069c97aae26fc5d8ddb3bf9117ad2f4e13bd15d1c462e874e
MD5 8d7861c07f5e8878e738cbfea6d5d0bb
SHA1 4002e76ba065963982f025df4de565c9afedadb8
SHA512 9dabef3dc5d6db6fc64ed9ef4911292911b300556360f46cec72eb3cbcb498258a49a75be6241122c56b8acf81b4b1b80f13a73b86c04f40f22717baec7fff2b
SSDEEP 98304:6QRQyi36YOcPbLvw2gAf+PN3WD527BWG:xQyiKa/X+PNmVQBWG
TLSH
T1A3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9b58565ba28005930a57ef7bffba89c8712af0bb06bceadfbf4ec1c94101a830
MD5 94f3cb261dfb53c2f1b1b4a7d8320683
SHA1 40e3b0aa80bf430fdbb1d1768f94af15afc203ec
SHA512 4792356ff62c579b1f35e60067e3ad8289f80b969a09d20043a8a4f6af14b855de62c5f0a06336943953ecf143c66a2c5b828a902e008aafe570478aa7c83078
SSDEEP 24576:SwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0JsqjnhMgeiCl7Ge:s68Qg55nhceWu7PNU3/wDmg27RnWGj
TLSH
T102B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1343026bb1b3a038cc4178263f4a1e6ee937c5abd405b6ccce98fc981e8b5d8e
MD5 9a0398993729c10583db22e4ccdc4349
SHA1 139ceb8c2845db51d7446f6fd58ff2a8604a61f4
SHA512 dcc6b87ce67b722b909b4520b4996b0740db0de4ba69f6745e5cd115c882bcee766393455f7582288a289e37f8023f3cc883baf951128230151b7e51baaeeec1
SSDEEP 98304:dy5112gYy5azzVvt69nLKnhZJD527BWG:ALIHEWhXVQBWG
TLSH
T1CE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1c7f6bed6d4a02a4dacb1aa792ec2e3bbd7b92750a69625fc3d293aa7645e970
MD5 87720f678942d2c25dbfb7d516108b8a
SHA1 3963157da54f741d8961c42b46127cc6c02ba9b9
SHA512 e57c10f0ca31b70742a9a92cedf815e923d963a870c47c09c7c9bbd8218cbd97c5c66a12e8300b6e911b2a1f7894466865501ff2c09672f1f26308bc15e6dced
SSDEEP 49152:NB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gluDmg27RnWGj:Tu6Jmdxd2duD527BWG
TLSH
T1FED59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c2acdb0f29fe8bd36e9e4515b315d7cff339ac4973c5272f6c26fa8d153b5ac0
MD5 6bc05f8a6c8453d517149975f7ebf48d
SHA1 77613bf37a7644428974c9446b3ccd4330e6b88b
SHA512 0eb5bff6be8708bd1b688502bd2c19d92bc056078b31e907bc7262d9dc06cc01f03e0053006dfe786aa8206e639db740ae5f6336e56e1ecf4ffb448286671084
SSDEEP 49152:n1hpsNoJpF1A63U44CwH7R4xqDmg27RnWGj:nmifPWRvD527BWG
TLSH
T1CFB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 034b6fcdef0a725093137af4c88867299d0ad9f4665e082dcc0fca64a0f1631a
MD5 0ae4e0680e8fbf9b9aa7fd15efbe76c8
SHA1 222c1f39362705f9cfdae4eb1ebb6acac72e1658
SHA512 fee1e181096b16c558297d563241b9b1aa7d6645d3c33a638c4a40c3f2a6e8566702ad85cee5092aea8c31210846a5132a7d5faf9d6f7aab7cb7829f7e31600b
SSDEEP 49152:YSuZQIY0Be2KcRVtOnks6NMHq9Dmg27RnWGj:C5dKii619D527BWG
TLSH
T17EC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 03ead7d97b2ea5d9679ef1cd88990e965d39a76357f37d6f6dcb563a36ee69a7
MD5 9bb5e6b45ee50a4d2c82d1ac1c3b5506
SHA1 c8d9c68b561602109c5fc93b6a8de958ce1c2040
SHA512 768cba888f8c528df63847ed0f3d14b585bb85f70b2aa89dd6dad957b3e7722199d36548c6daa20497d929fe668fa0b54b6d98d0e5d41a80172c2cc92ade65ba
SSDEEP 49152:ThtSn8EApI0fig3giDn0AP5weDmg27RnWGj:SX2imphbD527BWG
TLSH
T1B595BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0da273da8b73710ba3d7cc8fe670466f1c7bf2e5d8f1c96786f3edbc049dcdce
MD5 3001cab7960ebd23fc5dd91c2868a95b
SHA1 162ccfd1afb446f69cf7954fbc23455ded4b0ed3
SHA512 5c4212ff2b4118cbd17368ea3ac7d84a9a834ddfabe9454c503ac5c3a4cd93e2c0aebc0000a672559e086aacbdfc90f3ffe4ce4dd656620cff71dd57a904fe5d
SSDEEP 12288:1dXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1dsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1804523BF965C41CAE52648B5C3E5F10EAC073E5BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 fec8b7c82f65d3b6ec13631dce2e4fd07f450340865e1c5aa93e4215e20569fd
MD5 ec445f22f0f9fc5abc15a537113eefaa
SHA1 0053f36673fbfb0bf56a98f0eeb16e9900586506
SHA512 98f1ef6ca7783cf553b4e9dee3ee1767c22c6243231a4cf36bc10a7a71c70e41f08587c17125bd612d8d9bf3e45e09dead9dbbe7fcab0136a729eccec84bb369
SSDEEP 12288:/IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/IsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1924523BF965C41CAE52648B5C3E5F14DAC073E5BE92004837AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 946876e9d5f096f0052642898cef886806e4b66676f4689dbebeec252ca0147a
MD5 54dcc39d0e4dc0ec0f09b1a76d00b6fa
SHA1 514293129390d3176ac3b2673002f8e79171a918
SHA512 56842b87ebe68f7696ebf60bfaef64ad10a5669850691f8761ce7240be10d002b7bd609b94099662719f7781ab2d16fe48eae3107f0af9ab6c9310bf8891c014
SSDEEP 12288:6uXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6usqjnhMgeiCl7G0nehbGZpbD
TLSH
T13E4523BE965C41CAE52648B5C3E5F14EAC073E5BE9200483BA977CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 5c40628ad28cd5d33a7955d23fcda2c2833822d343b8de3a0bba1b6db8b1ff82
MD5 4c380b485ee65dd0ad125cf8c101bd31
SHA1 4907e061dc022353fb548b765696e8e32119f4e0
SHA512 d18288d0de8fd89f51f3e03b7016fa507da68dddb32a7cc1240dd1762f62aee8647b43e397ddc7e995ed44d3120d1a46350cc20bbadb84e004d1a98158b176d0
SSDEEP 12288:xV7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B445236B675C01C6D83285B4C2F5E11DE8237D96EB3005DB6B532CBE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 41cd29fd82ef449d233ab512e3947046a9aa032bf29272331a29b6a50f63e82a
MD5 da3cfd41e71c1d3bb48bebfa99bc5862
SHA1 5ce565cfd6a66bd7e0a8529f30f80a52121b33a0
SHA512 112400c08357941e7cf0e0505254a28536422234d0ed3eb860c1df87fe4dd472d69f9d46abb8665d0919b01919b8c3f49faa047724940348ab7ce97eb483acbe
SSDEEP 12288:vzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA4523BF965C41CAE52648B5C3E5F15EAC073E5BE92004837A9B7CBDFBB14584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 7316c4bc5dcedf4f8f9d47c4c4db410ffbfeac79a5c5c6dca7f38e273c55945b
MD5 4ccdcfb9f8c776a0681b88773dbfa823
SHA1 aed40d7413a70f8a5b43dfebcb3f2cc4c8db17c7
SHA512 bc9a4960a09d15c7c1625a137bbd41eb99ff07e0d2531549257f2ab09c43a18922933d15757a23083df0458b3bddd506b4a37fcecd3285e9e7de264cfebbf9cf
SSDEEP 12288:cMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1374523BE965C41CBE52644B5C3E5F14DAC073E5BE92004837AA77CBAFBB14684B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 3708695f00388b2b8807572dd47702673e2e7277a38b724de99e37d758f56a4d
MD5 c25099fb8bfac7351b8addb6b8cf7fe9
SHA1 f6884d1869a01689f839a9db73df804971af1c69
SHA512 f136603e576679580a33f79e0f93ee417a062a8db1e4a4c97656d3c955a8f555de66f4cbf44757ab82b79693d82f751c8eb8f6882cce064c8894c40add68a0e9
SSDEEP 12288:BgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1214523BF965C41CAE52644B5C3E5F11DAC073E5BE92004837AA7BCBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 3ce16b72cf2139b3337cf0f94b72b3316d55b3fb40ce19fad77027d6c943e939
MD5 c2541dad7fd7796d0ebea379bea247a8
SHA1 07d87bc2582877a431fa3c5c4c3fa3ba061b422f
SHA512 ba5e30153522287e323bee33a33aa47864905ffaf7a00c6da52831657db1df4a3111774b02132a78d3389ffbf05ceaddee24131eb6ccac8322aa6c15cb0d0b1b
SSDEEP 24576:zZMRzFVSOosqjnhMgeiCl7G0nehbGZpbD:zZMRzfoDmg27RnWGj
TLSH
T1316501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 32810768ac15c852a6890e6941a51417cc6750948749e47cb9aff4d2107f73c4
MD5 40f525929e753c102e025334c224d65c
SHA1 247c6ba8d878562aea3b78bcb5089d1d86f291b9
SHA512 eb9af2e5bb590d81d1d532c221a286477f7d45e7cd511413e6c9e62ac31d79bd515c295bd3d637cee8febaa6ddd3a942297170fd8fc6c0541165fedd1ca85e26
SSDEEP 12288:apXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:apsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16A4523BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ebbf87eb0d28a96af879709062e419bbebd6b00d2490d796a54de69f87606780
MD5 259417f18a9fbd3b7de93038e05c7e50
SHA1 243ce6ba0c3185ba6ec8004af62a42b44b2f614e
SHA512 8cbf3e23db08227b777e3a20b5ce2f6f3fa42a350ee9fc1097726f9e9be8c7c72be4e059e51ca0b61d1d4c8134c3cd70dc0fd16789a8b40a47001501817ae054
SSDEEP 12288:hFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14E4523BF965C41CAE52604B5C3E5F14DAC173E5BE92004837AAB7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c2f9035a1b0e03bac659110fd6f5438c86c2dc7417acc83aaa637094e4151bd2
MD5 276b8857d3d5db40d3c0c56a144911dc
SHA1 040b0aef7cc62852035bb6f60806ab7907375574
SHA512 f9fbfe6c6e952e1be3a64c1c8bc53355bf7df01707fd1c88dce8b563511ef0c35d943e34e218082459784159b76f2fbf0159aec73960b6664482c61438ff119f
SSDEEP 12288:VyPz5L80Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8zy0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ED55125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d89fd3083573683ff5e3d2f284f45f0a5b03fb55402c5e072f5bb32f286be8b2
MD5 735f0c2d7fa2edfa1b00e9f61aeb9bfa
SHA1 a6082341aae8d7682f4b105ac1bc45cbdbfaccf6
SHA512 67b9cc65fc55d3e0fa75c73e2c5257a1c0cff3c0291528ed94fab61de8c66beb329e927665bde8653d89ad327056618a62654571b617f3685d54ac87ba6bde2d
SSDEEP 12288:DpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AC4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 9e495cfa7bcab7687e6ee44cfe5c510ec234a1ac4696a081d018066764032fe4
MD5 92792d59c669c2b2a5ec719be7779e0d
SHA1 5945634a6fc0f40bfe7818dfb97f6c222a275adb
SHA512 c9e83bf869c69cb7a4c98554e69c7c87ca1aa42882aa23e74513a43b0fbc7c146fbf6360d764e37d1090b19b8cdf75190baa97ac341cdb98adcdf50ffbe91359
SSDEEP 12288:opXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:opsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1374523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 e5dca4915d59f7598426860637115e223fde38c5626a40671ef5ee5be2ccc948
MD5 8007ba575697ed3f53efe5f92888f664
SHA1 0da29a62884289b6569f6adeb81a03c27df4a986
SHA512 57e55490dc308f2e76becb300add2abc77597014d6bbe1751e3760305789ab45fa6da2518885c046b5565d8363324798ca350cbf93becf93d50ded74843c882f
SSDEEP 12288:myPz5L80Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bzy0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10655125B73A530F9D1368178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 99cee0dde57bfc661ec4e4d3bfdc20195368e820bfdb7679bbda3d247dd0b5e4
MD5 0f5dadae48f3b038a622026391698698
SHA1 e06207a6da5f272a651153397408e6c2f47ca0a1
SHA512 4f6dfbb3ed84d3a726ef8d755991aef84f7c9ff846096f07762575e5fbbc7d7a2e87c705dc48096d4c4e18b474d23bd2d6a96a600c2049befb49003255ffe5c1
SSDEEP 24576:JTDaLl3z0zD+sqjnhMgeiCl7G0nehbGZpbD:JTuLljDDmg27RnWGj
TLSH
T1AD6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 4ed4fb471dc5720f3e5b0b197def8631c615cde61ad0d91de6cbcadbe376c043
MD5 349fceb5cd5123cd8c77aad31cd2aae9
SHA1 010d0b35b9cf5471a8cfefbf6b8bcedf595a9ddc
SHA512 59a0c2d40e36f416e11e42af8cfe381412f7c7c3b118519272b79a5cbc12f7155934af7c41c966b1da9eb9b92423ce00b7e49cdc280606a03c8b6bd5e843e603
SSDEEP 24576:k3vd9CHKy7GZysqjnhMgeiCl7G0nehbGZpbD:uvd9CHKyaoDmg27RnWGj
TLSH
T14275CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 bf18238df72126ce6ae8df9814501ff5fa3bda8b00e2f80c80548553159bd288
MD5 514bc486f2a5cb7bf1bf934474cb2013
SHA1 7982ce05b7a7ac024f49f623e5e9c1d67f9bb1b8
SHA512 27f627ab53e828831bfc2afcf46f41a85d48c4e1cfa82f0b0e83b71cd05b6e06e47e8ffaffb88afdcb10ac5780e946a3b7f607689ffb4e2bcfd45a5ab785eaef
SSDEEP 12288:WOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1964523BF965C41CAE52608B5C3E5F14EAC073E5BE92004937A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 b142673d761a8ad3e9d4c5c04ab7bd682eeec2bae002ce87f48296368a9fd937
MD5 8e5158ace2e051564c025a34d1a8b0fd
SHA1 a2c40b6ea1ddd496de02dd4200c254f988aae8a0
SHA512 58ea9ea3ddbac54eea5ac7e05e9bc41d052bc4945d49ed13b0212e9769fdabf07328434b28562df2b094438a5fb377e8b8a812f226af79cdef69293a237e213e
SSDEEP 12288:DUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A54523BE965C41DAE52644F5C3E9E10DAC073E5BE92004837AA77CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ed7a0363602ea5fcc4b9186f8f8e268cf4ddfff8a229fa8591ac082f05035b88
MD5 636edfcb6bb6aad87d2185caba29ad84
SHA1 1e3f60f3e7daf2d0b9e1acfd44afe69bb105571a
SHA512 f84a709d13cd38276c7c1a8ba579dbd41349fb6b3e78aa5d71b7cf541dc923c4273505d322d1c4a9e110932e7599cf77f178aa435fb75e24bddc2119ec0fe4b7
SSDEEP 12288:i3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:i3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AC4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BAA77CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 d5e599009647f5d2209236835b59618bcadf098ba53e74d55fb873ac7ba27be2
MD5 d5d2dd88f7b7aa145b951065ac3b1210
SHA1 8b3f69a3ec35a4150d24a4ca45a5f71f3846c459
SHA512 3a50447b7776b0fdcdb9898b66ca433f28aa7d7c617fba6fecb68f8bd365c3e1b125c64bea309c5fa469e8a6fae8d766bc6869bc123273c007e04f1e6ecbc26a
SSDEEP 12288:1pXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1psqjnhMgeiCl7G0nehbGZpbD
TLSH
T15C4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 7c613cd840a135265496130665fe39ca6e18d0c0de31f70f059e60a3c3c4d4b3
MD5 8bf33fb5a14c5c68249167833f8378f9
SHA1 6dd210faea3c762c79a1265834d15b3826df3a60
SHA512 7589b410bf086a110b910545029422ba0196480c73e39f4aeb05913f378e4ed65556e0c4172318e27663dcb09160187534362299c0ca988dc50dba781ce62f3a
SSDEEP 12288:9OXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9OsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EF4523BF965C41CAE52608B5C3E5F14EAC073E5BE92004937A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 d015147857cc95ce4876dbcff46b9ca6005511eecbe652c7d9a377ca2c5ab316
MD5 bd22b394a2f080c2ee8a6f9953d5507f
SHA1 a532068accf5848855d2451c4ce4b199134bb7dc
SHA512 0ff1698781575d4194a658a6b2044de6d999c1bf0d0dd1854ef2b6e9c150bb5523821b54c69edd644caa0ec6774625bd8fa47fb959ca75d522509aafb35404fc
SSDEEP 12288:KBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13F4523BE965C41CAE52644F5C3E5E11EAC073E5BE92004837A977CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c4f1ed27720edc05ec1edfe5958bcaad0cf471604f95c2c9686f7f6144c31703
MD5 996ff7f0d9c83bbb44d1b2a6a46dc22f
SHA1 79aef7bfa8aaad7ffcc3118b8f03613cb611fb7d
SHA512 d1c261505737a95767bc404b1e6b4cc5217b9fe5629be91d1f9ad3246d7cad2c2ca45786fdcb9726a18f3925a58826ecbda56c07bba7f20cb74215f9b63b4d77
SSDEEP 12288:FzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AB4523BF965C41CAE52648B5C3E5F14EAC073E5BE92004837A9B7CBDFBB14584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 17fe3dbe6b90234b02250cf4f808e4b24a19d4d2b567f78bb154f21165e71d29
MD5 4d05edf8e9ea4e447d31faa25d8c9fc3
SHA1 2de47a59a2e7dffa03e0f0a1c55111c2f70730b2
SHA512 7174734ff9f35459fbf496a5eb44dd34c47696fedff0ec9089e510f582211ba28cc7d6076ca9fb28f01b9e9a3fe405b4dd274dccc4d4c87073f59d125143f8be
SSDEEP 12288:b2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:b2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1034523BE965C41CAE52648F5C3E5E11DAC073E5BE9200483BA577CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 28a5c5eed86dd60862d6696f8b8da33ce4fc55e998b788ddc45a28252589fe82
MD5 f2d56dfc34250c38e073976c9781b848
SHA1 1d0060a04ee4c3bfeb20cd479594bef621122d03
SHA512 ebe176e677239c5948248f28a288008ab7e6eb80d3545d2e77dc0b7b4b60ee88739819d7d1b65e9287f67ea36d8cc45234d6039d801943baacfb7af5817f9d9e
SSDEEP 12288:nzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1764523BF965C41CAE52608B5C3E5F14EAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 de0d047c9a67aa349207292afaf81b746ab2e9d30e3e62ca834e543b2293b5d2
MD5 d15f7333c010dd5b35af15da5a28b949
SHA1 52f51ab0cc97d214815a61f8b063111aabd13c97
SHA512 d94afa892e0a6d146d9841153921b450bbd265206705c60a9d4d21f3f4e9b70b2376debfdcb9a72641d3516aa8816038c2f2dc6f54ee8198c58f787e63cd54e0
SSDEEP 24576:qfwvUk9RX6wkyAI1sqjnhMgeiCl7G0nehbGZpbD:6MnYIpDmg27RnWGj
TLSH
T15A85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a8c8919e01af198a7ecdf766ac38dcbecf6464d174623084691fec72f372f4f9
MD5 20aac27a5c2efa286dff21e8ba3ec9cb
SHA1 c68a8adb99196a64cdfb65f143dbaf5af781fd03
SHA512 06c2ae7dc9a11ed18910e93a38bb9409f21c2e9934fb6a8219f619b68e0e717ff44a2a9eb2c157c9623c6735e174f0ef131f38a6f9c1c961fc5d1251d1683466
SSDEEP 49152:lYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0+Dmg27RnWGj:IySzP2D527BWG
TLSH
T173066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e1d034ad1c48c8a92bb6d2ea302a21eca51c71addf5a36f5aff789128eca25ce
MD5 37e314902df63bc5ecad06fedf38b96d
SHA1 c3f0bcadfce96fbbfe45f0ae6afc6d64690239ae
SHA512 75463d4df041cde0e4d32b41af717c390bce594db573a8028e329096a75d0b5d988333bf5daf4cf7ca5a4021e6d8812813d83ad8fd4cabdcb4823b1b2e621f78
SSDEEP 24576:j47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYYsqjnhMgeiCl7G0nehbGZpbD:j47JUQjTirIhCnDHUPfF/uDmg27RnWGj
TLSH
T16865AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6e102d76de635b2a4906c512fbc9ae6937ee79fef805f357a9a2a46a88cac26b
MD5 0f96263bb60fb91421e4efcf4b296694
SHA1 b9d26ca7da4b0af256842deb695c425863318654
SHA512 a40662f7828515f48c62aeba547b799b404fa9689d30573c3af4838bccd64db44c18755fae5ccdc2cbf9616153344f0adfc4b95b29f6a87d9cc102b77743129f
SSDEEP 12288:Zbsf5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:05sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15055015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1000KB
SHA256 9cce7445ea91da0c6a1acc6dd7e29456761d30f544e6cb72de4872a4dda1b24d
MD5 8c5dbc414c367e71e82ebb51401b5432
SHA1 83fb3dccf114088167128114ba1664fe9fa4200a
SHA512 070c5146e252d9288f3fe340d314ec1df9229593e6b1673d90f9d69ed49f46c0a4bb50ba88e9b20b143cd4d3daf23b564ef07cdd67641b3e5da02671b860eeff
SSDEEP 12288:7eqrU3fRqIkaySq1Vpf37IUmFaVLPgj1:7egUP8aWVpf3vmFaVq1
TLSH
T1FE251710766AD75FC6AD40321E32D1CCAB707D41EE05AB0372C9973FC576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 49d4441ee9c09c43e409bcdf07941db70a909c1dbe85f5c08ec76d736e9b0b6f
MD5 c80c6cd5e2e159d155a7d164a7cc7060
SHA1 e4c5688ad2d987480b0675176f01f6afc2040d0b
SHA512 2b4aeead25207155a4fcd4e46c41ce273c603a44fd7c19157c0aa5c612924539826172d8d2cda6da4eef9114df378ac56a30b583edd1bf57262ad5722a7102ad
SSDEEP 6144:i7wbqlqEqot/dqEcbVtMxdcbVtMxZf7m654j+ksCzOot+tTkKTL/MO01Ae8:nqlqEqWqs7m654j+ksCzOot+trR01AP
TLSH
T1AF55C6416537A39FD1FB6032072A6B4CAB64EC03B7095F2663C4453ED82BB65A0B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 2a7840c785e13dbabb04137b5b23acea5d0551693c80a31b5f82c51326b9bd56
MD5 58f84103429a319498194a21b677bab4
SHA1 18cad44dd8f0d5271a0f144d590c6cbb7e067b2b
SHA512 a286a1dfda9dabecb451b36b9232ac759faa7af72a630d07aa3826b0c182d4fb530b2e09bd9e0eb3d463a30b96c1cd2dc2a330c8b294aa820f3805c021fa48c8
SSDEEP 12288:T07RXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10D45237BD35C518AE83605B482EAE12D681B7E669F1004C3BA1778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 516fe0bde0e4371a6c46893a6e587b6e0ec1ca5a0f8ab2731d6501e0ea657b97
MD5 4cf4b7eb64ecdfd55b6a1a8e536ad670
SHA1 b68ac72746bcc84c49e5ca642f3e49c673a59a33
SHA512 f3f11637d8131544128ad1b22f6254a50a8e8d49bb095eafdf7aeb474d89812152bff0dd31d8be0bfb095fc2e73c1591dce05d64fa6666a449c5e0997472d54c
SSDEEP 24576:agb6bmBIi49WNNFpg1rSvFv7bYfsqjnhMgeiCl7G0nehbGZpbD:agb4mBIBhGFEDmg27RnWGj
TLSH
T1D7659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 6a27996dca9944bc98b7f0b81b9e756c04fa7c4aa9dcd5bfc25bb8956dce8edc
MD5 08db9d2c83b7167a78666124ee92af43
SHA1 500f63ad66f2306b0bb9d229205d7b4a22702d2d
SHA512 7f679931687a0810ad9837b66d6700e42e98ef58658b6a17459e1b7d1bb3885ae643f812528fa8995d440431c88ab0fe47bf834b8b8ac1699b91354d88d55f14
SSDEEP 24576:NG88u8FpJqH1bzria7/mosqjnhMgeiCl7G0nehbGZpbD:A7ZFPqVea7/rDmg27RnWGj
TLSH
T15C85016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e8485845be09ee1f2e03964a3a75359191578a6099662e6e9b8297d203fa2f54
MD5 4b2964f97fa9891808e373caceabeba6
SHA1 d768a060f21be1ce693e57246cc8f5c9b4f0c59f
SHA512 45049d60a4cd8d2c91baf1732d39693f3efc3a9afafa70b1562d0b2dee8853713537cf77fa7fa01f77f19b213edad97e936deb8fb8c3bb91460cbf9411ed3416
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4Dmg27RnWGj:FG05lO43bxD527BWG
TLSH
T14BD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 681a002d0800a672be6c4bf8e698dd25ab3ce4f8608b61daea427a69a67e173a
MD5 4cc784301d1f97b3ec2aa93aaf828c34
SHA1 4f723a6add0cf1a005bec01414d672f6344b9e67
SHA512 eb6d2895e8e6d792dadd639c1ac18c93a7dca64c5b3084d66080c2ba49a06063535f5e01ded82235c26746287286792a943771a574be0996c0871511b6e5a7e7
SSDEEP 24576:wfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnqsqjnhMgeiCl7G0nehbGZpbD:Ia5POZ3BJt2pasx2+mwDmg27RnWGj
TLSH
T16465BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 dac42d8ea82bc6ca3bcf445e9e49ef6e44ff64152b64c5236f18bb49968ed952
MD5 687b208128395ae32d881ae62ceb5ea8
SHA1 d5021daa74727cbd554af9af70f6c77b78883f45
SHA512 e7792c294cafef7871e99e677727132cd927f6e66bc93664d41f77a98fdb8c9da043d4783484bdc2370beb610730dde6ca004390189296ea4700d00e6d60d638
SSDEEP 24576:rNcwHdjbyQ4nLC18lb/EOjowL7FkwsqjnhMgeiCl7G0nehbGZpbD:rNc/zEOVHFLDmg27RnWGj
TLSH
T18A857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0618310a46cadd8965e7615e89abfabcd0860f072c59235cfdf70761f317b272
MD5 49713e016ed0b23ef22b1540b19ccb96
SHA1 d65891be4fef3df3985f877f8ec95df0af4adf4f
SHA512 e8b017fa86a5de629c221f86508e384c4b1a3ba3be81d13dadcd51a98bae4b7e8fb62f3c055f17bccd35bd4277f4e1900356f994e8c2ecc51d61fbac388a2418
SSDEEP 24576:WTkNvNnaFeYhJNtmZBm2sqjnhMgeiCl7G0nehbGZpbD:WTMwBtOm6Dmg27RnWGj
TLSH
T16B55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 6acb13b6d9d3b5364ddc6dbaf45ab7a88b653fe7cf5baf10c5b27f22c91b06dc
MD5 56f70ed0907e5232cbdfd2bf64df8785
SHA1 90a917500e68b0fcc573382e7b219f83d31fd243
SHA512 ad5a5d8d6671f23ac66b51d3868ee1c290f28aa176cacaf8a478021532a7e95fe6b2cba1299b9442cbc83b27225937eee5d623645147d13e9629bb6f42e96677
SSDEEP 12288:fHvUrBFrEjwaQ8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:fPUr+NQ8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F865F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 f39e7635cc242d101051b9904b297f12319034d5ccecc8bc80f0e1a09628bc94
MD5 7a80b32295feb476d426060e45845131
SHA1 76cfbd5fe205a250fce0681251000d51563e94ff
SHA512 de8d00a033af29614f8180bfecfb90fbf844d20f9d2f024748df750bdfc4ba2f9aa8448b98ad4ba4b4668519213fcb3527a3798b818ab113ac65d2281bf403e3
SSDEEP 24576:cD3FHshBIYQgA9sqjnhMgeiCl7G0nehbGZpbD:cDVHeBIAAhDmg27RnWGj
TLSH
T12175E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/776-376-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/776-374-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/776-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/776-361-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/776-83-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/776-89-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1008-121-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1008-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1008-130-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1008-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1008-127-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2188-359-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2188-101-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2188-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2188-95-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2188-357-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2344-108-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2344-109-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2344-115-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2344-362-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2652-23-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2652-14-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2652-78-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2652-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3316-360-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3316-79-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3364-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3364-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3364-107-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3364-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3376-363-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3376-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3376-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3376-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4084-70-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/4084-39-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/4084-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4084-45-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/4084-74-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4084-46-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/4088-61-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4088-72-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4088-292-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4088-63-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4500-50-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4500-51-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4500-57-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4500-272-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4560-7-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4560-76-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/4560-0-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/4560-305-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4560-304-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/4560-9-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4560-1-0x0000000000740000-0x00000000007A0000-memory.dmp

Download