1b53a951eb83936497b1c5ce9cee28ce903df97ee8e2a995d9c1fa4bb4f746a1

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_664b81da0cbcf7e013b90ad6f5d6330b_icedid.exe
Size 1.7MB
Sample260721-vr9fxsda25
SHA256 1b53a951eb83936497b1c5ce9cee28ce903df97ee8e2a995d9c1fa4bb4f746a1
MD5 664b81da0cbcf7e013b90ad6f5d6330b
SHA1 46aede9df31fc69004924557228b2b9d07370c51
SHA512 c1639085349c920c09c276abddc91de595bd885a2e1eecbe2c55b715cd61b6418a9bd7a0e9f43fab42d153aa7d58e91ce9aa798c464e24538740ba03fb657048
SSDEEP 49152:+3XiRYFiwKtZGtbOWXS9jilkKwsH8kRULYPQrYESz/38B+kn3Hnx:+3yRYFiwaWXUjiEsH8kUsEqo+k
TLSH
T19985D00733A2C0E8DF6790F2C9395223D772780507389BDB65E0692DDFA7AA15B3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3208	elevation_service.exe
3516	elevation_service.exe
792	maintenanceservice.exe
5980	OSE.EXE
380	PerceptionSimulationService.exe
1100	perfhost.exe
1164	ReFsDedupSvc.exe
4296	SensorDataService.exe
5128	ssh-agent.exe
4904	AgentService.exe
3396	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-21_664b81da0cbcf7e013b90ad6f5d6330b_icedid.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-21_664b81da0cbcf7e013b90ad6f5d6330b_icedid.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-21_664b81da0cbcf7e013b90ad6f5d6330b_icedid.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b26c048d238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-21_664b81da0cbcf7e013b90ad6f5d6330b_icedid.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-21_664b81da0cbcf7e013b90ad6f5d6330b_icedid.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000722ff5953419dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000009cd426983419dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000661be7973419dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d9c05d93419dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e1c3a953419dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000055ffadd83419dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b1c287d83419dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003489ee973419dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f35dd2d83419dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3208	elevation_service.exe
3208	elevation_service.exe
3208	elevation_service.exe
3208	elevation_service.exe
3208	elevation_service.exe
3208	elevation_service.exe
3208	elevation_service.exe
3516	elevation_service.exe
3516	elevation_service.exe
3516	elevation_service.exe
3516	elevation_service.exe
3516	elevation_service.exe
3516	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3780	2026-07-21_664b81da0cbcf7e013b90ad6f5d6330b_icedid.exe
Token: SeTakeOwnershipPrivilege	3208	elevation_service.exe
Token: SeBackupPrivilege	1164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1164	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1164	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1164	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1164	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1164	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4904	AgentService.exe
Token: 33	3396	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3396	SearchIndexer.exe
Token: SeDebugPrivilege	3208	elevation_service.exe
Token: SeDebugPrivilege	3516	elevation_service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3780	2026-07-21_664b81da0cbcf7e013b90ad6f5d6330b_icedid.exe
3780	2026-07-21_664b81da0cbcf7e013b90ad6f5d6330b_icedid.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3780	2026-07-21_664b81da0cbcf7e013b90ad6f5d6330b_icedid.exe
3780	2026-07-21_664b81da0cbcf7e013b90ad6f5d6330b_icedid.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 3132	3396	SearchIndexer.exe	100
PID 3396 wrote to memory of 1060	3396	SearchIndexer.exe	101
PID 3396 wrote to memory of 3116	3396	SearchIndexer.exe	102
PID 3396 wrote to memory of 5584	3396	SearchIndexer.exe	103
PID 3396 wrote to memory of 2908	3396	SearchIndexer.exe	105
PID 3396 wrote to memory of 2168	3396	SearchIndexer.exe	106
PID 3396 wrote to memory of 2084	3396	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-21_664b81da0cbcf7e013b90ad6f5d6330b_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_664b81da0cbcf7e013b90ad6f5d6330b_icedid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3780

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3516

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:792

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5980

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:380

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1100

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1164

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4296

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5128

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4904

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3132
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3048 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3116
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5584
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2908
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3048 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2168
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 dccfa2ebe5a5032f054afb71f8b9de0ea6200cff802b04c600ef8bdd6e7384f2
MD5 eab8ba89edcffb9c5a1cd1507a846811
SHA1 f3bf9ccd256701fc12c62bf970ea1dd7ade5acb8
SHA512 2710d74e7bc6f1ce12ae798b10c45ffa8faeca4225c799bf4f384387799d755bc6c82245c3c82efc0eac8a144a3e259a67aad6bb379b9ae85516f6278ed5deee
SSDEEP 49152:ob+632BuPkFKRrdE6ohvstBhuXjfS4LWxnSB+kn3Hnx:C3q6sjB1+k
TLSH
T138D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 b6f37ee79039e519d201c955eb6481db4bbfbbec67a860b378f2d734b0e452e8
MD5 231a18e7566893f0e2a48281b7af661d
SHA1 01e7a093edce8ebb0d463b28f3d5a42070f5efde
SHA512 551444eb67fefe95eb57ffc969f79ea94137473cf59a11e1222fa6ad44b4c1e991c1e684b6411cecc01f1a2b4728668161c26cad612c3d04ed68dbb6347610fb
SSDEEP 12288:M1XLsswWkxy2lRq2czAHLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:6XYfDtczA8NyBo4kx929bL3Hnx
TLSH
T14E65012867D409F9ED6B9278C8A2C511DA33BC4547A0E7DB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 8d90520822ad0a54a15bec738c21efc92493b4a02c36a9cd3db7dce5ef93d44f
MD5 87e948856f6ffc462667499d462dc2ab
SHA1 d802c6fcbbea73e34cc25a684a442cb3c2c05c35
SHA512 4c8cbe631c20a2087354035a37dfb479a12689fd6cdf80ab242c4feb816d2a0b92eaf245d318d2194e37bf8394ff383d22803b8db8cd5239ca33e8755436d2d1
SSDEEP 12288:VXZNYVLeyUji0h90ZD0wxpGZIVuArHsuLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:70Le5ji0hmxfrMdNyBo4kx929bL3Hnx
TLSH
T1FA859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 39c048b17ab7f76961105912fd596124c0b66885062a81ac3aece99678795cc5
MD5 327badae62eae279914e6f7669e12978
SHA1 1c2cf4b1e2e4e13c4b7fabbe81744ef88a9e89b9
SHA512 d322c693fb90c50b28b693daf4cbe1b35e7ae51a14af4a190d1ef54e5524e789ae6e98995887c8a191f0589d786d484427ffc281834a30efa152afd050c18fba
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWn6q8wyurNyBo4kx929bL3Hnx:6/ezSC6vUzPveHjyZB+kn3Hnx
TLSH
T145755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 99e7960161238df9b362856f2bcc06827242e95ca52dcd9a5232e08ac5ff6de3
MD5 12f424cf1422729352ab8d65550a0b4b
SHA1 fdf6939f5847e54bfce89de6c88d87711af960f2
SHA512 e9bd27a0d0625ed776fa6a3e23844f220d708b1779d1babef15675f02df7a14c8ede766fbc773cd06dc65451062791c07546067bb26f490aa4e7b5646b1e913e
SSDEEP 12288:5VJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98DLDAptNyvUgXZ32dT4ePc7N29CD:5VbqPb88hv/l+YQNyBo4kx929bL3Hnx
TLSH
T18A559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c6299f4a737f0dd8299eadaba6af31205d9c89c876e56f6f5e214ba21de75508
MD5 dae5266af5bd9f24de16239bb9867cd1
SHA1 339864c8c90fe419b6bcd8938acb258095ceb24d
SHA512 7071a92df8a2614b156e3f926c544b6491c6ba1e902eb143d0d4f6b45efe753632f832d7e5bd6e67d29ac05f386df11d42089818e916d45675d9fa44dcf9af68
SSDEEP 12288:xm6LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:xmRNyBo4kx929bL3Hnx
TLSH
T1474523124B0C627AFBBD3E70745E8454CC35BC8D0D95DB98DE62ACBB58BCD92DA21103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 367219d43c85d96ba25643e6d3249be68116949eb388486fd4deee48a4501b11
MD5 6ebd10398502bb822e8727701941a1a8
SHA1 92458fc7591912254145df31e366127369e7ab25
SHA512 2909c1461e80800126d4c7e8ba601ad589abad7b59e627543d34950357cd8032955fa4b1a7dc0f0f60c16b756c63c61ff02b9e9dcd98566af7d25285676d8e69
SSDEEP 12288:PeBNUbTVO86UrLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:PJIUoNyBo4kx929bL3Hnx
TLSH
T17265CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6bfe2a83acf564c48b68845edc879a4bc3a2d3b46fbbdc2e35a8b132a700a9e8
MD5 f47088a4230e015f990ab083a142e052
SHA1 c1e275f74c456e4ecda17d743737f2b7e60c6fa5
SHA512 ed6629725a4aadbba81af3b53d2a34350c0cbc0cefe05d872e334255e45c1482fa14dfe296feafdc62482d4dd777ef65db52492f1d2e9de8e032e3dac986d727
SSDEEP 49152:lQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THp:lQvGAdlCEL8c/DRNw5Co+k
TLSH
T119266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 32291408e8ab7f5621ce262ce9b934ed3385cbbb11e999b453e33a141445131b
MD5 3e415431ca112e1e4adc74a604f4a9d4
SHA1 7164e83eb2e38043573cf2609d29df72fab98bc5
SHA512 9a4fd1af3b3beaa786ce900bf7a5908e538c2fe16e684bac01a174cbc9ee6d5866a11c9f7339e86d9126d16703946ea5d7b19394876881a47e157afc29d6e6fc
SSDEEP 12288:xAwSfxL/2Dc3XDLLmt0LDQewsAjBLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:SOewsAj+NyBo4kx929bL3Hnx
TLSH
T1E875E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 eb3aaa900e6ecad5916c0b63077cc346130c725030a73563bc0343dd84d09379
MD5 a696c470e79b06138293e21db12d7994
SHA1 916ae8dd22027323dcf38b8d69de9dc496407fba
SHA512 362b5c72f3b8bbf9ccbdacd3d06156dc9d016b41668fe6a4f66c471f8a49ccda9153ecd3324e91458a195c3970f0a8cf9434a9aecce880d9139c7a393225397c
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHr+k:wUEtQevvqc2W1cpV2tI32r
TLSH
T125474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 66399a166488b8f8fbd14e09a16202bf3786c854725851f91bb31b235d81808e
MD5 bf082b8fe4988b379f282a5af1a69d92
SHA1 5b423a635e3123559fec7b0c1eee5d619446ab3e
SHA512 28db6303f585aa697bd9be8e9fad15ea28d3956b77c7919cff3d189cf517ef50ef9d284e72002411f76a7c9454f0c409d6da15b8cd0f1f9df1f6386c88dd10b1
SSDEEP 49152:qCbRquA/m2yL5zTfFiV+XenmE3/zVB+kn3Hnx:foquVjnmE+k
TLSH
T191D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d72a9373f0b03853914f8eb44dc051fa21ef12bcb8061a9362a54110d7336033
MD5 f67561a61d8225c861a8482a4982dd9e
SHA1 6f97f395b17b9770fc8ff8e6f98e2a728af973ab
SHA512 8b529fffe2dfa18e9e17e349d14d450bf51f6361769745d2399ff4ec3daa42638a53b352f1077ffb62313086de8eda15b23568a02d08bdfae40e21218ab0d6a1
SSDEEP 24576:/AhGL3IFoiwtA5l7S533NyBo4kx929bL3Hnx:/AMUFoiq5IB+kn3Hnx
TLSH
T112359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 3fa1bdf3a94030ad1c5277abc906a2c74733760560e004022fd2b0b584e5bdcd
MD5 fcc11a8eeb9ec6e9da3702714c816258
SHA1 777446dda203f4187067362b959104fd704165ab
SHA512 e60c50d962ad713d50530bee125f9fee897690d79c376899526b3a3e11b859dbc785f5f74da0750dcdfe027096e2d41a9ae7c705bf083f5b46dfaf07669d8ddb
SSDEEP 12288:Imw5HEjsChNzBFgl0WDm+CULDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:lwu6OWqNyBo4kx929bL3Hnx
TLSH
T1E165F10677A81CF9F96756388587C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9437ad2ec1f007d78fbf461b9de9e6efce485c0cd7018297ae6b842d87fd02db
MD5 30a560761e91b9c1606d6bff3388e463
SHA1 bfed15ba2424b784de4cf7317768022a10ba2a23
SHA512 37ef8eb77c1acc01165cd6b89aa710e8a74e80560ef673e5037a319c679e17ef5f4ee4ad386bd2cb68a6d2dfa32861cfa41e430b109ddde5fc00ea09488cae19
SSDEEP 12288:5gZ1IyxLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:yZuVNyBo4kx929bL3Hnx
TLSH
T1DD551216239831FAF2AB2678D8E58544CB32BC461B7283CF5A2145BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9c2a675808d8b96f8bc29adb4c38981d8fb5a655cfbef97e96922675515f7d29
MD5 162daf59addb228a3f01b35e26dc949b
SHA1 1fe1398dca00dffebb75246ea74072092e848029
SHA512 135da48b19a28e701e7461aa3baae99415357f4c421f76f7ba75a4108897aff6522adaa72e72d3732a765380fedb93f0559b9795141a385b95b28958457cc09b
SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U1:dQRQyi36YOcPbLvw2gAf+PN35+k
TLSH
T1C0666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f6b79c28081681248286537f62499b2a7d70ceb6baf0d232387337c514bae99e
MD5 247fde3d180d570bdb821b0f1519ab75
SHA1 320b76b79fb7e2fd1af8f539505ff5458a9ddb02
SHA512 13dedb8c94087b94d1bde5f4799228d417e1f0232b745a71cb09b2c319d5dc9782760448a5fd3ac2f584e63524b0a704a70d18188a51b53a1cd1b5a1f17af824
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U1:xQRQyi36YOcPbLvw2gAf+PN35+k
TLSH
T108666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d18336df65d5df9e85b09be1f1fd3d2239b38df25e6faef80c17c6e29d003826
MD5 ed550360f6085f9278c92f417e627ec3
SHA1 af03c7ef9ad9d158cb3cbe6b7fb1936f767a4330
SHA512 502c36931f64dfabf9cf1f2c026b96fc7893794fa2f156a18f113c639efc66b9ac24d4405e29316238ffcc6c7f5ecbdc49e0d04ca1bae6754c847f5fbe25bd70
SSDEEP 24576:hwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0FNyBo4kx929bL3R:t68Qg55nhceWu7PNU3/FB+kn3Hnx
TLSH
T18DB55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 23cbca75e151e4b26888e89bebe6f9b81bf4d809aae4dada9ed5d4a42c2aac66
MD5 73fc8ffc289b606ea92f9225754840a2
SHA1 8fb439ff14a95e0f59b01ac75c72f5dbc507e380
SHA512 99e7a9664f0692f7947a62a500a28b3e90946bf8f3318ee8c0700340fe3537cdd5b7212366e9612241070aa9c1048fa259b60ed32923339262de4631d4f86e7e
SSDEEP 49152:q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk997:7y5112gYy5azzVvt69nLKnhZ2+k
TLSH
T1DD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 af5e391379d80b69b4832c2b07a909c4202068d9f48e5100ca76fdecefad2388
MD5 9a34d6909470ba6c47f482e7c5ec9cfe
SHA1 1e51620a2b784b0c90e3caf52580a6f19765ec7c
SHA512 8a9b1d35d186d45f497d4f755dbde0c899956ba882b1a7e3286daea3163d5b872249f3d8944c4f814c50cd549f0d881f6560a0295118e2b45ea370f6fa16c8d3
SSDEEP 49152:OB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl8B+kn3Hnx:cu6Jmdxd2dg+k
TLSH
T191D5AD13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cb19f165da13b264e3cadff7f29d7e8dfa1d8014a1bca9fc724d33f003619efc
MD5 b22d605dd7ed11d3456b2106607a55cb
SHA1 6e09d35238966aee5d23289129b07091c8ff7366
SHA512 a2e4a1bc6d71675f39ef47d015d3d965c137557f3ccb24ffc9cef510b1a5ed255d84f5dda31c26e6f7a5f3e71a1bc7996c3609551a3e73203615499db2b4bb05
SSDEEP 49152:L1hpsNoJpF1A63U44CwH7R4xrB+kn3Hnx:LmifPWRE+k
TLSH
T109B5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 15591ad779887d374f01f636b8071fed7fb9af3df1aa55f6e1debf5eebedfed9
MD5 8b5ff777d61dac3eb894d2bcc1acbe41
SHA1 525ccb0306f55b63740bf5b74e3cedbae6c970bf
SHA512 f4f4d9b3eec3c801926160f69a038f84235228f9a3fe6f02c3bada9e252c606c4dc89432e5974a357b4542d98ec55953d92fd92deef3f900d79e82e5a0d99cfb
SSDEEP 49152:xSuZQIY0Be2KcRVtOnks6NMHqCB+kn3Hnx:f5dKii61K+k
TLSH
T1D4C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 382b880846e537db8d416275a83edd2e1f506af40ea69bb856ca276c0d5d94aa
MD5 1c9bc2c3904a33d046155c66e7ddc8c1
SHA1 bdb44af74ff486cbb3cfcacfd1501a2e1f72269f
SHA512 b32f86ce45f3cd60385c613159631094187e1789e376d60431e9a38292b61a626bbcda387d759d7c71d9bfb0bb7e22c60b9a6054f8b5612bc41423a828d8ffa2
SSDEEP 49152:bhtSn8EApI0fig3giDn0AP5wnB+kn3Hnx:6X2imphQ+k
TLSH
T13895BE13F2D901E8D06ED174C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 dab58c53e589f727e469204e093dbd497917ac9b8d223e4ce2a355f21d3b5a53
MD5 35f9a5e9003787c40fc06895fbfa3652
SHA1 d8af1a1e9c321650bb81f4570e41b013a8b1ddf3
SHA512 5ae5cee5162597e7a2e18198f393286acb176230683ce71f844176cfec7329ffcf1cd48054650ccd2852380ae30efbcae96172eaf3e453a51f85980596989806
SSDEEP 12288:YiLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:YpNyBo4kx929bL3Hnx
TLSH
T1664523125A0C627AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA25A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f0c25b9e434662e83f97e741dad27c194af6993dfb48489bb60529b582f565a4
MD5 ca3fcb0d2b90476b238e2ec310b3b4ae
SHA1 057d7c3f03a0bc5753a17839d83283246fd666a9
SHA512 2b48f4010c820dc139f78f0730b1e332261d2f5b1cb9daa573e5671065a1e732adc861679389dc11c6eaf6f7aa1823c3175192e5b478084c9114cde0a3a9701d
SSDEEP 12288:kNLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:kSNyBo4kx929bL3Hnx
TLSH
T1094523125A0C227AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 52716e62061356e837e76701e1acc0729412f3856f94838bb9f5ba0167c64a30
MD5 46874762368ae88289f222892acbc802
SHA1 0ecf4fab17ba03210c5e272cd7d25a948b80e320
SHA512 847e43f8d5885975823d563acc412c6c31e42c110aa6c0cafac08d9a8383db140653d9658c6f08e092d05bdd3345213e0f55277e475884f5e8a1344d08cac6d3
SSDEEP 12288:ETLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:EANyBo4kx929bL3Hnx
TLSH
T12F4523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 7b8fccf5df68b6d8108b66194c9c8de24b83783b837112128ca0c7fd422e1f0e
MD5 9367222217b870152793675069c942c6
SHA1 28264edf4f7fa966ca588df01b0e012705cc28a7
SHA512 bd2e4394ff3f9ae92f67d6756e4a30fa7fb7afd4ae86ffbbd090ba496907a00bf941bc03a832294894106d478cc429e425bd3d6ebc529052e624c0378a60faed
SSDEEP 12288:wVILDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:oNyBo4kx929bL3Hnx
TLSH
T11B4523025B5C12BAF9797BB098568054C835BC8A5F7297DFDF124C7B0EB9BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 aee51ce52a7079189710adf9066a20cb923d47682ca4cba7727ba1a6d4b70241
MD5 1da0e890d1121b783679b89c9fed6300
SHA1 a5a65c654d9526d8bbaddcabd3d9dc3fe3581957
SHA512 a8870a0f3de47594720ef6afe32e2517d1ce9971e01c609780030d890be282f93ee7876096d40b77a31ffd647d6532400b09afcecd6780c29e8eab6ebb1fb637
SSDEEP 12288:ogLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ofNyBo4kx929bL3Hnx
TLSH
T1714523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4fe1783c4054534393e9e13c371a8cb61daeaad5f94548ca0070db3ec01db3e1
MD5 65126a84ef7d27d338eae975641f331b
SHA1 81234aaec1a9678839f6ed5bf29059beef2e8744
SHA512 37cd8f4ae92f06e46fbe4ff1e9a35a3e8beb676da2e404c495244bd21bc605a1459deb8c830080ca6e20fdb7170b79eb307528fdfc79e4c7d2c4bfc55cc7eb71
SSDEEP 12288:UpLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:U2NyBo4kx929bL3Hnx
TLSH
T1C94523125A0C627AF76D3FB0644A8498CC34BC8F1E9593D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 cceb61f180bc8f7df4300885be69581c2599f1eab749c58fc96a119ba22cd877
MD5 8deba2c511b130b8c78244c9ad13fffd
SHA1 5d754fa50271b186ca3e7ac0094ef1bb853a9f38
SHA512 2c99dcb802d66e0df36c2aad2cd7cce01ae8bebaeb90fc205046ff41eddda40a8eb583477e49f363ad0a54664f59340b051178e635295214cce4b843a59833cc
SSDEEP 12288:AFLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:AaNyBo4kx929bL3Hnx
TLSH
T1D94523129A0C233AF76D3FB065498498CC34BC8F1E9597D8EF27987759FCEA25A20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 2ea3972e4c8b926a16ff3beceb8fa5220d56803988646888fa99704e36764f57
MD5 63e71101343a733becbc67dcdf68a84f
SHA1 1bb9c6409612371074d8ca89862cf7808570ec03
SHA512 38c6c7f9e9f7d4f85b4d38fa88ba9b9d3e34d0be8efa8b35de621fcf0b198ea7b59f792f5db484aebf13cf2ee35be4ae870593aad0045befa997d6fd900a265d
SSDEEP 12288:ciZwbjzzFEoS2cPvytLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:/ZMXzFVSOyNyBo4kx929bL3Hnx
TLSH
T15A650195B39418F8EC67823DC8158906C6B2BC4A0BB0C65F07A4367B5F773A10D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 32012caf7cf2c9007ee7c0633837f895ae04eda79b720e8335339040c1685736
MD5 567c11f491b951f46faa00183a555c52
SHA1 69800cb20ad8b6685a751143501aad07a341bba1
SHA512 b323c367cd0735d0b5d6c13519fb1a46057c704d82a5befa4e9fd44e6d29b8af6d89b2f91e03e5692b597585ec531f896385a1c8959e08de038e820cecb12dd8
SSDEEP 12288:WmLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:WlNyBo4kx929bL3Hnx
TLSH
T16E4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0dabbaf7cedc0fac5d500fe6c9605a54dd5f4069d94c1ef1e1e6500de2fc0925
MD5 d57b3a1592428fdf405aa44e28fa87ad
SHA1 b6ec2d8391b8f5b5eb03c993a75e4d51fa6121ce
SHA512 53ce56e524b1190fb6edbb83a497a5efdf96c72b28b723208035ddda71812fea05a2dda319edf278459a9314414f3e74f380151930a3081e7589bf434940a181
SSDEEP 12288:oqLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ohNyBo4kx929bL3Hnx
TLSH
T15D4523125A0C627AF76D3FB0654A8498CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 70946f72ad8d888ab6cbd8b9cb13065d56a25dad8c1b7b79228842a77d1303d4
MD5 de163c5fb0edb4e8be846e20391ee7ef
SHA1 25eaf9853bec3ed80bc39a9dec05884696a04ed5
SHA512 572bf67bccccb63fdfed8dc6fca5bd79f446256fcdbc536530f49223174c778008c959be0685aff3a9013d86c4bd5dfafcc08efd4f514c5a2b38c206f8a63e4a
SSDEEP 12288:6yPz5L8xLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:nzyONyBo4kx929bL3Hnx
TLSH
T17255120773A831F9E17A6234C8960A05E731BC360B608BEF5760467B1F776E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 69bcd85aed41850efded24de53e13ff488434f823949b71d8086dae112b54960
MD5 6627d8d9809d92cac158f0945c88550e
SHA1 b16270baade136abeb1c28a5c8c2c284b30c4dec
SHA512 17ffe4dd3b807b2e319cea44fe7876affd865880b1506352aeae403a51426c2931301d075daeae80a453e943a9fb64bc3662eecce7e660f8a2995257b0f27e9e
SSDEEP 12288:RmLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:RlNyBo4kx929bL3Hnx
TLSH
T1EE4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759BCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 19325424ae6d915d770ff3dc7162f88ced7c69ea86ad68fbf4e355fb28bd4472
MD5 ed2a7cab760c22d98afe6bda29817f1f
SHA1 b6c58d8769598d20f6df247e235d49dd6486496e
SHA512 28b8b786d84f094bb76f18ab57d72c4f8c5aaebdf6de1e72aa8199b6f3f6feca2bb7a5db0026a1867861416bdf1651b951655561739df40208ec9afac995e419
SSDEEP 12288:EmLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ElNyBo4kx929bL3Hnx
TLSH
T1F24523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 cd1a680ea1092434fc5aa651656cb61bb98f1de62aeaaed32496e84adbfbe02d
MD5 a9a6f484f1cc02f984b9a7e06293769f
SHA1 e48f1918a3e32f099281843c028429f1015edc3f
SHA512 86e5b6def44035291ac1726e11eb034b5cc96850b8baeb113221fc1c90343a6c831aeb71b971b44013c4793a334efc8df5d6a324ea5dda7756ab0d4efcc10596
SSDEEP 12288:yyPz5L8xLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:vzyONyBo4kx929bL3Hnx
TLSH
T17655120777A831F9E17A6234C8960A01E771BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 247beff6dc357bc6a51e3a905aae8dd82e33b2157f9c3ce3e2893d0c2e7ea582
MD5 8b9f38152beb57abbfae690444c1753a
SHA1 599f0a4f415d679c7ae3a80d4f3c91ea740c1075
SHA512 71d4de21fbb6d00484513a6d3e733d1c0d8c804799af797e2bde9c977e00d19ae466f37a5b45cfcb61182b83b8c7f672e70fdd419d79c20c31fdadd14d2de96f
SSDEEP 12288:vCd98WYoaLHF3z0z04PDvhjLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:6TtaLl3z0zDwNyBo4kx929bL3Hnx
TLSH
T12F6501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3DB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 a1682a47afa1efdf0041dd1e17d96fde7df1aa47d0bf22b3b4675d192136389b
MD5 960f18ecaadc668f5d6d4b1f2052e239
SHA1 540beeb12338dff4bfa67b8e4a179b79acb63b1c
SHA512 1f8403acbcd02744bd638d6bc6a3fc89495986f8367048bca7bf3966e30c74c5826ce77e3273048d0da33b813ac06c78db44749449050f3f917d6aea3bdae1cb
SSDEEP 12288:Qi4e7ARdTfgwCHKy7GLbbdIvMLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:Q3ld9CHKy7GZ0NyBo4kx929bL3Hnx
TLSH
T1DF75CF90F3E810E8F1B79A3489764511CA767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 9d213d0bc044c62a0c67ddce7f1c77225f8e40da679f70785466184b8554f527
MD5 854ae01dd8d8d66b787b1a18e44813cc
SHA1 bdb47ca4f5fe833ef270f48f202808b15e0e5b62
SHA512 2dcca23ab8a6ff9eb42446b0f2c3f6f6ca6c7db95d11ecebae005ff37bf1d4839b59686fcbde84fb9b8ebe7c54ed59682a7de9f5f28f4a7df4de86f136df1a52
SSDEEP 12288:3zLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:3gNyBo4kx929bL3Hnx
TLSH
T14E4523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e2375c1c157543ba482e35a0c95eb3038092a19ce976ce14a83e35861c7a90ed
MD5 1e217ecaaed3708f752684701a1874a0
SHA1 84c4f59a05baef5af732ee4dd90c4184d43a69d3
SHA512 9ad5b064ba37b5fe7bf77b27a811a89501d02dbffc3858a051cb54dd37392f85aa8eaeeb87dd87e1a8e3bdfa2cc7f80841e07716a7ff2205c9d6a9f88523bda2
SSDEEP 12288:VRLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:VuNyBo4kx929bL3Hnx
TLSH
T1644523125A1C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ccd8f8a87743cc4e289a33636af57a0cd9079f61b14e617609df77db518314b6
MD5 af24c07e783a2abc375d35835eed399e
SHA1 a5c6e1eef401755c3f1c7b131a1d8cfd72bccbe9
SHA512 7573944e717161f846d5ac0116fa3a7258b13fe7db341203ed4f01f4966e4955126a7e16e11e6a27413600e23389bba1be2fb8c8e53ddaf4e1dd758b3621b6aa
SSDEEP 12288:6MLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:6TNyBo4kx929bL3Hnx
TLSH
T1BA4523125A0C227AF76D3FB0654A8598CC34BC8F1E9593D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 0133a18e35df776c5f3305210ec0c6476ba5e80e1f24066a257e58decb75e102
MD5 a685a814f6e41048512c5b65f5af1ae4
SHA1 ae0b4b2ee55753f7bf245b94899a39fbf3b90f5b
SHA512 9c9c10008742c09c6db092f6c5d766c1618b5761a727dd3c8d9bb7988945c85b186abd7ea118563063d928c08fbe2f0efc5578c003c3b2d2bc4dfb069cf0afe8
SSDEEP 12288:ImLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:IlNyBo4kx929bL3Hnx
TLSH
T1824523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 8b23d38c6fb08804893400a4b1b357e06f9eb825bf4b515db749c336b64574b2
MD5 58ffec8839f587363347203af57df17e
SHA1 d684fa4a7f9ed5da8fd8730564676f097c5066ae
SHA512 eb6c7669682acca91ec5af6233cb8f9f25d93ef91eabb91c67c40c33e5e4eb8b5b02aba6d7018a5abce9de10b0db627e6dbff8b534c2e0f18b82e07a5c8e73ef
SSDEEP 12288:CzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:CgNyBo4kx929bL3Hnx
TLSH
T1F34523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 4c29e5957229d04b376e8046bb45f9916c3dac238fe8b47762a3b64af1aa209a
MD5 a83ce0be82836ae54e610b73b41b28b6
SHA1 f1b29e116922c6e596686911d5f429fd08ebaec6
SHA512 d737c259f526ec769dd9521600294143d350fc0b88f122744a0aee01997145d948d618c4290772f068f40f95f64e7b15f6e22af79dc3e1dce810c4e49e90b992
SSDEEP 12288:6+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:6NNyBo4kx929bL3Hnx
TLSH
T1294523125A0C227AF76D3FB0654A8554CC34BC8F1E9697D8EF27987B59FCEA34A10107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 57db7d82f232e4149cdd8ed908a698eb69d51dcf55f2cc1faeb8d9bb3be3fc3c
MD5 6c13a41313de519fbc64805bfe77dac0
SHA1 9a1e611ba523c00dd0db32926a082c1a44284210
SHA512 796c27930bfe45bc7c5bc6ff483bf670a19d697a23bd102d6dc2106c4820697407adda55b783b3f648af9ef2a6060de6e8860702b059392a1db20d58e2c5a4c5
SSDEEP 12288:rgLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:rfNyBo4kx929bL3Hnx
TLSH
T13C4523125A0C223AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 7ad15def0592499f73c7ea551802272e7c43aac3b7c2b6a63c408815aa55853d
MD5 bfd7401852f947143800de798c4f7d54
SHA1 66c9a522b610f157bedb6b50558984447a2d20b0
SHA512 86658876ef2caf6c6aa3be715230fa551fda419e053bab9e94e4317c75c277ec9d786e771fe807d484b733ac13ba4d5232ef4c1ce52b516d4f664c9c44a53225
SSDEEP 24576:pfwvqk9RX6wkyAIxNyBo4kx929bL3Hnx:NMnYImB+kn3Hnx
TLSH
T13085DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53BE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 792fce8ca6d35e7e6ad35d2ee108893c1ed4f64c26d85684d03fff70daf51986
MD5 98de5e02afa87fe13157e58eafea0c8d
SHA1 e8377e018e7951a7786fed0c3bfdac03d9998d09
SHA512 08985a6bdb08afc7000ac97ce655b5d32d7abcc7daf39570c2cfd4e2026e15b351afbb554fd238c36b47b83430c4c46d2a10597576b4ed08926aa7d28ec7aefa
SSDEEP 49152:2YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0HB+kn3Hnx:VySzPZ+k
TLSH
T12D066C56A1A801D9C1B9C1B98F0BCC1BFA7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7f7f956bc18c21eb89d6e8bed34d176b602edc4076eaa707ebf9ca1310cc6a69
MD5 ac4452a7f23abcd325f09d909337b0d2
SHA1 923f44f6677654862d149afe8417c1111953c75d
SHA512 7e5934c7b246898154485873400af2bffc8c5c73e1f14c340bd7944966233f1dfeab7ebba19601262ae53d50f522e463e5c07e4b37c2dc9ce93c401961ebef9f
SSDEEP 24576:D47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYCNyBo4kx929bL3Hnx:D47JUQjTirIhCnDHUPfF/3B+kn3Hnx
TLSH
T16D65AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 38f614c3d5880c730ad528a2bb7676298bede8acd9ffb17aed1e140e83a6c33c
MD5 7dc6ceac8e019c1288e34b3d92f79eec
SHA1 fb24a19864d0d5267b8104e2a7007e872a309387
SHA512 5889e80b832b93a448ace8b34d16c6e6334115de32fb5fea6bb66f7459bd9f391c4e48b8f8a35f95c83c7fbf988a56f1a0bb87024816658e3893ffd3edcdbdb0
SSDEEP 12288:0psf2LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:JVNyBo4kx929bL3Hnx
TLSH
T1EF55F00AD25812E8D16E2274CB468A40F7337C5947E1D3CB97D0F87E1F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 0acf598391e208ba92daf66d6fa0c7b90f1c741d51f1fae44631796857758da1
MD5 840f33890e5fbcf6fc4740caeea6e275
SHA1 2c22c8d1bba6976a33edcb59393358751e860248
SHA512 212b830c45406cabd07a009a86bf339e5c95a10309fff8f928085b9e79a723d0ea66be6c5f904677dc897d066400b234a7e26775a108673a09cfa0268497dec0
SSDEEP 6144:h4sBC2na2k05vrERzfKDexH24Py5xb/ICkvQU6aY5JMBIiWZDc66rHMmBlo94hyH:PjyIsy5xQk1x5ZDl6rHMAlo6h2a5XE
TLSH
T155350701762BD75FCAA940325E33D1CCAB707D05EE456B0772C88B3FD576568BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 18b917058a016072b76d03046edfecc24f7184527a266be2bfe3a221a9996f02
MD5 c47b9e68871f6f7ed61526679e107139
SHA1 be845579a43be8dc1bce0964c7e8efa527d2960f
SHA512 42025c31b15031a9177b4007361042ab2a45af8686ae9d45cce5fb553eb246cf010f1e62719a918b58dcc7353a591d155eb526dc2b3ce66e3a381b4403ce5389
SSDEEP 6144:wLNab7Pl8pkFOk6vnDe4lKZkkvY0kvEetYIvaH8IjKKDexHC2qtXjr2AVoCa44I4:w80ZCYKZ8Bvanz2CMnMVS
TLSH
T13975F8815537E38FC5FB5032073AAB4DAB74AC1677056F2673C8047AD82AB25B4B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 cd50e217c6b221db91090453bc5d60493b1fb4285d5fa74147b746f770dd5b20
MD5 7286ff14992db4f0d18444e5925702c5
SHA1 17452e8feb1f96754fa9757e57c0329f9cfd7331
SHA512 d811440b3a3f28dc6c846336e28e5f07cca6bbeceee0ad884e6b00dad9395c72b5ec4eae21f07fc4b709adc214b563fad012ccea27e3f1b2eae8bbbfb793ce1f
SSDEEP 12288:9y7OLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:U9NyBo4kx929bL3Hnx
TLSH
T1B6452312975C663AFA7D3AB0645EC024C839BC4D0F50D6DBEE1658BB59BCED28E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2fb8dc0fbb82cb48f84ddb972579b2bf2111f0e10e19696376545e2853d1b4d2
MD5 c09b7f4453fb643ba57127a39523884a
SHA1 b1a2353b6a5a92b1e8405a6cd9a6bcfb5f9cf609
SHA512 22595642d13a721226bbf96fe79774ccbf66a3f46f861210e9f59d497e44c4d6b8210ddcc97a5072d6b2e950d4dd212d84d0963765013528dfc93db0350f82a1
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bYrNyBo4kx929bL3Hnx:Hgb4mBIBhGFBB+kn3Hnx
TLSH
T11B65AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 0e245babeb6b7b2648624b184a06c9efc86ea018baa93a411bb78edebdd92493
MD5 0a6c3d3917b4353d78511d62946215cf
SHA1 b1cc71a6babaf57245e40c3e377c765f912dd5fe
SHA512 c28d8322f51c3fdc30d03a3557bf23f1aa50760b1f385f0d68bcf324fd96abb8cd32c454b43288409c19437c1e8af7206097d900ec099e364aa17609ee29594a
SSDEEP 24576:zG88u8FpJqH1Jzria7/myNyBo4kx929bL3Hnx:C7ZFPqVAa7/cB+kn3Hnx
TLSH
T19B85F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 3461e8d6a880ced4aac9b5f47b98a994761926e40acd5aef6c146c7f06ad8cd6
MD5 e55187f6e378470c14268327931cdd71
SHA1 df2fcd56e31a307d0a075d8858d111fb91bc8931
SHA512 9048e4d757fcb31546787bb6d1b2867deaeca6794e005792b783b84842eeccd355389bcf1a5c5bdbf8808059a1104901131804f346d4675fc6d4e21385c0403c
SSDEEP 12288:aHvUrBFrEjwaQZLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:aPUr+NQGNyBo4kx929bL3Hnx
TLSH
T15365F21F22AC18E5F67AB17C85868609E771B8560712D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3be63af9c6148ca2ee5d0a3094aaf6ae0251c42380479a9c046c61d41dbe9e43
MD5 9b5cfcb8dad9338a45dc23156a56d29f
SHA1 cfe093d8e097e2c8c1b8aef7672796925c7a77eb
SHA512 55cbb312841a93566e62125a9d1153b890a25cfa83fd0cb9219c10f4ab0ebdcecc0abd58c97f2eb82c5c78401aad358613b28abc65d1e94d802eaabc3bf26c49
SSDEEP 49152:TBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj9B+kn3Hnx:8G05lO43be+k
TLSH
T14BD5CF6A62EC11F9D0BBD17CD9C6460BEBB23815033556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 eb5d4657eeb873108d84514e35e56bf5c9b7a8b7a5deba5047f200c796e484fe
MD5 cfc35a3df20ef3ef7184b9c1695ca4a6
SHA1 3bdb45ddfcb8aaeb136ec294c34346cba60a8b3e
SHA512 dcc9485e0c1d9af834a2e78b6762c6af0b2f541c3887d1f632ff2db5dd748db83d357faffc7d80dd33d81fbc9b14a07dd9b45fa7be052704edafa867a78d24d8
SSDEEP 24576:nfa5POZ3dpuWVM50JicR2hG0lasx2+47eidncNyBo4kx929bL3Hnx:fa5POZ3BJt2pasx2+mFB+kn3Hnx
TLSH
T13565AF5EA6FC01D5E579D17CC583861AE5B1342653329BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b7d9a71a9cea57a5d2be2d8ad3d895cb2a8700edb2831dbc14202bc01883b31a
MD5 6d8850f193759391d352661d37bbba1b
SHA1 4f9c07a3f60df3e428f71be839bada3d278d26a1
SHA512 52f1a1196c9dd3497b4bd7a25500864adc8be2707860eb85f628c4139ff98f7df2d895baffa4ef85ba94c9061b7d3233dadf1662265b8501acd850dd6d88e872
SSDEEP 24576:QNcwHdjbyQ4nLC18lb/EOjowL7FkKNyBo4kx929bL3Hnx:QNc/zEOVHF8B+kn3Hnx
TLSH
T191858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 02f6b9cf915a27659eefb20715b047a3aa8d21d4d1f7de7ad52bc9cf6addb5b1
MD5 449545ef81b63460657b9c17a4c04fc4
SHA1 9b9bc6af431abd238bad701c3a36e22571bf0a0b
SHA512 e7151c74b03114920e48bc25cd280d4324e1c4499463352df8a5c589789bb3ddf1d21764def1e1a31942f0216b637a5b1ea8715f1307638a0bcde92ad73929b5
SSDEEP 24576:bTkNvNnaFeYhJNtmZBmfNyBo4kx929bL3Hnx:bTMwBtOmwB+kn3Hnx
TLSH
T1D755AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 5826895c257e7fe3575dc4e293b5adf92e3de56126e64f382812eed51d03543c
MD5 8ac23484b0b92b2d36512ce8a999ab1c
SHA1 121938f12f85f7aafa5038b5a3b94272b9660fd8
SHA512 dcf69f8e1f666b2050d2bc32b69cf33c9abdef48dee80b2613b2fdb57d8fb521f2f2bab674d8a2b78cdde04225129147016d09fc901c889ced9d2599a6749029
SSDEEP 12288:BQcMxWDXN1Dp/fshBItT1IQgACLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:9D3FHshBIYQgAJNyBo4kx929bL3Hnx
TLSH
T13775E13EE75C00E4E57BD1BCDA538906E67138AD072266DB0694C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/380-69-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/380-71-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/380-77-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/380-291-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/792-44-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/792-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/792-43-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/792-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/792-56-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/1100-81-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/1100-306-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/1164-85-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1164-307-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1164-91-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1164-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1164-325-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1164-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3208-17-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3208-24-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3208-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3208-96-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3208-25-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3396-313-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3396-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3396-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3396-138-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3516-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3516-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3516-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3516-137-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3516-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3780-15-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3780-13-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3780-9-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3780-0-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3780-7-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3780-1-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4296-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4296-104-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4296-97-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4296-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4296-310-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4904-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4904-128-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4904-130-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4904-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4904-122-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5128-309-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/5128-116-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/5128-110-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5128-117-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5980-274-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/5980-59-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5980-65-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5980-58-0x0000000140000000-0x000000014016E000-memory.dmp

Download