bf9617688d7213517fde334ce8997508793bdf1aa2b2453abb093db81ed6c7ce

Analysis

max time kernel
151s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_4a61cb2f9ca861edcffacea566dcbf17_icedid_njrat_remcos_vidar.exe
Size 19.9MB
Sample260930-b74e3axgrb
SHA256 bf9617688d7213517fde334ce8997508793bdf1aa2b2453abb093db81ed6c7ce
MD5 4a61cb2f9ca861edcffacea566dcbf17
SHA1 f0c9080dd77b3b43948af1cd63cae01d8cf588d0
SHA512 f70c95c41f7e2a0b5b50f7925e7f590bb6ff04f53ada036cea5949eaef0b55b6f01e9d26778d1274785c88d37fd38dc788d0155060629c0953829340799f49e4
SSDEEP 196608:cD3DY+PEN1vhZpQFlQxH2+/k5gu2BcaquS6G3phpHOjcHVsT6pHPXGQ2:M30FzhZOFlobk532B9S6gphEcHVsvz
TLSH
T163278C52A7FA41C8F2F3AF31D9B542568A7B7CA26A34C28F0154764D0E32AD08E75773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5928	elevation_service.exe
5360	elevation_service.exe
292	maintenanceservice.exe
3700	OSE.EXE
6092	PerceptionSimulationService.exe
596	perfhost.exe
4764	ReFsDedupSvc.exe
4500	SensorDataService.exe
4160	ssh-agent.exe
2940	AgentService.exe
4412	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_4a61cb2f9ca861edcffacea566dcbf17_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f0b6e0a1e4fea11e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_4a61cb2f9ca861edcffacea566dcbf17_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_4a61cb2f9ca861edcffacea566dcbf17_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_4a61cb2f9ca861edcffacea566dcbf17_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0001000000009329-42.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107750\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107750\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_4a61cb2f9ca861edcffacea566dcbf17_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Control Panel\don't load	2026-09-29_4a61cb2f9ca861edcffacea566dcbf17_icedid_njrat_remcos_vidar.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006df399d57d50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000852972d17d50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000516901d27d50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c22bbfd37d50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5928	elevation_service.exe
5928	elevation_service.exe
5928	elevation_service.exe
5928	elevation_service.exe
5928	elevation_service.exe
5928	elevation_service.exe
5928	elevation_service.exe
5360	elevation_service.exe
5360	elevation_service.exe
5360	elevation_service.exe
5360	elevation_service.exe
5360	elevation_service.exe
5360	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5072	2026-09-29_4a61cb2f9ca861edcffacea566dcbf17_icedid_njrat_remcos_vidar.exe
Token: SeTakeOwnershipPrivilege	5928	elevation_service.exe
Token: SeBackupPrivilege	4764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4764	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4764	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4764	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4764	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4764	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2940	AgentService.exe
Token: 33	4412	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4412	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4412	SearchIndexer.exe
Token: SeDebugPrivilege	5928	elevation_service.exe
Token: SeDebugPrivilege	5360	elevation_service.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5072	2026-09-29_4a61cb2f9ca861edcffacea566dcbf17_icedid_njrat_remcos_vidar.exe
5072	2026-09-29_4a61cb2f9ca861edcffacea566dcbf17_icedid_njrat_remcos_vidar.exe
5072	2026-09-29_4a61cb2f9ca861edcffacea566dcbf17_icedid_njrat_remcos_vidar.exe
5072	2026-09-29_4a61cb2f9ca861edcffacea566dcbf17_icedid_njrat_remcos_vidar.exe
5072	2026-09-29_4a61cb2f9ca861edcffacea566dcbf17_icedid_njrat_remcos_vidar.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 2028	4412	SearchIndexer.exe	101
PID 4412 wrote to memory of 2356	4412	SearchIndexer.exe	102
PID 4412 wrote to memory of 5212	4412	SearchIndexer.exe	103
PID 4412 wrote to memory of 2884	4412	SearchIndexer.exe	104
PID 4412 wrote to memory of 3316	4412	SearchIndexer.exe	106
PID 4412 wrote to memory of 4808	4412	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-29_4a61cb2f9ca861edcffacea566dcbf17_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_4a61cb2f9ca861edcffacea566dcbf17_icedid_njrat_remcos_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5360

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:292

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3700

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6092

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:596

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4764

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4500

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4160

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2940

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2028
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2356
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5212
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2884
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:3316
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d4c1f38bb708be662283745704a9035a04ead7f997242bbb2cf34ad066b008f2
MD5 ccb4536477dfbbd4cfdf83216bf353ad
SHA1 b80ee701488fc6a81afa1fe031699b22bfc6405f
SHA512 58e29cf64be5583dd3c04350ed29fcb25a01e7a5c1912febabe7eb049bf6eb60726e312f542929231fd4c7881d5be57dfaaa82d8e2ac741afa1c92b0c24899cd
SSDEEP 49152:cb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnbb5+Pl6bJTIZ5jdgp7:G3q6tjByslgJTIZ5Bgp
TLSH
T103D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 a78af890b52d7af2f524fb0d85d4315f453e44c9a2e98cd197152ff3ad22dbbb
MD5 11596977a1ea710fd195a31aa533e3f8
SHA1 897bfa03e08153393eca6f4b0834ab0758ba28b5
SHA512 f95b1fddc8895734f1a55631c34bdd26965c42b79ddae381920e82450fbe31904f11d10691aa39e9479608359c0a6eee2d49c2d5557570444ff8d71d3814bca0
SSDEEP 24576:1XYfDtczANmb57GBiOl6a8JTth/RWZvR6wQQ92pN3i:gtcpb5+Pl6bJTIZ5jdgpQ
TLSH
T10285F11967E504F9EC67823DC8E2C611EA73B85587A0E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 c1b15f285d8375c1d8da49df92f8cc5564a457e11177b4926ba0be86a0f4440d
MD5 d23576e6922973f289c77b4841406ebc
SHA1 10e5df8c58e762c790ea9250a12f1289c8271a94
SHA512 3c91403dfa40def52fb0bf9ea449c83a5b9bd3aabb105ed688f0cf7eaa8012f7b3daee6e0ce785169520fb4785581b1a867efe824776bcfeffe2d99842d788d5
SSDEEP 24576:c0Le5ji0hmxdrMUmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:cPji0Arab5+Pl6bJTIZ5jdgp3
TLSH
T12A95AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ff5e69f9a5a8eed1f259d493500b4c2bd06872898ee7f92adc0192a205777dd5
MD5 874d1f6f6336b889dbe3795d0ecd006a
SHA1 693752a64ff1a9895e1590c22807186cd956e0de
SHA512 beda785e815dce0cad1161d611c186a30b6a124efecda14e9672adc38c0516495ef652c6f09c4955ad73d382e8057baddfb5f1654850eee87ea9150f4e585389
SSDEEP 24576:Ta7/ezSC6vUyDZaqgrvWx6q8wyuWmb57GBiOl6a8JTth/RWZvR6wQQ92pN3l:+/ezSC6vURPvMHjyWb5+Pl6bJTIZ5jdq
TLSH
T16C756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5a90209cadfd90b6b3b13d05a0a44c9b8bdab9c378080f020a389aa18e8ca72b
MD5 8171781b011889f18ed5310298649b1e
SHA1 4fc7327bfcbead93b17fefe6625c8ec083f18768
SHA512 7f392d24273b2bace28063b49c4033b01a34c0835ad737f1500e21efde005251e9c17dfd86ccd86ad37d054d776fca793a2c145a8593d5ae4231a5c17f77c0fe
SSDEEP 24576:nVbqPb88hv/lV7Zmb57GBiOl6a8JTth/RWZvR6wQQ92pN3l:nVO88hXlVIb5+Pl6bJTIZ5jdgpj
TLSH
T1A2559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 a490bbf1647b152984245bd3eff39603a99b27f8b1badfd42d2cd2e39d30528e
MD5 f8b4d1c0875638724836c3395e0d143c
SHA1 95d8fb49a404e397192e96518573c6941e52cf30
SHA512 e797d237c1a3e74d4594de7de657cf8506c878f735c5ebee38186e1ace5185c098a0a51e3ac4587190dbbf2fb2dfe5e776edcc66f6b592766ce89e9d02ac9f81
SSDEEP 24576:TFAmb57GBiOl6a8JTth/RWZvR6wQQ92pN3A:Fb5+Pl6bJTIZ5jdgpW
TLSH
T13E6523834A6A30C5E5AB1739E9CDDF00F879EF55CD866BB6C575282BF034349B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 e48a4ca1958839d51fc049c18dbb19a5e6fc1b030ab20ac502af8c8513a025e6
MD5 e3eb46a4a5d372b8d08fca497e718c98
SHA1 5f6291fd7473406108eaa7e8d60cece8e3b4d9c4
SHA512 78dfa1a69bcc55f695c044b2911cafe4ea257d6879c1bf54b75210644b13fd83063b6f696e92c13934b5ee758aa669b75f15afda2fe41f45d333bf558ce56875
SSDEEP 24576:OJIUBmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Q:OJIUcb5+Pl6bJTIZ5jdgpi
TLSH
T1A985CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55D7A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2d50714487a33839997712048aee80bbe437db71dc46a56d82016c844d005bc5
MD5 27baecf7390736d55e45f14a0b81433d
SHA1 f9e53c954851ac74a2fb6ba1f3b8220df9d5eb82
SHA512 760a02642bef5dc58b62bf0d7ca17ab6e60a68a871615a08778f4042fb23aeb1e8937e183b605e4d98bf75da2c135ada0c210df1ef32c17acc5fcbd5878ee185
SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THw:6QvGAdlCEL8c/pRNw5CVslgJTIZ5Bgp
TLSH
T1C0266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 83117a5a686383767b13a59c024a427d12879a8c35feb70254c68979ba8b4164
MD5 4e4aa567ce4e2137949eced8123d7d08
SHA1 e4aeed6bf66db00833db31f41b3c7d6b53119e8a
SHA512 4829c9443a86ab86430bfa8acfedbbf09ff53a407d40dd5e9534f5edfa99decc2370fed17eb84cf791651d0858368762132bef55b3d3982ec2740ea0f5a77545
SSDEEP 24576:hBewsAjzmb57GBiOl6a8JTth/RWZvR6wQQ92pN3a:bljKb5+Pl6bJTIZ5jdgpY
TLSH
T15285E031FE75E036C2BB0DB65B65C716643DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 047fda07100f3950436c9e6cb600569caa6a0060e06a586f9f45812c33f4082a
MD5 e304d423ad73535774e48f7b049952d8
SHA1 c66ae5d5082ce489935ed6005db2bfdc3df219d5
SHA512 4979d9a24defb9e635814be42dd7e5a1d4378d71ad08fc79f8296e909973c286ad1f1776a19f8c18c3156ff6eae47ef153bcc3ec13ef6d8609791f039a5f7206
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHosT6p:2UEtQevvqc2W1cpV29I32os
TLSH
T19D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 735d1b90a9c2689cf7cfcf458d47a5e9aab9d3e5c124bf819e4d319fc67cb6ee
MD5 3fb036905a1f99845a12d4328886d267
SHA1 d7f1dd04cf4aafa8c8a206b36a43d498f15aa0cf
SHA512 851eccf2af24105a333d51b81904ee19d676cf2b1e2251d9f6971113d2c5c660c8146de039747df5b94ffa2475bc4ec1929f3c8ae84186f368f956fe149ca80e
SSDEEP 49152:kCbRquA/m2yL5zTfFiV+XenmE3/zqb5+Pl6bJTIZ5jdgph:toquVjnmhslgJTIZ5Bgp
TLSH
T11CD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ab49dcf4bae1b4297621b025cda7f469be83a6863517fed0162dad26b91e4d8b
MD5 27a5bacdcf63390798c86e8ef0a5ede4
SHA1 1b59ca48d73919ede915d8501a78c96799cebfb1
SHA512 4e94168c6ff1ab0f4f53dc6188a46005b4de6eb02ba2942fe03720e77432fb95ef69cdc65eedf0b0a8d0d93b2fc6e968dd01d6f9855e6ac72241e986b46ba9a4
SSDEEP 24576:EAhGLmIFoiwtA5l7S53amb57GBiOl6a8JTth/RWZvR6wQQ92pN3M:EAM1Foiq5Vb5+Pl6bJTIZ5jdgp6
TLSH
T196359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 18cea7ea911b9eba05575db41aaa7650918608f4617d0dbf772596dc038e0ca1
MD5 e530f86fb88e0a9b1c3e25d481f08bba
SHA1 7c64dfcfa7b8db0a82712258acdeb1ed237d295d
SHA512 2284e84258f6153748f715c52b5bcb9c8d08a1e4c4635f5f2ff68477b2db3346fddae5a75d97d57a6469043b5d5f0cf121a123fce1d0a4d6ca72b1a3ad75c03a
SSDEEP 24576:QwuYOW3mb57GBiOl6a8JTth/RWZvR6wQQ92pN3E:QwPOBb5+Pl6bJTIZ5jdgp6
TLSH
T1A275F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 61a8ac5e0696b9420950925ff76daf00e1166cd46c2a87605cd03cd878fc115d
MD5 4a77f04564e8a7292a7eb9b26c14cf63
SHA1 9570efe9e4e14561a52970d4d4448fc79e153f4b
SHA512 90d86e2a7af8332fd409ab3cc69b4877192960f4d536672ec21a82510e3ef0eaf6b41b79f56b1acb729b7872a52c0d830f7ad0d1663b68d9ebc403a077749c3e
SSDEEP 24576:1Zu8mb57GBiOl6a8JTth/RWZvR6wQQ92pN30:Yb5+Pl6bJTIZ5jdgpi
TLSH
T10F65128627A830F9E0A7523DCCE58B01F772B8529B7653DF4674056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 487fe40dba4a0b8fc4952f55fa5d57844723b6f08b91b8ef34d30a8a1dcc1a71
MD5 5d3eeddd726ff3db0ca5aec7463e95b3
SHA1 00c09b133eabef1ab7e5839d61c5ad401a241795
SHA512 f76dc853b4661db04630d03e8f8aa90dd65f1b8815dcdc863060e7439396967544c403e0479dbde230793569f5514d474d501ceb98a51739d8a549a61d500eb8
SSDEEP 98304:pQRQyi36YOcPuLvw2gAf+PN32slgJTIZ5Bgp:AQyiKakX+PNmsT6p
TLSH
T173666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 aea583c82833edcde625b810aada25a2ae3e4925a488f82f4c13ff19105b156c
MD5 4c2b0c76d7bfaeb86789e7389c7289cb
SHA1 a16d3c1ab629f3cfb2ad30b18b27a4ba20fd04e0
SHA512 bef601023d3519ae04ff29a820aa047be667753c3ded57407c59dacc903bac88126cd840249e8159b80b810d344568a451dc7abcc73cb98fcfcbec41cfc0ed9e
SSDEEP 98304:CQRQyi36YOcPuLvw2gAf+PN32slgJTIZ5Bgp:ZQyiKakX+PNmsT6p
TLSH
T108666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8e863a6e75ff8a33174cb956deacd0c219641777205cad8e01536d70529a6e09
MD5 396ec164aca737d131b8ba8c07352cfb
SHA1 a0fb8e77ae0e84e84ab04c8e2d1d53dde6612204
SHA512 dfd458192461f4510cea75714521305fc77938ce7679e20a547fb019bc0d1540f29d5c9cc4251d00777e263608b35bef15568394ca0b559e080b3bf0e6e55f74
SSDEEP 49152:r68Qg55nhxeWu7PNU3/ab5+Pl6bJTIZ5jdgp+:1thGRc/wslgJTIZ5Bgp
TLSH
T1E1B55A33B2F60099C44DE1769F4A872196E27C71CFE1E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a7a1e12e5443ff57363d125263cb74808e61a5a7c37f54450fab5f6fa4a744ae
MD5 a7aa297653e782eb497017af0b6925b3
SHA1 62168e0f63955f912665a65e96ab80f4734a4926
SHA512 7be164b949d042f0fdc6c249e338b31f28dec9e59d80b8f5313a87e2f03570a1d6af457b23515705664155a986c456b876322041018adb75bffb23f7c92d22ac
SSDEEP 98304:Zy5112gYy5azzVvD69nLKnhZLslgJTIZ5Bgp:0LIH+WhJsT6p
TLSH
T1F8167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6729acffad840870c741bdb9af682fdd853bc4b871a638422dcd5977cb9778cb
MD5 05e37445851fb002104774cfe936c58a
SHA1 2e079c31c8fe6c0a652a35e89762ae3cd83ae1d8
SHA512 25f1ebd5be92bf8e6ae724070bfde5eca77858529ddd99f6a7d385ed593abaf3811b336861acddc8debb132f8bace13bef9ab117eff92c4135b282d035ccdbc1
SSDEEP 49152:3B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glIb5+Pl6bJTIZ5jdgpt:Zu6JmQxd2dGslgJTIZ5Bgp
TLSH
T14CD59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 628de4aa9cdf5a1dfe753ca6855d68307680f8601713fdcda18ccdfea1382194
MD5 e61d05854c1ab3fe28d37e40de3f38f3
SHA1 73674906dd0bb21d7ed8affd2b0db13209f6945f
SHA512 12787e0361d7ea4ced48ac229b7a267230ac4226275a4e0b098e819d9b8cb425ff97cfaf39a4dfd8472cdaa5166629e21aec557dc9d2057b2190f0220e10c79f
SSDEEP 49152:I1hpsNoJpF1A6yU44CwH7R4x8b5+Pl6bJTIZ5jdgpf:ImifPVRhslgJTIZ5Bgp
TLSH
T17FB5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5b785ff2b025287b432b293ee2d46bd2581d2cc9ac98e0e7aa5eb6913d7eff7f
MD5 9aa4c3a8d48458a63f153d9f2abf888d
SHA1 13bfa57d4a458cc6b6693e17c7733ca14aef209f
SHA512 691d55063f18611b6be64bb80f20e753354a461d2004016911513492c677e3fe2343f6f54405b8e19daefc615814183f1d1a8820e5eed5c58d394dcb793f29fc
SSDEEP 49152:6SuZQIY0Be2KIRVtOnks6NMHqLb5+Pl6bJTIZ5jdgpr:k5dKOi61/slgJTIZ5Bgp
TLSH
T137C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4e8d8e6a25efceb809c1129ea774377c97a427a5ffa66fd0e2baad946b556fcd
MD5 95b6087959b107da2f60511732db24e1
SHA1 f0fb1a2abb9589ad01376f4e5dd91f1ae00a2fb7
SHA512 c580d1a8dfec8541e37ca03d2d08180faf54a3197ce1fafad927c206d91a23861887c3cc5b2e87acf4934520f22ef924ec4a57a5de1e32e9c9aaa0f4541eca21
SSDEEP 49152:LhtSn8EApI0figGgiDn0AP5wQb5+Pl6bJTIZ5jdgpa:KX2i/ph9slgJTIZ5Bgp
TLSH
T13B95BE13F2D900E8D05ED178C7468632E962BC164B35B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 dd359f6183da543873ffb55dccddc7826cbddb65533edad65c35f062149e9805
MD5 2590b2f9f17d713d349739eee4d34042
SHA1 3041357758c1ac8c0068f5b4a1646856c0c8aa68
SHA512 2d7fcab0602fef00d1afcb15abfcb43748b4fa82b9dc42f523879bc0bc3264f630edcf23cb3dfcfd3259af3ac0572bac699c8ec3f606640a6421f5ffb3baaf91
SSDEEP 24576:YImb57GBiOl6a8JTth/RWZvR6wQQ92pN3s:ab5+Pl6bJTIZ5jdgpO
TLSH
T1DD6523824A6B20CAE09B5779D9C9DB00F879BF57DE8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 f5a11bd52fddac136584b45ae3f4789d08c4e2ea6b6b06183c13390494043081
MD5 09a1f771c8df1572ba89988046066e07
SHA1 bd284ece88b545cccde57ad84b9b21f56da87b0f
SHA512 8b6651fc892d54c4c5757b6164ba9def6856ab6f32dc7f3b80109b759c6da879d248b379cbbdc8f243c9e235a0682189b67ff96509b95ab229eb5a307857f827
SSDEEP 24576:4vmb57GBiOl6a8JTth/RWZvR6wQQ92pN3c:Db5+Pl6bJTIZ5jdgpW
TLSH
T15E6523824A6B20CAE05B5779D9C9DB00F879BF57DE8727B6C67D0827F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 d4c5b2befbb979740fc4d28dd7fd060cb42e3c402dda9de26388c7e61f178ae1
MD5 24471527f1b6ee19ed8cdf9b804d2ce2
SHA1 29b27a43cd203dd38f60d1616b3c3a3ad1254adf
SHA512 143e1cb6ccbb03a15380c71276c4abcc31e2e01a00c5955c3e717453e43b858e6ccf81d25e358262134e7cdb074d71ae5ac0a5dfabcfd8663400cd5be1a2e486
SSDEEP 24576:Vpmb57GBiOl6a8JTth/RWZvR6wQQ92pN32:ab5+Pl6bJTIZ5jdgpQ
TLSH
T1286523424A6B30CAE09B5779D9C9DB00F879BF57DD8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 408eb1aeef7f50bb01d0abcebee75e80715ae70836f8400de0407809debb138a
MD5 e6c75360607b3aabdf97afc3f1c0ac91
SHA1 8177775e06a9efeae822006d92d14df4a2d2fa44
SHA512 ff0408ca9724634aaeb3366cc597c0e3c458d2d64e017fe6896c5272bcd22131ec4f8ee3a748afb276e8af6db292f802bc4fb7395d611ceffc5d83083179e6bb
SSDEEP 24576:Dmb57GBiOl6a8JTth/RWZvR6wQQ92pN38:ab5+Pl6bJTIZ5jdgpK
TLSH
T19A6523424B7A20C5E4A79379C9D5D700F4B9BE96DF5267FFC675082BAA31388383170A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 5f9b43cef2e9210908acb064679b11669c077cf8a7c4d88972684f2c9699c933
MD5 95991b0d63db50b47d68fc7c6b2726f7
SHA1 6f5d25f04c0c5163e61f12c8275c6f638c12a832
SHA512 5fbeda90facab190ab2f84010ff13d9d07e186aaf31a395940902655af8ba583cf3091bf824afa05727c238c2253765048a5bf51d5e9fb61530a3a779c2fcc52
SSDEEP 24576:Wymb57GBiOl6a8JTth/RWZvR6wQQ92pN34:Yb5+Pl6bJTIZ5jdgp2
TLSH
T1786523824A6B30CAE09B5779D9C9DB00F879BF97DD8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 9e761b3466abe529cdfdc2a21723cacb006bea362c1ac69966498b870c7974f6
MD5 8e707200bbb0439872a05929f634c2c8
SHA1 dcb29316e1f5b3ec7f43131d4127a0b29dd5a6bd
SHA512 e2bd9bfe07267c1c9162ca2008f210f623af792816d5aa06a9f2dd2c4e1aa9581cfaed91ec5d0a3b9726ac9153e8eca2f9e33afd0e5afed7c5ee8f4934677453
SSDEEP 24576:9bmb57GBiOl6a8JTth/RWZvR6wQQ92pN3E:cb5+Pl6bJTIZ5jdgpq
TLSH
T1566523824A6B20CAE05B5779D9C9DB00F879BF57DE8727B6C67D0827F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 6b6aea1b64f1f4798a8ed449b81c22f2b6782793f1bd6c66d84d06e8a25fa6e7
MD5 f839f18dc847241f9e2c5cc06c55b3af
SHA1 a7920fb6d3392ef6911babaaba8660d2fb80d5d1
SHA512 1aeb6313e77b1911f299acd60fbc59e8f92bc5b9441aa2421ba5865980e69f1d47d5a637c70d4217204ae456fd1fbea1d689a590295c02669f74711de1c78671
SSDEEP 24576:tHmb57GBiOl6a8JTth/RWZvR6wQQ92pN3r:0b5+Pl6bJTIZ5jdgpN
TLSH
T1EB6523428A6B20CAE05B5779D9C9DB00F87DBF97DD8727B6C67D0827F234349385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 2bd67b24c6e9aaa7f93429b08dec8cb5417911808731c8e3a6fbfffad96bc0bc
MD5 55b3d4837326acd58c85724223811e08
SHA1 0ad9d4c3a5d8f6f1a47278bf602c49ac9e90c676
SHA512 538c77c965d347888490c2abb859d6add67bdbedf101f0ea0476bbab6f1033560446715b051c7264ee4ca79d71970bd8373949e709a597ccb3487cbb8201f004
SSDEEP 24576:RZMYzFVSOPmb57GBiOl6a8JTth/RWZvR6wQQ92pN3P:RZMYzfCb5+Pl6bJTIZ5jdgpV
TLSH
T111850295B36118F8EC67823ECD958A05E5B27C5A4B60C65F03B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 f81c5a54e6d741fa398bd3aa07c7bfc2bdd42904fb46e62575f505f6fe8cb4ca
MD5 751f52b8b4b7f60f56d24e43023938f3
SHA1 5edaba3ead00b15d32238d52d7779760b5115bf1
SHA512 89aa7af68d2f905638b75aa416b6419fec4619a9365b143466e2d47d993a55e4b87b87556e757e2221a70a0568f9993f299ac1189a228125160603295d9c86f7
SSDEEP 24576:Fsmb57GBiOl6a8JTth/RWZvR6wQQ92pN3w:1b5+Pl6bJTIZ5jdgp6
TLSH
T1B96523864A6B20CAE09B5779D9C9DB00F87DAF97DD8727B6C67D0427F130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 d3f5faa0c09456c0a3e66a8eb4f3413656d27b9589a4883b7785b5d82d451527
MD5 4cfc34efde9a59ffe383b14a782524be
SHA1 448391c675c4dcbb2c3a6b657685d7b621b3bbc8
SHA512 9c784f799513c00efd316d8a40aee8dbb09ea30e5b80d3fd262a4465fdb9d60acead3cc22ef7de72ce5fdbd8d1344dd05990933a03abe67c4b24a44bdb4edc58
SSDEEP 24576:fwmb57GBiOl6a8JTth/RWZvR6wQQ92pN3w:fb5+Pl6bJTIZ5jdgp6
TLSH
T1586523824A6B20CAE05B5779D9C9DB00F87DBF57DD8727B6C67D0827F134389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 012157ebcc98b1f472a964143044c914704296db1c90940b7e9c30ec51879403
MD5 951a37f38fb53e95e315af3842a4e1d6
SHA1 2643c939d7fc642afec29da15aebe4219026bc56
SHA512 aba85ca3fbbb4c88a691b06ff4fb07d09e97182230763ac90d373d2b68ed754c87185fca881bb55622a2b725e071ba9183bc131627c042199df3a4d3da5acbb7
SSDEEP 24576:qzyjmb57GBiOl6a8JTth/RWZvR6wQQ92pN3q:qhb5+Pl6bJTIZ5jdgpA
TLSH
T19975024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 f622292ac4c0f7f0a4305026eda96cf9485ef84e1a06443495ba757b364fe25c
MD5 3ac8f4a4307609128c1e226295ee36c5
SHA1 91f0a416be15067ab2681b9aa8e98c66fdf3e8c3
SHA512 4baf597682262b158c93d7b6e414cfa34b09592a47e8467011e6ca1e71ea4a9e466475e8138fbdce6f1724cf47dfe404c0435f5d89c7cba5c93d3ff0aac835c5
SSDEEP 24576:Lsmb57GBiOl6a8JTth/RWZvR6wQQ92pN38:Xb5+Pl6bJTIZ5jdgpa
TLSH
T17E6523864A6B30CAE09B5779D9C9DB00F87DAF57DD8727B6C67D0827F130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 1e4b0993eb778534f376c93c61645319c7845c2e5d47a3bfc82a756476cb99f2
MD5 ea69f886a414927b790a0a85c1e74a6d
SHA1 1e554a8a1ccaf91189b608855e85d4fde9e91358
SHA512 c583b359fcef124371aa5923c3ec85edaba4ad1f128e58ccb59aa9493b44f9972de04f9c6aa98f3da2f75b1c04835578cd3b07297177117b81819ed8e37a4bca
SSDEEP 24576:Nsmb57GBiOl6a8JTth/RWZvR6wQQ92pN3r:db5+Pl6bJTIZ5jdgp1
TLSH
T1686523864A6B30CAE09B5779D9C9DB00F879AF57DD8727B6C67D0827F130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 2ad86c3b2d81974fc52b035eb58c24619b69eed91a6b4e0f330e3b3a2c822d3b
MD5 41bc8fdb1d29ab5319b608f94ca43359
SHA1 562658ea9396e222a62a179dc648f0dd5d65926a
SHA512 1d928add5fc9519dd279117873b53bb5134481ef159eb1459836b934b0261953f10d9337e0973758e43bfc8e26606d7dd7b05be3db15574b108e0b45a28797a8
SSDEEP 24576:gzyjmb57GBiOl6a8JTth/RWZvR6wQQ92pN3j:ghb5+Pl6bJTIZ5jdgph
TLSH
T12D75024767A630F9D0679238C8D25B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 05e2728129ab45f99f354016a5f88b2175c4e08b5eb6d5a15685de0db4462d67
MD5 307745efbea5d255898ee2328ae24a88
SHA1 564abe2af6b6421838cb45f917db1bd31cbf4e63
SHA512 f2c94cf3e914edfdea07f434eaf50641f3c777708c260ae587851500c4d5140dc9b85e3b8821228efb916e6292d8e60b6b0bf9c1660abd0a3310d348f2617bd1
SSDEEP 24576:XTFaLl3z0zD5mb57GBiOl6a8JTth/RWZvR6wQQ92pN3j:XToLljZb5+Pl6bJTIZ5jdgpN
TLSH
T1B6850295B35018F8EC67823ECD958A05E5B27C5A4B60C65F03B8366B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 f36f9adbe72b7f88e3691804f39981e3ec7b3e16f28a3c5621e49297b6eca8b7
MD5 eef8b9777b0b1b4ff75fc3707e33a0a5
SHA1 46393a36053385763281799358b4270e55496932
SHA512 23bd4bb49bbe5e0bf397cbc29051c296d155c534cedf431320ac8d5cfb39bede7aab5b23cf40452f1e28f99896dab536bf9124045f6ac9b8f814e575217b669b
SSDEEP 24576:D32d9CHKy7GZ1mb57GBiOl6a8JTth/RWZvR6wQQ92pN33:j2d9CHKyaCb5+Pl6bJTIZ5jdgpJ
TLSH
T18B95CF90F3E410E8F0B79A35CDA68611D9B67C5A5B21DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 beacaf351b1b317936e09cc36c7dff5364723d98017c3caffa73c888e553dac5
MD5 16c88703652f0f60c74717216316488d
SHA1 9c47fc50bcdec1f7ba397f5b4cae4e274b2569e5
SHA512 badb82e0ae3da822164fcfdff7b85e6b21725124165612b2d50cf943c5eefeb6e016673e532d86d043931ebc268c15f65d318df1d6df573032f0822cdbf3b88c
SSDEEP 24576:BJmb57GBiOl6a8JTth/RWZvR6wQQ92pN3o:Gb5+Pl6bJTIZ5jdgpu
TLSH
T1226523828A6B30CAE09B5779D9C9DB00F879BF57DD8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 27eef7c8636aa6fee926726970337a9806a3deca4cef54a5450c9238d2b40751
MD5 351b652c8019dffcfb1be2f09aed7ad7
SHA1 a073b1a7f01ffe0214d4bcaae06e1d1681fa0f5b
SHA512 7e28ea18a50f782909b7429035443e05edbd0d6988705f92c88385b9b3d91af54c550cf28beffcefa6322d0c0baa133db9415bb1e7989387c1cab7830cad6c0a
SSDEEP 24576:7Dmb57GBiOl6a8JTth/RWZvR6wQQ92pN3v:Ob5+Pl6bJTIZ5jdgpF
TLSH
T1DF6523824A7B20CAE05B5779D9C9DB00F87DBF56DD8727B6C67D0827F234789385220A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 aff9e1a4e40160c54f0b5316008d716ec6c493b625883aaa488580c5e132229c
MD5 7124c04415231913b7f465efcf4bcd28
SHA1 04e12eeb4c4c4e13b2c6d3bf53af0caa9a3ed953
SHA512 05c1606e12797701ffc4979d85d57b08ce3bcd55650d86046ee6eecfa60dc24b4a45a3837a36b565710026c57759ada239a9725eb01f4883582741c96953a143
SSDEEP 24576:humb57GBiOl6a8JTth/RWZvR6wQQ92pN37:/b5+Pl6bJTIZ5jdgpR
TLSH
T199652382496B30CAE09B5739D9C9DB00F879BF97DD8727B6C67E0427F134789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 07e1fd7a99b0967a13280d128d3472a7785d5b27385ded0a8a5821b85863de7c
MD5 6a7c2aa11b9acdc67715568b199e8de3
SHA1 1fa5b7ebadcfbd639dcf4820e3e16a79e8678883
SHA512 9dee9b28c7385420962ed2ac6c04bf69abcff4f36bf617babe0e349f64feed94e900702afb5abe0ed6db07dfd7a6d7b31015f13dca2d59a53f11c5d96bcd6879
SSDEEP 24576:tsmb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:9b5+Pl6bJTIZ5jdgpI
TLSH
T19B6523824A6B30CAE09B5779D9C9DB00F879BF57DD8727B6C67D0427F134389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 d90d82c0b82458c20e7a7b135747507b608cde515b835d077e057c1a17d96ca5
MD5 6e919893b3feaafe9e5e1cf0df9af3e9
SHA1 baef53a040e3b029c52a5640ffd4e17a6f24cda9
SHA512 02c1f4978257a666e90353061f7b1c58886e8e9f847d51437682d2542cfc20ebc1746a8b0bbf766905aace74033faf35eb1a2de9e762f5de39c3ad9e04b5ecad
SSDEEP 24576:qJmb57GBiOl6a8JTth/RWZvR6wQQ92pN3a:Lb5+Pl6bJTIZ5jdgp0
TLSH
T1026523824A6B30CAE09B5779D9C9DB00F879BF97DD8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 bf91ee8c48511485dc0687696b37d2e86afa922d4a0dae2468f8f1653f4cab9a
MD5 d131b71d14eb3c80affde2b128c255c8
SHA1 21a5ce6755208edfedcdf249768804f20a7215c4
SHA512 41208f131a77bded56dc6a1c0b9ab7ae9dc4f4ac2a3c3bc56bb217b8a8d736d8d14b1325e5fdd9783f6a09b134cf16d854de0c4e4c3db863215a4feca6c1f530
SSDEEP 24576:/kmb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:Lb5+Pl6bJTIZ5jdgpg
TLSH
T1EB6523464E6B20CAE05B5779D9C9DB00F87DBF96DD8727B6C67E0427F234389385220A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 ca0aa7f48aeacfe63764c4596293fe072e112daaaaceb844a3c3523c2adef432
MD5 43ef2a2298c4cf04bd861c4153ab34b1
SHA1 b4613e91a71d9aac7560f2ace7eb2862b2e647ba
SHA512 5a08ec1e1eb4e8f972761eabee82bdaf02eac99d1ce5817b828ddebc565171d99608011434f431c4b324dc9dfc96ebef3e59d261bb0f8a5b95397f407e8edac1
SSDEEP 24576:tymb57GBiOl6a8JTth/RWZvR6wQQ92pN3U:/b5+Pl6bJTIZ5jdgpe
TLSH
T1AD6523824A6B30CAE09B5779D9C9DB00F879BF57DD8727B6C67E0427F134389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 4c691e23e4cc28261e4bab92b50c928e7f2194a015e23912f315224a2613a86a
MD5 686fa8a13003a99c6c630c915726eb38
SHA1 fd868d87f7f575455ffdac4e75df9234075da22c
SHA512 bab6ec4dd080d1c8d99c69e37808940cf4999f387f8f03ae997577baa7f5ede9a8e93da6ac9a51e49325647d203396b1bf1a8dda589956b8f8abd74d9c66c8df
SSDEEP 24576:XfwvEk9RX6wkyAIgmb57GBiOl6a8JTth/RWZvR6wQQ92pN39:JMnYIXb5+Pl6bJTIZ5jdgp/
TLSH
T10195CF29EBDC04E5E0B7923C99E7460AF6B178595B31C6CF026A536E0E33ED46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d66ec04f3231eace8aeff263de0193a609db726b8520f8aea19d03c210839597
MD5 10da0249db8c60202f14357ecbacb46c
SHA1 7b0a7a1cc502e729053e21daa6c5254da49e17c4
SHA512 ffc761340af87c2f37d78b001d1dc9ebe1ed4c0e926b2ef3df7f30c29a8c2e1e6ea0ff99b1bebed480cf7a3cb16b13023931b650c0b6e54bc828613e56a6153a
SSDEEP 49152:XYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0wb5+Pl6bJTIZh:5ySzPWslgJTIZ5Bgp
TLSH
T151066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e89e87987ac79f76cb9a4e689b42bd1423333d58b407e262eb5637c53fb4f2e9
MD5 9b370c7b1cdbc7a04d042e2c05b2d2e8
SHA1 7e84415f20bd823d17dcdd21b3815647bea85900
SHA512 7043e7ba28b0e85e40cfc316d055d30dcb3f84fdca3df90ab19ac0c28ff5936d297189aca3e724e3dd6704c1891edeb74c72d3d781fa025f20e58bdb613b1e73
SSDEEP 24576:k47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AY/mb57GBiOl6a8JTth/RWZvR6wQQ92b:k47JUQjairIhCnDHUPfF/gb5+Pl6bJTH
TLSH
T1A365AE1EA3EC01E5E1BA923885558A1AEA71782E5F31CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 73746ec308b50836e4d850d1d2b234cbbb7d9b21f0b3fff2fff34e787ce4798d
MD5 fd017c9e0c61a95845112a34e538cc8d
SHA1 4b4eb992fd8b240914136a6ae773b7800c68ef33
SHA512 64b432561f2a20436d4fbd43704d06228ac045b3a95cfe825b655542dce5066bf746ba223e1d3256927d380bffe0f89d0f10e03596d1f9cf34a1f0ff04621516
SSDEEP 24576:28mb57GBiOl6a8JTth/RWZvR6wQQ92pN3w:ab5+Pl6bJTIZ5jdgpm
TLSH
T1EF75F14AC29811D8D06F6279CB858A01F7377D658BE293DB46E0F43E1F366846DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 0fbb1630a0f63f9e89df9174f10b63f481626ae6c2e755771f514cc1ec3a8a39
MD5 5c59ae3dd67fff339c03ce30e0bc52bb
SHA1 a69f831a4128b0bac3d2b8a9e854653f9a9a7c63
SHA512 99726f79c67876f19092cebb437357b76129b95b2f787ae78b3848b2f92dd3d547dc0400119878169d7b0e434ac514cdedaeaf3e18854bba52a1d5b1e14a473f
SSDEEP 24576:30mb57GBiOl6a8JTth/RWZvR6wQQ92pN3d:3Db5+Pl6bJTIZ5jdgpD
TLSH
T1326522428A6A6086E4BB5778D8CDD710B83EBF65CF8566E7C529142BF1306C87C7230B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f82dccfa6fc11d08cf5dd4315eeb9c9ee5eb7b97bba8fc56bb89a4e74d8e1cf4
MD5 790b5e36dcad59f73d640906da3da5ac
SHA1 fdaa7c2ade9d5c48f5471dbc502373c4fb54a720
SHA512 5f9b2a741eff6a2a0467ca1f7c776b695a282c2a327e2158a70fc0ad0ca2b1436cc95fe74c17984722f9f57a5f4f74fb0858b3dcdd8b539678db6a2a0fb22453
SSDEEP 24576:Vgb6bmBIi49WNNFpg1rSvFv7bYWmb57GBiOl6a8JTth/RWZvR6wQQ92pN3a:Vgb4mBIBhGF+b5+Pl6bJTIZ5jdgpI
TLSH
T142659E1E22EC02F5E0FAD2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 c9624f3fcab3c500d608d447f71c478e78f897bf687d028ba793195752047e78
MD5 ba8c0a032417e2c1fce6d2d054cd0d88
SHA1 032aebeeb436317f507f578cd4e61a59e46cc3fd
SHA512 f231f652a825fce500ed2755bf5236618ff400c74ece69bff2de664fee5cd3c0bbd62fe9e6a22ca16641fc306819ad515ca9ccba27f35419936c9ad43cfce079
SSDEEP 24576:6G88u8FpJqH1Mzria7/mPmb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:B7ZFPqVra7/xb5+Pl6bJTIZ5jdgps
TLSH
T10495F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 e84a151fb8586e9e7120853f56f3c47a91529500e44a5725cfbe629c6493087d
MD5 2ac96e48e8a50371847e6b96b2c4268f
SHA1 4534dbf50a3f897b8b1992ff7966025782e07fe4
SHA512 9a51668c1d5a5e8eecfbd230428496e2a24c6fdd4de1b41576d82ae2ae10cc72636471f81c42d37804643a695542a063a614ee926da2edd13d6f831fa92902ad
SSDEEP 24576:2PUr+NQLmb57GBiOl6a8JTth/RWZvR6wQQ92pN31:2JQCb5+Pl6bJTIZ5jdgpL
TLSH
T17275E11F26AD18E5E57AA17DC9C68709F771B8624712A2DF02E0813E5F23ED87C3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 793f78196421a0474e12e02ce0af2d82df06f339f7efe5abeb379731cc4e35d0
MD5 ecad7c72e482a4a1de33e394c53e8557
SHA1 54b9633ab7959ef45471c95cfdd0422e3e00d31e
SHA512 a2b7231d36ab06415da85b22118910c73ae8ed411c668855a896f4a4c8f78574a3dbf7d9c11d0e4583f9162c908439e9a446a53dccf3d6ab5d1dd0663faef8aa
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjSb5+Pl6bJTIZ5jdgH:5G05lO43bTslgJTIZ5Bgp
TLSH
T191D5C06E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 190a6b41425c03418f1ac78e5a7d4ec482a6d0d326572d5030ed285d15b51a93
MD5 0a7661efc39776b674ed2b6b739e4cbc
SHA1 5c8b5b73bbb55cafe3043b85173d6375b588b541
SHA512 6af4136c639a8cab91a749f1f9befaca2a7cfbd90f7e9899f09d5c745d34a46ed8b103446e8e045fb3ed43f69f7ef4b73022acfec9fcd7bf3c9e27ce417cc5f4
SSDEEP 24576:3fa5POZ3dpuWVM50JicR2hG0lasx2+47eidntmb57GBiOl6a8JTth/RWZvR6wQQV:Pa5POZ3hJt2pasx2+mab5+Pl6bJTIZ5/
TLSH
T19165AF5EA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8f5686ffe032f1ee0f4d1f7dbc221b1420651c496cf2d918a1f81fb89b25bdd4
MD5 d99b5832183a04174c01ea8f13b75c29
SHA1 631e3ebe17ea8936b4b81b75c14b7238e74eeb17
SHA512 d27d80ca2af12f396a5ffe52c587d8a5e807d990811521b1696d8abd1d0613b78a16316a97783d20ed8802ebe2b919b693f2f354b53fe4b16fe39ff1b035ee3d
SSDEEP 24576:FNcwHdjbyQ4nLC18lb/EOjowL7FkXmb57GBiOl6a8JTth/RWZvR6wQQ92pN34:FNc/zEOVHFRb5+Pl6bJTIZ5jdgpy
TLSH
T140858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 ce2445b368009242ba60ec7459e02c7681675a1e85cc2fb4059941e93bce7429
MD5 921b4a4fe789d19ca16bf2357d82a552
SHA1 68fdba5760510459ccd5c7b3d2fff39a8da9545c
SHA512 5395d5e7838e2dd5addecdefe4b0cdac6e2b08ad7bb7c9e03c177c56a63afdb28a77d6164cbca412368337c3a47a43f3cb02832a0228c7d1bdd5a78c137d07c6
SSDEEP 24576:CaDIMLrQj/8+QYVkxIktdfCyqQnGPw2D6Lr4rHGJo:CaDIWu/rkxFdXGND6L60o
TLSH
T11025129C33BB21F5E16BD07E86830113E2B2B471872259DF42E985B95EA3DC5BD3CA41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 5169b75c238a699ec8e9666480c4a16aa88b585dfe9866521e27ca11b069846f
MD5 45d5adcf6789830e79e04edb0b03c132
SHA1 31f01c40f65334578f81f14889a98c57361ede47
SHA512 6acb6cfcaa56b657d57e4a346af2425c669b37028d88db4e9b1e6924067f1e61bb34c23e654996a353eb3f48ad28ac383912f38f4125de55e9507528820531f9
SSDEEP 24576:FD3FHshBIYQgAomb57GBiOl6a8JTth/RWZvR6wQQ92pN3u:FDVHeBIAAfb5+Pl6bJTIZ5jdgp4
TLSH
T1B885E17ED65D00E4E47BD27CDA938A06F67138A9472266DB02D481BA5F2BED43D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/292-71-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/292-58-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/292-59-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/292-65-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/292-69-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/596-303-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/596-96-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/2940-143-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2940-145-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2940-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2940-137-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2940-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3700-73-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/3700-74-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3700-80-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3700-209-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4160-324-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4160-124-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4160-126-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4160-132-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4412-328-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4412-160-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4412-156-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4412-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4500-120-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4500-118-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4500-327-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4500-112-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4500-325-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4500-323-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4764-342-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4764-99-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4764-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4764-340-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4764-106-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4764-100-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5072-14-0x0000000002AA0000-0x0000000002B00000-memory.dmp

Download

memory/5072-7-0x0000000000930000-0x00000000009B3000-memory.dmp

Download

memory/5072-9-0x0000000140000000-0x0000000143A95000-memory.dmp

Download

memory/5072-29-0x0000000002AA0000-0x0000000002B00000-memory.dmp

Download

memory/5072-1-0x0000000000930000-0x00000000009B3000-memory.dmp

Download

memory/5072-0-0x0000000002290000-0x00000000023EC000-memory.dmp

Download

memory/5072-44-0x0000000140000000-0x0000000143A95000-memory.dmp

Download

memory/5072-27-0x0000000000930000-0x00000000009B3000-memory.dmp

Download

memory/5072-20-0x0000000002AA0000-0x0000000002B00000-memory.dmp

Download

memory/5360-152-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5360-47-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5360-54-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5360-48-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5928-40-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5928-33-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5928-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5928-35-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/6092-84-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/6092-86-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/6092-92-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/6092-279-0x0000000140000000-0x000000014019E000-memory.dmp

Download