Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/10/2026, 10:31
Behavioral task
behavioral1
Sample
2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
General
- Target 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe
- Size 1.6MB
- Sample261023-mkl32scf49
- SHA256 8890ae3c28d6d9a29150d61661bca21170025c92a03e6ba6ab94c297c8b30f48
- MD5 7be0c0b80d00bd308130dd9de1e2ffeb
- SHA1 b53dfefe3f80b6cce4ab7a548a6a8fb39223fe2d
- SHA512 60114fa1d665aefaf902df860ff33159b592df54790e983f9cf7c4dc45c583c210e8e66447386ab0e9f559f9797dcad5f54154d6b5857aba61f2b2e0b392f4e0
- SSDEEP 24576:HDGW7Th9u9w7LDXnQ/tbw/2Mkjy6Fr7g0oA:jGIoIDXQ/lFTjN4
- TLSH T1D475EF04A659B4D8D02604F788C2771DAA36BE4472C05EDA3ECE72756E367E0EDDBE10
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
2cloader
Botnet
-
d4faab834f3a2625be81ca35628d47ba
C2
-
https://aware-cr1.com/api/beacon
Attributes
-
build_time
2026-08-03T09:21:10Z
-
inject_target
dllhost.exe
-
options
ppid_spoof
api_hooks
-
payload_name
default.exe
Signatures
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe - Executes dropped EXE 11 IoCs
pid Process 2900 elevation_service.exe 1728 elevation_service.exe 4108 maintenanceservice.exe 2664 OSE.EXE 1188 PerceptionSimulationService.exe 4356 perfhost.exe 5928 ReFsDedupSvc.exe 2448 SensorDataService.exe 5664 ssh-agent.exe 2956 AgentService.exe 6084 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe" 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe Set value (str) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe" 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe" 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe Set value (str) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe" 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe - Drops file in System32 directory 41 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\80946f56c17a6531.bin elevation_service.exe File opened for modification C:\Windows\system32\locator.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\vds.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104140\javaw.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104140\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe elevation_service.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac59d5f6d962dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d659beb4d962dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000505633f7d962dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000003f8dab5d962dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec015db7d962dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018ddd4b5d962dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056cdb6b6d962dd01 SearchProtocolHost.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1316 schtasks.exe 4872 schtasks.exe 2516 schtasks.exe 5912 schtasks.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 2900 elevation_service.exe 2900 elevation_service.exe 2900 elevation_service.exe 2900 elevation_service.exe 2900 elevation_service.exe 2900 elevation_service.exe 2900 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe Token: SeAssignPrimaryTokenPrivilege 2956 AgentService.exe Token: SeBackupPrivilege 5928 ReFsDedupSvc.exe Token: SeRestorePrivilege 5928 ReFsDedupSvc.exe Token: 33 6084 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 6084 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6084 SearchIndexer.exe Token: SeBackupPrivilege 5928 ReFsDedupSvc.exe Token: SeRestorePrivilege 5928 ReFsDedupSvc.exe Token: SeBackupPrivilege 5928 ReFsDedupSvc.exe Token: SeRestorePrivilege 5928 ReFsDedupSvc.exe Token: SeBackupPrivilege 5928 ReFsDedupSvc.exe Token: SeRestorePrivilege 5928 ReFsDedupSvc.exe Token: SeBackupPrivilege 5928 ReFsDedupSvc.exe Token: SeRestorePrivilege 5928 ReFsDedupSvc.exe Token: SeDebugPrivilege 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe Token: SeDebugPrivilege 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe Token: SeDebugPrivilege 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe Token: SeDebugPrivilege 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe Token: SeDebugPrivilege 2900 elevation_service.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 5392 wrote to memory of 1316 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 100 PID 5392 wrote to memory of 4872 5392 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 102 PID 6084 wrote to memory of 600 6084 SearchIndexer.exe 104 PID 912 wrote to memory of 2516 912 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 107 PID 912 wrote to memory of 5912 912 2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe 109 PID 6084 wrote to memory of 4324 6084 SearchIndexer.exe 111 PID 6084 wrote to memory of 5880 6084 SearchIndexer.exe 112 PID 6084 wrote to memory of 3108 6084 SearchIndexer.exe 113 PID 6084 wrote to memory of 4756 6084 SearchIndexer.exe 115 PID 6084 wrote to memory of 4880 6084 SearchIndexer.exe 116 PID 6084 wrote to memory of 4152 6084 SearchIndexer.exe 117 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe"1⤵
- Creates a file in the Startup directory
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E590DFD.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1316
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E590E2F.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4872
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2900
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1728
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4108
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2664
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1188
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4356
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5928
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2448
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5664
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2956
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:600
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:4324
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2764 2952 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:5880
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2936 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:3108
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4756
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2764 2952 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:4880
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2936 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:4152
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exeC:\Users\Admin\AppData\Local\Temp\2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid.exe1⤵
- Creates a file in the Startup directory
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E592B90.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2516
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E592BDE.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5912
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 5a3cde1d2ef1357d93d8f5ff17628c294899cd4b4d4a2895137f4765fe219b2f
- MD5 838bc3a36ed85a2f79f06b7fa9123a92
- SHA1 be5a5500f5acf86e6b31ec6885a5f14c70ec6636
- SHA512 ecb5c88a3f2f809f34d9e76b6a2dbe679861270ba1da62e7607be4d4d5dbe9be7ac0567135f014e3029bfb886bbfe2cd69f6ddbaec5651bb1c07dc2a7aec1f28
- SSDEEP 49152:Sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxndQ/lFTjN4:03q6HjBdLm
- TLSH T10FD58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 acc4b0e6b148b37b0fae040fecb5ad905318aab629189b0b6dcc50de9d374d05
- MD5 886126660d049838a0ae1235cb3e9138
- SHA1 c66afc226b166cabd3c4aaac10d9049ef9c6960c
- SHA512 0574a2aa7e573bee2e44e8bb1b8f99e38534d3294fec052a7630a9b1dbde29a5c70cb8725f6ee53674d9c1dbc17b5491a14791e1770dd3ff38f3b7bc28864770
- SSDEEP 12288:l1XLsswWkxy2lRq2czAmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWGQ:rXYfDtczAGnQ/tbw/2Mkjy6Fr7g0oGQ
- TLSH T15465F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 1eda3567fa34cd0a12b6270836f1db4adf4f2efd8f6e34425699ff755e5958d8
- MD5 725cd9e5ced1b27a6bb2aebfd2b4371d
- SHA1 7a04d73267e4d44f34a2d0067a682fe1b4f9585e
- SHA512 b06097c6ccd61d0e548991966a87c0fa5b07e6bbd15479050054fbfb8466611f3872d36854bb95cc6393e7dfb1de6fbc0d5cf5a7e8b9c2ecc971a395197b6206
- SSDEEP 24576:a0Le5ji0hmxLrMVnQ/tbw/2Mkjy6Fr7g0ou:aPji0AlkQ/lFTjN4
- TLSH T1A9859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 20b0dffa12b4e89f4976fefacd1f8bc8d3719b61da6bf5888f2ee3ab4e1fd4ad
- MD5 2aa224ab774ce54eea848c9aae91aae9
- SHA1 4cc72e6cc83440c96c0438b49f8e73ac1e2fe7ec
- SHA512 1fb5f35e96c786444e0bcf0feb9da363452bb98d31ca2c6ee8ae0146f14fe7d5ef525ef12b69d64d7e83da080f82dd1aa505c8a091958b1ea05d82625c9730f2
- SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWE6q8wyuPnQ/tbw/2Mkjy6Fr7g0ow:n/ezSC6vUzPvxHjyoQ/lFTjN4
- TLSH T164755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 4af6e5e22a564bbb0480e267ba583ed401e54bd549a8165358a5837547b66125
- MD5 1f3c25bad8cd9d707c2faea9e2abeef5
- SHA1 164f059a71886074e1d197343c58d62a911a38d4
- SHA512 eca022c94ecc3ff3d2577a052fa66d69a0d2ed03f2be2c7ae566d32ff5a9a8ca2a57045d105176815d03c0eeb7dc18c01602d41e2e62070af2626d47e34bffb5
- SSDEEP 24576:kVbqPb88hv/l+6inQ/tbw/2Mkjy6Fr7g0o/:kVO88hXl+ZQ/lFTjN4
- TLSH T18C559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 51f0ea38cc4357cf7abaff4c2af4fdf717fc160009598619aed2b0ebab7b3d71
- MD5 683444e18d2f194f956854591dfccf83
- SHA1 cf0db121543b605966d72a0f4d5ca165c5b952d0
- SHA512 017a9f575c8cf1e3a6289d68d875a8dea91a6ab6816a12b0444f639f3593886b97d95eca76c984324518384cb6dcf2b3c9ef0b393ed42d443aa22428d0543fea
- SSDEEP 12288:vzxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:vzBnQ/tbw/2Mkjy6Fr7g0op
- TLSH T1245523696A24F89BFF2B06B15C8384826B7B0EC1BFD4A74E7744362D857C39446DB381
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 ed50c64cf42d420a7cd57e7822fb30e82a86dd32f1b6f1c19519d072c4aa0fe4
- MD5 d018c8ec701f6a0d7bc3cab83dcb18e2
- SHA1 99c2df714401e114f556e3bb9514d0c700d37290
- SHA512 4e5df67f834239b71284d2f5d2612305a03e64a9ed2e9db6389967a896ad734f477568de3b13ddd90c39f807d22685895e5db086db517b7ba8be5b9ef0f2307a
- SSDEEP 12288:XeBNUbTVO86UaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:XJIUanQ/tbw/2Mkjy6Fr7g0o/
- TLSH T18B75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 ee2fc037e9ef1cf082efc178c2c59f53b5a77eef14eb4b76f76af79f6aac67c4
- MD5 3a77d90fc393327378393cd1dfb92884
- SHA1 c8087f418685d1ff82c1111b4e2a32ebb0f347ee
- SHA512 9cbf59f74d8f103a49d372116d3baa740a55bc287bbdfcab0eaafd78c00904e4819db5b623cf9f99180c9215c6f316c70126fef1670a126b2bc256120915ae2c
- SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THI:bQvGAdlCEL8c/yRNw5CULm
- TLSH T13D267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 aa1ddbe843e94a1ff0c78f60125c2369a7ec2ac99bb05adf8cd7f56308ddea83
- MD5 a879d08afdbf30441f757118c6496b50
- SHA1 a301f2f8bababa4e88b08232c1d9419db21fd950
- SHA512 c6bab1d8e5a7b6b383c14e1bedb712cab13170152b85a35d40b0095badfed4d7185fa003f1062b1e5eb1df1800878b803215cb9004c87214b12d753cc622780a
- SSDEEP 12288:6AwSfxL/2Dc39DLLmt0LDQewsAjUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgE:PQewsAj0nQ/tbw/2Mkjy6Fr7g0o2
- TLSH T12F75E031FE74E436C77F0DB21B22C706583D6A604FA11AC3E3A84A9D99342D22776B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 cdbd33b0c922592968157e78088e3344969439913736300ccba43a6c4eab4724
- MD5 8c98d5630bfced8352a77cc5eb170ea5
- SHA1 d7a1dce669c7bd3e9479e1c6f0ff64adc28e3ea7
- SHA512 55585d1d41439f504487538c8a3ba264133546581f2b2cb63e0939c6eac4fa3697620fa0ddd8a5ceefc57e085b65a234f826ff0620c18923dbf93de38dee9ab2
- SSDEEP 196608:TUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHfL:TUEtQevvqc2W1cpV2EI32
- TLSH T17A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 a8e15a8090194f5b6c003e89d3775a60c1def707240b1653b7f55acb2c3e90a8
- MD5 8a216be79f39e525f203928e1b4b31ff
- SHA1 5610ad8dec4ee70414b5aaa414bec59ca65795b0
- SHA512 4954a9c4c78978775fd4ad2ee9d9d65e5fd35aaae184b7020d947170d211c660df65c716cbdcb54220df1b2d1f3eaf778ae32135c997e22212cd97ab20947627
- SSDEEP 49152:jCbRquA/m2yL5zQfFiV+XenmE3/zUQ/lFTjN4:coqtVjnmYLm
- TLSH T151D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 d977aeb9e62ebc333b3fa3f290badd7829fc17d7c1083d1c7732daa3dabbfe68
- MD5 4f2bed5d94a044986eea7583de795988
- SHA1 4726e3a50af7001175a4a7d28a79021a38c43db2
- SHA512 9f31baa03992dbf51b8469fde5545baee63363d6859adc0c9a56e50759cd6185fee40d12ac67b688931a9141639fa2b5d5fe188ff43ee88bdb802593b199e4a8
- SSDEEP 24576:hAhGLJIFoiwtA5l7S53TnQ/tbw/2Mkjy6Fr7g0oT:hAMyFoiq5DQ/lFTjN4
- TLSH T1CC35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 04484bd97ab2cc3633b9775d73dddb13d6d92a63ec997a7b69c9241cdf3f3614
- MD5 63c55cd30e8d8aa31790c26db1b49d2f
- SHA1 4430eb4227f4675f64de7d8c9f4bed8dc41bc809
- SHA512 c018bc615b0c3c96697bf74e21ff5f3d7ca939283417f297e3b5a16edef475b23bdcb81e3cdaba6c52f6e5cd93207d49d8c876aadcbda4953abd4c1e1ef31fc1
- SSDEEP 12288:+mw5HEjsChN2BFgl0WDm+CPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMn:XwuHOWInQ/tbw/2Mkjy6Fr7g0oC
- TLSH T1B765F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 b5cbcd1a7d1af043d34d675483ed5dd5dade46608592a42d9ef6fc143d8d2155
- MD5 bef9e5146955f0661aed318551ec283a
- SHA1 0c22963e4b6f05fd83e0d0a16078c575ea57ede8
- SHA512 d19289752f96af840dc2cc570987f04995724689f74fc53b7defcd1c7e0f49b447516a84ca040412c6eefb1fb9cb7a322f021a0f2c35e2c5677d0754f5404c58
- SSDEEP 12288:kXZ1IykGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:kZutnQ/tbw/2Mkjy6Fr7g0oa
- TLSH T17555126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 44d365a336872be4611d0ab50f9a0b292c9c519ac4fea67c09ed01c70df694a0
- MD5 efa3f02a948f2eed18b9229d0900dc9f
- SHA1 d018bc59d18fcdf71a2cfdc2a69dc8dbe271e8e9
- SHA512 fdd8312b1e35a7f6937ecfbbfa42d4ca5f22168695a0a6624b5946748076d8b9819d85f8150ed69ddcdb6a2bb31a895fe8439d2ddd4e60888e13ff53a8841e71
- SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UE:NQRQyi36YOcPQLvw2gAf+PN35Lm
- TLSH T1E8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 e911eef5c244a4637d4ee25e1438999eb8d4b277a192ce86072b568c6184cf50
- MD5 c315087523172e9195e2c74a6351e812
- SHA1 77ca0139c31a80568ba22595f510a124763e4079
- SHA512 a51841eadfed3c2318693b2422393a03512dcfb49b5324b7562a201cb566fc37cbf1e8a82594a9078fe11f37cd523fff215d8b4207cebe1195878c46aa58619b
- SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UE:vQRQyi36YOcPQLvw2gAf+PN35Lm
- TLSH T199667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 86a699d6ebeaba71144743bc72d8bba475b932d1d7fa09260af971d5d53d6d1d
- MD5 1cc426a42b5941f8c33497cb1d610982
- SHA1 64e79987302f317d3d36c59752f5945f66d96815
- SHA512 9153f4d2107127b7da362c3cda5a6dde45c1b12a5c482942e9ff3d6c1fb6986733b8642f7cd4f0f06c5f8af194690a1b8a3156f0febcbfc84460fc0752ee997c
- SSDEEP 24576:lwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0dnQ/tbw/2Mkjy6d:B68Qg55nhheWu7PNU3/kQ/lFTjN4
- TLSH T134B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 eb37aea6e0783c85a302dd190aa6b584d0170236d9b1a71318c9706496a469ac
- MD5 df24792e212aa2effcac907744b78dd2
- SHA1 7e59e6b3234732108fda8b863b324eb3b9f710e4
- SHA512 cc112fd06c7e66e8a36bce28a60e3b9f21452b8f90c9f4d04f1909d67c1d4c1d176df8465dc40303f79292cb01fe17ed0ca4aa36f0420fee432329a1294e2dba
- SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk996:Xy5112gYy5azzVvL69nLKnhZmLm
- TLSH T1A2167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 a639000f84157363650b708ddd21b5ff32935ac81a441017d852436b8b0db74d
- MD5 9a6036d9380ddda611e63e84b1aabc4f
- SHA1 5f0492b1f22c505682227fea6d45a74e408b334a
- SHA512 70d57376ac3a414b35bd4c5fc8b584b614149adb9d85b3faaa9296b826e41fcc4a2511e6d13d9ee1a1a3893a3ddcd9a32e06b2fcea7a2a11152b1000f338c633
- SSDEEP 49152:iB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl2Q/lFTjN4:Qu6JmVxd2dBLm
- TLSH T1B8D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 6f95562c53293ec6d7aeeda6d008a4a4c7e1344f7f1ba5995afe8c7144474a26
- MD5 e20a07f56a84ae987835cef8be808376
- SHA1 ed8106cc1006e653acf420b6c4de9571ff36e1a2
- SHA512 0db4a8436664b0a8d0710edb7af4d91dcdb2123da3b7d0153eced9652235edd789529816856b760be9260e5cb5e5a399f96afd2425f106b65a9f7ca3c7782747
- SSDEEP 49152:D1hpsNoJpF1A6UU44CwH7R4x6Q/lFTjN4:DmifPbRYLm
- TLSH T1DDB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 77e6b4a7fef63dd71117d2f88fbf1e9dc17d20eee1a6e002f6c1c32bc977f990
- MD5 1df6ab89428683a08a0866a852ec7ce0
- SHA1 971a8e2b918fb459c9d3f77b5731ed7646ddf0a6
- SHA512 b2b76439b8eae831c6f58e21ef187bc63b331836e0da9e89d076a671c88fa100062740cd3de9688d404454a5e8359de78410578912bd73791706937e56d0502f
- SSDEEP 49152:pSuZQIY0Be2KRRVtOnks6NMHqtQ/lFTjN4:n5dKTi61iLm
- TLSH T152C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 156843ab986b7e645d4f0547a4cb2aa7f38d9eb4133af40a66c1babf50f14668
- MD5 d854e72cf55431e2ec3478b23b80b883
- SHA1 1da5f43f93d043b8d4b45ba7aa9c39b4a0ee0384
- SHA512 00250ee57845491d3bff192cdd7b9a54688870119218280201520aefd0b280476ccfafec04ab5c0b3106989d75e273d920067db6e3312a3175ef3b44629b08ff
- SSDEEP 49152:bhtSn8EApI0figngiDn0AP5wGQ/lFTjN4:6X2iyphMLm
- TLSH T1E395BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 bac17db197cde40baad9e16c6201845a808d4e3e5736c6f93ee102268ed0a81f
- MD5 91904ea620113a9444b28497ad1ad138
- SHA1 566cd89596882df8f6895416a7e49140e47ad00e
- SHA512 22a84c18b0660fb9f2720e84404136128693cad4367019542cd10f355d41ce91c39e98f6000aa346b82970d838439ffeec79a229f243b19587b4be71b7b70f26
- SSDEEP 12288:FJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:FZnQ/tbw/2Mkjy6Fr7g0oV
- TLSH T1245523697964F98BFA1706F18C828182A77F0EC6BFD1938F77482129967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 352853229e502b84172915a6b891eb93cbabaff1366c19b431f6818faa159b3f
- MD5 233d8c8fe66222cd63a80d95d48eee9d
- SHA1 9108d1d62be7e9902b75ab72e477f75e9f543c65
- SHA512 1da591ebe95df98fe8c4d0cd0fe3fee80e7c246b36f5bf8aa3a12e1d3121d952d8c54c26df34a9a76e589a572fae8f9633c059d4c05519b053397687c7e3580e
- SSDEEP 12288:VQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:VwnQ/tbw/2Mkjy6Fr7g0oV
- TLSH T1485523697965F98BFA1706F14C8281829B3F0EC6BFD1938F7B482129967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 9a48d260c3a8650d0d6fef6649b3432452073e9f081fc278705edf535de2f395
- MD5 c097aa91264312904cc98fcd35a14d7a
- SHA1 72654c377ece2caf3a758ef059d23628bfd83dcf
- SHA512 edda765882957fdb1e5197318a91dc66566e919ca42d39ca3db31664d641b589ad48ccbb1d22c53a52561cb68ec629878845737c894f6142ee70125f0f9e4437
- SSDEEP 12288:pSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:pSnQ/tbw/2Mkjy6Fr7g0on
- TLSH T1515523697965F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 377f9ae40eb68dba685d71e1377acf622857143f173213bfaba02ca986e7cf73
- MD5 bac4534f83d9eafb425b258b5c62dc69
- SHA1 bf4c7b59ff939bed8cbcb7a117c18eeb858d9e21
- SHA512 b03dc522ece26cb5d623a909acf28c555a3c0db91a81ac3aec33359645023659e649f75663410074524179ab874edef65acc8fff2dbbf7f235d2235adf9dcef7
- SSDEEP 12288:XVDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:5nQ/tbw/2Mkjy6Fr7g0oQ
- TLSH T1CE5523693A69F4C7FD2742B4CC938142E7BB3DC5BBA1A38F6B04111D4E793D419A6B80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 787f9c824824bfa629e91c484a3bc50f4c7d3a1f762e98d941278b8569e77525
- MD5 30a7f4581aa9b0def628c5a27fcecd3d
- SHA1 a82ce66b1ea3d21caad142657dc4747cc6df223e
- SHA512 1d35e840234e442a5a65cfef3d8ba61121f22873d437864612d64c7bb482607f33fe80f36929f21724a591627575e5cfb4392a9728a5454554e6358292fdbd8e
- SSDEEP 12288:JLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:J7nQ/tbw/2Mkjy6Fr7g0o9
- TLSH T1E15523697965F98BFA1706F14C8381829B7B0EC6BFD1938F7B481128967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 16946147570754586cfb681efdbdc6626708e423b6305e4f925ca75c308b8b15
- MD5 3c7f3ff505e7cbcfa0991c35d726645a
- SHA1 3b2f833cb7a0771005f7de9c23aafeca0d3fefd0
- SHA512 26f62175b0e19660b324180746e9d168d01b9644e309b3bf6f04e865e4213783bb021ec672f025c6f2e6f065a18650b23aa0ee721b873cd45f657d8c2c662a0e
- SSDEEP 12288:pMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:pMnQ/tbw/2Mkjy6Fr7g0o9
- TLSH T1F15523697964F98BFB1B06F14C828186973F0EC6BFD1A38F7B481129967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 04187cfb6b1cfefefcc9f4f0ab4ffd663c07b3bf72185702fa74f9d56e4924c0
- MD5 0cc91936fed58f4ec552d2fb73a9eb60
- SHA1 e02a5e5e9394c4c02642f1eabe036aa300affbc9
- SHA512 2a0f81c9e1f6f50833ff963cc7e960161e014bfaa6d9888f61fd20b555ab2f2177d414d54fc4afb87da548f3b9ae0f2a84319a85d50771f23453f650ae2cce14
- SSDEEP 12288:z4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:z4nQ/tbw/2Mkjy6Fr7g0ok
- TLSH T1E35523797964F98BFA2706F14C8281829B3F0EC6BFD1938F7B481129967D39416CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 7f9c2bb0d03da732880ab4fb725f41d247777bc2eeebd1123fdde2507de115bd
- MD5 ffc0bd1e14d82a1f8387a08ab2b54286
- SHA1 0cf64b931d74d441e4afd9a19397d33401b9a6a2
- SHA512 266668e3fc5d19f2552f7e364b268a251af24b43dab37967c2120f34194a115eb586292a2dd3afd64c640f6dc519e083c50ed67a955f38d13a9f70468a6f40bf
- SSDEEP 12288:riZwbDzzFEoS2cPvywGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:WZM3zFVSOQnQ/tbw/2Mkjy6Fr7g0oG
- TLSH T1FF7501A5B35058F9EC67423ECC528906D7B27C5A1BA0C71F13A8362A5F373A01D3EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 57b903ff121b9f5df4076fcdf43a7aea201866c6d486158e37d6ce4a5730a198
- MD5 9f0bb0aad04ca00888cb8e9954b91a36
- SHA1 da550b74ffd9527fa4de77e474dce49252afbda4
- SHA512 6aadb63161bf0bbbd71f371111111f64970adf731c73022fb643bb18cb327d4296f8a8e0f6901642f718d29959502810d471bc960920a34704ebbba71d88de30
- SSDEEP 12288:jdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:j9nQ/tbw/2Mkjy6Fr7g0oa
- TLSH T1E75523697964F98BFA1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 4cfe2bb058df2f1781c09b67efaa87f6cf30e079e50d03b1baa9ff1f4075f7d3
- MD5 40a5ad0c768203e3076ebf1f4c4eae4c
- SHA1 0b18a3e3b437684d113aea3f3e74406ac3ac4429
- SHA512 ffe08844ee7048ad96b50baf3c4670aba904df5d552128ce7d48c78651ecd86cbc8a547e3ed79e1bba3808ee2d81ad06f41f7669321ec0751c638f413e1bd871
- SSDEEP 12288:wBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:wRnQ/tbw/2Mkjy6Fr7g0oa
- TLSH T14C5523697964F98BFA1706F14C8281869B7F0EC6BFD1A38F7B4C1129967C39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 c69f20b83ca96ba4816ab2cdf27a84386223f2523e27b63d916474f4eac7f75b
- MD5 a90d7f2feed97e739b43a574fb3d2bc4
- SHA1 4f1475fb1ab3024b34ec95891a1debcc6c051c45
- SHA512 9b2587c87761e302b70d599dd4382d4d81edb1ec88b78d8c9833b9992bf8a32da3b9574ef78c3595c0de944bd6b45f32533d8f65a1ab608fb3838001d5913c24
- SSDEEP 12288:dyPz5L8kGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:UzyEnQ/tbw/2Mkjy6Fr7g0oE
- TLSH T16765021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 dcb3ad2357faba54eb53d2a507543ace0cd123ec97eb71099be1c1f461bd9f4f
- MD5 8a578f4e9d72a41dafe32fb812c4dcdf
- SHA1 db1c0de69c52332fa0e5a8ad6eb8e9957ad80073
- SHA512 ddf7326198df80a6c5f0f8608cc86a48c03de6f27077a326b54bd2c4b4e9347691903bccce69c7a13a86673a3edf7ac62aa616d88186ad7867f4a078f65e8caf
- SSDEEP 12288:9dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:99nQ/tbw/2Mkjy6Fr7g0oy
- TLSH T1D05523697964F98BFA1706F54C8281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 2ab3c4f6c9dcc1ec16cbab707498f1843b15322ad5e0a5c7d3f7f37e39e30fbe
- MD5 d359857c5a03d9b3ba6be4bbf5476ced
- SHA1 cbab7d9ae10dd483651a19681f21898caeb5dcd2
- SHA512 6982137118d17a40569ae5b22ed94fbc0d424df46769a4faff388bdf69792d6c11f54b4a93ecee0cca2b3ca938ae2b833987f20ca8765f9d32dda2ca0ea85f13
- SSDEEP 12288:jdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:j9nQ/tbw/2Mkjy6Fr7g0o2
- TLSH T12D5523697964F98BFA1706F14C8281869B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 288e3d3cc5951019445536b035616773517e0423277a13c4c967b2dbbb1b53b4
- MD5 72988bde16e50e924f474cfe39aab583
- SHA1 633b764caffcbf8f64fc138093d86413ce2aaea4
- SHA512 440d52c5006c09ded53cf872c8c95b1a9aa7fb33a9bbaa9a7abec85ad7fc985f06bc257298fc9e16d177a23fade8cfc1b16cab5d6e9841f5d0e155305c5cc764
- SSDEEP 12288:2yPz5L8kGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:LzyEnQ/tbw/2Mkjy6Fr7g0os
- TLSH T17765021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.5MB
- SHA256 e042c7d839e980d9c1e8b1a8bd3f8d718c391d3a87a4805092ac33a0c70396bd
- MD5 5786b2bc1158f4bdeafcb8239049f40f
- SHA1 fd992bedf4d95dd93f66c6f34111251a00895f1b
- SHA512 9c52dd6f7e2ba4017160a92bcb39a3626e31c969eddc2a029df2038d961eb546164d5446fdd5868365249513f71a217618d1990ed2710ef1902e19baf00842db
- SSDEEP 24576:RT0aLl3z0zDCnQ/tbw/2Mkjy6Fr7g0o8:RTDLljPQ/lFTjN4
- TLSH T1827501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.7MB
- SHA256 cdd4844f8a1b7f7ab76a680680ccf037b5b654726182b13978614414dc9ae1a8
- MD5 3608e450de2fbd1c6a4e6194e3c806af
- SHA1 f8a3da6edb07c400eadf7a20d5cf443cb407b542
- SHA512 3c0de8cc8188c4fff22d10ffe5d3be69e5d89cdd8b73ee615557a96a46ae6469044ec1c9846f292e3c3b1915f8e10b81407f767ca330271fda39b4ff132fc373
- SSDEEP 24576:h31d9CHKy7GZ+nQ/tbw/2Mkjy6Fr7g0o5:R1d9CHKyacQ/lFTjN4
- TLSH T1C685CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.2MB
- SHA256 1984a96dc3f3c687102836cfedd50c1f99ceff096830a80e73e9cadf9fd460b8
- MD5 02b0248f719d2ef28e8bed7e13eaf794
- SHA1 8af341dedf75a3ab9576cfcbffb1d0eafda8d071
- SHA512 0affe806de558b22171318d5737b8402515c8372fc147323202b619057fba5418d948f77a41b9f2791c56947633494aea3ff28d9a50f04686f2837bfce2d64f2
- SSDEEP 12288:zyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:zynQ/tbw/2Mkjy6Fr7g0oJ
- TLSH T1B85523697925F98BFA1706F18C8381829B7B0EC6BFD1938F7B481128967D39406DB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.2MB
- SHA256 7c2b9d53f3da06edb82c5144f0b62f36a7a85867bc9eb8fa52163cec55e1674d
- MD5 5d3ecc0ae0413b00364bbc11c830922b
- SHA1 573d07b9ddf2d1cf86a928e10cdaa5d8a07b81c3
- SHA512 f2b82d5c1cbd7932b6ea482624acc860221fd923384667d7b74a6f81ccf8f379369ad3d90ec938d74ca81e7bf33196cbd6f93fd50d4b957466e8ab2dee395d78
- SSDEEP 12288:mEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:mknQ/tbw/2Mkjy6Fr7g0of
- TLSH T10B5523797964F99BFA2B06F14C8381829B7B0EC6BFD1938F7B481129967D39406C63C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.2MB
- SHA256 88622c6b73806bdaef7d8e2a556ddf7d1fcf8feb2b5e6a3924aaed8a0a167c13
- MD5 c2567d2e1da32103e6695c1818cc70d4
- SHA1 a8f1d2e8a53179bcc9d6268018289ab051f2c5db
- SHA512 aa97e0f9f045fe7e8fc1942d9eac941e7f56b829ce1436e211bcae801649a26af7f949a2a7f9a88bdb5eab698517e07cd4a6ca5d93462f375eebaee669b607ed
- SSDEEP 12288:wXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:w3nQ/tbw/2Mkjy6Fr7g0oG
- TLSH T1835523697925F98BFA1706F54C8381829B7F0EC6BFD1A38F7B481128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.7MB
- SHA256 c9af137563d60ca740c4983453bd5763bea6bf7c95052a0e43ce8b1ccd15022e
- MD5 23ddcd19b49b294d89af05ba138e2927
- SHA1 b4c6f0791354c89ad69a75091d0205e1e564f50a
- SHA512 0d902c393ca9cb75ac32da6dc663fd92586c78d5121db34d9767ef4ad6a0d686bb37bc8944bda71fcb6f5e819f29a12d99bbd496d2597bae10183fcbc694f1b0
- SSDEEP 24576:0fwv/k9RX6wkyAIhnQ/tbw/2Mkjy6Fr7g0oU:DMnYIhQ/lFTjN4
- TLSH T11085DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 1f786100344bcc01fb4f392520abad721aeb3e35e377d1d03de46d36d668ee13
- MD5 65e3c3cecacb51e045ba816c7eee89f4
- SHA1 ab297e3134a2b7213b78d25ff7514781d8804b42
- SHA512 9fb354f566f0ec94e62f4a9be6c5145bed01794c1739228546783e04cea1814a38f91c1202a8b5e7cbcbd74a0c569a8f8b3866095de65ddd08508d1f83311bdf
- SSDEEP 49152:SYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0mQ/lFTjN4:MySzPZLm
- TLSH T196066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 5dac13d329f3b7c71729b91ecd61e8405b095143018b4059f9326903001cf1e3
- MD5 98f0964de00c27866861b3eae958514b
- SHA1 4d84c912b0858c7c1137a4c74d18ce1927c09879
- SHA512 78c1c1a1a5e545374e1bbbc48a0812ca78c782d61a4f7f749679cad6f64be154f6724d9fd52755eb5fdf134d8acb690f77b0b139642d28fb789b513c1994a5b9
- SSDEEP 24576:S47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYgnQ/tbw/2Mkjy6Fr7g0oM:S47JUQj1irIhCnDHUPfF/2Q/lFTjN4
- TLSH T10E65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 5202d07c007593d166dce2ea0221d3e242fd22f7267761c071d91e00e394518d
- MD5 20474a4a53bfbaf9091821025217055b
- SHA1 4df829ab80ecb9118f7bb2775b6524b882a8783a
- SHA512 f6f851c4b3088326f4637ea0a5da9ab18fb175d5246dffb2a4a285e6cadc0405a25f4e6eba1871820eaf1e8027c244c1e80a48618026a6861a772ed7316a5083
- SSDEEP 12288:7ssfNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:3tnQ/tbw/2Mkjy6Fr7g0o3
- TLSH T1DC65F119E29852E9D02E5275CB828A41B3373C9597E1D3CB67C0F53E0F7A2905EEA743
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 eef2cc9f93760add8772e7f470a280836628fe3fdb30c4b84d22c14444f3a023
- MD5 159c89af10536093f0a311ec92af2e96
- SHA1 c3801c729aad8b504ce851a7f2bd7b3a1a6a409f
- SHA512 9e90a0893c41f973a2727a4db0a3d7858de670cbd6a3797a6ba07a09df46d272849fef5dd78b388922bc879a2ab87c6bed02c61c770d55ab4c327d1ef2a7294f
- SSDEEP 12288:6MCQU3fpJugF/ib0mX+DZwDqlLfu74RMgSnp7uMIvr:6MTUPjuQmODZzlju74RMXp7u7
- TLSH T1283518007666CB4FC66940325E33D1CCAB707D51EE44AF0373C99B3F9576A59BAE2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.4MB
- SHA256 b79c2ecf65f26474b86d517ffa339222b5bb205ea9af58d97fc9454809d34575
- MD5 1d3b51c6d9717ae10445e4b50906c71b
- SHA1 3720b0f7470160b6ae5ddcf2a3d65dbea47340c5
- SHA512 e6bf8bd6731850332a9c4e0646d64f60c2a8128353f685f99c5347b3a84258d5b623d23e8d3e227cb1121b1d9211812bfb70f0fe9f778798e7c09f655fb512e8
- SSDEEP 6144:DPtFDAqiuW316XaF6bjPS/iBy+tMxey+tMxpVw4vj4v85O1OYnkHkd73shrPRJeJ:BtS/icw4vj4v85O1OYnk/rRJ6
- TLSH T10765F8416437A78FC1BB6032072B5F8CA764EC06B7096F26B3D9453AD85BB11A4F93C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~st0E590DFD.xml
- Size 1KB
- SHA256 0ccc79729bf8b52aac3fd3ebf436fd9e838eb160bb7798a35545319b5c4a649c
- MD5 c1fd84e93a61405773662191c3e97631
- SHA1 c989f75f3adb2f93e18c377c6692364ae0af6536
- SHA512 dce3492546f201d2ef2cadde5b317536978f1a4622bf263aaf336d43249ccfd6075e8a9b837b33fba826e1fa99d056a6cdc2d38365a1d9eb7df5bc723c323ea2
- TLSH T188214C43ABFD220DF1F3AFACAAB9545259B6FC655D65D46D00B00A0C0931D71C9B1B3B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~st0E590E2F.xml
- Size 1KB
- SHA256 3b88e23b08a1d2e9ea58e3ea4c173ab59631121b64405f647467b24a9dc8699f
- MD5 a1650c5e0bbe3e151c61f1bcd06fcf7d
- SHA1 f0001f3bfe2d79e53a341e6fd4cdf7628a54feac
- SHA512 b05cd2a321822b0604f9b668e550e583db7120c146120cc1f059de657d5e04b90263c7ea37d33b1fd7089bbbeb2fe8f613d7f5277e0372f70df4706da683d6cc
- TLSH T14B31A047ABFD260AF1F3AB6CBEFA545259BAFC955D24D86D00B0090C0931971D9B0B3B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~st0E592BDE.xml
- Size 1KB
- SHA256 c458cfe3ed416776088bb8182738c53193a3962c2d5c82b79ab928485c4ca8d0
- MD5 374d78e28dc680f82a065f08006d281b
- SHA1 99a3911ecbb184da7cf161fc89baf5acf846fd98
- SHA512 20fdba4cfa59a03d4ec3fc25c3379b5318d3ef88d3cb80f8e6b475e0eda573ec4d0e696a3bce8eb05ec84ce2f1946c833b4ea8c5101316800537e60f601de959
- TLSH T13931A047ABFD260AF1F3AB6CBEFA545259BAFC955D24D86D00B0090C0931971D9B0B3B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 7503beac27337a19f50d31745c9bed7c8e3712ad5914274657c5b3c79a41fe8b
- MD5 ceb7d060de59395a8de1ae5b82f8c673
- SHA1 342d6628ed71987df90a29a62614875d558bb538
- SHA512 a2c4b05bd04f8d3c3ddfaebf6bd54a617e91adafc56c8f1278d7a74737ce71e451a5ba0d1498baa3e0040b03dfdff029581943898bd91cbd2512e4caf9bca751
- SSDEEP 12288:567VGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:w1nQ/tbw/2Mkjy6Fr7g0oV
- TLSH T1AE5523796668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EF6785
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 a213afe1e74c57283e9357f535e46fa4028f881788bc0c33d384e1a057df78d2
- MD5 82db3790dbea9319e0f51a9345236168
- SHA1 97d3e11a5948b825133a0f7fa6137ff63a913d66
- SHA512 ac77f90fed4b9a576272c9f92fbc40ec91029e62900636bbcf6130b54acaf5af31a0cd7b37fc575ecf923383aa63c0bd5c164b54a8ab87803cdb3b64b2906c09
- SSDEEP 24576:+gb6bmBIi49WNNFpg1rSvFv7bYPnQ/tbw/2Mkjy6Fr7g0oQ:+gb4mBIBhGFgQ/lFTjN4
- TLSH T1F565AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 ac824eac55d0ea2de7f34f51087026a495730f83cf5561a214fc786523ac739e
- MD5 fd15ff72f4e390f31e592659184fec95
- SHA1 88fce2f7c8ff9049f0eca627655a6eaa88bd6a3c
- SHA512 086c09c93b621f37d2ac2af3cc40c49affe55dff39eee99eb8e7940e6175339c2ad5384b294726a21b9b69e06dd1f3834e2a53a2e01ec7f2da999f2e666e7a67
- SSDEEP 24576:PG88u8FpJqH1Qzria7/mQnQ/tbw/2Mkjy6Fr7g0oi:+7ZFPqVva7/XQ/lFTjN4
- TLSH T1C685F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 d1cd1a84531651c7d3d20cb2c5ff893fb4f274c5c5a3d8ce0284c3b8723d628f
- MD5 e9523fe8de12352c90375262c2008449
- SHA1 d8abadf9a7ab90b5a99084a609cb8ea04c35f3fe
- SHA512 cff405826dfc991a2c69e833c9d60990816b03bdc1cac838a304f3ba0d25fa6253439d29843dbed3569608b3ecda7f2010fc9b3369ce831e9761bf14cc5ef7b4
- SSDEEP 12288:SHvUrBFrEjwaQcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:SPUr+NQcnQ/tbw/2Mkjy6Fr7g0o3
- TLSH T1B465E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 a7af4ad3ef16445f87305e32e006e3d301e30a7c7df737e3800c33ab2cf31034
- MD5 646ddb64c935bd1d005c537d2860deba
- SHA1 5576510d1670d172c4700c22113da844e09af4e0
- SHA512 ec942baaac5bf72dd88e65b0a45a76dc604a5d169b318f258b1931d99d51bee1d1bf462fd62b99ec1ae7368ea9241501fd4fd2e61a3b982ae874e64beb3333de
- SSDEEP 49152:SBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjMQ/lFTjN4:dG05lO43beLm
- TLSH T1C8D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 1969938db0fc351c9cd194eeb3af3fe8a5ccd543dd0296ea9be71df63bbbbbc4
- MD5 36836eebd9866d480cfa069a1c2ee5c1
- SHA1 37c8d7d2f53b5c0853d237baeb905849c8f7f395
- SHA512 5051d18b382eeb6af4c0062dab9048c76d1ee49d1675dbe6d7b61abe55f937924d0fc4733bb5043c01a16fcb87d2f44e223ada78c63c8ad5801f8cb2ab2206b6
- SSDEEP 24576:rfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnmnQ/tbw/2Mkjy6Fr7g0oY:za5POZ3+Jt2pasx2+mkQ/lFTjN4
- TLSH T17F65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 df53c0303f1dd0efa23db85ee866a1543e598b463edda0e36314644070583cac
- MD5 f81888bb9995df36419085542cb4d781
- SHA1 a0108e98df014410003f6133963e5498600e49c9
- SHA512 d0b6745c7b0b9248644a29ba045cc6ce95e2ee06f1a4f19017aff66b5ad82bdf85c2b0714f9d2a09e4397fa524fc0fb83c8cdacaab75e969724344ab8c02f0cc
- SSDEEP 24576:0NcwHdjbyQ4nLC18lb/EOjowL7FkonQ/tbw/2Mkjy6Fr7g0oD:0Nc/zEOVHF3Q/lFTjN4
- TLSH T1DC858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 5aacba34579275644ba250d450045ee90b03add45e76887949e76665898de316
- MD5 3bec5e54c87105de0152ee58faa435a1
- SHA1 95a3553981b2cd62d36b16689c458de5d2670a0a
- SHA512 d16868926a4281a3166454b58be4a19eafcbcb66ab20d9e3c3443a38db8f99b4bd2446b7cc5397363ac576417e8343b3a84a06a61e698552a4d01c53619a0c58
- SSDEEP 24576:b8kNvNnaFeYhJNtmZBmqnQ/tbw/2Mkjy6Fr7g0oJ:b8MwBtOmqQ/lFTjN4
- TLSH T1FB55AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 43b58d09408b9cc7635eb977eb3ba64c306459acc1c0d887928e986056536a42
- MD5 0145ec5476b4c7193b99e408a889a2e7
- SHA1 1186f9c736cb19991cd6c84974de217ea8babecb
- SHA512 67312d36ee24a1c81b1c849b753e708034de6bac2b50b922933aae0b2b21ac311e3385258735c115fe57e1121dd0a8b6fc4f84dd7df2b58673d8e44b8afed8e0
- SSDEEP 24576:vD3FHshBIYQgA5nQ/tbw/2Mkjy6Fr7g0oA:vDVHeBIAA5Q/lFTjN4
- TLSH T1D075E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
- MD5 SHA1 SHA512 SSDEEP TLSH