Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 16:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
- Size 3.2MB
- Sample261024-vgrhcsvzfs
- SHA256 c0bbd74bc6bb072e8082b7944d77068de96da46078f537c1e30c8997b315e990
- MD5 3508df740870b318419f56cac029c84d
- SHA1 c131c83b40737757072082a0bbdd63d86b434289
- SHA512 76af9dec02ece9d3a9df1adc990a43768c29ebc7bc3242f18afd3a07f5c6a9b08512ab8895a20fd309caf3a7b54e00265993c2dadd449789331a53072829a983
- SSDEEP 49152:oEWLjP1tR+varaPQRN0CWG14fCot2vbExxOkan8AVqAKE5eQ/lFTjN4:oEWLbMCrLNxWGuFgEgka8KK65Lm
- TLSH T197F52369A387B2DCD53785B40C9602EDB37A7B90CB835BAA1BC276356E731D43E16310
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe - Executes dropped EXE 11 IoCs
pid Process 4188 elevation_service.exe 2944 elevation_service.exe 2492 maintenanceservice.exe 3968 OSE.EXE 5148 PerceptionSimulationService.exe 5516 perfhost.exe 5732 ReFsDedupSvc.exe 5696 SensorDataService.exe 4076 ssh-agent.exe 4420 AgentService.exe 2776 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe" 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe" 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe - Drops file in System32 directory 41 IoCs
description ioc Process File opened for modification C:\Windows\System32\vds.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Windows\system32\locator.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\af417007465cd71.bin elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaws.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaw.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9630fded863dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f08257dbd863dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb63f1ddd863dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000352fd4ddd863dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2ad1c1fd963dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f64159ddd863dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a2ca4d1fd963dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a874211fd963dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3112 schtasks.exe - Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 4188 elevation_service.exe 4188 elevation_service.exe 4188 elevation_service.exe 4188 elevation_service.exe 4188 elevation_service.exe 4188 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe Token: SeBackupPrivilege 5732 ReFsDedupSvc.exe Token: SeRestorePrivilege 5732 ReFsDedupSvc.exe Token: SeBackupPrivilege 5732 ReFsDedupSvc.exe Token: SeRestorePrivilege 5732 ReFsDedupSvc.exe Token: SeBackupPrivilege 5732 ReFsDedupSvc.exe Token: SeRestorePrivilege 5732 ReFsDedupSvc.exe Token: SeBackupPrivilege 5732 ReFsDedupSvc.exe Token: SeRestorePrivilege 5732 ReFsDedupSvc.exe Token: SeBackupPrivilege 5732 ReFsDedupSvc.exe Token: SeRestorePrivilege 5732 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 4420 AgentService.exe Token: 33 2776 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2776 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2776 SearchIndexer.exe Token: SeDebugPrivilege 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe Token: SeDebugPrivilege 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe Token: SeDebugPrivilege 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe Token: SeDebugPrivilege 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe Token: SeDebugPrivilege 4188 elevation_service.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5232 wrote to memory of 3112 5232 2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe 99 PID 2776 wrote to memory of 4912 2776 SearchIndexer.exe 104 PID 2776 wrote to memory of 2408 2776 SearchIndexer.exe 105 PID 2776 wrote to memory of 5128 2776 SearchIndexer.exe 106 PID 2776 wrote to memory of 3228 2776 SearchIndexer.exe 107 PID 2776 wrote to memory of 2884 2776 SearchIndexer.exe 111 PID 2776 wrote to memory of 6064 2776 SearchIndexer.exe 112 PID 2776 wrote to memory of 5000 2776 SearchIndexer.exe 113 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe"1⤵
- Creates a file in the Startup directory
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E597F75.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3112
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4188
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2944
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2492
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3968
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:5148
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5516
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5732
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5696
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4076
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4420
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4912
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:2408
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 916 2640 2856 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:5128
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 916 2900 2904 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:3228
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2884
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 916 2900 2904 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:6064
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 916 2640 2856 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:5000
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_3508df740870b318419f56cac029c84d_icedid.exeC:\Users\Admin\AppData\Local\Temp\2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe1⤵PID:3888
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 4dada78cc1c0363b58b98fef399dea6018dd05f296b758002f97f7138b87e526
- MD5 931f646a9ec5a1a941f987dffdff56fc
- SHA1 ce8b515a412d6536dcbfe6f094056000e28550b2
- SHA512 28fb20d4321758a3e09384f01a3cdd9751b6c496606e5924fd5951d5ca8addc237508edfbcc87a904512e67fb5f1404b5390d917c63e6ca41e2bdf89be4aa7fd
- SSDEEP 49152:Kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnRQ/lFTjN4:83q6HjB1Lm
- TLSH T1B3D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 1b2b541af0e75d3a258fcf433b7e7379db54c1784b8e1e763ba31cbfbd10c98d
- MD5 a48536801a5ee4f69d85457e1a713e49
- SHA1 996e65ded405098d71d60cb4eae61d6190e4e358
- SHA512 f9358dc9743e8fcf91af352417f87d4fe760b1341738aaeb73654376cf0fca6cdbad1c7bdf1df6d99eea3595642a30057bf8819551ad8b6217c73ee5c37d95dc
- SSDEEP 12288:91XLsswWkxy2lRq2czA2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:zXYfDtczAWnQ/tbw/2Mkjy6Fr7g0ou
- TLSH T19465F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 77df212ca100e6607a8e18307749aefc3a6bfd641913c9585c40ca5be02bcad3
- MD5 02a3fbdfaee19a7acb7405994ea74963
- SHA1 0cbdedef47174a31757ce830214152fa1a6e4298
- SHA512 9c8e2112f23cc3ec923984406ebc11ff394e82424e3f8d37d8946d270971bd5e6db7b193c31e159efaa2289ddc832a230e4c8801c31c7e427c5986a74a0c1cc5
- SSDEEP 24576:y0Le5ji0hmxLrMJnQ/tbw/2Mkjy6Fr7g0oq:yPji0AlQQ/lFTjN4
- TLSH T1E9859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 2da37e061109a32893692d7d7b0fc2b565a6705812df4696c146e9be16dc88f7
- MD5 258cf23e3cadd79bce5936612adeb271
- SHA1 e14741cd83227cbb297985e7eaa3e1c69479454d
- SHA512 203463b58dda48193377ff4a5a1a0ff1732ab73af804ac6fc4b1e451544c65f25f37f53065604447f85ce5ab6be73c85c15cdad1441701f9f7c7e82a77d4aae3
- SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWE6q8wyufnQ/tbw/2Mkjy6Fr7g0oX:9/ezSC6vUzPvxHjysQ/lFTjN4
- TLSH T177755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 1d86629fbe35a650259ea984e3647679e34c1872f5a72dd38b7e8539fd6ca570
- MD5 14000c35ea8f391f4a5747dd0682711f
- SHA1 0aafb4e350f5e8b0f1e2cccfac2cdfb856f3ae15
- SHA512 5f03633eb0b079009c7d8e49cb073bc2ce140191ec90ddeb15fb1b5575cbb40e7787b58a38c776b9a1a44420eea665df120a0c7e77aee32efce4e4883d97ba73
- SSDEEP 24576:VVbqPb88hv/l+6qnQ/tbw/2Mkjy6Fr7g0o0:VVO88hXl+1Q/lFTjN4
- TLSH T1AF559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 f409eaed9f6343cd201d0b17c225c8cf1c4685353cd94c48c42743290f26e2b7
- MD5 75318157dd3ac64e697a32f69eb6d50f
- SHA1 8f81062382ef58c0fb61a90f5d40c75a2066685a
- SHA512 ee27dcfa8cd5b7df50ba99794798f3041c7bb594aab0c028dedd27a5f85e94f93cad5a273295b423429ac1a7ece81c09f3f4c4de6bdf1a91465c0adac0b4fd15
- SSDEEP 12288:GzdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:Gz9nQ/tbw/2Mkjy6Fr7g0of
- TLSH T1D55523796A24F897FF2B06B15C838482AB7B0EC1BFD4A74E6744322D857C39446DB381
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 5e092e0aaddd645a8e34dcceaa4d40eb54dbefac784bddbaa8726c50feb046f2
- MD5 5f96396a1638da8b1fdf44f3c02a1632
- SHA1 960e1e34a359d1ea803ed27a750335625e6969f9
- SHA512 be1044a9b6b4949534f0a64d50c5309d96fa06f85c1fc471259bb499c14efc6ef3c827c32834fe606241d460e7e76798a9b8dfdee5d894aede647dc1478a7894
- SSDEEP 12288:geBNUbTVO86UiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:gJIUinQ/tbw/2Mkjy6Fr7g0oF
- TLSH T13975CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 3bc5036ecda4074168d2d649657907575c8934cc6ecc309ad5e870300264e65a
- MD5 79a249e4bfbbb424a1e3670bfdb34614
- SHA1 83d3773a7c8b19c3882e1bb4544979f3d45bb200
- SHA512 e228454ddae091803e070c894c9502b2b7b917d92c866d2c1197f7fb50005aed1c76911e7388202d7abb3a51fde544ba2fb7f378d1dbcfb61c272f55551acee1
- SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THY:cQvGAdlCEL8c/yRNw5CELm
- TLSH T10D267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 35054af6cc28f20679d8010e36aa0b1e8a6e2e1b265d38565f944420d5e48d1b
- MD5 78e074a5e378ad884d07e23dd43ac946
- SHA1 12fe08efa25777f2086b839f06a2c4ad1566bc2d
- SHA512 33a15d3e0f380da5613bb57e35817d236d4d1ff8503279386376012d3f37a2155abd9ee12ad46012f518aa0a7a2837157f2dfc0fdb9dfd84d2fe3d2c97ab54fb
- SSDEEP 12288:NAwSfxL/2Dc39DLLmt0LDQewsAjgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg8:+QewsAjAnQ/tbw/2Mkjy6Fr7g0oe
- TLSH T1FD75E031FE74E436C77F0DB61B22C706583D6A604FA11AC3E3A84A9E59342D22776B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 dbacc6db1b5b693b27f9682f44b9ec5aef032e6c03a55baa0a2eb18d8be0fa06
- MD5 102425ac4cede39610e710ab19041882
- SHA1 c881421b1ea705cfe0d8506e70997bf02a5e825e
- SHA512 8ddbe1209419d735f97fa6d60f36d577dfdc10b77978aa3a2b6fe19b922090757edf7985fb0af8e33f51a1b6642146610f054f0769f504403dee94bfdf7e6944
- SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHLL:oUEtQevvqc2W1cpV2EI32
- TLSH T15C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 92f27bab6152d9bf10b24fcf5c4e5d5c4e427da02d79230ded87ce45941ec00d
- MD5 7204b935d4f7ea54a29d750f14b1f9dd
- SHA1 2f0e4f59b7e45a261094cfd1505e6ab37091f662
- SHA512 dcefb588d3829f9d6519ac6540c241f91d7b052d3c66cd2c5ee6689a2e543d9ffd558fcc1dbbf5cfc4521f0f8d1e39469d0d6fd271bb5aa27a84835a118f275d
- SSDEEP 49152:YCbRquA/m2yL5zQfFiV+XenmE3/zgQ/lFTjN4:RoqtVjnmALm
- TLSH T106D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 5765953756fff9afc786e86ad2260fce2920680c82e9784b1f8c34170fc6f106
- MD5 3957ce02fd7754f8c90a2c066bf157d6
- SHA1 2823aeda3c311dcebd5a85b94219cf99fcfa83bd
- SHA512 ddc28c8734fd43241ddaa859b6a9d6314d1a744e51ab04b029ed52344bf01850ae13fe2063a2d03685c33d1c0214590acb0010f198c1f00a64a76113927de6a6
- SSDEEP 24576:RAhGLJIFoiwtA5l7S53rnQ/tbw/2Mkjy6Fr7g0oV:RAMyFoiq57Q/lFTjN4
- TLSH T1CD35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 7c473afdce4169abb48fb12fff9742a91c1ac8dfce040f0b6f6e6d1c452c5768
- MD5 0ad052b67fe8cb4fe096beaab4b49ea5
- SHA1 3b2e9fdab0f72a597c069c41500b54ed2872d8f4
- SHA512 3175dc0707897b461727b353fb0dcf103d892081f726ac38b03388fd561219718c737288bee3f2a58154ecdf2c82ef5286ea6c25ba65884195cb737e6b3a0b76
- SSDEEP 12288:jmw5HEjsChN2BFgl0WDm+CfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMv:iwuHOWMnQ/tbw/2Mkjy6Fr7g0oi
- TLSH T1A165F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 5bc15462f2f2b0c8b6a184867e10fde6e4915fef6757899eca7158cec8f22fa6
- MD5 3bd43b4a500b7da13af0956f1f32aab0
- SHA1 694b18e79fa4b06b160162372e1afc7553c1aa80
- SHA512 6b4cdbcc722de4214cd50dcde981b709098b538e177f97206237213d0ee419cb242a01715b41dd131a2999c13a12d1195a10f6a5e0239d620da2a6e58898cbee
- SSDEEP 12288:xXZ1IyQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:5ZuBnQ/tbw/2Mkjy6Fr7g0o8
- TLSH T1EF55126A33A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 84c034edb863322774a19a498f1b382ea02dd41e6331ed816a91e4c9d54fb4e2
- MD5 780f4b04de17befa2980f61db2f7b250
- SHA1 d3b7bc6c1119a8595104b5dfb70540ee66a2370d
- SHA512 d60b96704ff87cb1b5be4367555f7642a04ffa9c68671038e2dd280ad35d0a9c3e1ad5024d00c04fba88ba400e3e5dd999393b2320086cfc3631e77ede1a2092
- SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U0:EQRQyi36YOcPQLvw2gAf+PN3JLm
- TLSH T10B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 648ae9b46523d23cde587fcd0c9da5db903a282cb5123e5db3833055a946c24a
- MD5 579a773bfa27414098449ac5e2dd36cc
- SHA1 9fd2e80270c2388a32273be7b561daccc1ef4ee7
- SHA512 f7b8098bca3e48fda87a07cc37145c8fa3a3fa38cc1ea592fa64d6f85d02e76d477d420cd4ebf3485cbfd72e40d489e347404d7657e0d71d2555f678b074e3cb
- SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U0:lQRQyi36YOcPQLvw2gAf+PN3JLm
- TLSH T1D2667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 b10946ac90e205150e5967c245e813c8655e12132471b781919fe2f9e15baa50
- MD5 7d331da6cd0e4fc480e7dd11f65e8bc7
- SHA1 0f16bb9042ab172094b9b64c559cbddc9eb72942
- SHA512 1e8f67c83b873ac334edb38f329871ae1ee933127364936987b91967a64c990766802556910f6d30e7b8567c3bf6e2f6829796132f51ce1c77644882f5122ba7
- SSDEEP 24576:LwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0RnQ/tbw/2Mkjy6F:j68Qg55nhheWu7PNU3/QQ/lFTjN4
- TLSH T1BEB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 a56d7f70de7ddf63b877176a531432da31f8c5161cd8bce17a35890a1da57b1c
- MD5 dfaf4ee973e520a836f830f0f25b837b
- SHA1 cebd486cd748c087a8c17a2bfe4af0c9bfffa338
- SHA512 dc73f5103687a3831174f79c06f87eaefa9e66ee18a61ab4413b5ae7f03d01352c5634869950504eb094652a691387ed5fa22389ecd723ee6a29dcd37421eb7b
- SSDEEP 49152:i3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99m:jy5112gYy5azzVvL69nLKnhZyLm
- TLSH T11C167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 a31862e95d47b688a1c9590c5166ed2b0e9dd6817ae852631887cdb5f8214182
- MD5 a3d2ead2cb7dce6d6c8a211604c0ea41
- SHA1 28c15db510ec536c8cd09dcc60ef9fd737099800
- SHA512 d44b8c8a03f02c573ebdea0cd369709bcc70330c5e88a478368a17638417a10c541227c1b060aab0483e58b0971eedda5a23505c23e397bc2675613e3dce34f1
- SSDEEP 49152:lB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glmQ/lFTjN4:Lu6JmVxd2dxLm
- TLSH T108D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 c372780c73c48a1d18185eeb2b9325d4a63bb2a782d25885ba4d67944f8e2ac4
- MD5 5877233b58112127ceb0e8569160f8b5
- SHA1 bdd9ea11d762cafc6fb1eaf70556ce8b85839282
- SHA512 781fe43fb080d5737aba5c9bc2c4e2259e04a75c907ab1ff0cdfd5845979eb9389e9992c9b29b8f4bfb84576206e248ad39e11c883c8c182688d43a923c14b87
- SSDEEP 49152:m1hpsNoJpF1A6UU44CwH7R4xCQ/lFTjN4:mmifPbRALm
- TLSH T146B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 289aabbe55c57e6a37f6242ec2b2b3d025e3977b9a651aad105fa766ae2339e8
- MD5 e469fc3969357a94dd1456de4078dc54
- SHA1 35bd6b8eb94380eed5cb12a2758fdf571334bf68
- SHA512 ed3addabdcc8ef995e4e65d7ad1123ac83647bdd2cb72b5073b1974f6aa8c28488a980b1350a97d236f9c489631451e24ec9c9fc7dc8b4968577edd939bddaf9
- SSDEEP 49152:7SuZQIY0Be2KRRVtOnks6NMHqBQ/lFTjN4:p5dKTi61mLm
- TLSH T1FAC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 411bb0db671550519ccc1e32f9f3e35cda56f026e152831f7117d6962447ec0b
- MD5 17508ae624d9431f8f241a9cba58cc79
- SHA1 5600595c029c98f623ea7261ac093f960ca494d2
- SHA512 81cc0506e7433c0a6d8c9e45b37f1d907abef7af846ca6bc4ad2636741d7c9037fbf73ef90d947710669a1e7c6f8df40c5e4fc54d528ee8be7da9d1c3e7d976b
- SSDEEP 49152:UhtSn8EApI0figngiDn0AP5wWQ/lFTjN4:1X2iyphcLm
- TLSH T1F395BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 69a5bf1d8a1b320fadd445565fcc3edb1c75d86b1395b518979eb6093e579331
- MD5 7fb06c1d35781b92da2a198dc0977124
- SHA1 85c960c3b3bd09333e5c67692b0a9d6dc90dec9e
- SHA512 6981f0e2c5463a2b5963d82d737e77e1656ae92d550ccbc9bbc53107a837ee320bb393dc2e33c4ca82aa66a7ce8088a41a833fed0631c5142935bc4d9cd5b9d7
- SSDEEP 12288:SVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:S1nQ/tbw/2Mkjy6Fr7g0ow
- TLSH T1CE5523697964F98BFB1706F18C828182A77F0DC6BFD1A38F77482129967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 260c7aeb202ecf2d3c92d0166a9e4a1ffd9243e38f9e845d8fe26493015aed88
- MD5 df82b19c9ab1cc4277b932db9f91d53e
- SHA1 749ae95ab7f99bc1a7e46820d59d964af0c4961d
- SHA512 c6a2a4bf2954fbc27736a671b44a7ca1d931d79ea6552987c50df8c80d23c969dc994ad0800cb05c57d22697a3bbd955af6a6019842b25aaa155d697f884526c
- SSDEEP 12288:+0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:+UnQ/tbw/2Mkjy6Fr7g0ow
- TLSH T1985523797965F98BFB1706F14C828182973B0EC6BFD1A38F7B481129967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 7ee82edefb922ff5b02fa2aa896df773fdaef4bb61f1ef54e0ed3c43516f2fee
- MD5 0fe4702ff052ac6c8e8a82541de9b9c7
- SHA1 96005250d0b0e3fdf998ac1ba25840a6d1dd7a1b
- SHA512 6858f8ea1e346e18a0330d174362031656bebfc5ec4b0beb08c0daf99efda246f4cbb3cfc8976c30d13507a6ebcbba9e536ae737fee0266dd07322846bd53a55
- SSDEEP 12288:96GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:96nQ/tbw/2Mkjy6Fr7g0oZ
- TLSH T18D5523697965F88BFB1706F14C8381829B7B0DC6BFD1A38F7B482128967D39406DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 6f1552b66fbdaaecae7ba650618df418a2ae8af7e3f4745a85d9baf5958bebdf
- MD5 0db1bf20277c350f4e2998bc25224b5f
- SHA1 a0b35528918666a4dcfddab7ebae3d34f2b5f120
- SHA512 785d853aca374eaf52648a897ee96bbdfdf8ea198be4ace99c6f11e54f1b2b1b89cd7495eba4f0ee752649f491e0fbdffb05ced18285e14971b4b952b47bb711
- SSDEEP 12288:1VbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:bnQ/tbw/2Mkjy6Fr7g0oG
- TLSH T1225523693A69F4C7F92742B4CC928142E7BB3DC5BBA1A3CF6B04111D4E793D419A5B80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 d2dc54dfab3b97c09fc8c7ed90913084e542f238b815cce5123d800b21ea4890
- MD5 ed81537cf33a4a75f65f859eaad69243
- SHA1 678988c190eb04b3c374f02a12446f8c0cf45971
- SHA512 fe695adde05415c3e9fac0924543750fd763aa23fd525219696b49a025eeee7a63b38fe76e693511efe33c38fcce14927ca95f44c479def4b2c07332742f0720
- SSDEEP 12288:HjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:HTnQ/tbw/2Mkjy6Fr7g0of
- TLSH T1945523697965F88BFB1706F14C8381829B7B0DC6BFD1A38F7B482128967D39406DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 db798d680f464b232ab9414118d4af92bb556d340e131a9c13327dd0a6df5e42
- MD5 fcbcbac81eb1c2f70d2334691c0ec448
- SHA1 1a13a68470c34e644e81d045baa3b1dfbf0a0507
- SHA512 ab80cb375693c36672e4aebab8563bc7cc5ca2ca23e7de589002afe671ca86c347e55c28ca0f0137d309e2664e5c2346f886a475589859ef5342a2d8b9ba6a43
- SSDEEP 12288:bYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:bYnQ/tbw/2Mkjy6Fr7g0of
- TLSH T1FA5523697964F98BFB2706F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 def816474203fd2ebad26be3bbbc88445bc866f6e2b1995112d08e7859af593b
- MD5 8a9481566ca9d6df16b2142e14e291d8
- SHA1 1d6ba97350f0466185ca9584e386813a00a4ea04
- SHA512 c34c18f1e7e8fd6f8aadfa17e812f43e86917d08e281020e5a68ada541d1ba30e336aff483bde1b2998c338e7608cad89a7109da44a573cf66bc48ce173d5cfa
- SSDEEP 12288:ecGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:ecnQ/tbw/2Mkjy6Fr7g0om
- TLSH T1905523797965F98BFB2706F14C828182973B0EC6BFD1938F7B481129967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 3ac100654c7b32e2c7170f2a8a1a560ba133065db4b07eed88c7db3bcd0ef7bb
- MD5 1bf89cf2f5ae62c51f4a3d66445c9435
- SHA1 0a51573a58e4e59ce622590ed9ad086813c82263
- SHA512 bf7083cdb15f1349658eea015b2e111631035c360bd782161d206eda9f81e39a74fc6eb1b5fb8ddaa21a8c265c89ad34b2f489b523c7f90aa545d218b4ee3e92
- SSDEEP 12288:6iZwbDzzFEoS2cPvyUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:dZM3zFVSO0nQ/tbw/2Mkjy6Fr7g0oE
- TLSH T1D57501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 fde7c47ff522a3ef84eabef808e43dcbcba938d1192c8bd43cbd8ede5ce7a340
- MD5 99d3a4fe2179d68840f75974f98e8df4
- SHA1 37f10043e6ca1283e0c4ca48b9457ec36570f335
- SHA512 1adbd1f7eb034d68109124664856937909bc03abb215e2c34d6acab8553fbdc1a44b5d16dd1ccb5cad6cc47c1f388d267422c2cfe3d8340d31118843d0d03c97
- SSDEEP 12288:ChGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:CxnQ/tbw/2Mkjy6Fr7g0oU
- TLSH T1435523697964F88BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 a90267f563ab8655c6c34f8dc350d995e3074541ca86bcacd8a8be078e9b9906
- MD5 2c5786312fe2afb2e5eb72d0dd9f6d1e
- SHA1 637241771c427c35262ef6f3da2cecb20c3932cd
- SHA512 6494879fdc8fe53be3e6a9f81c0aaf615c249ee6a2cfca0d26e6fc6c7015d73e72bc551738e190d284cbd38cfb0ae87562a9b0447a21ac44858f146f8ecc1547
- SSDEEP 12288:KNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:KtnQ/tbw/2Mkjy6Fr7g0oU
- TLSH T10C5523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 1dab0761835922fc42e62008f6167a47c54df9c7c1b88dc5ac9aac2227bda947
- MD5 66fa35d83bd31d16b42996ead2caea0e
- SHA1 2b1558aa6c2fea86757c0c0ce995c32d3ce96b9d
- SHA512 6f9eb22dccb79cce6274d1fd1840d158bb01db51f6a5e728ea16c2006dab0226e71f650437d0787b00f0404d7c20a35fc5483bf4110614b81e6c48d611d9e4e0
- SSDEEP 12288:2yPz5L8QGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:LzywnQ/tbw/2Mkjy6Fr7g0ou
- TLSH T1FE65021773A570FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 c81320b946f68fed16f10f66a73182c47228ce1b803463e1d93c4362b5c6705c
- MD5 1bfd527432aead39e3ab2e3c5760db70
- SHA1 ad04cb97a7cc3433e5e197fc1c921ce3000b1376
- SHA512 e529131696bbf09540164ab383b24857c345ee2df5d99228809de689e02af3d83ca5471d5c32f849518781b706c265840258680cdb5e857a189c5bb97894490b
- SSDEEP 12288:ohGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:oxnQ/tbw/2Mkjy6Fr7g0ok
- TLSH T1505523697965F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 966b9333fe3618262b8dc02fb12593e5a4bf56f3606f3dd925dc05fa56e5e0cc
- MD5 f7ce70aa064ed95dd10a5dabcc035dae
- SHA1 fab96372e48ba6c316bde5f0ab93236fdc8efa13
- SHA512 c60070c297972ca3003dddfbcbc0b8ef264cdc85b708b3ef70bf49a7e2e8895813c25bddfa329e5c76b2fe8c46d85bdcf89163e06a43131dbd31d094bb17bc90
- SSDEEP 12288:ZhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:ZxnQ/tbw/2Mkjy6Fr7g0oI
- TLSH T15F5523697964F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 dcdb27ff6d3f4bf5154da7b42f71ce945622f06a2d7dd878e9aac2d4c43ede0b
- MD5 15ef48ef56dec4faaa521a49c8814add
- SHA1 d8e0cfb5103a11e762961f56832dfe0f8d98e085
- SHA512 6acad629bbb2101466e2b692821189826101eeebf2454bf16c10149d1e57c751e7a341b1bd730caaca970a4fff3035ce96508b684d4be977114a298e30f9b01e
- SSDEEP 12288:IyPz5L8QGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:JzywnQ/tbw/2Mkjy6Fr7g0o+
- TLSH T13865021773A570FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.5MB
- SHA256 7fd2088f226680b88b5dc184f0d121a29d51c4b1ee526a3602b4d752729755dc
- MD5 b6867db3f314022810bcaaff4e1eced6
- SHA1 f8075e19668ceb42d7fbe6ebaa722a6c32ca52ef
- SHA512 189f10989f3bdfb62c180f69c6b5fc7335f3041ec66a1a22781da9a5a42d3df56eb1952adfaa89444b8b43ef24c18c01553377382e9ed9cd837f078cd02650b9
- SSDEEP 24576:/T0aLl3z0zDKnQ/tbw/2Mkjy6Fr7g0oY:/TDLljfQ/lFTjN4
- TLSH T1B57501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.7MB
- SHA256 f6f8034bc618190c40f2aea6c65ef81e6e6bc21252238c2cdb6bee021d67d7ee
- MD5 76a0421d9c7b57774e5433278ed34d07
- SHA1 4559cfadbff759bd21e23da861a99a8a67dcc612
- SHA512 2fc374bcaa172e747b5d93249154289c93fb8d647835fb4fb19e4711a223c0eec8ada0df242056ce3c42341f0ce28a3bf9baafbfd2de2704210126a9b5ae43fc
- SSDEEP 24576:031d9CHKy7GZOnQ/tbw/2Mkjy6Fr7g0oK:+1d9CHKyaIQ/lFTjN4
- TLSH T11785CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.2MB
- SHA256 61e5d13572879cb49dc9d7f5fd7250d69859f67f95134a378197bd40ad0a11c3
- MD5 9be8551a700d08ddf96b156f55e4ade5
- SHA1 bccad249c16e559a1f94c6d357a9d96e99661b58
- SHA512 fdd81cd1b86602592eadb0d673cd23c2bbfd08942e293c4a088972ac9e3cf3b064c984a823698535deb8bea3d1e1d06eff3df4337bcd0b44a37764d3d3a498c4
- SSDEEP 12288:XaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:XanQ/tbw/2Mkjy6Fr7g0om
- TLSH T1D55523697965F88BFB1706F14C8381829B7B0DC6BFD1A38F7B482128967D39406DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.2MB
- SHA256 3830da855e50bb9177616cad2178e1c723adef0f873f6435f561b218428dcda6
- MD5 edc9f4f522d863ed025cc572f8b72634
- SHA1 ca8ae1ac1d7a613630a9083a3a905ab9e0741b0a
- SHA512 c0da892d47ee4112df7400f264bff4eab9be2790206595b544a82dd55e909719ccbc247f96f3c5987d6be85bd260416c2e2d5f0f8371ed3ab6b926e7f9585f21
- SSDEEP 12288:cwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:cQnQ/tbw/2Mkjy6Fr7g0oO
- TLSH T1E45523787964F89BFA2B06F14C838182977B0EC6BFD1938F77481129967D39406D67C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.2MB
- SHA256 7e7a1b3f3472fbfb15e4fe682464edd393a10dc28fef5e24b999e14fb783acc3
- MD5 a9475f0826f566cc62f1e5905ff5a565
- SHA1 c8c55a09ff36730941a3af4d0b56ec31d51440a2
- SHA512 b3b16c5a70f32064b04eda9f2d8f2b2867a035480366a9b57dc59bb461cbfe879318712466d8e478f2535ed58b54fb73d51808711eeb87ac0634ca9ca037be4d
- SSDEEP 12288:IHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:InnQ/tbw/2Mkjy6Fr7g0oe
- TLSH T1005523697925F88BFB1706F5488381829B7F0EC6BFD1A38F7B481128967D39406DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.2MB
- SHA256 b482ec3e96788ce9172ae799f4948f8f3a9bd5db21bedfecb421501362e8bada
- MD5 f360984e4dfbd27b9323d543ed9f9c70
- SHA1 3af57b3d10adf696d4da71bac46436e244ac6162
- SHA512 2efa8d6527fceddb8b3fa48582042daee572058ec389c0712cdc504ef41c6ffbec8b243edc4a40e234421a854de489bc1932d9fae2bbe7e77f2a50f9111ef644
- SSDEEP 12288:ohGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:oxnQ/tbw/2Mkjy6Fr7g0oK
- TLSH T1D55523697925F88BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.2MB
- SHA256 c19be0191c75709f46da0767aa5550fec5cd5dc274425eb07dfd8b2a3c9e03b9
- MD5 d6adbcbad5a4e06be7e4f98c6b79d1f5
- SHA1 5824a4e95cc4ae2f6487a1ed98d8e9f2e93e459a
- SHA512 5b107ea6d46a94c445962ef8b7cefbd99c84a86b9e57d022e8e2b92230f38db2bf5a1b291fed9a2a2efa9c51dd73dac949eba4728457cf20bd5284f474de95dc
- SSDEEP 12288:6aGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:6anQ/tbw/2Mkjy6Fr7g0om
- TLSH T17C5523697925F98BFA1706F14C8381829B7B0DC6BFD1A38F7B482128967D39406DB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.2MB
- SHA256 9a2e0fa6118681a8de7b1508a0229e227b384d29c8aaf5f8283170041d9d49a5
- MD5 d336e40b0f887b2a4bb6378d905a9fb4
- SHA1 67a372d03fc913be926ecd22028bde246b84b6ed
- SHA512 2dc78f143dcbbf4ee48d7f3f297e0697d6455721224b67fbea744a7a25e0ef149a43a4e8840de2657b680b25df562dda799af084f722c0b5911bea895db2a2ba
- SSDEEP 12288:WJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:WZnQ/tbw/2Mkjy6Fr7g0oK
- TLSH T10B5523797964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CA784
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.7MB
- SHA256 9ddcf009af4246046e17dd7750f806df670267d399942eed9182ed026c2955f9
- MD5 1193f0a068dcaf62ec19b93d2a2741a0
- SHA1 8c37fa284da49c64b7e35f21dc515aa9caaf484c
- SHA512 38c24c460f2f9c85394f8336ba760249eafd98cb1f59a239919497446a602721a521bce9c7ae53b25fadf992b63e38386447ce638372e3c3cf76fd81c8abe1da
- SSDEEP 24576:Tfwv/k9RX6wkyAIdnQ/tbw/2Mkjy6Fr7g0oF:CMnYIdQ/lFTjN4
- TLSH T1F685DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 0c8b2248486d27489facda0d8f7dbb8147e9810357e2884f41ded49dbcbeccf6
- MD5 f6dcda5a855f0088807d1d773bde5a22
- SHA1 a72a06a4fbc5443d444fdeb48f27c55d6bd10662
- SHA512 f806bf7d0d4ca71b2cc1c40b937408e8f45c441d2d6d01b78f9157eefccf547943a0c855e749528e7603f511a9554f7bc3be3e41a2815837706ec49ae86ebc4b
- SSDEEP 49152:XYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02Q/lFTjN4:zySzPpLm
- TLSH T1A2066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 ef90188a404b8d0f666cf7f9e46361024986ca36dae5d9c72b889fcbaeed6348
- MD5 3b54943346d6debaebea4f95efbb31ba
- SHA1 1b4a56eee274739a363ad849377368e8e7e09754
- SHA512 aea460c23e69d6d385c66d48103bae91ebb5532afc0a26425e4a81a73be568aef1d7153e449bd647a59d035e8b18c1c76509c0ced761c9a504216adefaab0ba2
- SSDEEP 24576:V47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYknQ/tbw/2Mkjy6Fr7g0op:V47JUQj1irIhCnDHUPfF/mQ/lFTjN4
- TLSH T11765AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 f6369d39ba012ae23d292e363681791d7259df7438c6efeb77143bc7431baa1d
- MD5 433665b666ef9d0ec773d592bfeb8493
- SHA1 668db3dd8b1efd46de17b660d42e4743c5419328
- SHA512 c55ca5e1a9d92e88260e40bea1b8ac5a8676fc5b737c6e3c08c552e00090e28df40552fcb1cdea6197ff3c231b544f44c4414b7c51c76527ece5a0a6546dc1df
- SSDEEP 12288:kssfxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:KBnQ/tbw/2Mkjy6Fr7g0oA
- TLSH T19865F119E29852E9D02E5279CB428641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 0c68e1d1aab05120745203eed4e2e22f68dfc3f8d7da0eff327ec716677962e7
- MD5 1718b916524627c504ec99343c8baae5
- SHA1 30e8e6025813624883a5333d127169de444a257e
- SHA512 9a8623e0869cb636852ac09e78a8e1159e51784dc3c84a22d7d8b5280330dcf0d1cc91c4dc208791c8dbec24a5b5364e884222be2884522497c1152bfd9cce1e
- SSDEEP 12288:IMQe7XuU3fjaWzrz8ABpl1BwmJGQ+fmYkVZlvTI0:IMQGeUPfkq1BwIG9fmYslLx
- TLSH T1A3351800766ACB4FC65940322E32D6CCA7707D42EE44AF0773C9873FD576659BAE2292
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.5MB
- SHA256 18ee7672eb3062931383149e427d7fa7ac0407ee46400f4e916bfed7bdccf751
- MD5 018f6baa9631fda823add57ce9b1cfba
- SHA1 c6023865d5bb94049a349092275111f381d6fb90
- SHA512 f4550621f0fd285c15ca709c0b3b2dc27368e99048069e95ad1f009f2dffd80960f15471b47682134e0cbf53025cd06dd23a871a89b4c9e581b3bca18ce2a889
- SSDEEP 6144:GKPzbNTUBvy0KaM+22Z2iuzpSrt2UYoMiInSgpa16Mq+eXspNLoy5UO8QytMxvey:GKPzb4Z2iMgB6SgpaOkDII/
- TLSH T16A6509816137E78FC1BA5032072A5F4CB764EC13B7496F17B38A453AD82A712A4F93D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~st0E597F75.xml
- Size 1KB
- SHA256 78dfc5064a0bfae77e73cac8f6b5483d76c8dbed2d535803002154a053d2f4cc
- MD5 444d51189eef160236498422c8a6f4ee
- SHA1 e26963570044d62d3174c1bb84186e0f40055389
- SHA512 bc525e2ca63ba32f864b5dc8abb5f0f8a251fd1536015d453ca27838116dc1a7963740ef3b73094c5f27f9710bf15c10e39b6f48bd00a54586dc4e83aef224fb
- TLSH T18C217C43ABFD220EF1F7AF9CAAB9941299B5FCA54C24D42D00B0090C0535D71C9B1B3B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 ee07fb8552c457a3dab0f23d620271e7ebeaafa2680118a11c2886755c84b134
- MD5 de0ff2a3967bbf33826f8a0652dbff11
- SHA1 10ce941fed087ef351044ff491296aae5b61ab87
- SHA512 fe810572c5c8db0ba915856b11ad65de9b9512ac146e6de7a1057bae257f1c6c0065c68cc6404a8dae52f9a51db13aebf690d6105824b129d61cbe334f2e0acf
- SSDEEP 12288:667ZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:dpnQ/tbw/2Mkjy6Fr7g0o2
- TLSH T1B05523756668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EF6785
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 9c4417c4993ad97a0acf832f508049992dc45a08669a722fe5d32ad3ceb816cc
- MD5 0ba23d265af20ba1f574028e6e6e4918
- SHA1 72702ae26edf845d0c8293ce3fda647b7edd4f4a
- SHA512 8ad5537526016bb2766e333551e4660dcb5638082f06716239fc4f88a44ed95d5c186b736d5914441a0ea87f195f61fc3fb78b747080e63e811b715961280803
- SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bYfnQ/tbw/2Mkjy6Fr7g0oV:Sgb4mBIBhGFkQ/lFTjN4
- TLSH T19365AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 532c2760c9051ceff8b1ff4808db8da7f414adfc180d1302c4c6d75fec3beb05
- MD5 1d8ee1c0369568a016cad76e056bfdbf
- SHA1 3350fb9c813792a8dc1ad255b747339ad8eb6c29
- SHA512 93262543eddccefd9ce5b3b90e75c967c2db004469a0f7d87f2b9f525729ffe2e8122232bc406926837e20bcd5ee7195c81bf3a02a52a2c3b250b0a9116befec
- SSDEEP 24576:wG88u8FpJqH1Qzria7/m0nQ/tbw/2Mkjy6Fr7g0oP:j7ZFPqVva7/HQ/lFTjN4
- TLSH T1CB85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 6710698d22d4f4de151895bf3d4fb8b7b5acfec99340a11f8145d092128e5383
- MD5 72c8d36810124e5249ed7f2e3cd31c9f
- SHA1 481e95ac99a2c1072fdad5316e18346921d70647
- SHA512 c459aa6e5f29c38bbd5347aa2b9b01bc81a40131fd9f399d09b08e9248337f560e4c1995bd57d4741844b7d32ac6ee88fc83172fc72ec194c9ffa9c4ecad73f0
- SSDEEP 12288:NHvUrBFrEjwaQIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:NPUr+NQInQ/tbw/2Mkjy6Fr7g0o4
- TLSH T10665E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 14ffc38e6e5fa4982bf452f1b69b71e766601ab09e73ae313bb3909e0d34c0db
- MD5 1076bec1e5dac3166485503731daff0f
- SHA1 18e33b1b9365e71116d7ea3afc91c5985b8c0bbf
- SHA512 35e877e49d55118bf1075adb653308bd0f8f2e2c705fd4bb621f6b86bdaff15ded90fbc10297f861b31ebadf609e028dcfc9619e120c7ae1ed551d337495199b
- SSDEEP 49152:TBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjYQ/lFTjN4:8G05lO43bKLm
- TLSH T13DD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 49224f8e5b0640e0e3e4e3079189c7e16e38dd6b3eb9a7e087104b1431a6025c
- MD5 c83f309ad1148cb6414c13701db7b387
- SHA1 a6abf7f6a3e0d15beb048e95e0b923980f7a82ba
- SHA512 92035df8dd9ce6fac06c2649bc162847d85e3fe115f8595f8882cdbd68875aa0e16c34c4fae6e64185db59fcdf557d995ef2f07db979117c20871320d686fea7
- SSDEEP 24576:0fa5POZ3dpFWVM50JicR2hG0lasx2+47eidn2nQ/tbw/2Mkjy6Fr7g0oe:sa5POZ3+Jt2pasx2+mQQ/lFTjN4
- TLSH T1AB65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 cddd76dd2a0f04b0fd7ede728a171f02db7ca43f8cc91b5219a6dca3f26b2800
- MD5 0b4d766af20728bbfd73c8dbeb792211
- SHA1 72ef02e9df16b06a92f6ab01e65ff10b1921c660
- SHA512 1c01b58afb4654cd7157f5bfb7fc8832e8b8e69349a7b129881f14ab0503aed168e20a1e8438f7c59f780bca849dd47faefae7f04c7b57dc658cb22b7a122e68
- SSDEEP 24576:yNcwHdjbyQ4nLC18lb/EOjowL7FksnQ/tbw/2Mkjy6Fr7g0ou:yNc/zEOVHFnQ/lFTjN4
- TLSH T17B858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 6e0cd73be0b6a74372b082c39e837ab957a078bf2858c486128e8c855210ff17
- MD5 333d285438281356a132644edf48a5df
- SHA1 546d09c81b9d39eb95006a9d3d78e5860522b1b0
- SHA512 3ee7eeb1e9974cc7d9394b5d415a53bcb096cc2bf27efb3d9c380df8e9f154f512cb5926a7a0462b8050389a3866d63972dc80747f237f0cd6bfbc37076e0281
- SSDEEP 24576:48kNvNnaFeYhJNtmZBmSnQ/tbw/2Mkjy6Fr7g0ok:48MwBtOmSQ/lFTjN4
- TLSH T11055AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 2b91d701df04dd3c2f07c2be88ac77f8684c9f195805fc91c03dfa2b23237c56
- MD5 2116f2ac907be504354c528efd7a9d9f
- SHA1 af0e64d9c04408ebb9c7c4b747ee7ed45d3b5774
- SHA512 2f8f9b062c26f5059468b9b9a393cec1b854d4061ce5070895cc4ca70467695c8938942ed0c84cbc4b063807ba4dea1a26287b83025681731360f39b275e2c96
- SSDEEP 24576:jD3FHshBIYQgAVnQ/tbw/2Mkjy6Fr7g0oH:jDVHeBIAAVQ/lFTjN4
- TLSH T1A375E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
- MD5 SHA1 SHA512 SSDEEP TLSH