13f5667a27e7f28c3f7ea1db16c7e7d8dc139b1068dbd5addea14c05a3f433a0

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Size 1.5MB
Sample260511-che7lsh15x
SHA256 13f5667a27e7f28c3f7ea1db16c7e7d8dc139b1068dbd5addea14c05a3f433a0
MD5 d7de67453cced34a85588cdb77aff673
SHA1 f2b53b9f3d6e86a9bf2ca29c93585bdad2e30b5c
SHA512 0fb84164fe609c8eeb9a7dc2b7b8c662824590795555f5911c0aebf678409648c425d9ca1fe56ccebc15e283e5046462b59a673f2edce5643f11416f3edeeae6
SSDEEP 24576:6iBE0LqwXeAVmYQsqjnhMgeiCl7G0nehbGZpbD:iG5Xe6XMDmg27RnWGj
TLSH
T14F75DF58A75841E0D1B2C27888539946E6727C018B71DBDF1298E73E6F77AE08D3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 22 IoCs

pid	Process
2304	alg.exe
3280	elevation_service.exe
2392	elevation_service.exe
4592	maintenanceservice.exe
2656	OSE.EXE
4020	DiagnosticsHub.StandardCollector.Service.exe
3460	fxssvc.exe
2996	msdtc.exe
4812	PerceptionSimulationService.exe
3348	perfhost.exe
2324	locator.exe
4496	SensorDataService.exe
2548	snmptrap.exe
3492	spectrum.exe
4564	ssh-agent.exe
4968	TieringEngineService.exe
4172	AgentService.exe
3300	vds.exe
2364	vssvc.exe
1776	wbengine.exe
2308	WmiApSrv.exe
1476	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\922dd90ee7d1e4d4.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_81171\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b8125fb2eae0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1e8b4b2eae0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd65d5b3eae0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9eafdb3eae0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a9b68b2eae0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe\""	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3280	elevation_service.exe
3280	elevation_service.exe
3280	elevation_service.exe
3280	elevation_service.exe
3280	elevation_service.exe
3280	elevation_service.exe
3280	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1216	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	2304	alg.exe
Token: SeDebugPrivilege	2304	alg.exe
Token: SeDebugPrivilege	2304	alg.exe
Token: SeTakeOwnershipPrivilege	3280	elevation_service.exe
Token: SeAuditPrivilege	3460	fxssvc.exe
Token: SeRestorePrivilege	4968	TieringEngineService.exe
Token: SeManageVolumePrivilege	4968	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4172	AgentService.exe
Token: SeBackupPrivilege	2364	vssvc.exe
Token: SeRestorePrivilege	2364	vssvc.exe
Token: SeAuditPrivilege	2364	vssvc.exe
Token: SeBackupPrivilege	1776	wbengine.exe
Token: SeRestorePrivilege	1776	wbengine.exe
Token: SeSecurityPrivilege	1776	wbengine.exe
Token: 33	1476	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1476	SearchIndexer.exe
Token: SeDebugPrivilege	3280	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 3140	1476	SearchIndexer.exe	119
PID 1476 wrote to memory of 2612	1476	SearchIndexer.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1216

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2304

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3280

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2392

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4592

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2656

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5092

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3460

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2996

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4812

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3348

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2324

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4496

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2548

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3492

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:984

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4968

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4172

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3300

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2364

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1776

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2308

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3140
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 91a9ebadc9f15d1d6d7aa9ef1cdccd54ad6c0282f2baab202066b57ae231d06f
MD5 57c98fc549ad5c604dfc7899aa619e9a
SHA1 6ec00c6f7ef8956dae1c699bdba9a383306e07b4
SHA512 2994c5998ed9606c91e0f61ef1625733b596a783d0bc6612c426d1ab70c3d8278c55c6124855f436c6b6b8d984f5c42d378d9c4bca8b512ffa6dc2c72cfcae1f
SSDEEP 49152:zb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnkDmg27RnWGj:R3q6sjBjD527BWG
TLSH
T15ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.3MB
SHA256 cf867489d126774bdaddb88f724cfa41069531d6d209acaeda8e834faad66e46
MD5 1a1dadadf9abd9828eac0a958280feb6
SHA1 61a3840049f7d2c83f436c6fae448cb6493c21f3
SHA512 c98da3a0ecf9e9ea2834b8ef6769b01b2b2550df933c79dc458fc01f89274487bc237d881f6a70b5fbad5a58b3b80067f6b7ee6e832abbebe51d204cbe38ade0
SSDEEP 24576:gXYfDtczATsqjnhMgeiCl7G0nehbGZpbD:XtcuDmg27RnWGj
TLSH
T16A550129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 b4274964f46aa6a2aa40c1bc2902bfb7f1d0b68ecace117a21768f3a743e6443
MD5 f10e8fe618f7cbd5359b107e0221636f
SHA1 4593ca013dd9e81ee1bbf0582a5a93921ce7fce5
SHA512 19c626cd6aff16e1a19e1c7b3c2dbfd3df5a714611555c792c5aaedfe1d7f7bf053bd58f6801189992827d93d1299858fae0738311fe080f32e44728b9749930
SSDEEP 24576:30Le5ji0hmxwrMQsqjnhMgeiCl7G0nehbGZpbD:3Pji0A+FDmg27RnWGj
TLSH
T193759E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3e18be1d4c68721047b83fbfa93a3a050887bb5667b6285c4555abcd86f3c2a2
MD5 118a3cdfc9b5c328909afb9061d6411e
SHA1 d9537f076867952e3e7740a193aac642cdab9cc5
SHA512 58450d1e83acb97e2b6c1610981316da47de2782e28192dd55db94f44b964bb90ecbb5d5159f47cbf52f5fb7c3072a412032081f1994c3932a6fbc6ef59d18b0
SSDEEP 24576:za7/ezSC6vUyD/aqgrvWn6q8wyuKsqjnhMgeiCl7G0nehbGZpbD:e/ezSC6vUzPveHjypDmg27RnWGj
TLSH
T17F755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 216de850442550e773e6ca7af9ce5b11bd7a7333bdd6a3ac9b5c1a2ab6b18c5b
MD5 692e8e1ed48ccb71dd8ad7f9a4dc1198
SHA1 ee7bd1992c938c358a3bc7c2ea6677bbc8e3361f
SHA512 ef910d7f335313f5a676f6fb8a180cb76acc713490f6e16d5539affbc80046fbefafa388bdc462a5bfa6b651389928983f10c1570c6000713cf74897b45899f8
SSDEEP 24576:uVbqPb88hv/l+YvsqjnhMgeiCl7G0nehbGZpbD:uVO88hXl+2Dmg27RnWGj
TLSH
T1AB559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 ac81a6f9fbe088db51df2e1947f1a878f99e93eb72f460474235909b4420f515
MD5 067142d64dd87e84d79a6e7e6169fec2
SHA1 3ed682237a6fc7c67252891b341ee41181df1783
SHA512 7d2155bfc0c83aa66d186d8d9f25df3c2aed539dea583bdd56d8bcaf32dfc171d1bca24f13663698d8a728aa5ff466aaefca500fd1ed601accc3da09090aa3cb
SSDEEP 12288:pDMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pDMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16D3523BF864C50DAEB7608B5C3E9F11EAC177E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.3MB
SHA256 d30b03a5f86103c2fe6a2ddf224f3ffdec2bdf4171fa1648bd80be6e7f219097
MD5 b8690161a000b6ebf16658546c3b1e25
SHA1 ab3f085edbdc7d8e289f29b01b4c1691523a8724
SHA512 bfca4f0cc450a3c5a01ca1e2fc1768d9991274310a5c2a3e483aecba2af2441532bfa8c62ddd1654ecb92c0b06682953dcb59a559238c89ac859a8e405227712
SSDEEP 12288:deBNUbTVO86UnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:dJIUnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12765CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d436b1352e50d33a433ba8c3d66613713efae579c8e5e61b2b75df5c8ea34158
MD5 b19741cb3f4bfeabb0052158068f183c
SHA1 f1c3af3aadfd39712de3dd2c59117e29580ac17d
SHA512 3951fd3ac3514fe9a0f7df2da674ebf79401ccb7f424156d9eaf12a687c1a2f267b1378964c27087c1e3bb13917fa9965731ad3c44f6845854e5eb5a3b0f21bc
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THa:tQvGAdlCEL8c/DRNw5COD527BWG
TLSH
T1BE266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.4MB
SHA256 c2e061ddc1daec8379f01f5086cca6e603e2fdd2fe38a40db496ee3fcdd2ef77
MD5 22004293f79032427e6015879dfec3c5
SHA1 a5139d98300aaa872fa9648bf43e238f5abb28fe
SHA512 62efc4c6f73bc38b175b3931affa6156d724ac453db882ed05c8da3071be955e52fe4d9c1fa7449087696e64f2f55f357e23652c0085f46ca1bdf7b288f8c029
SSDEEP 12288:SAwSfxL/2Dc3eDLLmt0LDQewsAjhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:XfewsAjhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16465E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 11a5dfb0844eb508150f739d35b3521e51d1abe47485891d18f1fcffda8bb24e
MD5 d5f54c44fa376cbaccef83079ae93482
SHA1 9943be716679d58f7e7d8119f9b5af3ad2ff9869
SHA512 282b7a96ca629ca20d47d79bc2ca33af64ec960df0800ce377e7ece89dee51ad464df3934ed71d5a1b586aae6e036cbf7e6ec4537e40ea6863fb3c779115b97a
SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHNVQBWG:oUEtQevvqc2W1cpV2tI32YB
TLSH
T16B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7dede3d99476fd18ccb1c2d72ccac14e0df9407a11614ea35fbbe168660b1f7b
MD5 d3d7b448bbcf9c16ee953f2ecee74271
SHA1 69d7d3cda20a9a8aaed5f6c0525dfaec4bfbd3ae
SHA512 1c0c7086e03186cf22939dae0631cbd1119e2afac3d292aeca3b8c02240dbb47a129fa8a80091a3d97fa912a6913ad43a2af3a9573fc8f89d3116f6302f566ea
SSDEEP 49152:TCbRquA/m2yL5zTfFiV+XenmE3/zVDmg27RnWGj:soquVjnmSD527BWG
TLSH
T165D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5437d79e44ecc3f95cea8dd1fe55bca85111a95327e98e174270d2a4fdab5bf3
MD5 68eadf4f7a28c864ca0d88e0e10992c9
SHA1 cedba56aea241ff62bd8d8160dfa99717572f7b8
SHA512 6079b920b9170351b6017970afab43d9bb3a6910810778c1dc084b467cd439b8d6ef6c46ad5ed333e0ef81606da5555e68d1c68441828803b71215ff6bfc2118
SSDEEP 24576:0AhGL3IFoiwtA5l7S53esqjnhMgeiCl7G0nehbGZpbD:0AMUFoiq5CDmg27RnWGj
TLSH
T135359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 95ce7215023938cd431db448c502ba2659a594627a90da56c662b2aa0e756476
MD5 bbb317bc3be03e8bb0001c6a6e4d9d51
SHA1 36cb5cbc5a406522c3ee7f8af8fc49d23c69f055
SHA512 bcb4f5e10bce0ff1721dd0a0ca31ac77fa47faa2f720bb97af0ecd61203bedeb4af23313e1edea153c129b25c9dd6ee2006f05806934439db28591d7afc82058
SSDEEP 12288:Jmw5HEjsChNdBFgl0WDm+CqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:EwugOWVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BB55F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 94e2ce0291c2ffab341ace83aae6413cd92410ec50f0f5cbe1b30f1ea58b64b7
MD5 751f4c4d019705b617c76708aa84608a
SHA1 320b418800b389bbfa161c299d39e77427cdedac
SHA512 9dc3e15039d7961547c7edbcd38b6ec628e185d582d9045f2c8167bf4bc554496dc0e34cf37c8280d1175dd2bb1dda0f1fd986a1b221437e6bd2eb43477c2be9
SSDEEP 12288:cGZ1IyRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tZuosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1624512AA239820FAE163417CC5E5D609E7337C52673043CF166259AA6F73AD44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2e7058bb90d82f9638c7c4af2586cd06984c4ad3eda56329b40487169b964618
MD5 30260b7527d11d9a608c1f89fdebd8ee
SHA1 b8cbd7a4b2177ddb5783f1ebf1cde23296e65fd5
SHA512 0cf56c70830f484166beafada448fd12b9c2ec7fcccfc182b0b2a9752cd236c01a96e4a049204850a17998d2dd6217b37a7cb425fbd3b6ae39d3a87c76e8abab
SSDEEP 98304:UQRQyi36YOcPbLvw2gAf+PN3fD527BWG:7QyiKa/X+PNvVQBWG
TLSH
T10F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 85916ad2429214ff17fca29ecfcb78fd13e330e3bd8315fa7faefc19cacd3a3e
MD5 e56fbca051cc7d566116825c6abab45a
SHA1 f1433a1a4e9f53f5129b5dcb5ef6f7116ffa274e
SHA512 194e7668a4aff4ccfffba7cfe5b65023716e8e24c8b9e107b1c2f6d9214ebe292cd980ccf78e08e0c3d6b29fbf6a6794c6eed00f644289611158ce12562f4b72
SSDEEP 98304:1QRQyi36YOcPbLvw2gAf+PN3fD527BWG:MQyiKa/X+PNvVQBWG
TLSH
T1AE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2358a676a772be005550563eb931030ca2ca58777d06f0d9aa8e12bafc54da54
MD5 78fbb2fab2d7283de81d0df8a175f04c
SHA1 f3f351ed6c7064ee45e7f963cb2a55a3a48da0cf
SHA512 2f132e5bd93d5a7ea5ff1346e001ba3f7eebe7bd413ae4c41e820d0352721ce4611ead375bffb3f15b020502566127c7b341df6ecab91a45bbd16df2d06d093c
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL04sqjnhMgeiCl7Ge:F68Qg55nhceWu7PNU3/FDmg27RnWGj
TLSH
T136B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d7d778482dd3dc6790dbf27a0b10d639be29bfda2309cb83d47ab6493ce2dd32
MD5 13aec9bc739335ee2e4a87a38b78ae01
SHA1 ca749a91dd7f5258bbae532ceac9eed52bea5683
SHA512 c64ed238b5b1adb3d50f6ce46475c0140531d6b00b7cb35f977d49f327781f8c285b099ac7c136a30557627c5373ddd44c08036ecc3973bf3100551faa291933
SSDEEP 98304:9y5112gYy5azzVvt69nLKnhZ4D527BWG:gLIHEWhqVQBWG
TLSH
T1EF167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6396c4029b7e4bed0c744bd76aa01b09f2f2dc9ffc2e202bce1dc104a0947528
MD5 efe985b6f54fe2440d51d31e3b9cee38
SHA1 6cb25e16bdc7a28cd20568840ac5b3a7a045d59f
SHA512 aa52c9c50de3e8e23f3949b00427ba8427f79e32490a02d26c32eed6c2f073ca84280b944a2a3dead01912aae6270b1842fc9e90217788cbb519ecf2a2a64b95
SSDEEP 49152:4B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glnDmg27RnWGj:Su6Jmdxd2dnD527BWG
TLSH
T18AD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6f06dc32cc1f54dca2ac0e93c2e609b14fba7283c87e6b8bc92a61cc954b3416
MD5 46d5fd25146576fa021d43b6828ea891
SHA1 b7c11570db9f04b3a88b5dd2a6968f186e2ea465
SHA512 d4389568ac8a2e20da38a3a14e2d9f695aee178ae1bc205242ee282c33a31d11fba47caf6d9f48cb0f975bd234d3a6cee817b51002eddb2946c8568d15e35957
SSDEEP 49152:t1hpsNoJpF1A63U44CwH7R4xbDmg27RnWGj:tmifPWRSD527BWG
TLSH
T1CFB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3c1dcca8e33f497526551d8d013489b61204389be29e281398669b00f59b4467
MD5 28d49c67472d3eaf7b7acd34e3218944
SHA1 9b804a8117fd2e6179962860a6d605de1d4d247e
SHA512 8bf8fddbcdf7e9aaae678b7bf80492294bfa486fb0cd1977d557705e824bb7baffa04643e8838ec213b949b0efbaed9540c04395236e7a1bc35e7674edb37dee
SSDEEP 49152:lSuZQIY0Be2KcRVtOnks6NMHqUDmg27RnWGj:r5dKii61UD527BWG
TLSH
T16AC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8cd90ea0385b2fc6bf749c110e643332795531a82e2a1a61bf9d53a38a69cc0f
MD5 1f6e523942a93afce4c9b1b4b1b1caef
SHA1 8fd264e9f3d329f4fc07cb005f7394b844fe8e3c
SHA512 7ba69f3f040b66b6b9ebf3ad1e20290ca1f2b27c4b8b3c5622bb446e88981d62dcdc38689c95e870ceef7bcfbaef220990f7b13a42920a4feaef9c8f6d620a02
SSDEEP 49152:5htSn8EApI0fig3giDn0AP5wXDmg27RnWGj:IX2imphmD527BWG
TLSH
T1C695BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 9ff2e43226ed16b5e02e91b6dc59cb6c6fc7c6599dfb9ba0c6609c36d41a1fdb
MD5 1df92d117b558c8c958ff4739035e11f
SHA1 40ef7e66cfe2a5e6a4a1da182375885a892da74c
SHA512 734a5c50675db1a0e7d0dfe557dec218f49eb79f1389b1b295a9a824f3b766efba89da9a3c07c33bfdf0cddd9532f38bffaeeaa54618a6440441a94b1fc529d6
SSDEEP 12288:BkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D03523BF955C41CAE62648B5C3E5F10EAC073E5BE92004937A577CBAFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 b937513ca9981eee36c5ab2c75e480c188de67f68404a4af6a9aa3e2ffe176c6
MD5 89aa6985fae5419b3e4ae8a632d8c51a
SHA1 c51500177a2425c724dfbd6adf464eb39ccde0c4
SHA512 d21becddd682ec494fac44d1154c2fee7490384a43030d5b1b26eee128cb30aa312ceb620ed812100708f9654663576229ce49c2fd8bf40f54e1b07a1df780e3
SSDEEP 12288:U9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:U9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AD3523BF965C41CAE62648B5C3E5F10DAC073E5BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 625e0e6b3651d330b25e2ceeb42ddb8e371db7212ef64d79e06c34dda3da8f6b
MD5 d58e74cfdabad04e20deaeace69c9c60
SHA1 6dabc7e56f30b0740182b7f274295eac0d002cc4
SHA512 05c525224788d09327e840ae50ab0bef2d2cdc5730b6167ce3e80cfd488c82a63c0c6289c7e170827865f82e42be988d38c3ea8fcd806d76345a76e8c0fe74a9
SSDEEP 12288:7/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B3523BE965C41CBE52648B5C3E5F14DAC073E5BE9200483BA977CB9FAB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.1MB
SHA256 7914338e9ddd186bed388a0bec32cb8145f0a5d6f77491d8e4f9475e60c7ba30
MD5 87284870880b6a0ab154c191686fd9b9
SHA1 830b2fbf59a3f38194fb3245e53f5dca4e731824
SHA512 e581b0546e9041f68ed4675691d66359c2e487ca664f38e0b098668d4d1b66332bee889ea5017a7639f3502f46d57f94dea1bd92418644bb66de10bfe78cfa2e
SSDEEP 12288:WV+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E245237B675C00C6D83285B4C2F5E11DE8277D96EB30059B6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 8e399328f7c356c1d199498b8242f1f59ae426220c565e8633046ebc321c8df5
MD5 3bc3914cedf68baf71d9b55f3574c2c4
SHA1 bc112b377260345168e64b02fe221e3b8e7fd4e2
SHA512 4c60f106e077b2f6fc7d0fc3a78cf03a74c6ae74790ea69e2e174226ce6028d04b2f1f1ee3ce223abab3be1c81ce55651fc9d29897b7320c9606b3905fbba768
SSDEEP 12288:iGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1813523BF965C41CBE52608B5C3E5F14DAC073E5BE9200493BA977CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 40a9a8b0c45309ae24c38bc2a5552bb42dd28ac7acd4660386fbb7a13a98907c
MD5 189a3eddf87b2ef2be99d2d46a61e09c
SHA1 b40f84fbcc7f32fed177d8beea9e32f5a7f401ab
SHA512 26c6804f147a6ead50caf729c1e941e5176512b9188ea10ef7364d2586346dd5c4d8bafb6aee9101fdd45e30032a63e9c3d92b76095f035a83df36d08a28cef5
SSDEEP 12288:V5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:V5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1933523BE965C41CBE62648B5C3E5F10DAC073E5BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 033ae267296d9acb8c6fbeb3ec9d4c8184959cb0cbd61e81b0c7c93de83f0cf8
MD5 13d91657f91ffd7d53c8c86b320d7571
SHA1 e4d1c873fb2583f6dd3b8411328d5f44e2e6a493
SHA512 6201b9ee22c32253e1bd0d14656f17e409099d6e7fa32639759a128de4f21ebc58e89c6db61db538d7b2d4ca7cea02d00167fd350f4b5d776abfac6aac519bf9
SSDEEP 12288:vlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12D3523BF955C41CAE62648B5C3E5F11DAC073E5BE9200483BA57BCBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.3MB
SHA256 e745272b89c044feef6ef302487df97ef18bf3b11dcdf099d22a745a55123a10
MD5 b8cbb59aef400e599b3a86c43ab3c312
SHA1 7d5fc5a8b4d2f67d27332218d0579946dbfb036d
SHA512 edbac11ae2c95ccc4830e82c2c5a72b208f2ba7c76c050d39693182ad06b4ad789f41967da150e4124440af7b03f91a27554ca1648441fc5eb8f67a82c44f0ff
SSDEEP 24576:3ZM+zFVSOdsqjnhMgeiCl7G0nehbGZpbD:3ZM+zftDmg27RnWGj
TLSH
T16A6501A9B35418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 f4d4c0323f77938ea20e34100dbbad28926f2fdc4d284516facfc036b35d2118
MD5 6328d502974fcb0a103bb9f0dc562881
SHA1 952c69ad8c61ddded6433670d9bc662b5c0ee580
SHA512 6749c13c7e351ca37a6743e62ece76af5a7ac19d91600d8d2ec4b996a85f3a25631d65c49473ffdff99a0abf474a99f99df4b09bdd3b21b692c2117bade3a691
SSDEEP 12288:GYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE3523BF965C41CAE62608B5C3E5F14DAC173E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 28ebb3bd53e799344d2b67b6af4d3f1a0f8415d1437f0baec59687aade0911b6
MD5 e8561ba489ba4c3df521584eaf7f2bbe
SHA1 5501f8b0bfa67fd496655331eeeadcaa9754be41
SHA512 76174efcbd8bc932aa13a37ee380d3cc1794d4ae937c2f8e88bf019b5ddeb14f1e50bbcafe2916a286a6983bb48e50435fb0a7e73dcfbb709ac8b8971ea26e04
SSDEEP 12288:I8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:I8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E33523BF965C41CAE62608B5C3E5F14DAC173E5BE9200483BA577CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.2MB
SHA256 f4879223d5b95ae4df06b35e3721b6367a8c58fe481b4eeea0e5ddfb8ce8318e
MD5 14490418dc9eba1f0fe492fcddb7fec0
SHA1 1ba374c4db8fc06efe03ea06d3619b0e73b15485
SHA512 a7091666318ec12a2c47a6a0563a808ef27182c0c6c1f522cff43f37d388e1d4a873d2169e5143f953066dfce1273ea25f71bba4e86c73027e540b57008c5d4e
SSDEEP 12288:qyPz5L8RXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3zyRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A55025B73A530F9D1368178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 24086a3dbde2abed80760a4b335f504907b3de99f3c1bc99c48562a66392d9dc
MD5 4fe59065321b6e427847ff356f98730e
SHA1 36ff4e3821c92a4ab32dd144a8070902c6c581ca
SHA512 a97d859df42fc241207611d0c78c2c66bda8a7dd1aec8388e8c78be7898b6b2fc01778fccb471abaf88caf6f275424475262d0f4e15f57ec6be80e5d1e08214e
SSDEEP 12288:BYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B93523BF955C41CAE62608B5C3E5F14DAC173E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 a089905273180f05f109e03b53ac8e016d22ad20388380a4fa5bf136d02fae27
MD5 42f09a37341926b716f671e681e45f03
SHA1 9341f15105d2a515881142972e04d7d091eb9d2e
SHA512 5583d2637fd34c3b8f4f8c4ef728a4250b99f9e7f0968e9b373363444e29f6560983421c8bc3c005b298f1e592d3a5b4e628c37387d2f54a9feda104fd804c58
SSDEEP 12288:uYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B03523BF955C41CAE62608B5C3E5F14DAC173E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.2MB
SHA256 4a6a07b3ee9ca01940e91ea163b781a05c42aed3d32e8e4552d4f9f806227c12
MD5 9849ba91c687bbc959edf6f41bf6f72f
SHA1 a855a439524906c6a290574c568c3706050f5423
SHA512 7e3646753affba4ee727fbaba62ce600209c4abfa4f34720befd6c0fa101a7e5e79e0d896f99b70dca472f44dab8a1df286878899a71775b1f572eb007e9cbdd
SSDEEP 12288:ryPz5L8RXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GzyRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15C55025B73A530F9D1368178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.3MB
SHA256 d1ddcaaa1bb929c93c8b7d795fc70cd41f7f420131ce2df658e8b49b73d4ddd8
MD5 587ed3be58ab23ed26c054dd216939b5
SHA1 a7b667945e4da0709b92c03b48d37d85249d6500
SHA512 2c067b229bf0109e0bfb627c261473fecee08f330f8f9aa6fedcae050e682ae6ae302c75ff6100b93be7a3b3f2902017a8bb4132f4ee484217c8f1e49d540138
SSDEEP 24576:9TYaLl3z0zDPsqjnhMgeiCl7G0nehbGZpbD:9TvLljeDmg27RnWGj
TLSH
T1746501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.5MB
SHA256 be49a0f56d820ad2a7f0ca1f97278062361d8eb5fcc13485a2656c92e1e5974f
MD5 b0041140754844a164465882339b54c8
SHA1 3947c8d8ed6db7236f2071883ae082a3def1d45a
SHA512 f4db9fd6fc949f78cc9c89086e8adad9e24d9cd885523fa16f1a49002807eb5125420f034929d3bfff2d1dcdcb1b2f591df4ecf43a2977209e39b0abd68f6d1f
SSDEEP 24576:D3nd9CHKy7GZLsqjnhMgeiCl7G0nehbGZpbD:jnd9CHKyatDmg27RnWGj
TLSH
T13E75CF90F3E810E8F1B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.1MB
SHA256 04e1dd255c456abb01ee811e69c6fc711963917a126704834ca59f9bbbe69d52
MD5 39e72e1a74d5de76bbcc467a2000c54f
SHA1 39fa1c3e484d4e28951cb71aebe1148135621556
SHA512 dad85715f28208be1850c24bd284311741b856566600734a70992cf38e718fa98c31cc5a6ed7ef367b9b0223463d91b1289d0bc9d84dcbb84bc9c6c35618a6dd
SSDEEP 12288:/fXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/fsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1523523BF965C41CBE52608B5C3E5F14DAC073E5BE9200493BA977CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.1MB
SHA256 bf1445b6511c473d4997d9abeaa647c76f50bb6b5c3d48ed28052798b1294d70
MD5 3f10b284fe1467f76d4100f5a62e23cc
SHA1 4af4169f24f0b2f8f81f48393d88a86ee12f2f2b
SHA512 c4f6423f98279af93aaec6930da1e499d10c9f014cfb16eabed3ea86b84377c59cd673acd4725a17cc09b5513c04ce36c8cd8ea9a8f742c7d2eb7965fb9223e3
SSDEEP 12288:ZxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A73523BE965C41CBE52648F5C3E5F10DAC073E5BE92004937A977CBAEBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.1MB
SHA256 0685ce1e4cdef51cf433773c0d7a7ea3617888d4c497a7a6fa09565b7437e1ae
MD5 e7344e43196026a0265a28ac636752bd
SHA1 c9009d3dacc4fda1316363552ee7590fe5b9f23f
SHA512 517acf13aac1f51dd4c8c016898f62763dc68d0a2f2cfc9d45a64a8735cf0bbf14329cf6f740b5ade7c4338361b1a75100673298d16882221e88698d51e9b4e5
SSDEEP 12288:HSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15B3523BF955C41CAE62608B5C3E5F14DAC173E5BE9200483BA977CBDFAB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.1MB
SHA256 fec1df076fddf0f1f2990b2830e62219f02e92005bc7f6e61ecd89e4bd28d376
MD5 fd2eaed84e2c11514b2479201a903837
SHA1 7d2f153455daf97a8ab16db9f783da528849741c
SHA512 d92f240711ca002b47a5094af239f8e27e44ec917cb8bf194ed35632e56c4e44a8dc4ff5ba036732baee049e9139caadf058e00dd4a406ea64cdd12095540d3b
SSDEEP 12288:YYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D23523BF955C41CAE62608B5C3E5F14DAC173E5BE9200483BA977CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.1MB
SHA256 553e58de3f2297ab896885fcfbb25b83eb269a62892b7a1ffaa6751565679a1b
MD5 78a625225e0d35237bdaa4992bb0264b
SHA1 230689163618ed01e6a3f9353a634f46d423f054
SHA512 ed8f68c8de080caa6a2dbce33a18b735e62a39585370f159d889b06f27f71bc4895fcd14eadcc9e4a12cc4392ae4934e91bcc2baccf08bc37426f56f8d355f11
SSDEEP 12288:PfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13A3523BF955C41CBE62608B5C3E5F14DAC073E5BE9200493BA977CBDFAB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.2MB
SHA256 a1816c4c0ac3860aa4cb81dd8dc61fabb88726393da13e4aeaa888a6f05b22b2
MD5 afb793cd7e4d6979028db78f6686df32
SHA1 918a42d73fdd244b937fd1eec2834baf76c78e91
SHA512 eb77be4ad0ce32fd7979224c4ad3cfbf00ae56f00c5c6eb0d688d16f375d2d7a23d0c612c94247b4f61bafacd7d5b0fca572b7093663230e6193cc6de897ce60
SSDEEP 12288:7jsfoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BC45015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 5b384c54708b1ee9ff4f01799a5e2b57819bc2f08af0fd9894359fa42859b2e7
MD5 5c66933545d95517d5ef59d6e4682b2c
SHA1 8ce8349891bf240353305aa8d6666758035dcbc2
SHA512 95e65c3a638824895dcb7ec8fb41f78257f0eec3f062695c48782da3fa869fa20b379f65183ba522486189bba4c16c21ce475696ad51700eea47e4ef7ddc234e
SSDEEP 12288:COXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:COsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A35237FD35C518BE57659B082EAE02D681B3E669E204483B9437CFDF6B08948F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 7efe4133c6080e4d5bf54d3b59389f8f552dd9daa89ba59d5727d333687a018a
MD5 11374dcd783ef48221c729a7faa2583c
SHA1 ecad2610249364298e9b2e2627b6592814121a92
SHA512 1359d09dff923b7a48e9f4c9bd5d03a5ab77ed071f41b103c7d90071d1a6d96ed340e638c90eb3c66187233e5727d894658d26898321e5d5946fe429c0ae930f
SSDEEP 49152:qa0h2GEkuAe73q3pp46zwwQ8Dmg27RnWGj:qa0hNYG4JwXD527BWG
TLSH
T17985AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 ed0107cbe335466234acf2fe0d6a89f119c1ff4db0747bd08f91aec1cf1ce56e
MD5 3b298f2a79806958adebb942761c12a0
SHA1 9b6e53807a93b4fff80afe16efbe47ee28ec6df7
SHA512 911f02383fdfe34da994d0605c9efb26e81bf1cbe78d5db4bb3897d67342cd22ea9e2f69e9b6aca8de952544262979d3efea1694e29e871af6afe5315d801a6e
SSDEEP 12288:/hbHjfXXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/hbHjPXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14745127E12AC20D9E57291BD8296D10AD632BC26172053EF23D281BE5F37DE44D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 c53d013d6a54d9f98f4af9cbfe411fed61d08aa6eaf10d2b0296643b7a3ac406
MD5 544d71ecc6363afcf9fa4a7a0abd64dc
SHA1 0c265efb2f94320591d47654807a554d06d41001
SHA512 80b8acb374c660ccda7ed239d5336de8c8e18df94117f0240450474e69ee518e6cdeece53ab156bd0cab270edc92ce9b64829a448c4ac6fe5fc833d69e929452
SSDEEP 24576:23YgnJcRTk4yti+R5dpR//sqjnhMgeiCl7G0nehbGZpbD:2IgnaTk46ppR/jDmg27RnWGj
TLSH
T1B045BF2EF2B910B9D8A6D136450147B5FB71782D1F209ACB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.1MB
SHA256 2e330d3bdada6d7757d523de6f764dac54da9393c7c5e394db028809679e81f5
MD5 4fea91b872af3a351b5ed5e09981a0f6
SHA1 7e024cdee91a3f6780579f6beee6f315e38eafc4
SHA512 589fcd78ca7982ba425d197f8bc35786807154c4c80b39caf64481cdd117fb2cb61e9f8ea20d6d2c7366681dec9a3de836dd67d8220e1d32a5091a2e2f6b7d21
SSDEEP 12288:DyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1483523BE924C51CAD93649F5C3E6E11DA8073E569B2004D379A77CBDE7B18E84B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.4MB
SHA256 9593fc404ff2a131710d6ca72e1dbd92a1171c8038f9a61996cdc7fa4b23d6d0
MD5 1641d4decc11e33263a3d23f7309e79d
SHA1 a30b5c96441cd095e85d2fe0864520df831009a3
SHA512 5a4b48e49fc0cb45843435c861d0d0950bfbf5646302063bed5402a89c5fe617e30b912cdc4e4072ddae12ec770e98379c928733cde14cf248c64b4b2f04a1ab
SSDEEP 12288:IObHA4LWOsvAYFTJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:ljL3UTJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D3650159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.2MB
SHA256 2f114ba163579d3538654aabff65c2b388a6607dff0ad50c8281b8ec31731077
MD5 48b6e0c5361f3d1c2db709ed5afe2933
SHA1 fe1c050c43e03741cd60d3356cda7b81a2a99af8
SHA512 4cc0aa0fab82d7d519489c7d6c9b1568ae8d11b452b6f5e87ad537368420d8b63a2e2f358cac79bfd5c58aca8dfec7aa82897764071fdf01c5a524ac73420bb0
SSDEEP 12288:YpFtQOtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7OtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18245022E33EC10E9E536917D8692D20DD6327C660B2117DF06D184BE5FA3EF84D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6380553bb2fd24398eb319356106239874a139f5f7582b38717ddce762655f69
MD5 ca710bceb2309dad725803fa03bf13f4
SHA1 5ce39ce99a78b486334718a1bb92450554d467be
SHA512 2a60f4b1be0d165177bb24affa597dd27793189aed0c8f3fba81d0d1299c507b567af687b24ea027f3f6ad8930c649ef33ed522584d5bc4a47fe5c87622bbdd8
SSDEEP 24576:v7NM9YmZqmWMUkPjZM48Mv6bEhs+sqjnhMgeiCl7G0nehbGZpbD:v7cBWMpPjN8DbEhLDmg27RnWGj
TLSH
T15F659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 517a5880b1132fa9aa91b4a2bd0229b5e16c34cfc264904a6dc05c820d59a8b8
MD5 6b79cb44e49c3f2f8d65ced60d123627
SHA1 04db03534a8cac06e43c8868dcef1bb7c61e3adc
SHA512 d54bd88fcf5b94a7328202caaef3cf74aaa1858b812d16bc76dc7032b06dfc1679336426cf69f9f9e6eaebb85b56feba5cc1bd2f6922cb2442e522b1385c6db4
SSDEEP 24576:qW6BApg2YuyuNDYTabvcRvNYf8km1csqjnhMgeiCl7G0nehbGZpbD:qF2YuHNETovcvNYf8kmyDmg27RnWGj
TLSH
T192857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 a2d2a3cc8b731c641bfa0151a0bc35801c74c980ecf41d6460b3a89ee78c6806
MD5 0f4dfc69864329994bc60a1186c31d44
SHA1 2e0eda263578a0b72ae224fc7c0fe2fe53fcf4ba
SHA512 d6fcef556ff96fb5f41ecb80876438a2e4200644380288e3083ce13b4f06899f72c0a81cc2c0e1a94b942374da899869207876889c25a066e47037903cf56caa
SSDEEP 24576:iAFs06+OmlfkNXEbTohsqjnhMgeiCl7G0nehbGZpbD:bFs060lwXucDmg27RnWGj
TLSH
T11E65BF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.4MB
SHA256 752684b7bde42082493591a12ed2d5f7f5f0df1a03d12cff9aa033b8d1a0dda4
MD5 52f69d67c01e4d7aa7ac67281413a468
SHA1 8eba9f87f6eeb84a2acdf7128e11fff38885a0a1
SHA512 96bb7ffcbac2b58d6122adaad83cfc648a45a9f3c42fb3077bcf73029d94089ce86b628f19a53568b85b5a705ae917a1b24f2688069f17de8345b4b6f2144ecc
SSDEEP 24576:HJnJ5D3WYgsqjnhMgeiCl7G0nehbGZpbD:HJnJ5DGYcDmg27RnWGj
TLSH
T1A265E13DD2A810E8D4B7C2B4829A5746FE72383D2F2169C728B4D5357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d9ec9cb39e00949cce09b0b24b7d094cfdeaebfed57fd60227bfbcd0b95810eb
MD5 13a1fb2adacb49d4368ef8f9580bcfd2
SHA1 2e81385daf5322623185a62e9599700f9fe52877
SHA512 a5a757829acf3a9aa3c38af8304a3f5b2577dd36f7cf2364245c2fc5c34bc48712db68a7cf90fa63ba414f68605de821d7380e691f419690218113f62909e42e
SSDEEP 24576:eEPohm6/7IIXdwcXrif7qQncjlP65i3Vu/sqjnhMgeiCl7G0nehbGZpbD:5o06DIKdwc+eQnSt65aVeDmg27RnWGj
TLSH
T192955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 c02c0d1d72ab0379718d81d827918f0c54bb3c30f7610b2c89bf17a6f5b5b7d9
MD5 49a6b52004dd3e2d005fd0e32eccd6f8
SHA1 5b05e04175024781be78877a2c7aa51cd8bc5f59
SHA512 e01384ef0e6c7c144db193a2a1b4bed65668f81659cc943a6744b238c7ffc3f820aea4b79186354264838fbbbd5ed1b6fe8938d05624f77dbc2782b67c1a2ffe
SSDEEP 12288:6EP3R6qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Z6qsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A45126E679C60DAD136907D82A1C209D733F4716B2127EF2692C57E8F739E80E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.2MB
SHA256 224d9f5dd615c25834f9b8653fbe01b41edad65827d4c311697869002a1daf48
MD5 5d2127ae37d519230c9f550361a415a6
SHA1 63a02f39d637775e84ae6dffd0dc60374a58a051
SHA512 b883a402e4055b73cac164e75e102ec5a5528a1a5b3e5eeac75dfea729218cf3b5f4e089df387f83ffefb2f993c0cbb4fbda0d7708f8152c5cc1f276d8e2a533
SSDEEP 12288:djkynXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dIynsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DF451219639C60C9EA760578C6B3D1589C36BC319F2042DF6591FA3EAF72BD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.1MB
SHA256 302a2cab27c12abb9ab110583ba0550ddf9feecfa81429463fd177865534ae30
MD5 898c93821e70a143bc7dd35d50064f67
SHA1 dee8d72270c26cd22276b19aabd194fb7f55b33c
SHA512 7d0ace53f45317dc20e5300e63e04b92b5d6ce33c57d5b9dc5a976ea6adbd853682b190892c1a1c03c79e73d924023487bd3e5e65d4b755fab66202e83b33d57
SSDEEP 12288:L99Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:B9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E535237E525C60CAE93245B9C3A5E51DA8133D766B2014E739E3F8BDEBB24D44B38813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 cedab73eb2e15df5a80517468bf17b639828a484b08d3ea601e0a9bfab0c7602
MD5 2ee82fca3d9acb06aafddf1b6397d8ec
SHA1 1cc1f50f28a3c6b692f087a4f322063794830642
SHA512 caa2bd2cbc7497ce95e1660f56e255e7ac2d24d3e7908ee95efdd3f1be66285e5be7a317ce161c9a80998ff2a3506e09241ecddd868ca4a17956b6eaec2f6ceb
SSDEEP 24576:RQ9MxZKdcz97w32sqjnhMgeiCl7G0nehbGZpbD:RVKX6Dmg27RnWGj
TLSH
T170558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 123329506c330ba6ca05f88e021e447bb4476631328fa4d09e1e41f152cd2d87
MD5 3a62d71e767ed8add4aa9134b2f722a8
SHA1 7d26879a62b37793e15dd98152f12138741f619a
SHA512 937dd872a6dd8f771f58bbf8ab516343ace06dbbd920efcd1043f7eb9a186b436d646f46516777e2cce345e813730d03c31003100b9936a0af98bdde5e226c8f
SSDEEP 12288:wyoKo2fRple9prXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:wyocJAprsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10455E01FB76D40E2E176813C8985C249E673B4305B6157CB6692C73D8F639E8BD38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 be72701e324bddaad9f3ac9347b905b3163f6b2923fa1cc9df936c89526b321f
MD5 49e96432b940e4174c32b8a083239fb7
SHA1 14e3bd21f8ce09db87bc339838d2b936170c035b
SHA512 1c8bce5385522da05ed583bdb3ce7da23f288e7a7852f9af06496a76b7ac6e9e19ce89dd14798c797046ede5484e191c84f848f02f558c1a79f0d8811c1e3cf0
SSDEEP 49152:nWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKfDmg27RnWGj:f0zuNIzD527BWG
TLSH
T160A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1216-0-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1216-8-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/1216-9-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1216-12-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1216-14-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/1476-479-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/1476-421-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1476-495-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/1476-601-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1476-501-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1476-507-0x000000000CD40000-0x000000000CD48000-memory.dmp

Download

memory/1476-463-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/1776-400-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1776-499-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1776-394-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2304-16-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2304-23-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2304-24-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2304-22-0x0000000140000000-0x0000000140130000-memory.dmp

Download

memory/2304-213-0x0000000140000000-0x0000000140130000-memory.dmp

Download

memory/2308-410-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2308-600-0x0000000140000000-0x000000014014C000-memory.dmp

Download

memory/2308-500-0x0000000140000000-0x000000014014C000-memory.dmp

Download

memory/2324-299-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2324-293-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2324-301-0x0000000140000000-0x000000014011B000-memory.dmp

Download

memory/2324-513-0x0000000140000000-0x000000014011B000-memory.dmp

Download

memory/2364-390-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2364-498-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2392-230-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2392-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2392-50-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2392-41-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2548-322-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2548-325-0x0000000140000000-0x000000014011C000-memory.dmp

Download

memory/2548-530-0x0000000140000000-0x000000014011C000-memory.dmp

Download

memory/2612-514-0x000001502A860000-0x000001502A870000-memory.dmp

Download

memory/2612-522-0x000001502A860000-0x000001502A870000-memory.dmp

Download

memory/2612-515-0x000001502A860000-0x000001502A870000-memory.dmp

Download

memory/2612-519-0x000001502A860000-0x000001502A870000-memory.dmp

Download

memory/2612-518-0x000001502A860000-0x000001502A870000-memory.dmp

Download

memory/2612-533-0x000001502A860000-0x000001502A870000-memory.dmp

Download

memory/2612-535-0x000001502A860000-0x000001502A870000-memory.dmp

Download

memory/2612-534-0x000001502A860000-0x000001502A870000-memory.dmp

Download

memory/2612-517-0x000001502A860000-0x000001502A870000-memory.dmp

Download

memory/2612-516-0x000001502A860000-0x000001502A870000-memory.dmp

Download

memory/2612-520-0x000001502A860000-0x000001502A870000-memory.dmp

Download

memory/2612-529-0x000001502A860000-0x000001502A870000-memory.dmp

Download

memory/2612-528-0x000001502A860000-0x000001502A870000-memory.dmp

Download

memory/2612-527-0x000001502A860000-0x000001502A870000-memory.dmp

Download

memory/2612-532-0x000001502A860000-0x000001502A870000-memory.dmp

Download

memory/2612-526-0x000001502A860000-0x000001502A870000-memory.dmp

Download

memory/2612-525-0x000001502A860000-0x000001502A870000-memory.dmp

Download

memory/2612-524-0x000001502A860000-0x000001502A870000-memory.dmp

Download

memory/2612-531-0x000001502A860000-0x000001502A870000-memory.dmp

Download

memory/2612-521-0x000001502A860000-0x000001502A870000-memory.dmp

Download

memory/2612-523-0x000001502A860000-0x000001502A870000-memory.dmp

Download

memory/2656-65-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/2656-74-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2656-231-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2656-71-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/2996-265-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2996-261-0x0000000140000000-0x000000014013F000-memory.dmp

Download

memory/2996-502-0x0000000140000000-0x000000014013F000-memory.dmp

Download

memory/2996-271-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3280-29-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3280-229-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3280-38-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3280-30-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3300-503-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3300-380-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3300-374-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3348-289-0x0000000000400000-0x000000000051D000-memory.dmp

Download

memory/3348-509-0x0000000000400000-0x000000000051D000-memory.dmp

Download

memory/3460-264-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3460-262-0x0000000000A10000-0x0000000000A70000-memory.dmp

Download

memory/3460-249-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3460-250-0x0000000000A10000-0x0000000000A70000-memory.dmp

Download

memory/3460-256-0x0000000000A10000-0x0000000000A70000-memory.dmp

Download

memory/3492-333-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3492-327-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3492-563-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3492-335-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4020-350-0x0000000140000000-0x000000014012F000-memory.dmp

Download

memory/4020-245-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4020-239-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4020-238-0x0000000140000000-0x000000014012F000-memory.dmp

Download

memory/4172-368-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/4172-497-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4172-371-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/4172-362-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/4496-512-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4496-510-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4496-304-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4496-312-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4496-310-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4564-596-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/4564-345-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4564-347-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/4592-81-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/4592-61-0x0000000140000000-0x000000014015B000-memory.dmp

Download

memory/4592-53-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/4592-80-0x0000000140000000-0x000000014015B000-memory.dmp

Download

memory/4592-62-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/4812-277-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4812-283-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4812-276-0x0000000140000000-0x0000000140131000-memory.dmp

Download

memory/4812-506-0x0000000140000000-0x0000000140131000-memory.dmp

Download

memory/4968-358-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4968-597-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4968-352-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4968-351-0x0000000140000000-0x0000000140168000-memory.dmp

Download