75b4f6c8570e892885ba9cbd953f98445ce3bfdd341bcf58182324a467d29639

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_18fd69da20c97acc9f9d4ecf8912da0e_icedid_mespinoza_njrat_ryuk.exe
Size 13.5MB
Sample260701-ar7bcabt6m
SHA256 75b4f6c8570e892885ba9cbd953f98445ce3bfdd341bcf58182324a467d29639
MD5 18fd69da20c97acc9f9d4ecf8912da0e
SHA1 0262dead7e60bcf92bcf8bce2ba6c952b2958b4d
SHA512 e0d0c46eb5c797b8d9e60638b386ba7ef6a056159bbd1ad41b7632bcd7a08e38e00f90a60c2c64b6d490d1b1d9583505f3186b65c3048207d16983e30f0592df
SSDEEP 49152:dNOG/i0zDH2uS1GHdQdP8RXLyf7FFAqjgVAp2IvGmq8VNCdNoYQF1DVHEEHMI9I4:H31+4Sm8VNVhH59Iq/izqNjlklLm
TLSH
T173E6057696B4C288C1954037C54A4CFAA36DBC11D8B3A23BD5483E77FA3E5D0C9BE219
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2464	elevation_service.exe
1068	elevation_service.exe
1884	maintenanceservice.exe
4704	OSE.EXE
5780	PerceptionSimulationService.exe
1900	perfhost.exe
5864	ReFsDedupSvc.exe
1676	SensorDataService.exe
2752	ssh-agent.exe
5032	AgentService.exe
5772	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-30_18fd69da20c97acc9f9d4ecf8912da0e_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-30_18fd69da20c97acc9f9d4ecf8912da0e_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-30_18fd69da20c97acc9f9d4ecf8912da0e_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2ee840cac4173e65.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-30_18fd69da20c97acc9f9d4ecf8912da0e_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-30_18fd69da20c97acc9f9d4ecf8912da0e_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000061b4a81f008dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000672fbcc1f008dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2c10c82f008dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2464	elevation_service.exe
2464	elevation_service.exe
2464	elevation_service.exe
2464	elevation_service.exe
2464	elevation_service.exe
2464	elevation_service.exe
2464	elevation_service.exe
1068	elevation_service.exe
1068	elevation_service.exe
1068	elevation_service.exe
1068	elevation_service.exe
1068	elevation_service.exe
1068	elevation_service.exe
1068	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	528	2026-06-30_18fd69da20c97acc9f9d4ecf8912da0e_icedid_mespinoza_njrat_ryuk.exe
Token: SeTakeOwnershipPrivilege	2464	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5032	AgentService.exe
Token: 33	5772	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5772	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5772	SearchIndexer.exe
Token: SeBackupPrivilege	5864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5864	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2464	elevation_service.exe
Token: SeDebugPrivilege	1068	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
528	2026-06-30_18fd69da20c97acc9f9d4ecf8912da0e_icedid_mespinoza_njrat_ryuk.exe
528	2026-06-30_18fd69da20c97acc9f9d4ecf8912da0e_icedid_mespinoza_njrat_ryuk.exe
528	2026-06-30_18fd69da20c97acc9f9d4ecf8912da0e_icedid_mespinoza_njrat_ryuk.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5772 wrote to memory of 1312	5772	SearchIndexer.exe	98
PID 5772 wrote to memory of 1440	5772	SearchIndexer.exe	99
PID 5772 wrote to memory of 5276	5772	SearchIndexer.exe	100
PID 5772 wrote to memory of 2428	5772	SearchIndexer.exe	101
PID 5772 wrote to memory of 2976	5772	SearchIndexer.exe	104
PID 5772 wrote to memory of 4668	5772	SearchIndexer.exe	105
PID 5772 wrote to memory of 5396	5772	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-06-30_18fd69da20c97acc9f9d4ecf8912da0e_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_18fd69da20c97acc9f9d4ecf8912da0e_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:528

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1068

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1884

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4704

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5780

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1900

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5864

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1676

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2752

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5032

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5772
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1312
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2132828192-1552876075-2324613956-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2132828192-1552876075-2324613956-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1440
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2780 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5276
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2428
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2976
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2780 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4668
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a2b0fb5c8515faf325c8165a31dae2a2b35bb0f855a15dc948556ecc654cd68d
MD5 ad0655f5b3d432047adf5eb065f227d0
SHA1 bcce79345e77c3abcd2de836974bbf7ceba3d65e
SHA512 daf3baaeaae8cc7659b5208b3aeaabddaa0cb11136f26b16dc403fc887d1516db3cf6271dd4ee42b4d4b501640c44b5f46e6291ca101772546c97da6035bc702
SSDEEP 49152:hb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnaQ/lFTjN4:n3q6HjBSLm
TLSH
T153D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 77a2c435944572eaebd1f749d6bf3419f03c7ea1ebf5a5540e11cc2f38fc27f5
MD5 e6704ea47d2b5dfccc9f404fb15d8465
SHA1 62a7667ac65887d2c4f3c176a7f80f58fcf5a96c
SHA512 783c6eebf8fb34b3d5e58ab6d9063c40fee907bd03e0d778348be70c7c722362b3cc4a82f2beaed2b4bc9e5a1d72537316163c955299fd3e9d050a83fcfcadc7
SSDEEP 12288:z1XLsswWkxy2lRq2czAJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:pXYfDtczAZnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T12865F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 dfa3437a06b45be7beb49de24c14143b3ae09158bea6bc65c43cf11e562dd85c
MD5 cb681be2387e2b36a2181347ab093a3a
SHA1 ca72cb7a8b8b15a013e0f3166248d7d43a14d3d0
SHA512 4a27d7feda032f34d3b26f92e4738109fd113e198bef23b311a51ed4be64f3dbffc8ca2763580adfa1f8f6b62017a7edaa94b6aa45caccea0588de4a04754c19
SSDEEP 24576:/0Le5ji0hmxLrMSnQ/tbw/2Mkjy6Fr7g0oD:/Pji0AlvQ/lFTjN4
TLSH
T150859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2655ff766d57fab799b3e508de18c79022eac1bb8c526f6c4fc80269322f4021
MD5 8ea4be2f543454e09242b082404fc6ca
SHA1 22a2a0a71c2a256899aa1937a798a7d50ba8c017
SHA512 b0a218621f3d4a07d0d4921226919cafa91d73658fd8078671d803022512218368543d60f5791c4847b080b17eef527ddb3482ed4895a69656b5634a8982b6eb
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWE6q8wyuUnQ/tbw/2Mkjy6Fr7g0oD:9/ezSC6vUzPvxHjybQ/lFTjN4
TLSH
T199755D15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f5d5027ebbe1a436af9215d05b38ca477f715a940feab204af4d3800e25e7f8f
MD5 02c56e6253b9fe89e5ff905fe8023fa1
SHA1 7f1cab6aba90b5570a87d358ea1cedb49af6a785
SHA512 1f6e4ab8843b3c5b9dab69867193adfeec6d1fa4b65879fa36df900a6efe3090b7340f36ca63f39b16feb57fd92ea444eef0eb507668ffe75e2c4ae7604a5612
SSDEEP 24576:iVbqPb88hv/l+6tnQ/tbw/2Mkjy6Fr7g0ow:iVO88hXl+eQ/lFTjN4
TLSH
T1B0559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 5e5772a3e7bf959332a3d553ff5e79c1cd0984ef28ce42803d6d0a519af5e1b0
MD5 8dcf1f922a367f473ce0522a4b3e304c
SHA1 b274eb9122e1a987dbfb0fc7f1c239f4913a13b6
SHA512 fb2d29de652431cd7771ef25a09085cc22440959637ad2743157487ec3d40ba1673df451cce61bd4449078323dac6b873572e6741cad5c6c75d0d6dde147e00e
SSDEEP 12288:vzGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:vzmnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1425523696A24F897FF2B06B55CC384826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 cb9b6847f773dec8ef594cc55ed875e95e3d5090f79f12e3927fded6b0ac420c
MD5 a8bde01dedcdb8a4a52f251c60cad2e1
SHA1 6bb3a7ba2524f1333f0bb4e608f8788a7f1eda0d
SHA512 68571715f71557f94e8e422f7b5fbef6142573aa51ab6aaab87989e81e78dff599c5e05d50eff63997790d5dfa98acb20e82df3acf548b02a89c0dc1ee361386
SSDEEP 12288:WeBNUbTVO86UFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:WJIUlnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1FA75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 15fc3bef6daf3f56110b5f9aab6c1532bc2838f6179ed2f7ac483b0c285decac
MD5 44576a59fb219e99bebc1a820cdbb3b7
SHA1 5f85140632470b6928284efa201427fe81b9470f
SHA512 9970b93de5c2cbbf81af204370ed954f4c4b3bdbd357292a0f972eca4f76ecaefb69e980955fdffee16b37a0ec384a2a7a90452a81b3800efed8de013215fac4
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH9:XQvGAdlCEL8c/yRNw5CXLm
TLSH
T1E4267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 9f507efb1802df05fde3f5e34e503a39d1818a7f80a0aef2c016d5d58b15b724
MD5 e5f7459c38968d22a47c3adb5694ac2b
SHA1 89730c6100a2f108e36ff8350eda83bb10aff87a
SHA512 07c79199e7405963590eb850bc864f0b9fab3da70e03d6206df96c45086ec9aeec14ce3041eae0fc7e9b40eb84dfbb29399810db9c2b62d3569399e313e3df0b
SSDEEP 12288:VAwSfxL/2Dc39DLLmt0LDQewsAjfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg1:2QewsAj/nQ/tbw/2Mkjy6Fr7g0oT
TLSH
T18475E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8160952289a853fb6d97933fda6fa4cbf833b46922cf54c18df4a6f2a42f1513
MD5 c426b4e732fc33ad1a8318a5df1c6c4c
SHA1 572fed0e0b8c91541d010ebfe974f92c9dae4cef
SHA512 544f63fe04fc003f6af4bf29228e1336365dbfc90bd2db6e00655180cf5a342759df1be8356bfd97ee656ba5994dee1874e620bb9d5dbd15507a8a63eb8e0222
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHML:dUEtQevvqc2W1cpV2EI32
TLSH
T1CA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a77d4f5f976cb3ba90980fb72f294e47cb3d74f270db37c2b89bce106eb5807a
MD5 8489e0da67ae3fa41f48595a2797e110
SHA1 fad87422f3979d9a75a5877b8d82926eb047ee20
SHA512 c9b1a67f4b75d5ca77d0f841e0ac94c94fbd7aa876285118663f4a94ec1d0f5e9a7f9c86712b89c4e8d8b3344bf08af0b9632045a61ac8b38d7e4773ecebdc13
SSDEEP 49152:7CbRquA/m2yL5zQfFiV+XenmE3/zfQ/lFTjN4:koqtVjnmDLm
TLSH
T10FD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f71c516aefa995fa00250ce7c949047316c9ee5e8fed9eab4ec75e8986492f1b
MD5 f147d62e9bf707f5b3628b5181162b09
SHA1 6dd0fb798375279a8bd9e4801e625e99bc70cf5f
SHA512 917be54fb262d5778f86d37b5cbe72fd94df695e953788c3f1381f30d1ce887873efb6c20e14e2fd0beea0977e992d84b9fd217471c7d196cfa8ccf914004dc7
SSDEEP 24576:pAhGLJIFoiwtA5l7S53QnQ/tbw/2Mkjy6Fr7g0oP:pAMyFoiq5AQ/lFTjN4
TLSH
T1AA35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 ee23fb7cc08b25b0610bb7e93d031841c82d8a855603357f7f9b83e129f78a03
MD5 71e07cee9ba3cbb1bfa7a001da1e9419
SHA1 75c6e2a04071e2b0b93b00d647ceeb8202e22d03
SHA512 fe303ae4566f152377693b0b61559223d6e1d8d6db67d72c7485037a510606935571276d5abc55d47d4da3f89827b6c30ce1b46df215082015ad8975a109147f
SSDEEP 12288:Ymw5HEjsChN2BFgl0WDm+CUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMh:VwuHOW7nQ/tbw/2Mkjy6Fr7g0oyB
TLSH
T11665F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5c4ee0d1c641593bc2267046b47b8323465eb75bd477bd56870e53522d8dd076
MD5 fc0e8f7b2b76c9cf5fad3250d34c290a
SHA1 2f92b975a45099092efbbdbb8ad535a77e0ceff3
SHA512 94dd5192ca5449d5b0a22298365bf83ffeb52723aa79b8569b349f5d0e0834028558f675baf7cb841dee90c262da9482de3aed24bfe67f9d77d97d105a8d52e8
SSDEEP 12288:AXZ1IyvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:IZuqnQ/tbw/2Mkjy6Fr7g0om
TLSH
T18255126A33A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c4e4b33405bcf7ed33f81edc4b1ba9ae143b4aa4ac26bbbc8610d39f0393b38e
MD5 73744f2d2654f3eb70f8cd9028518c18
SHA1 b3c1ca24f3f18ebe4d3f423ac5b813057128cd19
SHA512 c88cc327edadd3d75384a623bae8446e073e5f4eac4fd42d1520a6ead1b498267b027f8b8c661b98bd6490b2a74acc25844470a9ef1b421810adf918bc733432
SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U5:7QRQyi36YOcPQLvw2gAf+PN3WLm
TLSH
T109666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c034f4b715d7cfbd332ee66b18e20e083c734efce922fbd41c94246815c78a33
MD5 d37ce51da282de6ee6226a4e65adec64
SHA1 088bb2571e3bbe8a6e0b281ccf720e45852d190a
SHA512 9274254c4cbd0889aa326fd2125d954f1597d07198b721eb78850c7f4018c82835a1163e9d0beeac6d6b269000ee050f91173a899ef1e5ead69136a73c619b54
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U5:iQRQyi36YOcPQLvw2gAf+PN3WLm
TLSH
T171666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3765d0b0cd83fb8108a9e2feba80aea710482177f0c654e8c601379e7f33b7e6
MD5 155355750d16fbd151c82e1914ed0565
SHA1 fa6b0c1f7ed714a0c5b2f8d796168924a4c03d54
SHA512 598dbaf8e2ad83d6c60d93e69864ca0aaa10070eb5c0b45bda248007f54444103e354a7281f949b7ab4cf6a5c728e5d379df956095821fc82653438e27db558b
SSDEEP 24576:1wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0anQ/tbw/2Mkjy6I:x68Qg55nhheWu7PNU3/vQ/lFTjN4
TLSH
T12BB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2397efe94817a07f547a353389cadd84409791cd81d8a677878f2cb8c1adb900
MD5 d2caa85d1120ec39fa71bc964db6e8a6
SHA1 9c37b55e5cf4a4ab42028a57606188f5fa637abf
SHA512 fdd8f7398ca3664f62828655426cf3e7f8bbb03e1dda0c3609ca93a7e69041e1e6b738c8b3ed5860687feee75c97841cf58cdc85c2bec17b42829932a36f71a5
SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99n:4y5112gYy5azzVvL69nLKnhZxLm
TLSH
T1E6167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ffbdfc00b56ed1a336acdeb5ba0c5bcd12f6ff93d1f2555c336596bef3afea8a
MD5 94b2e8521c43379c2f1cb8b5cad380fe
SHA1 fd61f57068ea3758d952ad8987668fccb54ab2ad
SHA512 69f0491d7c57fbe16134adef1f25421cb175af4edfdbe8c89721e79c5467d33e3a22091d90f03ad3b1c88c1a1718fc24e86f0fc35070425717e3309a42ed9e94
SSDEEP 49152:sB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl2Q/lFTjN4:mu6JmVxd2dBLm
TLSH
T175D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2d329f19fd5aaf4eaf9f6e982e6f0d3ab2654cf09e78fa5a874cd7af3e0b1eb8
MD5 0caec18e63297fe9855c06e706de5f3a
SHA1 51e2282ccc3ad93b08e02de1c64f5692576c8528
SHA512 1751c71e19c6e3f6a7ffa55f3f0bf3a891d509eb462fac2959eced0ab047bfb72c64d464203aac6a722f529aab362f6e8356c714cf176d5c4e4bdda9d12f9d6e
SSDEEP 49152:+1hpsNoJpF1A6UU44CwH7R4xFQ/lFTjN4:+mifPbRDLm
TLSH
T154B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9a6eae19d9c68bedfc89b8467a48870fba067b92f736bb2fdcdedb3da64936ea
MD5 63468b7b50c9a0cb336c775fd916e90e
SHA1 3c382f84df9a941050bd9e0d11c643be68d174d9
SHA512 8256c45da963b9bcd12def7ad8c5017e25685d328f81893fed10800efab9ab22c8923efafb38db6bb8df2732703f82f74a8454a9d9aeb4abd9671ca71713e0c4
SSDEEP 49152:eSuZQIY0Be2KRRVtOnks6NMHqqQ/lFTjN4:w5dKTi61lLm
TLSH
T1F1C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3030c8b4b416ebc1e3fe496dee713ee986e1860417b3d4f622be230b2e733b61
MD5 b67fb857443f3959652620ee6a663b3f
SHA1 567b3d95915b6f2dfc78a6fc6e91064986871afa
SHA512 a89e6b2ee3ce0b845497df68459fbe2e33e584a9abc3a68f129031f5768af787aa6b4656835104bb1e96192285a12ffdcde82df9fc103961fbdb7caab64d3891
SSDEEP 49152:VhtSn8EApI0figngiDn0AP5wZQ/lFTjN4:kX2iyphvLm
TLSH
T11095BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 7fb5693a4a060f443a3688087ee7b320a92d9b41473d0505d625386a4bca16a5
MD5 2f3742045466501f973438ce256c5f6d
SHA1 dce62b0fb0ec1a302cb615ceb56dd196c007a6ed
SHA512 3d194174a4e8b62a4449d320b0130b4aadd92bc96de7238ac8aed4c180f77961291f9d1fbd6a544979318f70d64324fc8db245613a7221a52569935824ad75ee
SSDEEP 12288:7eGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:7enQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1DF5523697965F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 dc1e03d167b78d497376977b32773ac20eee8ec8dd4157259437b73a4734c882
MD5 478c9ee2c280a59a8e46c5bd41dbddd6
SHA1 f7d3e13cfbdcf59e516f5e385d6f667ddf561d57
SHA512 1af59872c043219c88af8c3456e70e3c49b296ef41b538bc2beef592b7af024c8b1f92a4e4723dc5c3bc2467088870612a05a9ca16dbed85f002cd5e118e8672
SSDEEP 12288:bTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:bDnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1CD5523697965F98BFA1706F14C8281829B3F0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 87fc8641a2232a7a8c47e9f5d1db385610c6d3dcaa91c8c2a9792029a028e7d1
MD5 e9b16eeff14579fb0e1e0720f12741cb
SHA1 ccb250a0ee79b5887bbc13fc565b5abfd99acc86
SHA512 b6798c1e5015c3e3daeaf722df681048a6f41682a0e09e7efc1982502a2b04beb57ea80b5c4114688a0968b5772c29121f194010e1ec4cb92fd00f38bcae2501
SSDEEP 12288:59GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:5dnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1545523697965F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 c548aac5f04f42954ae405cbbaeb58fdafcea8c85d47a6948bbce74b697bd9de
MD5 f4a1a4ccc220c815f1e4e7cca9a9ce01
SHA1 ab9e762c9528161475c0e501e0c5a06555a0da91
SHA512 e84936e0370967180658fd185219ba52cb248c25d1cfc2e251d4de2bcc6db0865aa69403667c02ebcb4b1fa0b234d11a5b45e7dd1ab235fb2a650e234eaa6746
SSDEEP 12288:CVQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:LnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1295523693A69F4C7FD2742B4CC938142E77B3DC5BBA1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7c4afc0d30e4f7e27ffc158cc959d358948696a945664e699c15ac96411cc01b
MD5 f524e2c3fb9b9d35d4e0632e9a2d9be5
SHA1 88ed077622d762661ca08870119dd2f54ab4d430
SHA512 6efce10a3e40d0b2bd921c733b5484cce7ac0daca2817d8ed6aaf2280db81689e86f2d70766f6c6d0920a364a46ea32eed7073d569b866ee1b7c74be23990fcd
SSDEEP 12288:24GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:24nQ/tbw/2Mkjy6Fr7g0oG
TLSH
T15C5523697965F98BFA1706F14C8381829B7B0EC6BFD1938F7B4C2128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c880518a7694754e7f1e2f8f2f457c7ba43830aabae89c56840ce05151ac6ab8
MD5 1be85ddbbf0265c37a4a895766e8fe05
SHA1 1939997b655d1b503e8e2f94cf2d26cf3e313b77
SHA512 7e60a7a020519e6e5a5a0bd20594ecbd069f71751f1a1908537efef401eac60720af5876f15e1317035437b7e96e654b3f718d39c0367e4ffea3d279ac1ac076
SSDEEP 12288:OXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:O3nQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1685523697964F98BFB2706F14C828186973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 9ece623d0651ba373199a44c5cf91eb53b9b41f8a0e3e55c509125f59f8f3759
MD5 9326f309fe6b57a3ad88c97bf9791a1f
SHA1 c4603b813a8ea470364a4bcca53d01c2a69cf3ad
SHA512 43e22affa2bf2fcfee0faed43bfe751bc1cf39ea54315151d19304980596a3b4b93a465cdf76057ec71777d1cf3856d65a1cb2d9fbe4c597796b140c32220dcf
SSDEEP 12288:N7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:NrnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1455523697925F98BFB2706F14C8281869B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 068dc56116d1c0e0ec621b5fbc58c613a7cc33769d1b0f6de21a94d082fbabf4
MD5 04d2f68f1e9ec76cbc8b15d5c75cbe83
SHA1 97b202dc0156353b4d1f45ef154c3f9646154c2b
SHA512 c1a1d7e3b3a860fd0fd7e8d7e0d1a9766600825784ca34e22d2b19a2ff42f430a29b00dca340dd998ffc235d25ba0bc21c49a4842a60b52e321e41eb7abc260b
SSDEEP 12288:giZwbDzzFEoS2cPvyzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:jZM3zFVSOjnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1B57501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b7a20d3ec8da365bb8ed964b60102b06fb883ce1d2b2dbb9307c7641828aa7d3
MD5 2988b13fdfb2a0b1f080fbd27fdfb545
SHA1 068aaf7da7fc5b22f349c3f7d107af277e718425
SHA512 b59c69a1abb3679b1ab58258eb5534859651f80ce12cb530102d73550a43248a0f03018dac1594489def159d5e5cc1b776869f359c109903a5246e6ce8104871
SSDEEP 12288:n6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:n6nQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1605523697965F88BFA1706F54C8281869B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7b6e89788b7049b73db26ff070f24eabf29e2f4a7794f0dd129ce4687984ec9a
MD5 a47cb8b558361b9b094ef3624ea2d4ea
SHA1 42f3dd1d15f449d6a2cdd71c5a976bc021942874
SHA512 77739d9c19c88a8dd30b538c4712c0c64e1c326ec93cde2ea3c8890d7041d1dd3e5de5dcaa616a1567fc8521a1cf78cdc65ad73e067584bc1d518d6d866baf9c
SSDEEP 12288:+WGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:+2nQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1055523697964F98BFA1706F14C8281869B3F0EC6BFD1A38F7B4C1129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 3cb67401cff7f67ee38042dcaf14b966f8e3d2b943a4ed071e53c22cdc025355
MD5 c1294381374725e3d9bc7d172a9ecd65
SHA1 58c934ad55ea90692785782dc8461f5872a730c1
SHA512 67e9926ae5c82d44e762bdea4d8355057c1cb9e9909f77b7845df7eed949b32e6b155018bfe76b2dda4219a4189c90f71b68100587da226f4594a76d61f34397
SSDEEP 12288:nyPz5L8vGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:KzyPnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1B065021B73A570FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 1c81b2d4cb9346b4931eaaf30c4e8d9c16338ca5dfe4919637d3cd191fa03588
MD5 573366a18218560d60ec4092899ea3e4
SHA1 75df0636a99f2b94dbaf00035309af983b25f669
SHA512 18eba5da4ccc226c645bb77d21ff4ad9cdcfc8adde1034e7f173bd2d102dfa22527a8a51578baf5fe600ae187b0533a5eac1a215ddb2092aa1683b0307af7b1a
SSDEEP 12288:V6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:V6nQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1DE5523697964F88BFA1706F54C8281869B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 96b771d0f0eb2e2d39d023f5abd318e112ecb3ef2b8c008f86dcbaf6a515dec9
MD5 3f6bd95fa4b57fee6ce48f80711568fd
SHA1 5044834ecd3dfab9efa6144a693ce348d668b916
SHA512 ec981d2f4ce5bf03eeffca93988788673c002c49fbf154c94213542a610292cbe1f93a91c70c2714586615244e4c174497701e1f7a2f036c464f49e4b1581926
SSDEEP 12288:36GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:36nQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1115523697964F88BFA1706F54C8281869B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 20c358a8b667b2bc2b3598876256c1e3dab32ca9c677b54cbe89e5364ccea803
MD5 1ce1e3f2daaadcfd5c1d379e9775f244
SHA1 df12e83aa568042b380871d93cf6b49ab72e493f
SHA512 416283c7c17caeadc0c3f25232ab6b2def4ec02c2b71a121dc9760b4891652af50fecbc5b7d4b05040ce751df9216d513e999a1754603d211ac45d717f1677da
SSDEEP 12288:HyPz5L8vGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:qzyPnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T19E65021B73A570FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 463a3bd9aea00f2f7ec12dac226847553d580c715a94e018719ef42faa4a741c
MD5 b0c372c8c9f93be619b1bf061d346c1a
SHA1 e797568750bfb385de4f8a106b0aa48b115b330a
SHA512 82635768db48cf6227e9c6c803fd22cac07a68c9c03ccf0c27461850f42967f6f2d88dcb80e00d87985366e3012b70ae8277666e521011f302b0c47f7ae405e2
SSDEEP 24576:1T0aLl3z0zDNnQ/tbw/2Mkjy6Fr7g0op:1TDLljUQ/lFTjN4
TLSH
T1D47501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 5b381f43d11508719f9b787b26a16dce0c6ac619d11b717b4a7a36943cde22cb
MD5 0772361980925981059804de0b64f8e0
SHA1 0703d1bdca7c63d60d569d63b4c498787bd5eaec
SHA512 15431c7f29f64f1c4df3ff035827cd15717d2213b480e8cb6693164f40c6f59178a57c38a44819bb1fcd2ea1c21fd29319ae7b1cc3e12b9fc8221b95fed20c69
SSDEEP 24576:U31d9CHKy7GZRnQ/tbw/2Mkjy6Fr7g0or:e1d9CHKyaHQ/lFTjN4
TLSH
T17085CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 16314d3921d1a389345bbbc00183c9bf77662a705c0f5768a6e1da8ac122fcc4
MD5 45c66889410982cf9c041c3c8e72055e
SHA1 ba664a24a7a55ddbfd20cbff2fad552f002c850c
SHA512 6261cd92c63aee7030c4f55d7e8fe9ca0a48b7824b962a5a77d281c31cd5c3dd062a6a2ba76c93241538199b65c3c19abad403f2cc4b564c637cb0ab2f786352
SSDEEP 12288:8dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:89nQ/tbw/2Mkjy6Fr7g0od
TLSH
T10F5523697925F98BFA1706F14C8381829B7B0DC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 6a5c34f14962844164d3ca13d6005cb5a0b9102bf163435dfa39a1105fc0efd1
MD5 b7a82e8025c58be90731a73d599867fb
SHA1 3a9962c62d7a605787c03dcbe168a67546b73518
SHA512 ccba286bb2202b2f3c37bc4c700983bc9104180cffaadf92341a4fd1d190854b8a61c3c3b481b51b859a95eb7b5a183caa28668b9147c76bfa9e464803b9b791
SSDEEP 12288:5PGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:5vnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1635523797964F89BFA2B06F15C8381829B3B0EC6BFD1938F7B481129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 66394e171b6dfc66c0cac60b3b618b8e0d4c12f017ce62690d7ccec83b64d097
MD5 81ca5ff3cbc3f2cfd79a432b13a6e02a
SHA1 c33d9387120128ccf849036e19e0e6aaeade861b
SHA512 6ffcadac9804d758569de6791435419b9f005bc24a3ca29626cb9c2008f6494d2dd418c7be6bbca81477142f0d9273a6f1e996e0f986a70afafb81b37ae38b00
SSDEEP 12288:4cGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:4cnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1A15523697924F88BFA1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 e27b5b491d91116658f87b539952670c154c02065c810670eccb120650c97d10
MD5 b18334cf25f994220d1432f4a285f320
SHA1 f1a485b2c81318ba96a68c2d6f4f0077fb611a21
SHA512 4620efb3ca2bd3ad3c2c90d0ab5658b3f3fa742e9fc842432b5b2a9cfaf0ef2a5624d2304cf1af35c78714ef120cd293862b639932726244de5d87d9a47dd249
SSDEEP 12288:v6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:v6nQ/tbw/2Mkjy6Fr7g0op
TLSH
T1C75523697964F88BFA1706F54C8281869B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 ae045f5cee04799c6e008da0c50208f0d8a31d7a1d5928a8b8bf31482dd2c27f
MD5 e9a1580cbdff73c2aa9c0495d6d0cfa1
SHA1 6aabce0403d07f83502ee767fcf639204a0ce2da
SHA512 17a0fa699f5fe5e09ebcc660c1e765788b89d5e39bb94146df7f3bfe2e47a49379d6f066ac52a99ebca3a6aacd7de1085b4dd9637b94ccf0ad028e27c6b3c835
SSDEEP 12288:5dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:59nQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1265523697965F98BFA1706F14C8381829B7B0DC6BFD1A38F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 462cdadd1fda07a3b9ba4f6007c44e7740c05b12d6628db47e741c89a0f34153
MD5 198bbfa11a38c7d5f21e55a92559b2e3
SHA1 02f4f2220743ed39eb274be70715cfaff9528db4
SHA512 fcd925832d849bc9fb3ad15d09e524f17c1417d5d9ad4dd200b2c17d3f47cae5e29cf82e0571ea946f6060cd3ef932648f50805b6d960128e3ae61716f54879d
SSDEEP 12288:jCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:jCnQ/tbw/2Mkjy6Fr7g0op
TLSH
T19A5523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 d6c45b3cd105d9815761d5daa9dcb0abe297330eb23b355bfb54e31bc7ad51d1
MD5 42ae70906eb5fb319e22aa867dc7964e
SHA1 911f8af41157b946dd19514ed666410ce4fd497f
SHA512 8d4b37ea3dbfddae37a359d252478e3565e475cb0b16f80e9413dcf394c1295e22f77c6827206f156fa3e05676330c5439a1dbe45f94d3eadba98bd76cdfca24
SSDEEP 12288:I4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:I4nQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1295523697925F98BFA1706F14C838182AB7B0DC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 257cf719c80ed1f6ba7edeb6a257655b1c2104bf05bc096fdd2d1ce7084d6a5b
MD5 d229ae9601935fc4c9985afd39d95cac
SHA1 f0808f25961be56c2d04ff4a5c3dfd0c4ef7f23a
SHA512 7f4e3872ab9e6d1263db2a3124750acedb16592ce91f2aa9aacc141c7a6a5610d4c2ff098a57e8bd8193b4f5ac9b4b9f31ba5af15cdc5a5353a4e13fdcd85b10
SSDEEP 24576:Rfwv/k9RX6wkyAIGnQ/tbw/2Mkjy6Fr7g0o6:AMnYIGQ/lFTjN4
TLSH
T15685DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5957815556f3a57c506c7196133cf45bf96ac2f38341be4caf0c2f6c8edc3d0a
MD5 cc4b0e7668b7a31cae0ad705a451818f
SHA1 e77b952d842ed07ceb4aebf5e09af1aaa68a4bc0
SHA512 b7b1591a4a17d56a3cdfaec4727e02a4ce85f8dab78d2a1e225678f4b73245f5a01bf2b1d60423da8b130c4efaf35deef2a399b6d19eae22054b09980f2d7c88
SSDEEP 49152:+YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK05Q/lFTjN4:wySzP2Lm
TLSH
T128066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 273f132ef9fbea4010a94c9635751df013fc6afa2fe7d809e6416d883daf23dc
MD5 e05442f263b66d8f5b22ea93468ac358
SHA1 e5d0b0f9221f43e15e746985afc0905a0247f5cb
SHA512 3dca9f95d1a18e48151e03eeee4bfbd5ca014e6fcf9be7ab410ea13d11b24cca9bf1f2aa8c37ec92efcebe372b6c48daa2ab2ad1ca4a0869d636f51cb8bf0d48
SSDEEP 24576:C47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYznQ/tbw/2Mkjy6Fr7g0of:C47JUQj1irIhCnDHUPfF/JQ/lFTjN4
TLSH
T1A765AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 20cf2c5f4eede7bd46e4375984f260c806c1253ed7d1fa908625b30e20c2e989
MD5 0d13a4dcf591ad0aeb5c27736f37598f
SHA1 4482492e941fe70ebcfe16cb31a24b5f482ccb90
SHA512 4496e685018131cfa9271752c434d6cc63ae1e65c8f9f20acee2681c10cb5dba392d8d9016b6952e21d9ce6335bcf60aac9fbd3db47537b12f7f26c4e351fa90
SSDEEP 12288:issfqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:UqnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T19465F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 877614008bec8e5aed0fd11c15cf0b994cecbd1bb39e49d65072b5bc0deaa8f9
MD5 ea54c912571f3af7093f71005c33c6fb
SHA1 2cd5a5ed4ca582a52c2d9d95a7a6e592e8e6bc17
SHA512 dda3d6175d17a5cc387b97fe3b130eddf34c038c169f44203d1eca536ba44c7f482a3393f14e208557894fde7a332012095e8919890e3e0b2a965496ce173876
SSDEEP 24576:jYpUPnK19UEUORqbx7DOErtehPwxvE0LEs:0pUfKjUEUORqbx7DOErtehPyvpLEs
TLSH
T1A8351604762AD74FC6AD40321E36D5CCAB707D11EE44AB0373C88B3FD576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 bedce5e4de0c5ed85f70992803014f6042875003db2347bb53fa8d60f3a3ec12
MD5 a50aff370a46aaef0ad92a9fa7e08d1a
SHA1 a5b4919c59d515bd89a0a2fea4e4d8eeb9439815
SHA512 f18278a6745aa3b5dd8926396ff40d0307179ca8172d9a3a6a483439ed0975f1dcf40a298da6dc7a9e51d0083c1619e4ebc43db44d7df711975ebe1d6eaacb6b
SSDEEP 6144:324LjO+TlYOR16aADetMxsxKfibLWfvJ4rWDetMxJqnh5g/i9PLu:DHl7ocKfibLWfvJ4rtFK
TLSH
T13265EA44A436E38FD1BB6071072A9B4CA7A4EC17B7056F2773C8483AD866B15A0BD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e793c3e1dcc5301e95e39076eb13fb60ca6ab9ae26451f2096659976e3523fbd
MD5 04b389819951d7e6000131021583b9d7
SHA1 88fa1bf3ff9ec2f982822a89e1c90045510e1e03
SHA512 4dc1bff8fea7ee3c70ff7ae5737de34be485127010999d65592138502ce8dfe648441fdc872eada22b321d2524390dc42d3f058c2f965508b497518fa50b8332
SSDEEP 12288:D67yGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:aynQ/tbw/2Mkjy6Fr7g0op
TLSH
T1935523696668F94BFA3B06F058828111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3635dd179f47d78ed9efc9eaae761c25aae2be042e70d1d45eec047525073dbd
MD5 09be6fb0618d053b22c76d45324f79dd
SHA1 25843081892010850399626df225f6c28dfcb206
SHA512 14ad193be7a86316a900864834102af6e0ec47e7cb46e9b164a5e4aff08f21ae9323109edb9aa1b74044a8fabde73e035c29dadaa470227d7c6bcf15f58dffb9
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bYUnQ/tbw/2Mkjy6Fr7g0oi:Hgb4mBIBhGFzQ/lFTjN4
TLSH
T11B65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 ef2501500e91d56872ba4bd8117b160b71174eeed5850218c4c959128fd620b4
MD5 183373482e3904c44dfac2d0d93c6372
SHA1 0e068948f17718cf6edf15d5bf8c49f85bde4279
SHA512 4912ef41c677b4ae26bffa2add842e869634496494f98b5a2a19f0964ddd608e7374280c3e72ecec7018e94b3fb74c3f1a7c218819a806c8e0ca7dd3c68732ab
SSDEEP 24576:MG88u8FpJqH1Qzria7/mjnQ/tbw/2Mkjy6Fr7g0o8:v7ZFPqVva7/8Q/lFTjN4
TLSH
T12885F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 321e5ef9f9cadf3035d2ca6caffd8de20c0f8367706015d260507afdcdd8078d
MD5 3ab82f11a7b6e958799fa9622387df5c
SHA1 4d69bf9ec8018d6020c104dc6f0699023db04944
SHA512 bfa944fc28924b0337dfbd11561fad8b4ab3c807e81ae494871ed82398a3644ccb032d5ec23c60a045fb1f58d665eb7467407d7c0c32dfec00c7c32c2a357155
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj3Q/lFTjN4:WG05lO43bJLm
TLSH
T11DD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 83ed317226ca643b0286679a4c9c60998db1c21956db0983b72194894c754ced
MD5 d287098d791483d58d65e637184f7081
SHA1 384f4f90dfa52d047750836be90ada85f32fa7bc
SHA512 960ae5e3e09b692dfdda3e1787838dfa2e086d1abeb734d3e5bb977ab50f6864c8e925d7b3bc3cdb70074fcef3a7cf7457b152fd39ad7dcbf3274a1b898e5915
SSDEEP 24576:Gfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn5nQ/tbw/2Mkjy6Fr7g0oV:ea5POZ3+Jt2pasx2+mvQ/lFTjN4
TLSH
T1C765AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f131714f9b2c1f5ea657a390a63fe245979e0a63a8e3633603e204eba703203c
MD5 bafdc9c49ed8a3bd9737403805381616
SHA1 6b2e4f3b50f0d3001b0eb297f209f0604c03cf6f
SHA512 8d19aef02bac548ff2c221e475bcd6172b406f27e5572a83f134797e3daf34cdd07ec0c9207b301754ce99626b972ecf2088fa1eb5d47cd73fb591e82f200978
SSDEEP 24576:6NcwHdjbyQ4nLC18lb/EOjowL7FkbnQ/tbw/2Mkjy6Fr7g0oj:6Nc/zEOVHFcQ/lFTjN4
TLSH
T197858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8409391a360c88ab258a4d128bdcc9bc23e7547ce9a28bb5499ee4d033be12a8
MD5 d5c1a278d2ce2044daaf018b29b0a6c2
SHA1 2bbc62b770761e41a4168f9957999ecf8c868d1c
SHA512 123547e22ce5cc836b6c15a1610a422013664e55d75c1916052c6e4b2122e0be678c505a3eccae7b4b77ba2b212efaddc766c398d4c66c3dba7d75c401f83727
SSDEEP 24576:u8kNvNnaFeYhJNtmZBminQ/tbw/2Mkjy6Fr7g0oL:u8MwBtOmiQ/lFTjN4
TLSH
T15C55AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 9879264cd6a59a5193cd8f8962ebdc402f039eba24504aa7e66a3b0a722c41d6
MD5 beec7e38bc82385e5f992d581fbc5ada
SHA1 60a01cdfbe4617bad7dedf12ca4a867f896692c1
SHA512 19acdb8b82f69d61743e1a7ef4ebda204d550b5ff06a4e6f024cdf6da1da94c0c5490cb1ae13f88b2ab637df0e06c5b9c480366843c514c8c000a8f5e0278402
SSDEEP 12288:EHvUrBFrEjwaQnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:EPUr+NQHnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T17865E12F26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 d7436f2c606b956083c49f5430147a6c4671d636f8634dc39d4f0c18a3365b66
MD5 fb9ea123bedc35a95c6f414e2d91bf50
SHA1 88a568c7009aa7db09593932f034417accaee2a6
SHA512 732b9f2c4b4991a58c34886fcbbdde8a15b1cfc15c96dfd98ce066c732f4c10264cc4a790863f544017bc1522b90e4bc688732fd50bd7cc2c27de6e0dc42d1b1
SSDEEP 24576:aD3FHshBIYQgA+nQ/tbw/2Mkjy6Fr7g0ob:aDVHeBIAA+Q/lFTjN4
TLSH
T1F175E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/528-0-0x0000000000940000-0x00000000009A0000-memory.dmp

Download

memory/528-24-0x0000000140000000-0x0000000140D9B000-memory.dmp

Download

memory/528-13-0x0000000000940000-0x00000000009A0000-memory.dmp

Download

memory/528-6-0x0000000000940000-0x00000000009A0000-memory.dmp

Download

memory/528-8-0x0000000140000000-0x0000000140D9B000-memory.dmp

Download

memory/1068-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1068-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1068-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1068-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1676-103-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1676-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1676-109-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1676-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1676-314-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1676-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1884-43-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1884-42-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1884-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1884-55-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1884-53-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1900-80-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1900-311-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1900-86-0x00000000007C0000-0x0000000000826000-memory.dmp

Download

memory/1900-81-0x00000000007C0000-0x0000000000826000-memory.dmp

Download

memory/2428-329-0x0000019731DB0000-0x0000019731FF8000-memory.dmp

Download

memory/2428-398-0x0000019731DB0000-0x0000019731FF8000-memory.dmp

Download

memory/2464-114-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2464-25-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2464-17-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2464-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2752-125-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2752-122-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2752-116-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2752-317-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4704-64-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4704-282-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4704-58-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4704-57-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5032-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5032-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5032-134-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5032-136-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5032-128-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5772-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5772-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5772-151-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5772-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5780-306-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5780-70-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5780-76-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5780-68-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5864-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5864-91-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5864-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5864-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5864-331-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5864-97-0x0000000000750000-0x00000000007B0000-memory.dmp

Download