9fd4051104151b7557d00a95517d0d423dc5ad401bc4cfbc837024e1057a5484

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Size 1.7MB
Sample260702-vddgbsft3j
SHA256 9fd4051104151b7557d00a95517d0d423dc5ad401bc4cfbc837024e1057a5484
MD5 a96537022354dd7e1ba3eb46edbd2102
SHA1 06314b2d046a2932563e06bb1616944f215d8b10
SHA512 8f88340ac33d8fb8ef706b72a688fda2b5817c7bee424c356554db2e225c1eb2be2615235cfc72fb8c3fafa2dc2867cc32ffa0d0552bb92313c4c4ce0eb4faf8
SSDEEP 24576:BiBEVWqwXeAVmYYGavXrBHFMYxq0VZZlr5og:NQ5Xe6XYG6X9HiYxq+Ntog
TLSH
T1C285DF58A75841E1D1B6C23888539947E6717C0187B19BDF03A8B33A6F77AE09D3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 11 IoCs

pid	Process
2576	elevation_service.exe
2304	elevation_service.exe
1608	maintenanceservice.exe
2152	OSE.EXE
4232	PerceptionSimulationService.exe
5456	perfhost.exe
1128	ReFsDedupSvc.exe
2992	SensorDataService.exe
3360	ssh-agent.exe
264	AgentService.exe
4700	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d710c45b80095f6d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005db85e29430add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034ab176c430add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8be8529430add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000528db129430add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000063463929430add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e4796729430add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000304c006c430add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe\""	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2576	elevation_service.exe
2576	elevation_service.exe
2576	elevation_service.exe
2576	elevation_service.exe
2576	elevation_service.exe
2576	elevation_service.exe
2576	elevation_service.exe
2304	elevation_service.exe
2304	elevation_service.exe
2304	elevation_service.exe
2304	elevation_service.exe
2304	elevation_service.exe
2304	elevation_service.exe
2304	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3956	2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
Token: SeTakeOwnershipPrivilege	2576	elevation_service.exe
Token: SeBackupPrivilege	1128	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1128	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1128	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1128	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1128	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1128	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1128	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1128	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1128	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1128	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	264	AgentService.exe
Token: 33	4700	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4700	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4700	SearchIndexer.exe
Token: SeDebugPrivilege	2576	elevation_service.exe
Token: SeDebugPrivilege	2304	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 4544	4700	SearchIndexer.exe	99
PID 4700 wrote to memory of 2764	4700	SearchIndexer.exe	100
PID 4700 wrote to memory of 1584	4700	SearchIndexer.exe	101
PID 4700 wrote to memory of 2744	4700	SearchIndexer.exe	102
PID 4700 wrote to memory of 2076	4700	SearchIndexer.exe	104
PID 4700 wrote to memory of 3488	4700	SearchIndexer.exe	105
PID 4700 wrote to memory of 2360	4700	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_a96537022354dd7e1ba3eb46edbd2102_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2304

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1608

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2152

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4232

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5456

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1128

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2992

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3360

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:264

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4544
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3047816590-610495838-277027736-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3047816590-610495838-277027736-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2764
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2812 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1584
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2744
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2076
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3488
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2812 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 896a497cc90d19921438232edd90a7d89d2288f99f26847430e68e3cf4f20f9f
MD5 c15bfdbddd1fb127e39585a3f57f4a12
SHA1 db57bcbb3c614470e0213fad232948b429966b50
SHA512 1a8e33aedc8a2daab80814bb4cafe2c373f70126926755ba0e7197b85b3831df1a2e2ba28ce0e25e5123a21b508f3c07446da80a384e0327448a6d52ecec071e
SSDEEP 49152:Jb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnxG6X9HiYxq+Ntog:f3q60jBCG6ZiYxW
TLSH
T1B1D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 f08294478137f1a6f9ad4223f850de7a38fa4b1c4335834d9681a8a75c32e095
MD5 14c67e6fe526290edd1580c7d8637a39
SHA1 b63b8a24669b90e2e23b7ceb1d8558f4e3810ff9
SHA512 8931f9b07f3f528ffbe0f172624cdb5df152361aac2293be26ee2bb3e9256549d8db3a11dcb4a32177757c1fb54424827dc8772dbabfafe9a84fc53cfed8961c
SSDEEP 12288:41XLsswWkxy2lRq2czAmCbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj9p:+XYfDtczAmGavXrBHFMYxq0VZZlr5og
TLSH
T1E175F129B7D409F9ED67823DC8A28412E673BC954360E6DB03A4A6751F333D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 5fdcceaaee3019d23c119d120aa220f319c1d4d3e241d7ff47c1a34729e24766
MD5 1967d76b16be8767dea51e2b20a159c8
SHA1 711b310b5de2d44665f39ece6cde8b34ffa874fd
SHA512 31df8631a987312a042b8179cb3c298e954dbbeb6ced3e72d13bc39278ac3ba7ac8c88f4d98822deab23be0e17964707e46563f9638eb9571d02cdf41a75e5b3
SSDEEP 24576:s0Le5ji0hmxUrMZGavXrBHFMYxq0VZZlr5og:sPji0AiAG6X9HiYxq+Ntog
TLSH
T10B85AE26F6748335D073C0B9C5D2A68EE971308657308ACB4286D77C7E67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b99805eb349831a7f07233070a884e910d5dd9f9c142dda2c0b553fd576cabf5
MD5 9212e780ee5486f6a8a3d2e447692ff1
SHA1 6cbd20c5d75b33c6da643ac8b63723e16dfac810
SHA512 226ebd8ac31f345c8d92233b9cdefe58ec54577996e1b989ac95177b3b4f4721ae969e893da8b0261c27cb277673886b928b136840be7bb58677966772d4c7ef
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWr6q8wyuXGavXrBHFMYxq0VZZlr5og:a/ezSC6vUzPviHjyUG6X9HiYxq+Ntog
TLSH
T1C7755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 21a6e20697a105e212d592b6a6b99a02258a26224bb6c6955d0f931e6d548daf
MD5 d0d27e1313a8f0b089a55af03df306c9
SHA1 f664871283882989770a9366a85fab76ab7abbea
SHA512 06515f053fddfbf757573c053dcc44797c4f4f99a34f93a3a3cef6bcc35debf3a3be4988d0816e955c9bc01d0486627eed064d4746cf3b5eaf1df294812f88ae
SSDEEP 24576:zVbqPb88hv/l+byGavXrBHFMYxq0VZZlr5og:zVO88hXl++G6X9HiYxq+Ntog
TLSH
T15D559E66F5748335D073C0BAC4D3AA9AEE3234425B318ACB0246D76C2E677E5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2f1a95d09d8ae9718220a30c749193d6c030a448d2917aefc67e8753e8b2222c
MD5 bf175e1f01d463aaba9096f9dd56832f
SHA1 ed84b66ecbe16f7a677f49154d61753e649fe17a
SHA512 717cb143bc6dc4237c8350e5609d11095278d0bc45600462fe866d01a4456f8dcfa0e8e0f4517cb9d158962038f7eac0d95f15b85eda3542326e811da7d68451
SSDEEP 12288:w9FCbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:w9FGavXrBHFMYxq0VZZlr5og
TLSH
T1DE55232BE54C86CFEBDB1E35E0E7506A0495CDB8B1B6045F072833B9957A1E0C76E887
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 b03331c5a048e420076da723fc3cd298523cfd550d2ead278253e89c27948d5f
MD5 81bf64c518f479184c3a68fbc50df6ed
SHA1 0b90b2c889dbb0ea50ce17747162bd1a0343d5c6
SHA512 15d9e79e3b9f00b6cdbfab49deeed681e91ca3180ceb161fe87286d0e1b05f2a628370966cb432f6265b2f8ffea7429d704cbef7a11a608d29e46496b934639f
SSDEEP 12288:teBNUbTVO86UaCbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:tJIUaGavXrBHFMYxq0VZZlr5og
TLSH
T18075CF3BEE28FCD2C67E5DB95691820097B278704B6293CBD274930EDE235E05E7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9cd1cec832e22587ca220f299c0d012f2177de830ec1c578e69d1199a86738ba
MD5 e77859cbee4ec9d33bace66e36e70c83
SHA1 62bbeb45945f94dc8bb1d991c1fc80b54d7f4fa9
SHA512 c8477a1a3b6bc87a31b793ad07ee33bcd8370547057aae5e8aaa9e36f280e78380f84d49b03bee076b347078748f5c788a4c127f405c3c2ecb722d59bff80bad
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THU:0QvGAdlCEL8c/RRNw5CHG6ZiYxW
TLSH
T11F267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 84793e4c0e304e46b66f9b96fa21b531a3fa107754b4f939f6236a52d0f5df28
MD5 34a58a56c4fe182a95c731ebe9696d48
SHA1 617a9255540d05cdafa8121c8f86f3718b9e5b24
SHA512 5e84dba347417c57fc484af4486b1619de7a2c72c062e49f417c02336b4f8e41fa6b50fbea67e6574da1113cd553b75f54c9869b5f0e287269786856581d18ae
SSDEEP 12288:rAwSfxL/2Dc3ADLLmt0LDQewsAjwCbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXb:UBewsAjwGavXrBHFMYxq0VZZlr5og
TLSH
T19975E031FE74E036C7BB0DB21B36C716147CAD604BA219C3E3A85A9E59342D1637AE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1c3f140dbda8f17442f207a58d45b08e53301a92f1794ccb3b3e470ad5426ed2
MD5 9568fa78a66956c16cea45e812cf71ef
SHA1 bc3a0d4b5f3a554fc80cd2487c36522a2a7b31fe
SHA512 4c632c8d3663323b304deb492691a87e3aed80b35c4b442988535adfa87c8ff035db69b8fc8b6a16e3a3a4fd8c032f9053f9cc3b3bde1444c6ea6107819e4488
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHIGmW:XUEtQevvqc2W1cpV2RI32JmW
TLSH
T158474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fdf734af67e8e38addf0c727c1cfcd09f481034fbecb3cda321c31cac3d96eb1
MD5 f95713d6a393b381be744e454323ee13
SHA1 a082ec9c7295ec90f4038ef30e778ad4604ab5e4
SHA512 f0549ac94b70c1d133da55cd142e04cfab0f59e19f3d3e1f44582190fae21d6a7083debfef931c79a9fb23d98e734a97622d21a7361cbf78bedab81198825a00
SSDEEP 49152:UCbRquA/m2yL5zLfFiV+XenmE3/zQG6X9HiYxq+Ntog:9oq2VjnmbG6ZiYxW
TLSH
T194D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 da020ba6f919f7496cc8c7b5385febd65f4f47560ab364fe1b4a9ff0e7d9c11b
MD5 289568ab66ec51577e4ade083e9acf19
SHA1 57f8af33fdc48b31d99d2cc050bf5fbfc0247b1a
SHA512 f20abb5b4c610e045ad112590afaf817cf2164ca77abe10a522fc90bc71b7537ea283ea72ce16c812d36af43cb96a156c0a34da56795cdf87872117da949540c
SSDEEP 24576:9AhGL2IFoiwtA5l7S537GavXrBHFMYxq0VZZlr5og:9AM1Foiq5LG6X9HiYxq+Ntog
TLSH
T179359D81E7F945D4F5F3AA7899B68171EA76BCA95E31C20F1260D21F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 81a6c6eb013b232bda8df2df7385056060f0a396e47fc96a190b8597b0ad9f7d
MD5 a0dde34297af09ad516d132f3edab6cf
SHA1 c2c4774000b5779ff1dc472ddd27ea83bd1690e2
SHA512 5af86f071dd2bc1ee60852fdc412ae654b2ba07e79ede3538e54beede989870c5500525b73b6347c0da97f2b38fc16a7909525d4b9b96e09aff271c378b4214a
SSDEEP 12288:/mw5HEjsChN9BFgl0WDm+C3CbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3G:+wukOW0GavXrBHFMYxq0VZZlr5og
TLSH
T1CE65F14A76A80CFAE9A75639C597C036E7F2BC152621C71F0760C75B5F37260AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 c301b159b2c207fcf9318c5ccc8e985659f02addb48152ec0e58464020c1c6ad
MD5 b7508d6ecbe86f2358151fdbf0e8e15a
SHA1 7a767427fdb96f38dc7b6cd3f7c1e43d3ff26a81
SHA512 9f7180b6a2c559c0e516079f5da3148a72b9212ce7e3e5a12d9b0474f8191f4af0b33593dc36b7b99ced2934a27b212e3ebe08f78cb5b4e01361eb0150783e93
SSDEEP 12288:TVZ1IygCbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:JZuhGavXrBHFMYxq0VZZlr5og
TLSH
T17755125A72D861FEE6D71639C8E2410697B1BCA5637203CF0724236A5F37AD09E3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 38d473178e3a6380dc13ff39513649c74d5329ac7577ce402e50e2190db09f7f
MD5 f6b0d0f8c6f67629c133fc38d2612f05
SHA1 d0ccc3d24e69f49cba5bc6bc139766b261206b5f
SHA512 89e6c1e7047c53b1ed15a0e156e21d28019d042c51e1bb4bd5b320e876375d79d41afa04c373036f59d0b198eea3b665ae17406fe665834e5c1f44a4c80684d8
SSDEEP 98304:OQRQyi36YOcPhLvw2gAf+PN3uG6ZiYxW:VQyiKahX+PN+GmW
TLSH
T1D3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 dc08d91a14acf6a12e27fb8e273e8db3ba579475e352a38cb663b6b8d836f949
MD5 dddf824b45a23a62de791543c6442db7
SHA1 72ee4e3cd167bcfdcd449d285d63c04319cbf75f
SHA512 e196bdccec8773dbdeb3aca94dc6ca8151c2e59fb1c7e83e0dec7e0143edb6977babca1f262b6216876747a8c2e2fb4fb0cff2585e21eda3533929a7b54de511
SSDEEP 98304:7QRQyi36YOcPhLvw2gAf+PN3uG6ZiYxW:KQyiKahX+PN+GmW
TLSH
T101667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a0b9226268d395f835d9657890162502fac1096d9c634dd324bf724a550e89f1
MD5 a36640ed90b18b442d4fcc9aeee6a3bd
SHA1 37843817205bd49a259691c3709b8bac24cc2c7d
SHA512 31f0dfd89bddaea80d5cded832bd56b510a61d12e9c886a6f91a43a860ff98adf664a46787961079276d1921135bc307f11b2087accbce61ecc7021072cadb9d
SSDEEP 49152:u68Qg55nhceWu7PNU3/AG6X9HiYxq+Ntog:8thLRc/AG6ZiYxW
TLSH
T193B55A33B2F60099C44DE1769F4A873196D17C758FE0E3DB8611721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 643ccd9f13452c9c923268ffc61ddac684695f045aa74062c72aa5793f3692f9
MD5 5d60180fad3e94fbffe364994d561229
SHA1 1623db7132fd5ace4f2ec0f4aa70b0641a46587b
SHA512 10624ef8ff274392d983eeef069665812b29f5bc73cbcb44773ea7addbd845770cf4360a591f3962ff71da5fe527164358519ca0f66108db6b25ee23ec121999
SSDEEP 98304:fy5112gYy5azzVva69nLKnhZFG6ZiYxW:SLIHjWhzGmW
TLSH
T14C168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 255cfa9708fba0616b785eb1934f9f916d61dbbd02a45604ddb78bc6dd4cba72
MD5 874e0cddfe02e167a58625f445e7ab8e
SHA1 6d4ea5c93b00a362d65be39cfee000adff255576
SHA512 ccbeab5ec3e2b976ff57027e3bf57a5ae032d7c3f6ad5035fd554754caade772660e8a34d2bebf5496b44749b9b7bf6ec5db1b9d485ed853a9323dfa4deace7b
SSDEEP 49152:5B+taZ3usBWOBr4tEG20bqx0z+n217aau1gliG6X9HiYxq+Ntog:vu6JmUxd2diG6ZiYxW
TLSH
T113D59D13F1DA01E8D06ED478974A9233E962BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c901fccd929299a1274cbfda582793ef13e413dde75e9ae46ca909ec8f408f2c
MD5 28fecffdc35bf7677403f44b2bd5121a
SHA1 fdcbef3751975498ee027404c9cc231613a8d7f1
SHA512 01ed88d8dd5387fc860fa86c57954e12966f5f842d93b8c5e40add641751a88a3d3b05dd2729f60d9644eda31294fa80bf38b2f12e2851e7ce5f90e48a7ccb8a
SSDEEP 49152:D1hpsNoJpF1A6BU44CwH7R4x6G6X9HiYxq+Ntog:DmifPkRbG6ZiYxW
TLSH
T175B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4efe6fe85eb1a304a5669b52249715ed7457d50fd01dc9053d3c98806deb10ea
MD5 8fd64484d8a7c696b6a8681eb8057a6b
SHA1 490e83d978ccc39ef973a64cad1b2813158c01c5
SHA512 f4bb609ed7ab164e603dd558e766deb1e247aa5a70b669bf343023dd89cddec5341ec68b38c060521a90a84b85a907d20b012711094d67f598a7ecaef4975c74
SSDEEP 49152:nSuZQIY0Be2KNRVtOnks6NMHqhG6X9HiYxq+Ntog:95dKvi61hG6ZiYxW
TLSH
T174C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 656399ded7a121d1c987719fadaec7108931a33542f0ec4788acf0d0d80c0455
MD5 f8338a939818850e0cbef76e6199c168
SHA1 dc449b7898323f574edf4295144b96933033c41c
SHA512 3ba5f104fc5e41f0edda8e04db502cb77afdf4e6f71bf02309a6db863e3bab891fc704f530a8ba2425a55984e4d68611bc016e6ef2b8e1ee7e25f7d4441a0b6c
SSDEEP 49152:/htSn8EApI0figXgiDn0AP5wmG6X9HiYxq+Ntog:uX2iyphfG6ZiYxW
TLSH
T1F895BE13F2D900E8D05ED178C7468632E962BC150B39AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9ff918dbdffca1891688f67e3f4d1b4137cf5dc55d1891d164007812195ba78a
MD5 49ac876af74dcc4a7bc806887abf10d8
SHA1 717275a90f69869b684e193d004bdae60e464cca
SHA512 6ab30e3a07f6667b0b7ac7883b6c226268e0fc878d89091cd81fcdb39e1d90a4ed61a62b15f43bc52bc551dede7363ab09f9ce1861473b99eeae4831f1f27f24
SSDEEP 12288:XNCbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:XNGavXrBHFMYxq0VZZlr5og
TLSH
T16C55232BF84C86CFEA871A75D0E7506A0498CDBDF2B6009F172C3375957A5E0C76E886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c76e4989f127d5eeda4a3d31a9dae08a36b113906b6f79b87809195a7953926d
MD5 474dbdd30b145615f20b55d7eb694fca
SHA1 2acb5e66d949736bb73d25dcaf9a6c03bceff42d
SHA512 827067eb4c32b008610162ff0a5f0bf291bd3c2c6ec35248d2d2826ae7944769f2bdffe51f1cd1f7406225c34a2d4e1262bd0a466e6ab9b038bc63a07f687bc6
SSDEEP 12288:MMCbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:MMGavXrBHFMYxq0VZZlr5og
TLSH
T1C655232BF84C86CFDA871A35D0E7506A0498CDBDB2B6009F172C3375967A5E4C72EC86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f7bd0d2bde782345acefee5f573f69d1f0bf1def6dbfc474932bc64a07f07880
MD5 afa8109cadfbb8ddcb0539f408bd7df3
SHA1 fa62d0375055020de756193fd0f8a5b4ff8f9595
SHA512 a32caa082a2926a35ed725c5cc68cbb9129d6d6218663a4f4846e4cca94f4ce78ed9e1f7926e8f0155b946881d774b757173452b4726001d5772fc644982ab75
SSDEEP 12288:UCCbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:UCGavXrBHFMYxq0VZZlr5og
TLSH
T1DB55232AF84D86CFDA871A35D0E7506A04A8CDADF2B6009F072C3375957A5E4C76EC86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 2e2ab77d065ffe616d4cd8d7b7db02bb5a587a759bc640f09e7cfe430afaa338
MD5 47122be0a450e8cf018f96a5e71e354c
SHA1 9d381e12956960b852d14e8f9747fb009774eefe
SHA512 454cc9ef0fd188b3a5e44ef7f92f53079e914e1474a2712e2c3385c63ec33f30228d99b1f3a031c31bbed818e2b95bf14f53265515b052730dc2889ceb991ca4
SSDEEP 12288:2VbCbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:oGavXrBHFMYxq0VZZlr5og
TLSH
T11155231AB95C82CFD9979A35C0E3806A55F5FCE8F37201DF0714326A4A763E0DA39D86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d3b7d88d4b81be920b900bc3f56f5f275bcecce56d3863b2eead0dbe6e11bfcb
MD5 c9b3b6530d8bd5b78cac7c341480117d
SHA1 7c6d1e3e3cf9649a3ba8605e8e2b4e64da09160a
SHA512 d90c1643504915ecb12f3cf8fb8fa6d7a98e9d13b4f497dd89bae28c8c5c1705cdbfcc8d731307ba393dfc5352cdbf49553b9d15f43d1daec198dd81b12810f2
SSDEEP 12288:9TCbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:9TGavXrBHFMYxq0VZZlr5og
TLSH
T1B355232BF84D86CFEA871A35D0E7506A0498CDBDB2B6009F072C3375957A5E4C76EC86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 1f6976b5e7e2bbd3ca97c27c58ac530ea257a57762342eb66307abaa4e6b9f68
MD5 b416206757f6299775d9c4a92f7a1da1
SHA1 1fa510d84d9179985a67f60a1a3fbe4c8dcf6c31
SHA512 4326d14a3389014fc78b44b23feb1cd1a6e54aee020d295f62b6133ea41cab930666e1aaa141d5fdec8beabbf4d838f4666e35c80531f315a5cfe22d1d690a23
SSDEEP 12288:44CbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:44GavXrBHFMYxq0VZZlr5og
TLSH
T11E55232BF84C86CFEA871A35D0E7506A0498CDBDB2B6009F172C3375967A5E0C76DC86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 e068e37153faafa8b55b77944e179463b2c204529af00319e476f00da1ce2419
MD5 3437ecb910a6073763e130ef092df78d
SHA1 e1924b3d978c467055d8cc9a11a0eaafe2bef1b2
SHA512 45b84ca201d054e815872dc74fa7b3005ba5a8e75e9de67b57437a61a1ae6014e0a5fc8fad643c7b9d4d6dfc951cac8625b88424b652e9a0d3c674ca35f0bc2c
SSDEEP 12288:LECbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:LEGavXrBHFMYxq0VZZlr5og
TLSH
T11655232AF84D86CFEA871A75D0E6506A0498CDBDF2B6009F172C3375927A5E0D72DC86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 f456e260f22914e0818ae322858c41ef2262dbf7a487ced7a7de365fb980fae6
MD5 a4a634d5a680950a7bf148a01af26396
SHA1 897653af547c6b2e815592637c2ee2e1202eeaea
SHA512 5d5f1cc2cd34f4478800b51a8e7f5b1598c47e6a68539ba206ce95ccb7dabd10487a1f8c110676cca29c1015acec91fe33927dd43239970434fdb0e125eaadee
SSDEEP 12288:piZwbNzzFEoS2cPvysCbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PO:sZMJzFVSOsGavXrBHFMYxq0VZZlr5og
TLSH
T1BB750155B39008F9ECA7423EC8668816D6B2BC695770C65F03B832665F333A05D3EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 3dd08d8c8e362a91220c7841b4ccc5c0bc0ac59800c86ba14d26f6296622a19f
MD5 4508b7b8222e76e4bcc4f72ce6e66eb1
SHA1 eba019636b3461e9c050a84931de75262d7ae5ab
SHA512 35fd34441834606528330aef22629963e599b8b8b63b71d5e59be4e7d9e0437c98d856210b4a0925e1ba0db1b5bb69ad735907c2552d0ff36b2d5bea15ced4d5
SSDEEP 12288:0RCbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:0RGavXrBHFMYxq0VZZlr5og
TLSH
T13C55232FF84D86CFEA871A75D0E7506A0498CDEDB1B6009F072C3379967A5E4C72D886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c934b02649d6cac7c37dc111e18778b28d12a87e42a357d89490982a00364178
MD5 3b42f98bbf93ffa8c3d4138198a16ce6
SHA1 1674c87aa903b32a758b661d9a7d0477c3e82f91
SHA512 cfdd053f11b199e94d11b87f14e79944c2bb831dbef85740774de8e82392d4006b428cb4f0a6c2c3cd6ab8ad4fd70f2190ad8c174c973ae11d4c3d4e0c7231e5
SSDEEP 12288:G1CbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:G1GavXrBHFMYxq0VZZlr5og
TLSH
T1D255232BF84C86CFEA871A35D0E7506A04A8CDADF1B6009F172C3379967A5E4C75D886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 3d3c84f43424272e3b73682c2fa5fa97075a1f87475e3112b242b0c452842649
MD5 52edbad1f13cae1206b9a564da6b1711
SHA1 43b0a93938c356bd400951a7ad2f08b289960032
SHA512 23677f5a465b415723efdfe4e4a957965a1c9b1b784d5ce6e8f3b388d9cb456bf2226fa0d2491cce46956e60fc15e5e0d52b349d2def7c9d8621962b80c3a1d2
SSDEEP 12288:CyPz5L8gCbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:fzygGavXrBHFMYxq0VZZlr5og
TLSH
T1BC65121BB2A521FED5675238C8A21512F7B1BC7557704AAF036423762F372E09E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b23f0779bcdda10c54852c6588724c221423fcc6857f82dd169e30d778832931
MD5 de108c14c664499aa8bb34ee48bae154
SHA1 1d3531ac02d3e79bf04678822a30178089a7c874
SHA512 eefc1c9e1553a09094fd2b81cc6c78c005e92aec3fd34f32fc49efb2cd46147f3e8a1d9809fa7bece49edeec664b6124f047a7fcd73f2ab1bcaa164f7fcf42a2
SSDEEP 12288:lRCbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:lRGavXrBHFMYxq0VZZlr5og
TLSH
T16555232FF84D86CFEA871A35D0E7506A0498CDADF1B6009F172C3379957A5E4C72E886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d7036efb8ec365b162d9bd1d9d74147a1bcb6a813acd998b29ca4a18fd9edf1d
MD5 019697d10ac42b7f2eb92b9e0bee1994
SHA1 c6ec75651049c6ffe604c6056c16b3e86fa99020
SHA512 c2cd63862058ae68095391ada746177576c8d99fe9e2a690befec47a14cd87e4c7227cc55a27e151b5536bfc71db809a0e7b4a8fb84ecc90dfae144dcc1a6cff
SSDEEP 12288:eRCbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:eRGavXrBHFMYxq0VZZlr5og
TLSH
T1BF55232FF84D86CFEA871A35D0D7506A0498CDBDB1B6009F172C3379957A5E4C72E886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 da9a9972e2e0b82bfbdef78b6f015426bece6e3e1af2ce87533b9b51182641c2
MD5 8044703250820d59893e60ff08aa2975
SHA1 2c831707e8a928421f36fdcd165f3bedf962dc07
SHA512 526e166b7d3d704a33b48da9108284bd8233930fc49fbac57a208f737bd3fcefbbbaecfd7c1fabc42eed1ac2fb143fad0e1674523a934ccdcb7239da66d840e6
SSDEEP 12288:5yPz5L8gCbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:4zygGavXrBHFMYxq0VZZlr5og
TLSH
T1CB65121BB2A521FED5675238C8A20512F7B1BC7557704AAF036423761F372E09E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 cae0a503b35164420a8723f384350cafb96dd66deeaefdb90092bee6af9bdc6f
MD5 b85307ea8c33c3ff0baa77f286a2c561
SHA1 c4892c05b3d9a69c4a510a08b49346774143c5d9
SHA512 7e5b1da2af1e4cedc0b6a16244e11a29b7fa2f4c6a1af929f33f0f5958b8d57072d278c3d534d91040722d5ea76a493dcd69e535a1dd751331bcdc1e2574e4e1
SSDEEP 24576:nTmaLl3z0zDSGavXrBHFMYxq0VZZlr5og:nTlLljXG6X9HiYxq+Ntog
TLSH
T158750165B35008F9ECA7463EC8568416D2B2BC6A1770C65F03A8366A5F333A05D3EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 f3ef5ed641cc0a394c7958529a15bd3e5c2df5c63f29f8cbc182028beae9e1a7
MD5 e35318e37da9c5844a4b841eb3031703
SHA1 75478bf89730cefbcf9ee90885eb080e20d96584
SHA512 ef712fb6c0646356746827768382b3bc13eb6238333d207295b6ed0d6c3ffaffd842ab0b1bc5c3e1c20dc183bbdabb8ce24755926a66c2c19b63d4d366951dde
SSDEEP 24576:D3Wd9CHKy7GZOGavXrBHFMYxq0VZZlr5og:jWd9CHKyaoG6X9HiYxq+Ntog
TLSH
T1BA85CF90F3E410E9F1B79A35C9764512DAB67C995B31CA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4dc92420b7b2d28d998975428d00d7c43e547303961cc20a822fd1cacf2b6147
MD5 378507dcacd6c362749b2abbad3d73f2
SHA1 a7921ce9659a885d445f90e7530e6c17954d1c5f
SHA512 7a730199de459bd9c0c0b71593e6408a1739c9510a4ed867ac7d35931af784e58f3db430f1b48537f95b7c851d11f974d291b6a787f6f120df8128eba52a1bac
SSDEEP 12288:QiCbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:QiGavXrBHFMYxq0VZZlr5og
TLSH
T1FF55232BF84D86CFEA871A35D0E7506A0498CDBDB1B6009F072C3375967A5E0C72EC86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 798a8941150f9c30560a2ab8cf60342ac3b9bde312fbf50d948f538e330a88ca
MD5 9a72cd07a81a5519752966b6fce1dd69
SHA1 70d189d6d200e6c812607dfa4276404305a55790
SHA512 24a7c37f9c12bfc698643f7cea4875a663849691790000eb359027666b4346c8d0bb05a4479633f4994357acaa0942a3854f9117c87462b7b5a96cebb334dd48
SSDEEP 12288:2ACbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:2AGavXrBHFMYxq0VZZlr5og
TLSH
T1D855232EF85C86CFEA8B1A75D0E7506A0498CDBDF1B6009F172C3375967A5E0C72D886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 49113f6d43952f1f336ff0e7b6a4ecc87af4ed52932c242ad1a28cb24a67b7d9
MD5 22c26b1464bd1bd244ebfb168230fd9a
SHA1 2ee54ec11e939c6b22ded607ee93fd696a699ddb
SHA512 429778ed0ed37644678a241b474fab53cba0a7f6fe265a37236bdb368510d267652ecdd55dd17f12414e5c4f0936774eb09c99784cabb1ab1eb58af486063209
SSDEEP 12288:WPCbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:WPGavXrBHFMYxq0VZZlr5og
TLSH
T1A255232BF84D86CFEA871A35D0D7506A0498CDADF1B6009F172C3379967A5E4C72D886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 1a53b2660a22713b1536212f28527f0402aa0478d8f6f4abcfcff74497b921e5
MD5 5644c09ffcad4b9155dbbb89daf6e47c
SHA1 8290aae521b06fc6f39d137f8e25757989437b4c
SHA512 0acce66db182aca3bf02c6d288746570ba907c9d3607e3045cc3c11fd0e376ab06a622e63b12e17712ab7994f806f321aa0cd953022ef408adf967c752bd6c8b
SSDEEP 12288:NRCbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:NRGavXrBHFMYxq0VZZlr5og
TLSH
T15D55232FF84D86CFEA871A35D0E7506A0498CDADF1B6009F172C3379957A5E4C72E886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 de179b78611fa604c49f2cca84ef239165447eecc4c94e12531631142e0bd260
MD5 42907cde67252ec6ec0e660edf4800c6
SHA1 3ad1ce3b5d83d3935d93175a9bde1ce840969abd
SHA512 ec6ec33eddff5dc0006efc849bf5e6b2d1ac9bab5d05a37a5ac85e25e540c17c7c7016deac8b503be36309a86b3438d9adcb38241379fa3fda69cc2b1a48a355
SSDEEP 12288:8iCbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:8iGavXrBHFMYxq0VZZlr5og
TLSH
T1B655232BF84D86CFDA871A35D0E7506A0498CDBDB2B6009F072C3375957A5E4C76EC86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 2c486c40cb6d9fe8ceec324a619bc3025d993eb8ca82cec5abddff86d067f172
MD5 a66932d2e302a8fe7cb9d3a3e1efe19e
SHA1 5d4a7f099f7bbfb5de937b1878eb80c2b41f425a
SHA512 b4ad71b2ae7778e6dbd4eb30fb0ed606eae196d8fe6eb8a023f51b508a273abdd5acc01d355b43c77dd9143ecd65234d9ef6db757ff3c09bf21f0f0de6f6ac02
SSDEEP 12288:IpCbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:IpGavXrBHFMYxq0VZZlr5og
TLSH
T15D55232AF84D86CFDA871A75D0E7506A0898CDADF1B7009F072C3379967A5E4C71DC8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 1e86aa7522a6f15dc8ab0bed3ddadc2a44dd7cb2b4ac505a98ef79bbe4f1def6
MD5 6d21cf853e3302c46c38f43b922769dd
SHA1 43d740abab8deebbdfa6811316329a27f37d7690
SHA512 5cfb8a4f111dd12a6fcc944576c238edb5e1c16d9211734350a289bbd35754d19f1abeeca3964f04109ed41609a8fd416f4e18de2a8a9474261cae8b9c7d8eb7
SSDEEP 12288:/TCbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:/TGavXrBHFMYxq0VZZlr5og
TLSH
T17355232BF84D86CFDA871A35D0E7506A0498CDBDF2B6009F072C3375957A5E4C76D886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 47f50ea9780b09b95f0c9da6121d88504bb4f39f739dfb17cf7aaf5a697648cc
MD5 11869e9d1f43d4c35d9b506e151fc931
SHA1 b9284bed27b8f1e14d4510008dd7c76618ec10d5
SHA512 ffc76d019afe9c89273dd2c06740197ab009206ffee26c1339180c3323e25c29c29ff327bc902563666729cfe00792981a538d3d4fd00ab08b2dd706db01047f
SSDEEP 24576:Hfwvfk9RX6wkyAIlGavXrBHFMYxq0VZZlr5og:eMnYIlG6X9HiYxq+Ntog
TLSH
T1CC85D029EBDC44E6E1B7923C99B3460AF6B178691B31C2CF025953AD0E37ED49E39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 18f1cd52531a4c30dc2164da62786ee51463eae9b7e110b8d9d5006fb72aaa10
MD5 c560eabbacb097e2cc452d3d444c28d7
SHA1 8df27ea8edca072082f4fcde69ed3ed54868327f
SHA512 e66facc328bd289252415edd0ded899e0b4b0151d4c3a78bcc22cb90c081b46185005c3699d6d632dd497ca139b4d9c0b10aaa9afe53217b3d4fbfa8348144b3
SSDEEP 49152:MYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0GG6X9HiYxq+N/:EySzPOG6ZiYxW
TLSH
T17C067C57A16801D9C1B9C1B98B1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 41b0b2c991b85bf5d71a0516173bf41e7ca462344100d40d94f906b2b6fbf34b
MD5 c7d741d28ebd295f78cf1a20e37ac137
SHA1 37849189308e3a72d6e794658ea922c974d13a0f
SHA512 fe2fab76fd01119399e8f0185e633cd5d01f72aca0f7c2edfc095c0bd3134c6b95e2ee0aa29ceaba118bb1f6fba26f779a1eab7b026f32dd98eac274c79fcd24
SSDEEP 24576:J47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYcGavXrBHFMYxq0VZZlr5og:J47JUQj4irIhCnDHUPfF/2G6X9HiYxq8
TLSH
T14465AE1EA3EC01E5E1BA927885554A1AEA71782D1B32CACF1270537D6F23ED48F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 ebfadc1373b3d876a335a3fa1dc4db8211a57db93959395304bfcba86d2d753a
MD5 b2415e658222179f48407746257ae11e
SHA1 263ddd52e9c53c3e67e0f4ab22c429e89ffdcf3b
SHA512 666a772beead2f7d1115ec921a6420575d0ceae4cd547f501e46c56b1f0779cf42275f4a849465154a89dc29ad7a52b43f39f01a1237630d4dca4dea399441bc
SSDEEP 12288:2XsfhCbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:ZhGavXrBHFMYxq0VZZlr5og
TLSH
T1FB65F11AE29842D9C0AE6235C7964541B3737C6593F293CB13D0F63E0F766D09EEAA43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 62c7e915c310ef8c96bff5c234e52e31dfe8c65e1647d1f33a40409438cb8308
MD5 c9776c03803b5d8e2d18d5da7fb25453
SHA1 a2507f40277201ace86288b49a4cf49eff455890
SHA512 69a9b3d78ee0279e601e6131a678e30773747ea6316676a4744960bf14a96c7b0c7c7c675254e6035199078d107a1fc000ff6319494979243b7e6c0777f6ef4b
SSDEEP 12288:eTwERU3fJfIiOkx14Ri0dJOD8Zk6q3vO3Ml7/lxpqBjJD5hTA:eTw8UPyl6aigODLJviMlLlxpqBjJDnA
TLSH
T10F452641B226D78BCA6950321E76D6CCA7707D41EE04AF0373C9873FD476658BAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 a0b6e5426fae25d976d1f0cc8e07c48911521854b8fd51b7f94563326bce8c8c
MD5 603d878bf992a9a3c1f10bcda2219687
SHA1 47a71f2343710a650733b54987dfab700464926c
SHA512 7dd1d63447eedb03af20507fc3f506bfe71be2447f72411ad2a16cf14eea6cde20a2b62e4d2285eb9dde128e380c8ade57ff731b1061d14920bdc92b0157d8aa
SSDEEP 12288:ZUFkhXpKLXnbejJ/Zi8YXSBYysEKw4n+bE/oYl1ogsslko:CCjJBp0cVb81HLlko
TLSH
T1D5552A01E5B7E34FC97A5037573286CEBB746C02BB452F017384893C986766EB6E6392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3f0311b2bce38a42b1fc796e54cc96feb0ea77941c768d460486af22556146a8
MD5 5f82fe437c83f2879c62b2c68e5ed95c
SHA1 cb115240b93bb8d174c55ac0677e7fcb222007f9
SHA512 e57ec123a4a6ba02c6c4762a8e95551a2ac7b14b85f4c9261a3ce7c5dd7ae19d9887dd29fccd64b10d685d3dde9244e36153fac2d24fc0da74a46193ae359612
SSDEEP 12288:Yn75CbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:O5GavXrBHFMYxq0VZZlr5og
TLSH
T1CE55232BE54C8ACFE9EB1A3090EB8036145DEDBCB76100DB571833A995765E0CF7984B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0f4f9de034c6cc4fcc8d05c346dcf81fd31ac94d08c2b3722f06ee7a6bbce881
MD5 a700f441d39785fc8b99d32769c16d06
SHA1 58818e5a1a1458eb672db7296892a9cbee9113f8
SHA512 d6c9ee70439faa51a3628643d25406845417f564963702fe8c6892d4bf1e1decb5fcb5e7f57a11eef0d83f2c17f39a514ec83894f40feed35caf6bcde519b9a9
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bYXGavXrBHFMYxq0VZZlr5og:Hgb4mBIBhGFcG6X9HiYxq+Ntog
TLSH
T17F659E1E22EC02E5E0FAD2B8DDA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 958967cf9cc47f3cc062639c0da87882f584957fc76e29fa0d1383afcb688476
MD5 faa69e60ad7b94dc13a0decb4b3c841a
SHA1 c14e4231c1f17ffb7b8ed886db05e0a23acbfd0b
SHA512 09344334dd7d17d699829cebfd302710650a14fe564b3a226afe971661380eb71c8251021f4f35a9c77bbd6a7f15f990bf990d26031a87449a54124b09e63636
SSDEEP 24576:5G88u8FpJqH1Rzria7/msGavXrBHFMYxq0VZZlr5og:s7ZFPqVYa7/vG6X9HiYxq+Ntog
TLSH
T1B285F125B6E401F5D47BD13889824663F6B2B8251364EBDF07AC8B551F33AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 08d5ddfd77d3bb7478357de8fba43d8931befaff3c5fc1b633eb806333777b1f
MD5 57e2b7d39bc567bc7cbf36a29a7af48a
SHA1 701c13f1e1d329fee1b75b64a44e894f3c65b7d6
SHA512 999b1a99103077b6b3647a0115b87b91d46a09c4d98f695e9f6f4e0f4eba6ac19cce66425226bc4c34a51e9304d5d14299e85e21e8f5ea37f21e8d5a8495799d
SSDEEP 12288:2HvUrBFrEjwaQoCbMX9h7QCDz1rD1bke7yVYMY/YKCfHy7VZXpl4Z3sj92PgX:2PUr+NQoGavXrBHFMYxq0VZZlr5og
TLSH
T15E65F22F62AC18D5E676A17DC582821DE771B866131292CF03A0917E4F77EE8BD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d4f4e448c7d8850ef3dda4984a6d692814813351e0059fde518f850655d93aaf
MD5 2c138f121e05a3f70a6817fa894039ad
SHA1 4e55e4a9c3ed786ef7c68bc169967e7f25ef7193
SHA512 41a476e933a03745bba3e6322309980dd60d39a56e367b158a286b9c2876bf87879d0a7d68b6ba2bafa0b60c51e8acb541d07bb77d10e927ca5baaf2eb9341e8
SSDEEP 49152:ZBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4G6X9HiYxq+Ntog:6G05lO43b9G6ZiYxW
TLSH
T143D5CF6A62EC11F9D1BBC17CD9C6460BEBB23825033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f0b6b7a42d1208055e0623dccf6af9f51d17876de8633965b78067af24fabdd8
MD5 9a819505daa829292b6523c071f64b30
SHA1 e734eb0fce3e64a63d3bb0e50230e362b723706c
SHA512 cad8f4130b24a0d95587857ca700728b19111469210d1880acb5a360f6f3c1ae19d23f2be068f5a897a75cdf07e34703af6909b7822e1c0c6ff10a013df3fae0
SSDEEP 24576:ofa5POZ3dpqWVM50JicR2hG0lasx2+47eidnGGavXrBHFMYxq0VZZlr5og:Qa5POZ39Jt2pasx2+mAG6X9HiYxq+Nt5
TLSH
T14F65BF5EA6FC01D5D5B9D17DC583861AE5B1342153329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2842d3495a6b37adfaa09387692d6dd385fbd6c079a0bc595d38c0f672fce057
MD5 76d99bb7a6a6d96eb061618ff76dccc9
SHA1 a111c0109c257d654b303dcab735c37f1c40b287
SHA512 9b7ec5de12cfaf2a5403b098cf5f62be9f8f16553829ea06c33f1dcd41e4d18c365d3e6970b48259582db25fe69aaa231731fa10c6ba5a2def2bf5c6b1bc1e27
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkUGavXrBHFMYxq0VZZlr5og:tNc/zEOVHFPG6X9HiYxq+Ntog
TLSH
T168857C1622E901E4F5BBE1BE89779546FAB17869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 317e0c87ca50f3c233449905ffcc78638efd33bfcf22e0c2f483021c9b8b5911
MD5 c258b2ed105c81f56b31258e81a0d9c0
SHA1 aa9c5d5d8fc6c3ef95998de20a598538315c618b
SHA512 e75fc196c9c2e9b3ab9fdab148aa353c31160ad41b74b4584d610a144560f24c5eb45faf8a0992a934647c2c72286c0d44b742328e66ef7bce2006ce5a35b02f
SSDEEP 24576:7tkNvNnaFeYhJNtmZBmmGavXrBHFMYxq0VZZlr5og:7tMwBtOmmG6X9HiYxq+Ntog
TLSH
T18855AF2EBAB846E4D1FEC675CD238512E6727861173252CB5390C13F0E679D89E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 788bd11f7c32e6aa162727206c576db00fbd1400d32891b67946d736da36b6a3
MD5 0c08f7267af6e7e81227f411fe03485a
SHA1 509efd3774b7a2e88b9ddfa46c306df5d5b5f0ec
SHA512 6c43f85f90a559d48b27f93ecd8666bcd06264bffa7ba866cf6935b1085f43983d26db633b393e0fab3c85c6e8417516d4198d5164489da3965de1766d25058c
SSDEEP 24576:4D3FHshBIYQgAtGavXrBHFMYxq0VZZlr5og:4DVHeBIAAtG6X9HiYxq+Ntog
TLSH
T13375E13EEA9C04E5E57BD1BCD6A38506E67138AC033255CB029491BA5F6BEE46D3DF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-139-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/264-137-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/264-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/264-131-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/264-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1128-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1128-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1128-332-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1128-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1128-99-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1608-56-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/1608-54-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/1608-52-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/1608-43-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/1608-44-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/2152-60-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2152-284-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/2152-66-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2152-59-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/2304-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2304-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2304-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2304-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2304-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2576-26-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2576-24-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2576-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2576-18-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2576-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2992-106-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2992-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2992-112-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2992-318-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2992-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2992-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3360-317-0x0000000140000000-0x00000001401EB000-memory.dmp

Download

memory/3360-125-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/3360-119-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/3360-118-0x0000000140000000-0x00000001401EB000-memory.dmp

Download

memory/3956-1-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/3956-0-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/3956-15-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/3956-13-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/3956-8-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/3956-7-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/4232-75-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4232-299-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/4232-77-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4232-79-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/4700-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4700-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4700-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4700-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5456-314-0x0000000000400000-0x0000000000543000-memory.dmp

Download

memory/5456-83-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/5456-88-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/5456-82-0x0000000000400000-0x0000000000543000-memory.dmp

Download