da6a472833f11b56560b1787d037aed1c2593e28aa940569cb735de855bb37fe

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_c9ca0944a52d561fa4cb6a22135b7abb_icedid_mespinoza_njrat_ryuk.exe
Size 1.5MB
Sample260703-s16ehsbz6s
SHA256 da6a472833f11b56560b1787d037aed1c2593e28aa940569cb735de855bb37fe
MD5 c9ca0944a52d561fa4cb6a22135b7abb
SHA1 3d6669c3ad9ac89210d4905c7cdc161c62800ec7
SHA512 1bd4552d3ad08b00abd27cd26a18752af54b4504d31d3ae45fb1a95cdd17e97e087bc2e0900d9117494433fbb1d37a45cc85bcc53b40e3a42966a384190bcdd7
SSDEEP 12288:JyVOd/emcJAmfPNZsOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7T:Jy+fcSmf1ZutbpcNBw1FhtCrRhZV
TLSH
T1A175CF0163E84194F5F7AB789AF295269A337C925B38C68F0354455A2FB3F81CD39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1584	elevation_service.exe
1576	elevation_service.exe
1200	maintenanceservice.exe
6508	OSE.EXE
1692	PerceptionSimulationService.exe
6604	perfhost.exe
5492	ReFsDedupSvc.exe
556	SensorDataService.exe
6412	ssh-agent.exe
6992	AgentService.exe
3612	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-03_c9ca0944a52d561fa4cb6a22135b7abb_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-03_c9ca0944a52d561fa4cb6a22135b7abb_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\80d60b92c8b6c6e4.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-03_c9ca0944a52d561fa4cb6a22135b7abb_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-03_c9ca0944a52d561fa4cb6a22135b7abb_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-03_c9ca0944a52d561fa4cb6a22135b7abb_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cce00407020bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000da35d1c4010bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f46fdf06020bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ba820c4010bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000784649c4010bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a19af706020bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000085d209c4010bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054fc51c5010bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1584	elevation_service.exe
1584	elevation_service.exe
1584	elevation_service.exe
1584	elevation_service.exe
1584	elevation_service.exe
1584	elevation_service.exe
1584	elevation_service.exe
1576	elevation_service.exe
1576	elevation_service.exe
1576	elevation_service.exe
1576	elevation_service.exe
1576	elevation_service.exe
1576	elevation_service.exe
1576	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3404	2026-07-03_c9ca0944a52d561fa4cb6a22135b7abb_icedid_mespinoza_njrat_ryuk.exe
Token: SeTakeOwnershipPrivilege	1584	elevation_service.exe
Token: SeBackupPrivilege	5492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5492	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5492	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5492	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5492	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5492	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6992	AgentService.exe
Token: 33	3612	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3612	SearchIndexer.exe
Token: SeDebugPrivilege	1584	elevation_service.exe
Token: SeDebugPrivilege	1576	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 1916	3404	2026-07-03_c9ca0944a52d561fa4cb6a22135b7abb_icedid_mespinoza_njrat_ryuk.exe	92
PID 3612 wrote to memory of 3976	3612	SearchIndexer.exe	105
PID 3612 wrote to memory of 2116	3612	SearchIndexer.exe	106
PID 3612 wrote to memory of 4668	3612	SearchIndexer.exe	107
PID 3612 wrote to memory of 6676	3612	SearchIndexer.exe	108
PID 3612 wrote to memory of 7160	3612	SearchIndexer.exe	112
PID 3612 wrote to memory of 2944	3612	SearchIndexer.exe	113
PID 3612 wrote to memory of 4480	3612	SearchIndexer.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-07-03_c9ca0944a52d561fa4cb6a22135b7abb_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_c9ca0944a52d561fa4cb6a22135b7abb_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Users\Admin\AppData\Local\Temp\2026-07-03_c9ca0944a52d561fa4cb6a22135b7abb_icedid_mespinoza_njrat_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-03_c9ca0944a52d561fa4cb6a22135b7abb_icedid_mespinoza_njrat_ryuk.exe" uninstall
  2⤵
  PID:1916

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1200

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6508

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1692

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6604

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5492

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:556

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6412

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6992

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2581000985-3042091657-4068028891-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2581000985-3042091657-4068028891-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3976
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2116
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4668
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6676
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:7160
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2c41e9d3d0e7d642efb56d463e6314ffbbe4f87e3fe77770b189bca79a2f4233
MD5 d832da3c72215c43172799e840708843
SHA1 65b05e240114c5c5fb3ca4ff2d098e05183b1fd3
SHA512 7704e8552b49f4c87435c8d3fe22f7d16bbfde938f0cdd2cd86acb5888bef94c1a3a50eac412a8bde1585fdb370b2995f44d1691a7812d823b2650c9bf25025e
SSDEEP 49152:ob+632BuPkFKRrdE6ohrstBhuXjfS4LWxnBtlcQQD:C3q60jBSlc3
TLSH
T111D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 366eccc615586c455e8ab1f92a0379507e8cda6a3eb1ffc90883854fcf8fcbdc
MD5 a6055ac3b6a4f437ad92c0ed24e5ab4d
SHA1 ff3f5855493ed3ea396b671cf3eea2c86338bb92
SHA512 160369c6479eec2a20f43897cf6a235bd0a3c53b9b8ceb34fce43c5fa860917bd90dbe19b960e9c4a0895fd8d3fac3d9ec0e73c9f5f6e8ab9d1d889c865996db
SSDEEP 12288:P1XLsswWkxy2lRq2czAkOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZD:tXYfDtczA2tbpcNBw1FhtCrRhZV
TLSH
T107650228A3E505F9EC6B827CC9A18512E63378924760E7CB03E499661F337C95E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 2a7039910c64813bfd74dd1bf0cfeec28865e7702d61a6556b3729f5e7ef223a
MD5 c5c4ccb6f023c25369a2963ff3572af1
SHA1 a9dd2c4d2649e5a9cbca6ddfbbea25c36c9ddca6
SHA512 ef31f26783a931f32c430249290978e7936f132aabfca6dae7d7f8496e1eadaa77c1b5635d9f476ff1c0eb545d439f5fd65bb3991c5e8b3ae81d62d51792f3e1
SSDEEP 24576:k0Le5ji0hmxNrM5tbpcNBw1FhtCrRhZV:kPji0A7UtlcQQD
TLSH
T1DB859E15F6748371D073C0B9C5D2A69EE97230825B308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fd8f7811550715402b3189bbc39cc41449b3fde1ba7c0121e4547d2597611916
MD5 6e60ffba668bf84868d17347d11d5979
SHA1 0c8a0fcefb6d5e4efdfbe34b0074c00c5efb0ae4
SHA512 3000994794f4a14eb431788a164e351a01d491aa0300c76b96664139f423d89b3ac44fd56571db8d3f83146f40a0943174a53e7e5529f08e7a4b023cc8298f37
SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWr6q8wyurtbpcNBw1FhtCrRhZV:t/ezSC6vUzPviHjyQtlcQQD
TLSH
T112755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b9f99dc2353efc4e8e22bb5add1d4aa79be599dccaad5dd0bc1d67faba084d41
MD5 fa718ccd6b7e839b8e0aee87c52ec7b7
SHA1 0748a5e9a3c5784ab24234ed5b3b7b6375f13245
SHA512 ac838b021d5af08bb7f0ef1a012299c598cba1399f468c8eb7aef8317c56d6672d1e02614f9c968ccf0c290af821401a2e32109f1bbdbdbf5a017a1616190d1b
SSDEEP 24576:FVbqPb88hv/l+batbpcNBw1FhtCrRhZV:FVO88hXl++tlcQQD
TLSH
T1CE559E66F5748331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 afd18d59e7c9e8aad425d55b521361d09e986c4399197390ebcd43ea93d55d5a
MD5 200aa83073efea40d545e9599166ee73
SHA1 70d33a2c32c10d827b8ee8dc1a721c21ddda8188
SHA512 72f8c7f6f0c30e3ffbf0ea9dfacfcc3d08f3e59baea8f95405714e86d89750ca9925fa6df4e6e6568896f7301816b4ca78481c3f01e8a53fa4f27cbccac02516
SSDEEP 12288:MjtOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/:Mj9tbpcNBw1FhtCrRhZV
TLSH
T1E9452394C15992D1E6AFCFBC73611DD6262E3C938C8809C7CFA2BC876FB154BE166460
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 9128070bb5a262a720d94f6490cb5cb1607e402256c8694b4e77e6817c123a56
MD5 8f94235ef1071b66b22499f14500114f
SHA1 679ade44dbdb7e351a024eaa19ff7dac035021e9
SHA512 ccac5d06017e9aabdd37cc92e20dce71e751ea2328808843faa5c4294844bd164b00cd1036bccaee82e00f483428a741affed23d4ff7f6b6a0c412da13b2b2c7
SSDEEP 12288:/eBNUbTVO86UoOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/G:/JIUStbpcNBw1FhtCrRhZV
TLSH
T16065CF3BEE28FCE2C27E8DB857918640A77278314F5293CBD165820EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c59958454f6f07980f7228954b977523cb80464b754e8692f6939d4f4e2cd04c
MD5 b229d559718bdda96f7ed6d0ceee2a50
SHA1 77d66c980a882da65beab69cfd985fcf3d38d54e
SHA512 2e6c67a5cf69f12f0bf6cb93345ec4fef3d66e2c92964688deb3dff910884a828d748770eb9106d340e501b14a6abf8b4f2a53c282e1e6adcd1797fbc84e8194
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THz:RQvGAdlCEL8c/RRNw5CJlc3
TLSH
T1B4266D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 65af93c427055999c48ca67982687cc3dc1bef66283611bdb025ed80d5ccb2b7
MD5 3422592298182f0973cfcd5daace1bb3
SHA1 be7a3946e00609e81199c560be478350bf11d146
SHA512 54170d0194ef2b07a056ea06505ff575fe031ea9493d723bf15a6b93cd0c8b3119bf235bb77fe519ca9cae7f871e4e1c018cf89e09144f2a927b09259f225805
SSDEEP 12288:cAwSfxL/2Dc3DDLLmt0LDQewsAjCOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSS:BSewsAjktbpcNBw1FhtCrRhZV
TLSH
T1BF75E031FA74E036C6BF0DB61B36C716143D79604F911AC3E3A89D8E5A702D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5c562277c1a72b182f13d0c6cd3581a88f0e065981ddbc1e0df905f437c347a9
MD5 aae0415d3c8999259de7d5e20fa09f3f
SHA1 889402ba365270b326508703d08588dfc58aacfd
SHA512 f35cfa978937474e84e306d2a925a3b23df91eae1ab4adbb434b9c2c4f6ca9dbfd804e4123d1063a2200ed2be146c1678ba346cf1f55e06b4bce509b289d993f
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH:9UEtQevvqc2W1cpV2RI32
TLSH
T146474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9617ee3755b8e16aaa475ea5e4e2b3c6ec204cb6eb37d0ec34c5cfbd4ccd20ce
MD5 279d094b867fc1c024c798163896d27d
SHA1 c7094c22aaa2f7059dbb98231425958cc8227558
SHA512 42290a2ef0fcd56fccd3add071ffa275a4b1d6dd884315fe567790fcd3e1c0ec2ef8e017ff0bc728671b99262a08d86545effaa7c36a2f184303505569161b85
SSDEEP 49152:yCbRquA/m2yL5zQfFiV+XenmE3/zEtlcQQD:XoqtVjnm9lc3
TLSH
T18BD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f7e07f9e78b5b4c9d01e0b66872f0c7ab979db5bd9aab404b0f691275c493545
MD5 105fad3e97504e8c9f3844d9327d31df
SHA1 ecf4702b0ad08fcd50b7190619b19a380e61c989
SHA512 53d8b29f4a8ec515681931ee37b9beab0ed236a50e603b8a8f0ddab48a66bcbf36c130515b7e065961f2f1187e779401fc9fcd2c4f9c01b5a22eb623bc69dcc0
SSDEEP 24576:QAhGL2IFoiwtA5l7S53XtbpcNBw1FhtCrRhZV:QAM1Foiq5HtlcQQD
TLSH
T192359D80E7F951D4F5B3AAB899B69571EA76BCA65E31C20F2160D10F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 09af91adf6c6e76072c9d8104ce406da5a08ce7c19889e3be5da6969b0c82325
MD5 f45caa60e2c42831be570fd6a48486fe
SHA1 68b6fa4cb1a4d4df377df0156086256ed4713aa5
SHA512 cf5ffcf1fa4b8f65a8f543547172e9f1ac7d6363aa8fcb111b4768449565ff21a89b601d0d3780e8fa6e22ac55836558b0d74f93ba338c8a3d0fd5f7289a306b
SSDEEP 12288:ymw5HEjsChNSBFgl0WDm+CbOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRe:rwuXOWwtbpcNBw1FhtCrRhZV
TLSH
T16965F14572A50CF9E9A786388657C536F7B3BC022925CB1F4760CA5B6F33351AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d3f167f2d55a6c50bf52e8ae1ec256ee9bde0cb710500a7ac122bb69baeaa472
MD5 7ed73255bad61b5e9bf5ff320d2dd4a0
SHA1 19c9cf807fc81545dc7d5ab5af7b7ffa8391db7a
SHA512 50bd592066083bc5f38f0ef272ff6362f834ac56297d6eb1a3f2f487b09e298d3e7eebc5e4205945b9f5e7da1c3dd7df2c5004ec9c5948229413c4aa8488c6b7
SSDEEP 12288:A/Z1IyyOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/V:kZuRtbpcNBw1FhtCrRhZV
TLSH
T16855229922E461F5E1AB877CDAE00A46D7323893577503CF0B61A9872F33AC69D39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c863780dd2aa9922f3216f7b550e0da866047c4a4635661ec3d8297e7d8aa3c0
MD5 aa0b1d6278c9f71d170c7def586b6875
SHA1 8bba57d3e45264c193a74517b95214722a8b28d0
SHA512 656c41b02243837a275143a4279c6fb5fe2924cf73e5759e84fcd0438ad9d34398a983b830836752e5ddb039a71f4c828198f9fe6123000cb3db47fca82293a4
SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U3:KQRQyi36YOcPhLvw2gAf+PN3ulc3
TLSH
T1AF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a9ae8ee67348251160798da8b42d8c060d160dba6f0a9605841fae0ae62f289f
MD5 56428a0ff18f2b67725f282f269f2b6e
SHA1 97e6f14cddcdeefab3369828d2e7602de745c7ce
SHA512 8546c49535c59ddd3c175af706d2af14bd75d3822da688f5a4ff67ac422c764578a31ebd0d0d9e72451c8b489bc67079c7b6371909845c64c2add48783498a3e
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U3:sQRQyi36YOcPhLvw2gAf+PN3ulc3
TLSH
T144667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 891b9ea5a12339e5adf7ea419dae3b1dda7d3e001fc07255819457ad376a4478
MD5 5e6aa87a4df2304231cee7baf1effd97
SHA1 186a6b5cf2560351b34b97518f7f41ad2394c1a4
SHA512 5c53aafcb56295ee7e94306f14220ae834003934a8b344c79382246599e803890bce46db604bbe9b92db36debae48667d6a7f2248398749b3cc08804a4ae775e
SSDEEP 24576:qwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0BtbpcNBw1FhtCrr:E68Qg55nhceWu7PNU3/UtlcQQD
TLSH
T1A8B54933B2F600A9C44DE1769F4A872196D27C758FE0E3DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6de8e8aa351506865570a5f3a52dee0e85c7655abcc43a66c5c7449ae903d83b
MD5 75e352300ad9bdd8dddfa0d8095759a9
SHA1 dba5baf423885ffff882c249b62e85fb7163e021
SHA512 5db13d0e9876a44a5056a220cae64f85c27d348de0843e75302530ade8235fdb9cbfe32ba474051525b2eb374337823edbc45b404f5ddfc353c43658a787bbab
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99J:Iy5112gYy5azzVva69nLKnhZPlc3
TLSH
T1E4168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a4d2b613260a235f935e7a982472ad616b8065c91cf01d98726a35974f076dc3
MD5 9735bac71d3a9f60c9742feb63f4ce5b
SHA1 a05358de931c65965352f0d30372140a5fc81997
SHA512 e59a8ffca090c011011e220ff1be705e48ea363e6bfa728a149baadcc7a451a5913307a8b9e500791c4ec99098409a815d90b9026a1d6b7d9261aea00e99966b
SSDEEP 49152:mB+taZ3usBWOBr4tEG20bqx0z+n217aau1glBtlcQQD:Uu6JmUxd2drlc3
TLSH
T1EDD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9787f25bdb9f2fed55661e5d06c7e7da9f67490735a333a07059a81d51e64cf3
MD5 dc60820d718d663cbe7ccb477e39cc56
SHA1 3526600fddc3cc37c82e7c2295a899d1297e782c
SHA512 3d7a7cea7e4990ad3a4661e1ef7e50f8e6de7e5745c520f2b642ddc85fd0bce7f66b1d123b8698d6ec83d996e9cf8b62f654a3a04272492f24c5c8b0a88df0ff
SSDEEP 24576:thv8E1hps0+ogd2z615uCMVF1Agz6iUQ1zNOgLLwH7ReaQXx3CtbpcNBw1FhtCrr:H1hpsNoJpF1A6BU44CwH7R4xytlcQQD
TLSH
T1F4B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f9bef26d980ce239dd4a3bc2cfdc5cd401d7c5fba092a0004bf3d7b054e5d76b
MD5 7bdfc67b69071084a185e090fda6d17e
SHA1 743faf1c625d0838515cb1652c1b51f9821f1042
SHA512 492527f13d41fceec2d884bdee352938677024fb41a9e4d0913bdc9b74aee4fa98c88135495c4219a5244e3ebe61230cca5d9e0010c43dc4ce36f135df6a6725
SSDEEP 49152:NSuZQIY0Be2KNRVtOnks6NMHqRtlcQQD:D5dKvi617lc3
TLSH
T120C5BF03F2E941E8E0BED67887659232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 964ed1677f4c4c71a520514b3b87154b2dba1b9d553e7208bff3f74028641463
MD5 b95a6e0383e539fa003beb313eb5379f
SHA1 b1ddd9cddd4fdf9c10e1f0277f39f1887072ac1b
SHA512 08a789ab3be1c7dae239c10ba1f651b6d9836be93d625c5c5d8a2d657399ae14acb59c2cfa7426ec2907e574cb40aac7a0169b809601832dd84ed8c55dddfe00
SSDEEP 24576:thiavrPSLT8EARn+FgyUgd0fJY6BXi3iy9CTn0AP5+2QLCtbpcNBw1FhtCrRhZV:thtSn8EApI0figXgiDn0AP5w2tlcQQD
TLSH
T1B795BE13F2D901E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 56c50b41f09b96c4e418bec839ef4a39d6a06f4b56af4c65b964aed24f19da4a
MD5 eccd545fc8e788540c8e4da4e463188d
SHA1 23f2340b56ccaf467b93e81ea6d8db23b6033b0c
SHA512 d7dc5ff88b592a2f3b533ff2cffedf2e575413b7e62b41080f7ade3259ca04f2fa32dabde9034a76c961c5105bb7d6070a333a717f2707f1a69e36c25252703a
SSDEEP 12288:c1OytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/U:c1tbpcNBw1FhtCrRhZV
TLSH
T1CC452354C0AA82D2E55ECBFCA36119DA652E3CD7CC8501C7EF96BC436FB164BE126870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7a7e59905f4f2e1639b71a406e9974d1ff6b8dc755be61dd72493888c0e903a7
MD5 73f3b6d96d3d42db7b26d6915c91085a
SHA1 ba7f70f7de3d4118cec2eff0aa1d3d0f577f9897
SHA512 4b8d45b5213532ffe277d84dafbf04425a567496a166311096520be8145ab68a2399a94d9df8eeb2b08990cd73ff923ae30aa8c068658560da64070874c5c301
SSDEEP 12288:XuOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/d:XYtbpcNBw1FhtCrRhZV
TLSH
T1F5452354C06A82D2E55ECBFC636119DA552E3CD78C8501C7EF96FC43AFB1A4BE126870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ec3eab8ff142c6685f0dd551f6bbfb051b7b7bdca366585e49a66161d3506090
MD5 42cac7a6f2de2163bb74678997e67ca4
SHA1 a8a74800cf0df9656655333aae41599fe2554b1e
SHA512 c670700216f7d1b1c78d7cae3df32e28fb170869b5b84a138d9176ca00caba1f5b8f9bb980e3dbb07c82f492e14940a602eb496bed4a40c2863dc9f90639a6da
SSDEEP 12288:B3QOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/d:ZKtbpcNBw1FhtCrRhZV
TLSH
T1BA452354C06A82D2E55ECFFC636119DA552E3CD78C8901C7EF96BC436FB1A4BE1268B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 bc189ad00fe3bea74fa4d9ded82e008430ad52589a7f80c94a162ba5e08a9f19
MD5 6009e33e5cfbfba05d1df2587158d005
SHA1 103b285b951f72a9269c1d7cb946654e71d0daed
SHA512 a5ae5c4f70e907d8363f6be926dbbc8bca43c478cf7782f79f06afa7938eead60d7045814e87a31c318bf63f574e7bd7ff5f6e175593ea59d84c7023d45424d2
SSDEEP 12288:oVvOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/e:KtbpcNBw1FhtCrRhZV
TLSH
T1CE45235582AA82D2E86FCBBCD3611996A23A3CD3C81502CFDF517C871FB178AE135D60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d510afa7f93f2e20c3026795469be84fa3fb3dce4ecbd58040cc01c61b23efac
MD5 5be0c1fd40aef1bfc9ecccdbe734aa2c
SHA1 cbecdd3d19642366ae3caf6c260ce0c6faf85e26
SHA512 aafb7995286b0840cfa2e0aeaf18e69e0b9bebda4843f100e3640dd0c89c7b0adc5e9adb57b677bf08b0b3a43300d67c5180920acb9b16876a7a97277059bd82
SSDEEP 12288:UnOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/H:UftbpcNBw1FhtCrRhZV
TLSH
T1E0452354C06A82D2E55ECBFC636119DA652E3CD78C8501C7EF96BC436FB1A4BE1368B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 363df19ef721b16bfbcbde9a737d66256b1886b0642464736a55066acab7c229
MD5 e15f371702f3ddbc22d88ba0a9354bef
SHA1 ba8b64330ebcec96a65f1fd9617202d49433d251
SHA512 7b1ce820a6a07d4c6dee8d118714f972a353cb3ea5a73d86427af9f60a46b53316ae3d23f1594d6a7570e73cc065585268e03b28e742be6d0827d1a109e4dfd0
SSDEEP 12288:IKOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/l:I8tbpcNBw1FhtCrRhZV
TLSH
T154452354C06A82D2E55ECBFC636119DA552E3CD78C8501C7EF96FC436FB1A4BE126870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 cd1191296d1313d798ac487a7f95005a1ac79bd401425ffa6c5082876127b8ed
MD5 29dae4d40c1ceb23bc138f763fe4e4ef
SHA1 a743ee668679e4b3052099592cad3a53f3d250aa
SHA512 4737ef93c8faf37dc1b146aec4e8083a34c5face0f6d94c674c4d0fa2445f9d0c99af37b7c17af870fb5eab7aa082f5872b34e997d9de083c338b3333d913150
SSDEEP 12288:KmOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/5:KgtbpcNBw1FhtCrRhZV
TLSH
T131452354C06A82D2E55ECBFC636019DA552E3CD79C8901C7EF96FC836FB1A4BE126870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 1e8628cf13a09ba7d2c00acfaa1d163787309e489741998bf91064fa85174a48
MD5 504847204d2f6516b470ce3162885ef0
SHA1 a6e84094ce9206e2a11b03a34c7695c323ddc161
SHA512 012ff2a4fe3695a1c365689099623276739f03c5958774b89de9db1d09c8c9404cd14f9c60093d94269c6bea19a438eaa7f2d6600808ed1f320190d3435ce32c
SSDEEP 12288:NiZwbczzFEoS2cPvyOOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs1:QZMMzFVSO4tbpcNBw1FhtCrRhZV
TLSH
T14C6502A4B3A018F4EC67827EC9218906D6B27C5A0A60C64F07F43A675F733915C3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 a4e1d276dd4d8eac4a15a1f908f3e603bfeb3ee38267df5d0fb2ab9e907f0296
MD5 ed0dee00031e0f7ee67625307b6da713
SHA1 f5f1268da59151bc94f4178a8950d8fcc961ace1
SHA512 7ea00d2153fd9f3482620885588586c9bbf8b4c709f8c5c8ab81a5ecfc8314754ef8195b1da03cd4ccc1f7911d87ea255d6fbe5263e4ddbd0e105dec023a0c7e
SSDEEP 12288:XZOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/S:XhtbpcNBw1FhtCrRhZV
TLSH
T179452358C06A82D2E55ECBFC636119DA592E3CC79C8501C7EF96FC436FB1A4BE126870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b9f049ce3fc3c6cd576cee95d3c053d74ea0a2749d02f83ee3fd63fcf7a9ff2f
MD5 b1c2079fdc3ac503721dbf5896c75070
SHA1 fcc42e4360f85eb53a8fe6740c3d185e39f2a3ff
SHA512 c7e7fa5afeaa0384af21dfdc248304baf02141fc1a5e2f72dab25a24ca54eef90aa2520c638267a762c1d50d98cbe44aae894ddeb7731b8629f856eb1a4a99ec
SSDEEP 12288:AdOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/T:ANtbpcNBw1FhtCrRhZV
TLSH
T154452358C0AA82D2E55ECBFC636019DA552E3CD79C8501C7EF56FC836FB1A4BE126870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 2a78493e86afe65833246ef9bc49081b3c407389ab824786dbac1900686f2834
MD5 7e0a820fb2e99841db0717748a0a0033
SHA1 01ff97a62c3389e380082d56c0c02e5c813b2434
SHA512 b4c8f30fef377885860d1bdfae32a568181e7b05da0aae1b62672012d45e4b20f94a807009b79d8ef98ed3fcc96bc70a2194b31d2fc870761a6e72e081103b57
SSDEEP 12288:dyPz5L8yOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/r:Uzy0tbpcNBw1FhtCrRhZV
TLSH
T1EC55120762A530F9D16BC378C9621A42F73678734B204ADF57A05A772F336919E3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 4a1226a1bc6bc96abee10c1dbbbaf3fac4db680cc0dab3929ad9af33603ad1d3
MD5 dde77c448079520a9fb2ab092e3e5c38
SHA1 2641f9b43a563106fa2dad510dd1f898762d5c04
SHA512 cb65254f94a7284a8bd85231be35a07458052d4c517fa3618827d659a19ce5eaa5f2af75e2c2270d3e08f53a4b03167cfc7da7bfb804eb51107172c19044a9ca
SSDEEP 12288:sZOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/L:shtbpcNBw1FhtCrRhZV
TLSH
T158452358C06A82D2E55ECBFC636119DA592E3CD78C8501C7DF96FC436FB1A4BE126870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 6b4bc869132e1a0fd3bd1cdfe94016331df5273582d701d0820ab5910c57ce0e
MD5 dcf41c802cb8913c684818ad24a50a6c
SHA1 4a3d95a04aa5a091abdba321cf6ae47dd2e9ec1e
SHA512 5e0be6f280fff886d58ee81e88ea71532bf9324594b266d2f67572525f98ee7b22cbf446310d4f9afa1a20fdc1d1667dc8ee5ba7a8b541287b4ead986200b09f
SSDEEP 12288:DZOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/Z:DhtbpcNBw1FhtCrRhZV
TLSH
T1E3452358C06A82D2E55ECBFC636119DA592E3CD78C8501C7EF96BC436FB1A4BE126870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 a3408b4c7e35c3ef99683188f16d9d87356c59504abc2d574609bc038f0c2bc2
MD5 9e5dcf9afd5153da354c7c18bbc4857c
SHA1 32ea89695bab188af481cd87de4d9fce683bfbbc
SHA512 f8a62911a80d4185b4089cf963f93cbb1ea865ea0fb469e29f626275ce0caa7049b76fef300b926aff405f3543cd89b907741b795234c6cb9c6078c31b9ca455
SSDEEP 12288:FyPz5L8yOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/u:Mzy0tbpcNBw1FhtCrRhZV
TLSH
T10C55120762A530F9D16BC378C9621A42F73678734B204ADF57A05A772F336919E3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 5a1be2b8f70add2afaf7bbf0a3c7c39ae0a040fe2c10f680deccb4d484631dde
MD5 be0733081c925d970a32b0dc7508241c
SHA1 42905d6da53660c62e9085fd1938cf486b865f08
SHA512 6ab1ee62be7bac076abd6744b8403fb08450c2cabf2b0be4acaf03b564e5f0c642ad17ac83fbdd4018c7f247b62b97e5275f9832907e0e5e03b36c8860dce77b
SSDEEP 12288:qCd9MWYoaLHF3z0z04PDvhgOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRB:bT9aLl3z0zD6tbpcNBw1FhtCrRhZV
TLSH
T1F16501A4B3A018F8EC6B867EC9214946D6B27C5A0A60C64F07F43A575F333915C3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 866e0dc93402d64c71123264a94fb4d4002bfc30f3751455118b187f0fa865db
MD5 5e2c59c3d4248ac0184eaa56190fb9ae
SHA1 fcb60d926e5b927d9df192e4d6ab033a0612ca87
SHA512 be67f42e40a7cac8eb716fbf1f0357bfd350d183720cef41bdeb13ddb96cf70a48cf94d777658be243052d8a28be86f38d1f412d817f9119c7ca0a50daa889fe
SSDEEP 12288:Di4e7oRdTfgwCHKy7GLbbdIvTOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfiE:D3td9CHKy7GZutbpcNBw1FhtCrRhZV
TLSH
T1DE75CF90F3E410E8F0B7CA3989765512DA767C9A5B21CE8F03A4655A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 c3a3409267d39458a0e877321df0b7fa352125013e3bb9a8827a87ff327636cb
MD5 d4388a004b24fcd14bb55a3d3c794752
SHA1 1435880656113d3afb416e907e2f26028f578d80
SHA512 21a5811d9292107c8e25e3e9d89879226970b1a68dd271b96652f128581f7f9dfd3ba6c519835d7d151a4c3834d1d16fd11941a4fe8857163df81c165861aa89
SSDEEP 12288:VwOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/Z:VqtbpcNBw1FhtCrRhZV
TLSH
T177452354C06A82D2E55ECFFC636119DA652E3CD78C8501C7EF96BC436FB1A4BE1268B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 1056a2292c51fca4520f3afde947efd62bc8c28e180120c65f83529181aa5c3b
MD5 5b7501a3b4c33b54d8fb9ea609455d1e
SHA1 cd8f884da058d8b0b28b345b07707ea48069e3f4
SHA512 b212862dde0080be2be49750b80dd45b690cdbbcab8ee8540b5811d8483eb49c08d99f314111ad5b56e5f5f260c9b19fba23d39d9b8099dc15ad9c48d8d5457c
SSDEEP 12288:USOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/s:UUtbpcNBw1FhtCrRhZV
TLSH
T10C452354C06A82E2E55ECBFC636119D6652E3CD7CC8501C7EF96BC436FB1A4BE126870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 316f8b8c98d3b1898b489aeacd38e89387e799af58f576c9f8c2e1b2323f9c2b
MD5 07e6dd4e372ed805a465ab6c68cec02c
SHA1 307b5335b204018db855e66e2bf3e3f6374712c1
SHA512 ffe82f19d5f1a98442c831aefe05417b52420603e312d51ad40c5af0edf256fdbc8e36f3cf86e3d132541809b0d13c5a1fae68918dcdfac820c25766bba40bfe
SSDEEP 12288:qTOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/A:qztbpcNBw1FhtCrRhZV
TLSH
T134452394C06A82D2E55ECBFC636119DA592E3CC79C8501C7EF96BC436FB1A4BE126870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 fdc640560c2dfdae79a8e9534db1329775ee238b3d0e7bf0618a37aebc8ed0e4
MD5 e062d020b8a41bab4869cfb2db9c7e06
SHA1 bff2aaca82ac0b5534a739e704687af1f6500e3a
SHA512 3e5ca02919587fe1dcf15a2d4b17d09883d8b4d6cfba2e9697053f2ad47735e5037a46ad8181073a18dab5a11924be8c4167c5dd86e12a4a0886a2d7fbd0906b
SSDEEP 12288:iZOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/7:ihtbpcNBw1FhtCrRhZV
TLSH
T10D452358C06A82D2E55ECFFC636019DA592E3CD78C8501C7EF96BC436FB1A4BE126870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 2d1f1116771a0217d1b75ca17c25e0f4f51f62875a9309cc420c46a85d5a7ee8
MD5 36417660dae45215d16c2d0a0a5d38a9
SHA1 f418a9627c49621de154fe48566ffd866a55da62
SHA512 658ea498e361dc361bc8a1941f7a1908386cee979c9d0f4e5c165e354460b19b02b927b07f0d0c3d46715b92496c7ab5c402e4234f8b740b0289b9f393dd1095
SSDEEP 12288:ZwOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/5:ZqtbpcNBw1FhtCrRhZV
TLSH
T17C452354C06A82D2E55ECFFC636119DA552E3CD78C8901C7EF96BC436FB1A4BE1268B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 1f636f7aa81e09ed79812b2da17676a6a958cc6f241420d3be3092444ba3ed8f
MD5 06cb3e538ca70969f2aa8deb291dd0ad
SHA1 29372231ce80bb88a001c01b1f3dc8b0e35b2b04
SHA512 69d89fa8aaa70f5ad6e1c51f022bdf65832f47faa4daf29f71408162d36e9bbee1a0f49db306dfdc80c14fce0963bbd722ce010a159cea63a2b4111086a5eb19
SSDEEP 12288:jxOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/N:jptbpcNBw1FhtCrRhZV
TLSH
T1FA452354C06A82D2E55ECBFCA35119D6592E3CD78C8901C7EF96FC436FB1A4BE126870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 160ea25c28716fea31a7846e49a5a3731bd6bd330a71b1d2864bec0690b2dada
MD5 357efc8db02fddfd854068df95f88b33
SHA1 1875d81217454b561b49b2e019a75fb2023206ff
SHA512 9fdb2221c4213e300e519f233a442175aff4563b283dd9cc6fb97655dc32a6ad290ebc0abea93b83ae117c289a70f1ae3b955a391e1a0fc457ec1280dce2e3ad
SSDEEP 12288:5nOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/B:5ftbpcNBw1FhtCrRhZV
TLSH
T150452354C06A82D2E55ECBFC636119DA652E3CD78C8501C7EF96BC436FB1A4BE1368B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 6b360f0ae5439ba05219a67f11e887f9562a5df496d3462619fcdd364f136aab
MD5 2a03b6644e59703a9212e89bc1356596
SHA1 c159d982368403b2aa7b06e5e79dd358f483f0ca
SHA512 3f20860e93f4209cbae2a4e4a9c9dce000811051768deb17671d1a9908675fdd2ac3c5fc87566eec638c1de68a18889aa0e629f050d88d7ad3fd28365c8bc120
SSDEEP 24576:nfwvok9RX6wkyAIdtbpcNBw1FhtCrRhZV:BMnYIdtlcQQD
TLSH
T1B285D029EBDC44E5E177927C99B3460AF6B178591B31C2CF029A53AE0E33ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0e355694df4a26e98acfd63612cbcb7bbecd7c0e6c4fb63a35628a1bdfdd5533
MD5 4d47de362055130b74e37963bff87d12
SHA1 0c389912835b74864a925320b18bb8fcd41f41c8
SHA512 2c159d14ca2bd79a7970fc00b2c22408d733a527f2cbb2d159f51bb17bf4d6aefb66a81150b200809d8ad0f3684303ba1dd6da317731134d67919303766974b5
SSDEEP 49152:NYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0WtlcQQD:rySzPOlc3
TLSH
T115067C96A16801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d2eac5cd7903b1560b706fe70ba93cd6542c6810c41b72208daa45bb87388373
MD5 85630f877cbb26d3c84d7bc3e8817a24
SHA1 0ffacd705b43df1f01e3ab41e923edf2304d5965
SHA512 60c6f9deddbad13e3760ac26b9669a835f610906a1131ba5f345919ed04df10e170c374693d22ccd41f70b563f16028fb33002c35fa41b3ad2a01167163e3f0e
SSDEEP 24576:A47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYItbpcNBw1FhtCrRhZV:A47JUQj4irIhCnDHUPfF/mtlcQQD
TLSH
T17F65AE1DA3EC01E5E1BAD27885154A5AEA71742E1F31CACF1270827D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 b0c12023562f6595f7e1f4f4ca7803bed960539e78792cf646e13f17d8eda486
MD5 773f91510190041326e95bbcd9140030
SHA1 12fb99a7ac2702dc54081ebb02277f6d6208c5f9
SHA512 4aa305725aa7f6f5563ec03776abbfcc75bcb00324d99dd355dd2e815c7bdd7dc54bc238f3e8767e8b726a29a2de74d26142d0ff2bb993057c4c108670290a16
SSDEEP 12288:RGsfpOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/Z:jRtbpcNBw1FhtCrRhZV
TLSH
T1EB550119C29842E8C06E9279C7514A81F3373C6687E183CB57D0F87E1F76685ADFAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 968KB
SHA256 b44a2afb10ed9d4e3b6fbac14cd0048c6c676501c2a2e6b448332f9ef6877e13
MD5 e4bb57333d2cdbe78db7910fc9450df8
SHA1 faa0758c41bce8debd55ac9963627dd6114ea138
SHA512 dfd8786cfc0d58db9f04915ef45e6e8b7157ace961d02c2736137a86770997831ba77d562a8419518266a6ee8bc389833bef42afad146bfbb1f030e74ddc7793
SSDEEP 12288:tgX6AU3fdyJH6A5JqFNOi45NnVL0uxmlHbpIdlbo9h:eX/UPghHhVIuxMHbpI7bo9
TLSH
T15E251801B626CB5FC66940321E32C5CCAB707D51EE456F0373C98B3F9576A59BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 aba1ccf29aac83ab990604cd43ca7122afc17af738d9b3455ab7a48410183583
MD5 ae864bc648b0984845ba11756af68511
SHA1 5a5f3132b2f1fe2f6ca772f6bbca3b17a3228df6
SHA512 b0551b88c9ad0df49cfff5485e08a57e563b09a1fc53d772d019bcc77dd94aa6957b65581bc386a2f03c31d1e1d7fbd3a0920375bff23ef0d80537a6bafe0239
SSDEEP 12288:n+Ej0GjNXARJqF5AGJqFxA0JqFPLjadZJX0HlBirdZtZv0uilXzXTmRT2Tax9XY7:jxVXaXl2noo
TLSH
T1C465F9419536A38FC1FA5032033A5B8CB764DC06BB496F26B3C8493AD867B15B1B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 1c874cf0f7737bd56027d5c9f67d0e8e7fd216bff4328c2e520167f6a0d60397
MD5 93560efb9fe46683bc38228502c41257
SHA1 a7eb256ddf224cb756f3ad372219586c53ea5e72
SHA512 8188038844ca9a93b25f3b53a433e30bb078c0729c3fc1d1338318f98c24439f7af1e2cfc98b6b19b795507acaefad95a67c36e2f69bf7b7de0c91f2684c2336
SSDEEP 12288:hM7BOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/:6ZtbpcNBw1FhtCrRhZV
TLSH
T168452355C19D82D2F47ECBFC62655966262F38A38E4400C7EF52BC876F71ACBE532920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ec5d57fc31f875acd8cb808b8079712700b422e94bc6f209e5606aece5fa1a9f
MD5 48546c36b3ea882013da50e225116ada
SHA1 2ac59ca7c6dae08d633c0617b511a59c8cdc510c
SHA512 7c5229c08f42e725043c77b161135890a7e489e7f6f9ad7fc10be09749b63f469e83580fc8979c77eb345873be017a31a9aac712a8f810c5d4ba78d5f2cea232
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYrtbpcNBw1FhtCrRhZV:Mgb4mBIBhGFItlcQQD
TLSH
T15D65AE1E22EC02F5E0FAD2B8DDA64417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 8967ca6352b2836b9e975ca10052a74394c3170d92dd95ac76a851fe0c83a550
MD5 7a564725b294363346808623d9877dcd
SHA1 c602d215e2ad0fcc2ba4302630debac9795eb7ab
SHA512 0192a1a6282297a56cd58a4df3c94b74946b2bc82c7b50fec713b280b82a76f039af10c6e346f61a3061c5cb0d296b24d41c6ccfbf411db37cf5a465ae87eb3a
SSDEEP 24576:kG88u8FpJqH1Wzria7/m4tbpcNBw1FhtCrRhZV:X7ZFPqVha7/TtlcQQD
TLSH
T10385F26566E101F1D47BD1388A424663F6B2B4260364EFDF0BA88E521F23AD54B7FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 320311dad016421b056c6caaa5e25c8dd12d8f92dcc6758810ca13c804599e34
MD5 554db9e909280c1572b39932233a803b
SHA1 5ef5521070eab2a7bf4d66661ae604a2f18dd4ea
SHA512 ea14b951d08f18cc843ff3d1ad230a2b86a09bd684f368e0001e88fdd9e7a7dc125b8becad1a073c7416854cc50d3ae389895dcc698c84823ce241e2652dae34
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj8tlcQQD:5G05lO43bHlc3
TLSH
T167D5CF6E62EC11F9D1BBC17CDAC64A0BEBB23415032556CF02A486A91F27FF4A57E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ac67a66fd23701b03ec66955eafecc4b2f5900b9578c527a30732f979b71224e
MD5 b8a2ee387cfaca66deae190c2fbfb12c
SHA1 6dbb088c9620744dc66bfb238509b9210599ea42
SHA512 0904b93e0d34e2044219dd0fe3ba624afd79b4bf4ded10b766f8a96ca9b30744e56e9cb0beb4898c9d550362642af934fcdf7418f5ac571431c0a0c4a0c51508
SSDEEP 24576:tfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnWtbpcNBw1FhtCrRhZV:da5POZ39Jt2pasx2+mUtlcQQD
TLSH
T1AA65BF5EA2FC01D5D5B9D17DC583461AF5B1342253329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d1a119486d8d06bf01b9a150f8e563c9800e18cab01448c506ba98e62b35a461
MD5 2da668687b8c998bedb0d428483614b2
SHA1 8c9d0a658759b280cd732e31aacc28c9b72c7a9a
SHA512 447ba0b8b23c67e49decdf7d4a1da36d87f6e5a4001c37884098185692e1eb3e8da9070a74d1aa16c8d18506bfaed4331c33ccf08fc01e710aafa0b0cec55399
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7FkQtbpcNBw1FhtCrRhZV:HNc/zEOVHFztlcQQD
TLSH
T154858B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cae1ee4d35c5f8b6860a42ef29b71fc4b81a6b738afaf747b5af54da3ede041c
MD5 899a56a27944b2fec05ac21d1eaa2747
SHA1 a8cfca795cb665d46b5f50483e8ade8d6c128c06
SHA512 72bcd22a178f4a0a79c10535a34c343bebf194cb2ed024d6b7b7efc2a902d3e761aeeeebacd4c16d09e657bba31b0015dbe3ec654e77352c8a010e5b53bec44c
SSDEEP 24576:XtkNvNnaFeYhJNtmZBmltbpcNBw1FhtCrRhZV:XtMwBtOmltlcQQD
TLSH
T18455AF6EA6B846E4D1FEC6B4CE238512E6727461073253CB9390C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 6045e91bac145a05b05975d14cee4af4799e09be38875ac698cd8c009c4d4827
MD5 bfcde58e1771ea2a5a834836d9591eb6
SHA1 be23fb9b80f1984a6d29e4d9646078b8fb9cc08b
SHA512 adf3f61e34a54b994c5d58b1544149da6b09f64578dd56b6ae2a1a6ce4389a309ff5be3d0a34557119c043a17caa050de953803ba036a6dedc72061065d83ed3
SSDEEP 12288:dHvUrBFrEjwaQ6OytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/r:dPUr+NQMtbpcNBw1FhtCrRhZV
TLSH
T17B65F12F62AD18E5E67AE17C86824719F7727462071192CF02E1817E5F63ED8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 1610830ce9bd4ee74ecf0adf57b773a8a507ba25a87fbc0faf462e1570905557
MD5 ebe44ea42137ee39a6c429314517dd70
SHA1 f76a1ac39583dcbe32d21811e818188dc4d408dc
SHA512 31abb9a509f9fcbb45372091bb6e28d8b6dd4cdd315a16d78fc816b718e9a1a72c9301046eb122b3f5c73ddfe28431b3e55708e69a1cae4ffdc476315bc597cc
SSDEEP 12288:mQcMxWDXN1Dp/fshBItT1IQgAVOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfX:cD3FHshBIYQgAVtbpcNBw1FhtCrRhZV
TLSH
T1E275E17DE69C00E4E57BC2BCD6638A06E77138A9032256CB06D491B61F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/556-325-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/556-117-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/556-123-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/556-116-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/556-329-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/556-327-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1200-62-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/1200-56-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/1200-66-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/1200-68-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1200-55-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1576-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1576-156-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1576-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1576-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1584-115-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1584-25-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1584-26-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1584-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1584-18-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1692-83-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/1692-89-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/1692-322-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1692-81-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1916-15-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/1916-53-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/1916-51-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/1916-42-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/1916-48-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/3404-16-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/3404-13-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/3404-9-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/3404-1-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/3404-0-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/3612-157-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3612-330-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3612-164-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3612-158-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5492-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5492-342-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5492-104-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5492-344-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5492-110-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5492-103-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6412-326-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6412-136-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/6412-130-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/6412-128-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6508-307-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6508-70-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6508-77-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/6508-71-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/6604-93-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6604-323-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6604-99-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/6604-94-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/6992-147-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/6992-141-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/6992-150-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/6992-154-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6992-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download