63bd4639c72e105da6ee4931fb2ac44d2211281b58612b600cc73695c108caf2

Analysis

max time kernel
144s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Size 1.0MB
Sample260708-e1ae7aax9v
SHA256 63bd4639c72e105da6ee4931fb2ac44d2211281b58612b600cc73695c108caf2
MD5 918cb5a4edb99643a52bb8449255cbab
SHA1 6de556bd191831e8846787507c35d74c390afc86
SHA512 c977c92ddfd7a5ef7b3b5921506ccc0d890f353b520b8e0c02ad0b771eae60d25faaba8a3faff6eb49af84904b2ef5abdaa128e16243f8e2916653a0d9c99713
SSDEEP 24576:yooH6ThNF4Xx7AYNGtm/MzYvMnVFTelKa33:HoHGFEBAYEtm/EXT6/H
TLSH
T1EE35DF58AA5440E1E1B7C13889439942E6717C015771EBCF13E8E67A2F37BE19E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 22 IoCs

pid	Process
2172	alg.exe
6092	elevation_service.exe
2136	elevation_service.exe
5208	maintenanceservice.exe
416	OSE.EXE
4088	GameInputSvc.exe
2508	GameInputSvc.exe
264	msdtc.exe
2004	PerceptionSimulationService.exe
5452	perfhost.exe
5348	ReFsDedupSvc.exe
5464	locator.exe
5600	SensorDataService.exe
3032	snmptrap.exe
5612	ssh-agent.exe
5584	TieringEngineService.exe
5916	AgentService.exe
5912	vds.exe
6040	vssvc.exe
2156	wbengine.exe
4808	WmiApSrv.exe
2728	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6936c48f53e17fad.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe\""	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2508	GameInputSvc.exe
2508	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2704	2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	2172	alg.exe
Token: SeDebugPrivilege	2172	alg.exe
Token: SeTakeOwnershipPrivilege	6092	elevation_service.exe
Token: SeTcbPrivilege	4088	GameInputSvc.exe
Token: SeBackupPrivilege	5348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5348	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5348	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5348	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5348	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5584	TieringEngineService.exe
Token: SeManageVolumePrivilege	5584	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5916	AgentService.exe
Token: SeBackupPrivilege	6040	vssvc.exe
Token: SeRestorePrivilege	6040	vssvc.exe
Token: SeAuditPrivilege	6040	vssvc.exe
Token: SeBackupPrivilege	2156	wbengine.exe
Token: SeRestorePrivilege	2156	wbengine.exe
Token: SeSecurityPrivilege	2156	wbengine.exe
Token: 33	2728	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 2508	4088	GameInputSvc.exe	95
PID 2728 wrote to memory of 2376	2728	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_918cb5a4edb99643a52bb8449255cbab_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2704

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2172

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2136

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5208

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:416

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2508

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:264

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2004

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5452

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5348

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5464

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5600

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3032

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5612

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5584

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5916

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5912

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6040

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2156

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4808

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2376
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3437697693-2283162250-3003737219-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3437697693-2283162250-3003737219-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2616
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2964 2956 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5508
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2908 2932 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4fbb67badb6b70e122d02a4fc6aee520a564886a781df68d8635a93bdf807e8c
MD5 a482182341e5bb03770cfe0a2a36a124
SHA1 06ca0071418962460b8f3d18e7fbc2e8f6177389
SHA512 5fb577ff36bf4ce1f5c7b9f774f06d1ea86d8a742a900c7ebe2fd53f78007300a91e37ed2e6d4a42dd0decca777acb37fa7b456edbd745f2ebff117e6a072d6b
SSDEEP 49152:sb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnBEtm/EXT6/H:W3q6gjByEtm/uuf
TLSH
T1D1D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 355780abe8c63c954c57e7baa39e47bb5289ec95e5b791baf45761241350e1b4
MD5 a2134d146f2054fbebfdb3b00e1fcafc
SHA1 232558dc2a659253154512336c7ce9dfa5707382
SHA512 bb2958a40df0f97a2bd0ec01cf0681117046b7f1bef4a56ed00594c65f5b504c5dfe9cf9b45e308d78229faa8ad805e0be7c788fe8864d4edcf5050951495715
SSDEEP 12288:L1XLsH9Jkxy2lRq2czA8NKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atNo:xXYdItczA8NGtm/MzYvMnVFTelKa33
TLSH
T1D405F12973E508F9ED7BC17CC8A28502E673B8564364E78F03A499651F233D91E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 2f4c1757f82e811725d345802d287e0118497190e643c55d325e1bc7600d4188
MD5 288a15a90ae6aac0e0599e11a4a4f578
SHA1 b4a8e6d3cd03f0d7d09a2cf2b048a1a39af90fbb
SHA512 51a6a0218e37cd482d0768e78f7d7b2d381b7e3150493307e8746b166fce7f8af368b184f891074d99c5897659ccdf65b4d3e3a2cd94e5cc89779b09cce1e7f5
SSDEEP 24576:103eEY/08mxOrMPNGtm/MzYvMnVFTelKa33:1WY/0DoyEtm/EXT6/H
TLSH
T1A7459E26F6788335D073C0B9C5D2A68AE971308657308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e011836783cd14b7e8591f65e29535a1313a886d48632d6a493d29399379ec1e
MD5 c9a3b5294b72e45785e4d375a943bd01
SHA1 ab7f4111fd2444c0438a78f57f28bb45edc4e129
SHA512 0a026214ad0339a0f16baae86207529ce838fa6af2a11d49aa1ddcac9f473d2a660bb08d90e17fe0367848b73371100db71d3c9d3c52dafd134e5f11bca269da
SSDEEP 24576:Fa6/ezSC6vUyD/aqgrvW/6q8wyu+NGtm/MzYvMnVFTelKa33:l/ezSC6vUzPvuHjyhEtm/EXT6/H
TLSH
T15E755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 76b11baef13653b1ac7c6e67c4ee5e13fe3dd5a93e59cc92e1821447720c1466
MD5 023840a69c0a9211ae3d24cd7019c70c
SHA1 83b2e4be23ea1304f006a29d0e3dd1da1b78e218
SHA512 e3a77f93b513adc7007807060da276b3e6034ca1096330aaafda22fd3f5925b6cae16db0cd76d0e5079a34e0b800a073b1a30215797d46478ba836f13c84cbde
SSDEEP 24576:YAbMP2Sfcv/l+dVNGtm/MzYvMnVFTelKa33:YA9SfcXl+7Etm/EXT6/H
TLSH
T1C8559E66F5748331D073C0BAC5D2AA9AEE3230425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 6f2657fd884ca60015638fb7700b53e7e85e427a201f15430187b20e45a3c548
MD5 2566d0d13714fbe1cc6405e3dd047398
SHA1 f36981dcfc2f35067acb0ff420d7a5ada4984660
SHA512 43c00b5b4f185d15e50886b38d95e60a7f31005045418649d38a264da713d77e8661b4577054da83c619db5c98211befbc706bfc699e1cdafe8dcdc602013d77
SSDEEP 12288:AZm7NKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:AZANGtm/MzYvMnVFTelKa33
TLSH
T148D433A276ABC46AF3BFD0707192998391FC994F5109BB8D1A11BDF065303DF60725B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 1a234f6b7b8258ac349551a52843db48b27abd1f6a7d1c03b9264cb389922c76
MD5 63e77ad3b47bf0e84f394f26796dd35b
SHA1 64c8db0ba479f2c8b3eecf1450a4dc829d161f76
SHA512 6bf61c6ec7aaf058844aa33d8f79c54b5d5158a95271c0c9a332c8dd266271fecdb830f5bb4bf9d41dbb4a62a1b3e3b4320255b03522a9623840d17c733443c1
SSDEEP 12288:NeBNUbTVO86U9NKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:NJIU9NGtm/MzYvMnVFTelKa33
TLSH
T1C215DF3BEE28FCE2C27F88B85691C640D7B274314B52A3CBD165824EDE235E51D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 656b2fd99e4652cd1f02989769ef4e8bfc215261c95accb4b3d50c1cf8930981
MD5 27e56cb8447b7bb1ab2f65d2b383e2cb
SHA1 4595c471c1d28781e398e99e0db694738c620dc0
SHA512 5a76728c005bddba4f18ad19ff9b27a48e298da75582e8c47ec189f7e31eb7c4bb91b09b7598a2b75663441618a3b66f208ab710fbfa6b8a9ac69a4b3a0f9ed6
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJx9DN5JzNRV3THW:nQvGAdlCEL8c/xRNP5CbEtm/uuf
TLSH
T13C366C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 e7fa6aaaf5923fc9f42f9084f57e683618cbb78a07bfd29df1e38957cd1c2dcb
MD5 fd33cb7a8a20e953c135c33ae8fcbea3
SHA1 fb180973a21df7d74911dbddde5e469a9870cedd
SHA512 70febdc217965c6ff331721ed5513bd14ffae84b25d509419781b0bacad4252f64f161bfae6d063b594476f45e8e51825180276ce3472e263116a2bf1b812981
SSDEEP 12288:RWwSfxL/2Dc3bDLLmt0LDQewsAj9NKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRN/:AmewsAj9NGtm/MzYvMnVFTelKa33
TLSH
T1C815E031FE75D436C3BF0CB22B26C706547DB9214B512AC7E3A89E9D59302D22376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e44ee883bf39929f2db37a35b5407ab3b92e6edc58cd86685be7b040560e8ed2
MD5 6bca7bd0cfaf0db5fdce7de8cf275ca7
SHA1 0539c24ec6860bec2809b87b0f0d1e18d84c04ec
SHA512 1c59bd15675db7617af2f424efc5b90f76e218fa8f823cd384419add6b725055ca16d15f44ebd8c2ce9d85c74dfd7a6d0d4f71ddabc87cbcea1ea163aeafc47e
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrQdPlbuJHUgJf:BUEtQevvqc2W1cpV2Xr02
TLSH
T1A5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 bc31a500eb0fcdf4af1b4cc712e60a71666b40b803d75a625ce5d04e34287a20
MD5 97c632281be0057e362b95d2a88266cf
SHA1 a1d6ccfc27dbd453f16001ef1a08eaf13fe0aab0
SHA512 9e4ecf140b9e016d0e9223beeef6d9aab42d166b1cb4a0f0db00db1098dea97dc9b2330956b1a3dbfcb4d3d593f18d782b855e40f9324501c8964a711e618f16
SSDEEP 49152:SXbRquA/m2yL5zMfFiV+XenmE3/zOEtm/EXT6/H:4oq1VjnmxEtm/uuf
TLSH
T109D58D1976B8C1E4D1F6C37886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7eee1d306c115ba0f5de8d891c8b3e051b8971501cf20e86281e8ac84a54cbe1
MD5 def2666c48e27900c31790181217584e
SHA1 479c333a60bf22fea91d4a881a2e896a6214f6ee
SHA512 0ebf1787d1a0bdb6effa422e5c4b3d1c70a753313c8f7bb60ae27eae5f8859994fd931d017c0ac6321887870e21cf9d9dcbe0fd482a6807bf89478703da47653
SSDEEP 24576:RAhGLvnFoiwtA5l7S539NGtm/MzYvMnVFTelKa33:RAMbFoiq5NEtm/EXT6/H
TLSH
T11445AE81E7F945D4F5B3AAB899B68171EA76BCAA5E31D20F2150D11F0E33A409D34B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 01aff9e0f699262cc71258c59289c8a181c261c863ac5014ea7da0d8439a3eb4
MD5 419b989dee66a58279240d09c86b12a6
SHA1 f907dc26c70a57474a92e80e0776f8098783da78
SHA512 b0bba299d0a531d4b48c85765ff5662f5bee68d6271b2c98c6f00e6c29c51f7b2c33e82fa9de862a2b64a6d793f35240c236ed659b062ab9e4262824eeb15358
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CmNKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87x:uwuuOWhNGtm/MzYvMnVFTelKa33
TLSH
T1ED05F14632A90CF9EA7781388593C536F7F2B8062625DB1F1760C65B6F333616D3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 ec8add8bfcd3474bea8300ad8ebac897fb7e0ba461b8b68ba6a3bff751833bb9
MD5 14eed27ca1738ec7ee0789b30eed63be
SHA1 4d599d892d3d83eceb85393a604720f0fb61be25
SHA512 ca9a8d72e64d57f7c364613dc52e019fc097dadc86a76abd9325793682adec4a654f78c9b7a03ad21c1b38d92b8e0075f804d0c3191ce94abcc249994012828b
SSDEEP 12288:92j1IE1NKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:4ju2NGtm/MzYvMnVFTelKa33
TLSH
T156E4129A32E960FAE2B7C078D5E19A46D3B67457233653CF1A2046A12F337CA1D35732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1982958a2c0dd1c7ea5b55666dabe9f7ec3f267a80e3213e5915821deb57eb15
MD5 edfd61b500f66b86c553b5b8430e4f25
SHA1 0127792e18bf4df0f30b5490d4ffd45db61b8c82
SHA512 611b6c61465f3cca8de4ad1299751ddd6a239fa8e849389baec22961d319470e95aff3287388e7c42d926e1c8d4c57c0499abef75af6374b98ae9266850f7aae
SSDEEP 98304:UQRQyi36YOcP8Lvw2gAf+PN3jEtm/uuf:7QyiKa+X+PNggJf
TLSH
T1C0667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1b01a5d5538082f4a4b4219bc23c26a3ab67cf520fc89e05d0127c5c3a20b36e
MD5 cf9dbee28c78854548e15d12ade911e1
SHA1 fcb2f37cd9fe205f4f9c7360a775bd366128e611
SHA512 f694a6483245beec4f263788ae092815a8ec4218991a28a4aa5c7dd8b26be119f400ee832d6bac54ce8a40619952e8b336856b293f8da992ed09b8eee006080b
SSDEEP 98304:UQRQyi36YOcP8Lvw2gAf+PN3kEtm/uuf:7QyiKa+X+PNlgJf
TLSH
T189667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 73dd198d690590c5051d647a7be311f48a3bf58eb06aaff09851f9d96c9c8f30
MD5 b9e3eade2149f88d24b4c525903ae061
SHA1 6bd51a1fd47a938bc58769377467811ed74713b8
SHA512 861eb021ac71a62e0a431b35afab06a65270203cedcab6dd16883c1bccac8ccc779a0df7bdd7a0e9ac3da55edfe675daf3f3ac62887535660191521f93763876
SSDEEP 24576:qwvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0noNGtm/MzYvMnVM:E68Qg55nhMeWu7PNU3/2oEtm/EXT6/H
TLSH
T13BB55A33B2F600A9C45DE1769F46872196E27C758FE0E3DB850172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 16ee5e992430707cfe3333c5877c6d772af6f56e7c6ea8b830d55348e7b3ee00
MD5 b541c4f3d3c02af524fa85bb36b865d1
SHA1 a6efbacdb4785eb2af356f45b9ef119334f94054
SHA512 d3d2206b513b0d91fd0df1737fc259b3c0d7357cb6c48e4042ba27c08c0d1af151ad560701be1159b04da0ff23577ff4a9759af4767a0ac9b01f8fc474680b72
SSDEEP 98304:Jy5112gYy5azzVv569nLKnhZYEtm/uuf:kLIHAWhfgJf
TLSH
T19E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a789a5380fe933902b36bd40ee88827e54cdfe21749946bd4d836efc00d2d56d
MD5 991e95f6bf26d441a6657b00da8508cb
SHA1 1eece0e2524b640e060f0d247f10723ff83a81f5
SHA512 fd29ff58068834d546a196baf7336511ddf21bf04e08d58f40118689598f9ee4749aebfa6490aadddc2aff600ff978298342815d401d396e5b941c43a14d7c6d
SSDEEP 49152:cB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glBEtm/EXT6/H:2u6JmTxd2dBEtm/uuf
TLSH
T1E2D59D13F1DA01E8D06ED078974A9233EA62BC490B35B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4eddc836b1b8ee527796100f0c69f3deaaaf5c78bc216b0edbeff21555bf1ed5
MD5 715c640cd883a73ec07ad61b5dc33906
SHA1 1fdf6677395ea4988135ddd68cd2616b397b5380
SHA512 aa9870b3570ebcd0c5849a677408ef1bbfeee54d1fcfba352f315b1c52b6d874adaa07e9f8e66c182f14f0f0b97c8fd174e31e02ce51d6dd7e6aecbc105b649c
SSDEEP 49152:J1hpsNoJpF1A6UU44CwH7R4x0Etm/EXT6/H:JmifPbRxEtm/uuf
TLSH
T14EB5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e35a7a10be9e4a62b68a6b648fa25efa2fd4e986cc3b5d8ba267df6ad0a51abf
MD5 9b788c1aa9c497b2e080d2069453f8a4
SHA1 2c3e4332e946bc3a98b3c06b170154ed3d2adaa5
SHA512 63e640babb922cd125bea9d7823db3be4e8404ac736e0d4bdbd19ecb662bc2dc5139b004e5831ef9ca459bf73a561117a2ca82908d0731caf4acefcbc34306ad
SSDEEP 49152:QSuZQIY0Be2K6RVtOnks6NMHqMEtm/EXT6/H:K5dKoi61MEtm/uuf
TLSH
T195C5BE13F2E940E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c94f904c627a9463118c4a905f6fd15c922bc794f0fbe8d7ef54f47b8d87ae86
MD5 477b2a4871d0d99184f38c17db3a5da6
SHA1 f0d3e547fa92f9bf38789288d0ccf04c27512602
SHA512 7c7e5f8b22989c18836594ac9175c60c6020979e626db9141d31c1a30d076c1a3875f3b627166551f5bb880c16dac99238edf0bfb4f521c0a07be0ca5c09ee0e
SSDEEP 49152:QhtSn8EApI0figTgiDn0AP5wTEtm/EXT6/H:BX2iypheEtm/uuf
TLSH
T1E3A5BE13F2D900E8D06ED174C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 bc2b35272e1199eb5cd09568c492eece311dac2dc1bea81447e84852d051ec3d
MD5 73635cfe5ba755c304e05f14ac2e6fa5
SHA1 62bd3907f7d9a92cc81bfbbce840541962298dc7
SHA512 53b8dd726107faf9fa30a49784f2b0f99a45818f43dba6c38c84eb60f53c75b686173e8dadd0954a514dd25248747f392c0af23e7ecaeb3b2332e4c371446edb
SSDEEP 12288:jkNKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:jkNGtm/MzYvMnVFTelKa33
TLSH
T143D4236675AFC56EF37BD0B0B1529586D0FC914FA10A778D2A0668B06B313DF20B29F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 5183ce2f3afbbce18955a54fd57ba04ba12bada8a45f388d0133dee1274382fb
MD5 7fed4d2d1c027e5edf383419ef748356
SHA1 acf121fecca4a18aa32079314471a41863a9578b
SHA512 2710ad2e3d69153530d977b4c4f6116007fc5498f0ddcefe8096263eb1e040ba2d164ee0b8270473d8b521dbac6da8b841de2f89eb352df4da37d9c06f1dfb3b
SSDEEP 12288:JyNKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:JyNGtm/MzYvMnVFTelKa33
TLSH
T1DED4236675AF846EF33BD0B0B2529586D5FC914FA10A778D2A06A8E067313DF20729F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 086f2ed84ba4eec36aa75606112065a64175282f08a5d1b99b33bf21cb447568
MD5 96a766b5cca381104a4060043936a092
SHA1 3df1b0003c9be4112cc8a684b9d8e18b976d840f
SHA512 1fcb3a9260ad34e2050c08d4653de5c56a4289da5c9a175f9e4c7ec932a561ccaee2bbaf83798faba770fafd69e7a61f4f2b46736cb12d57e42d07e9adbbafe5
SSDEEP 12288:boNKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:boNGtm/MzYvMnVFTelKa33
TLSH
T1D8D4236675AFC46EF37BD0B0B25295C6D0FC914FA10A778D2E0668A066313DF20B29F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 cef40e2d9b8ae69d888345fbc531840c6b0f3735ce7f2a5911e96cb36ab3d721
MD5 c235456b922778b39a9a205ac10c4797
SHA1 546f649b3d6da1c90863d5f7befd98f745198345
SHA512 18d9dff72c09c6460de62a123c4e3cff48de2ce24daed84d684395328f2285fa9036bb848170a59fe5e416987fd5f76b50a1f09e540eab0efe2d40ab08fdb1a4
SSDEEP 12288:5+lkNKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:dNGtm/MzYvMnVFTelKa33
TLSH
T1EDD4236636AF80DAF67BD074D1529586E2FCB48FA226778F1F0119E01F3139E2471AB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 5fc59e4f3cc28f3ad4eb14c969287cde369b97025b883ce7dc12bbd292c50304
MD5 dd2d4855b3d5d490ff1d80aa2dae1c2d
SHA1 6787cf1c45e77cfbb47ef4b6897d81128e003802
SHA512 fb96e823b3083dd1a136a503684c40a8631ed975ab8b855168bd1d5d24dc22d8a1123d5faab25ac6e13d0defa1a70d629a6716fc611893b0567265e00b8fa1a7
SSDEEP 12288:6SNKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:6SNGtm/MzYvMnVFTelKa33
TLSH
T1BFD4236675ABC46EF37BD0B0B25295C6D1FC914FA10A778D2A0668E067313DF20B29F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 96702c70db6fa2c2de4277c07fa0a1ece959ecab45d0132fd11c8def9c5e8f13
MD5 3334e18e1870e272fecc414d7367e653
SHA1 68f737e171de3796f71442e45a00c0e74267428b
SHA512 053e3eeaf8223764b47b42f36b8f6c15cbac67473cd4c2ea7696af40f773a54b167593fa809bb81212570610871db7fbdd6caecaab2d0ed45c8f24db9906842a
SSDEEP 12288:xXNKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:xXNGtm/MzYvMnVFTelKa33
TLSH
T146D4236675AFC46EF33BD0B0B2529586D1FC914FA10A778D2A0669E067313DF20B29F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 fcfadf21e04d51ab51563368099fffa3045a54b368fb8a5773709add778bb6ce
MD5 9ae7495abe13f68c6b317f535f2d6068
SHA1 66cc47353be306c9d2bea7ea7deac30a8dda5596
SHA512 06694fa595cf466d13d6bff0506d5a683ec83cbaf1ba68ec93e3b7f0de3a40d8b3db9a0c1462d0e4c8359cb753599b1b3cb5578d8f3e394750b7a1d15f309891
SSDEEP 12288:iPNKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:iPNGtm/MzYvMnVFTelKa33
TLSH
T184D4236675AF846EF37BC0B0B25299C6D1FC614FA10A778D2E0669E0673139F20729F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 f1abc33ed38aa575d06318761a868ced612333573fdf7cd268b12c4efd66aa0b
MD5 066125958020e96c5231dc0c6f1620a1
SHA1 961b5ee5c55b7f94cc410ed6690d20db129388a4
SHA512 ffe096c90fabd6661cb2c3b217d9bd957b6d337a4d4076d8481639067fbd3f398e48a6f4852f35e3fc253009c574f6fcd2073e12dda39c71de93ea452221cab3
SSDEEP 12288:uiZwb5iz+UqSocPvyaNKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Ze:RZMoz+jScaNGtm/MzYvMnVFTelKa33
TLSH
T1B31501A5B3A108F8ED77C13DC9528906D6F2BC5A0660C71F17A436665F333A11C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 e170b55b00013bb9de40ccdd6431d06049f6d961c6cad77b82c34e9adbed10be
MD5 6108c5d595d008a64571fde98124f14c
SHA1 3ce9ed3398b130f44704386980209f37176adba4
SHA512 335962d63d785eee3210018b3697df6d89f660f3d7ad57c27baa2eb59e13296e70a5d22a3439a585a8237d8713d1fd02e7fd66e0e7d0a4655b11b38df0d1f68e
SSDEEP 12288:zfNKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:zfNGtm/MzYvMnVFTelKa33
TLSH
T16BD423A675AF846EF37BC0B0B25299C6D5FC614FB10A778D2E0668A0673139F10729F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 674c8395f4bb20fab722f244f5c3946bb5f5e3d40e0e4a1f82083e5dff679c84
MD5 347dc67abfb149d5346fda4d5bc429b1
SHA1 9ce7e11d4ebf7d232fa3f9a3bcbe56878053f296
SHA512 95431f97aed61db43168b567c3bb8e538cf2edf3598cd94a2a6d073c682feabc665db87dbd6c10afbebf254a3137cac2a135c61f137fc168f93ca8123701eab4
SSDEEP 12288:pPNKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:pPNGtm/MzYvMnVFTelKa33
TLSH
T15BD4236675AF856EF33BC0B0B25299C6D1FC914FA10A778D2E0669E0673139F20729F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 9c21d1d659ee96f99f1f9adc684bac62c7f7693f47b0801b889db7b4aaf9c781
MD5 9c5935bbd35d9e65fa2945c254854e7a
SHA1 8e2a6deff8e59dd9edd07185e2c6bd5885879839
SHA512 b0c11db6a10f55f49a7eae869749eda3095b3cf095b0d1bcfdb30f04255f246ae8a3397ecea6607b9e3da07875521dcdf5e37f114f24ce73a4459d6688f04a02
SSDEEP 12288:VcPWZLlANKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:OW3ANGtm/MzYvMnVFTelKa33
TLSH
T129F4025773A620F9E27BC134C9A21A42F3B5B83753249B9F176046B22F233955D3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 32956d3dd372b9d75793176e54e6d198a212d2a3e599fb90b97bfa348246690e
MD5 e27498680e8f4a17a574fc7b021a6584
SHA1 275d3460471e654f01c146c95159897c2cac99b9
SHA512 ba4c06404f04dfbbfc2a1d3b63fdee1090aa5c49bf1f43dc0bb095458281aa7cc890f32519005dda6958cf129f8fe62b19d9c41ba62534d81785ed151d92d039
SSDEEP 12288:7xRNKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:7xRNGtm/MzYvMnVFTelKa33
TLSH
T142D4236675AF846EF37BD0B0B25299C6D1FC514FA10A778D2E0668A067313DF10729F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 e988b9318180e6e5be09e37ce7126e00afe4f17964524d3c609ffc4021531c0f
MD5 8ab673da78de4876ccaace34850dcd6b
SHA1 851a64695c8a859b2ab429e65a4f866971f7b2b6
SHA512 3a4bd41189f5761d9cc9240b93eb41c57e869f8dfd1b9e22821696ad182e74b48df93d7d3249c32607bd1487fb1dda615a87a42a6092e9279aaa81f0b72f7296
SSDEEP 12288:3sNKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:3sNGtm/MzYvMnVFTelKa33
TLSH
T1DFD4236675AF846EF37BC0B0B25299C6D1FCA14FA10A778D2E0669E066313DF20725F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 17dcb2648386484fa2b4821efd897d199170d5ea5485987f552aa031d36a3ee7
MD5 8fb160c069f8b0e249253df6b9ea45e9
SHA1 80e51722bc1d37b85c20c2b388dfe8cb7a555678
SHA512 a4b5b6f1be90270f959d0e13bccaa8bde038491d4e23db428d99f38267a46acea284b563f02c8fa0fedf584093e21a39a4d1f64ac9e95ac43c083270ada2da5c
SSDEEP 12288:gcPWZLlANKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:vW3ANGtm/MzYvMnVFTelKa33
TLSH
T1CFF4025773A620F9E17BC138C9A21A42F3B5B83753249B9F176046B22F233955D3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 d6d51c0bc1ad1acf877419440d5267e40b3abd4f733536d2ad4dcf933c71249e
MD5 37c7e5da1004e6b73d46d13cb4210744
SHA1 9afa523c7e0eae78dd989a9c22413b6fa132c112
SHA512 0cee9bdd072e2f7d01c15e8133afec44904b616d8c8d70827728c660bf975750b0ac8efd53010b6ce2bbb78d85299067969a5d9fc81bf34800b38240672af1ce
SSDEEP 24576:sTVaL53z0zE5NGtm/MzYvMnVFTelKa33:sTYL5jrEtm/EXT6/H
TLSH
T19E1501A5B39148F8ED77813EC9528906D2F2BC5B0660C71F07A436665F333A11C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 9d718c2068569ea10760a72cde35267017a8aa7e15c4375b9017205f00a661dc
MD5 2df8ddb0935be20dd92f4e00931606ca
SHA1 dd529d0ed2bfdebd0d495f23ba78b7b33e269355
SHA512 235215a2c9415430ed21c905b0e884024dfd81f8e6e7503d68a1746405c43d478e907dc855f1858161cdbb4d759d6975ef9d5eca51220b4bbebb05e2d2aa4009
SSDEEP 24576:b39duCHjy7RZgNGtm/MzYvMnVFTelKa33:79duCHjytCEtm/EXT6/H
TLSH
T1A935CF90F3E814E8F1B7D63589729502DAB67C5A1B21DE8F03A4265A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 20aa92de75e5ac4d033bd27d938a6440de1b3a5ef3880cdb2126aae14811ecbe
MD5 ffda7f84c6af1d0bc24b21aedf5ba7c5
SHA1 b06a415eae3a5d5d3e300fcc9995d763eb4e996a
SHA512 1e765a40dee9d3ae519e0b7375d1d43bd13712ea946da03c52fd8793581ebf5ff7ba72fbfb5668e48b794c4395d6a407eafa87170d8a14c2796cf08b3b5c62b8
SSDEEP 12288:NcNKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:NcNGtm/MzYvMnVFTelKa33
TLSH
T143D4236675AFC46EF37FD0B0B15299C6D1FC914FA10A778D2A0668A06B3139F20729F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 9b95ad259471a7a2d9f647c8016c0e449684eb3191228437ce6d8d87bbc54897
MD5 5b065444df8808d13c34432d9bce9ffa
SHA1 846392429a718d543f426e7f8a4256312fa36c90
SHA512 db230b0f85f1463cfc324ccf97ef2b67a72ee52fceac18fd4abb36ba3c118d845ef94fab8d04b6feb51661f2e034bc652bc641eb894b42cacff4fbfb4daf3fe1
SSDEEP 12288:VsNKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:VsNGtm/MzYvMnVFTelKa33
TLSH
T19FD423A675AF846EF37FC0B0B252998695FCA14FA10A77CD2E0668B0673139F10725F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 471d8f4ec56ae64cfdd4b57f1f2f0a2e063e2b8b0e0182f1eb0274ffe4d48012
MD5 ba5721fc85614b4920b02176f30ff9da
SHA1 4fabcd67b51d7be467b16fa021b5d7c8a3736ee3
SHA512 f9287a741803a0901714bdf68aedad32969bfbe55c9441bea769369b1482a9498556dc6c3870c05dfac52c356a5fa46526d2fe2ac3a741986df61f7717454907
SSDEEP 12288:WCNKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:WCNGtm/MzYvMnVFTelKa33
TLSH
T15ED4236675AFC46EF37BD070B2529986D5FC914FB10A778D2E0668A066313DF20728F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 f81727666c7865b356be0a50eee004a4108953a1aaae536302967d8430c226b8
MD5 2cad4d2c3bb14984efcd81a5217dae8d
SHA1 dc4f2a4863c152bdf43446df6ec07f88651a6eee
SHA512 6c98e2fbd9d6576dffaf364fab5fe839ae81cfb5ac438590ba6d418ff04324117faae71115a76f36b330136b420d76c66c9d34ae06c93a57ecfef774fb544da3
SSDEEP 12288:J+NKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:J+NGtm/MzYvMnVFTelKa33
TLSH
T109D42366759F846EF37BD0B0B25295C6D1FCA14FB10A778D2A0668A067313DF20729F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 beb0fc2e50160ed1f2dbb4273d720ae29819cc78be716f905524904ecec45a3c
MD5 6c38753b33957baf6b55881ffbbc95b3
SHA1 98bbbaa26992f23d14efb6722254f81cd1a8dad6
SHA512 6f960e65fc47dcf1810b11b7cff2a8f06f368dd1145694ef70e7f1b888b22808c0e75ccf609044fb58a0008bf9b65ea31a23ca7cf13b0da1c1e808d6fd394e76
SSDEEP 12288:oXsfMNKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:DMNGtm/MzYvMnVFTelKa33
TLSH
T19FF4F11AE29842E8D16FA074C3524A41F3777C2A93E1E3CE16C0F57E1F322955DEAA53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 e6deb148f4460aa8bd712ce3b8c49bcef65065aca4f43588b2961c02937d6150
MD5 14abec54e3c7a79ac2d414c998a99e1c
SHA1 994bb53752bc7cfabdc2f69984f24532149365c0
SHA512 b13a5b2a5017060b032bbe7534578c3fa06674c2842e9a4c808c84dddcddeb103a669716eddeb0ce6d46bb9fde9176642d7ea4ab581b1d4f2a51ff7dd4b77551
SSDEEP 12288:Rx7ATNKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:DATNGtm/MzYvMnVFTelKa33
TLSH
T13CD4237273AFC82AF27FD0B06152D542A1BDB14F5305A7CF690169E06A313CF1871AA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7dd6c2e1c4a272feb5f2a37bbe4efd679edf0af010d7c78cd12aa7cd5224a93d
MD5 55a7e108301bc6904a7250c68039c84f
SHA1 ba94f2d9211dae48715891335f58203d73a8d81d
SHA512 2ad86e9d8043e5fa6aeb2e5b3a9c87e38c74a8472c31bffdb8f0397d062ee8f4ec0f3b7030fb422161af1470e1d0bac38c205ff259c34f390effe69d93cc33e4
SSDEEP 24576:Bgb6bmBIi49WNNFpg1rSvFv7bYxNGtm/MzYvMnVFTelKa33:Bgb4mBIBhGFmEtm/EXT6/H
TLSH
T1B265AE1E22EC02F5E1FAD2B89DA64417D6B278160332D2DF1251427D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 3972c12a4e126091c3ace45f170da2f7fa451d9a011078214c9251328ebfcf0e
MD5 493bbe821646d09082f7730cc681e74a
SHA1 3d42e2e5ac526e81c1b288a37e372798613e8730
SHA512 743a735dcd207101c9ee9e23321c9faf3ab387b54b48b6a5a55ea4c4aa5db9fa681adf8502be1d8c6a1c068986938488d7a152291e2f08076c2caa6c2c9c96ef
SSDEEP 12288:9JGTNKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:LGTNGtm/MzYvMnVFTelKa33
TLSH
T139E4227E31FBA4A8D63FC174A0629583B4F47057630977EF0991E5B09B312E93239DA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 3e84e078121d25288f6de61514f26ff477526465fcc3ca5427dae82bb39f44cf
MD5 cac2448c768d351ac89bc24c26bb751a
SHA1 e96efb98d488c91600065759832050fb87279edd
SHA512 b7f4f934e3f797d086af906fccc5d42f24d0ae181250a71175a0928257ee4e5876ee7ecc49631641b3b761cf592e124309ba0ce73b5de69a1f1c0ba046ec938a
SSDEEP 12288:WnNKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:WnNGtm/MzYvMnVFTelKa33
TLSH
T168D4236571AFC4AEF37BD07061539986A5FCA14F630A77CF290169E066323DF20719B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 5851d0ef4e3f2655f662288a9e4c857ab3c17d33a457fa48dbfdae2fe4097e75
MD5 c02351e1a0e9526876b39adb7f3edfe8
SHA1 71c2631186f5f2d52f5bc2a26a41d066ab0c9801
SHA512 66d91e1d4146fb227e43fe417f0c57db5e658ebb4e552aeca697907694be8a06bc114e49efb9f03e1351c9d74d09995ce05c4970998d71d6df264a028ec31119
SSDEEP 24576:7/Y8WjSCJqH1Mzria7/mHNGtm/MzYvMnVFTelKa33:bn2SeqVra7/gEtm/EXT6/H
TLSH
T11535F16576E501F5D47BD03889824663F6B2B4260364FFDF07A88A911F237E50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 f5873c34e2ffd83b0eb4fbe970a45f6dccd9413da0069c1beedf1bc380da2fe7
MD5 2728383aea5976cacf1025f519f4d92e
SHA1 77ef770e966eaf36aa53133f086de7d70c0b068c
SHA512 1fe268667e52041797dcd42c2d13f5dafb9d77ce6849d45d4e7ddefeb1a541ad89b764aa1f446f0b35781a091970fe43729e6bffa431ca5bcbc4777588d9c8ff
SSDEEP 49152:8BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjnEtm/EXT6/H:fG05lO43bWEtm/uuf
TLSH
T148D5CF6E62EC11F9D1BBD07CDAC68A0BEBB23415032556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 b1504803954061002391b974fe7fa118b9a760f9e62e10f897cb76617014b838
MD5 5693f8120814e5dc386e75f030d8d9cd
SHA1 e420ea6881088d62a72ceaac62c9152b44284448
SHA512 49be73efe8c0f88183738706fc95795fb3afe828e3e77397c8ea11676ff3ca63a854e65a250958f16b4496aa71b8abef2892447b80f0a46399f9040e89ea5449
SSDEEP 24576:VKa5POZ3dpbWVM50JicR2hG0lasx2+47eidn+NGtm/MzYvMnVFTelKa33:Aa5POZ3wJt2pasx2+mYEtm/EXT6/H
TLSH
T18365AF5EA6FC01D5D17AD17CC583861AE5B1342653329BCF122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0b53990452ce32acbe4ecc7f7669a6b0c7d884b01e89787bc8af7783b8b3fab3
MD5 e389fc64ddba6ce83e900e568b3f559e
SHA1 599f299e22f6a6927355f1c4d2e26972e0d92cc6
SHA512 77ba87ac7945d405af039572c73694243746de74cd2a30a14356567645a1d9cba2040d8bf703e66a192c4c7ccaf4c5495edd6883731de2dd855d59f71765a4e8
SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7FkiNGtm/MzYvMnVFTelKa33:RNc/zEOVHFhEtm/EXT6/H
TLSH
T1EF858C1623E901E4F1BBE1BE89779546FAB17869133486CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 098f77f22704cd4d325e30402eb2a20aaad9c63dbc1b21c26972d1dab4d5f175
MD5 3d7264bb06ed54531405cdb9e8d48bde
SHA1 307c261f4d4ce9cf67f5185f2caba9f399c7748e
SHA512 896215629c717f92ad40f09d1d1e3e460cd825bb790dbf48e2455e86394f39349d8fe67318340e1ffd334a082ad7d2491f3e71d23fbff3df7dd7890c7fa18788
SSDEEP 12288:eMHPJnJP6szeCs6Rl28d1mNKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87aY:ZJnJPbzB4SENGtm/MzYvMnVFTelKa33
TLSH
T12C15E03DD2A810E8E4B7C2B4815A175AFF71346D2B2669CB19B4D4343F12FE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 06350e0379cac96aa30f00e2308c262e321f7d9b385720bb7a406e869da8a0c8
MD5 bc632a45ac51d633d2fe47da6cc17f13
SHA1 fe347d64ccc65a42a68f5add9a1809079ddde0d6
SHA512 daeeaf94d989fc7abdac40ca3285e986d67986719d38e0cfc9391c8e7dde90c0ecc1d9b4a8eb958de8cd1067b71c13cd367faa646259764d4bc5779657600798
SSDEEP 24576:DCLHGL0MoeVtFumTijCmlKQWDkKNGtm/MzYvMnVFTelKa33:DCLHGeeV5ijCmlDWDkKEtm/EXT6/H
TLSH
T197A56B05A7EB4188F8F3CAF5CA2294169A327C549B34F7DF4E80C96A1E32BD5D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 202b6d8dc932461fc4543412684c53593e9062accddbca143cefc0d27d431b9a
MD5 da13d4f8724ebe8c5bd4e32abdc80305
SHA1 ae2c331d17d800ad13bc54d205ac77cf264a55de
SHA512 ac195f8b5ed570947693b1b4fba1e5077f8acbfa923fd372bc066a8711e8bba36273bf7f9c548f38899284f1a697120ee071adf5db55d8e8e4851f066739ba67
SSDEEP 12288:i1Hck6j5ZI7/NKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:+6DIrNGtm/MzYvMnVFTelKa33
TLSH
T12705015D33BB00F9D17BD03D92834502E2B2B06683126ACF0A94C5B95FA3EDDB939E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 a563e0ff301e0e0f9f4845bbf79e495da332d0341132b975fab879752f298ca9
MD5 2fc0b421768b88f8f28f7cbbf141d8b2
SHA1 9a8c35a8c36b528f2076e12ce444882936d14806
SHA512 02743551c9441b44f33b714e0e7895f5c05a09d93b939e0cd182955c70585224fe6ed041b95ea5e1777d6ac1b11a4f8538ccfea5bde5afb0fa87da9f071e532d
SSDEEP 12288:1G6kyWsNKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:MtylNGtm/MzYvMnVFTelKa33
TLSH
T127F4230573E990D9F6BF8078E66381919A78BC16631163CF1990FA7D2F323D97831B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 78a090d612b88f871beac716076a6acb4bd525100110505223a03028600e125a
MD5 1d86acb76ea950d160a15f44b9ee50f3
SHA1 50f641fdee7453aefd730f9e0afbaf0699fc4a55
SHA512 e659954d8d61d0b4a42999718b95c730adbd87d049afd2edc83e289749af3ae256fb7d2748d27358203aabd216b557a01f88979cebccd364857670b28aee2803
SSDEEP 12288:1E0NKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:O0NGtm/MzYvMnVFTelKa33
TLSH
T1C6D4237D71AB946DF63BD0B47152858291BCB16F230637CF2981A9F09B323DB2071DA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 2df754ee6fd174591eed530c4f9186a7fc38a48c044419d13e06e979934d6c2d
MD5 201ad063c3f94c55aaa0260eab7b6c6d
SHA1 d58fe606dd5887ad4e9a7d5c9eb42c0cc83b644e
SHA512 0584d5a3debcd2ae1eb93b9d236454c524592c5f3e385a4aa91849ec32ba852ccf480b3e414f03b682a50c00b2e12e56b3aa5e2f1a24fac3bf3748cd96d400c8
SSDEEP 24576:lJgBLoTfaidZ1NGtm/MzYvMnVFTelKa33:DgGTrZ1Etm/EXT6/H
TLSH
T12A559C1D77EA05CAE2B2D279D8625493D633B4315372D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 1e7d44499cdf87ea27e3cc47b9b0ec2caf13a3c6d81e905d3b0272924c45c22f
MD5 b3e96ba7e72f2897d612bdd30a83225c
SHA1 25201830065a86b9d8082c5c491cfef7977db506
SHA512 88df6256baac2613a0731ebb32d163aa377997d83274619388acd4cfb749e0a21e96e049d195e5e4cd0a66030f913c0fed0ac3e238841ab16c7869a46d390a7c
SSDEEP 12288:4pJcm8CNOMNKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:4rcmROMNGtm/MzYvMnVFTelKa33
TLSH
T19705F15EB2AF00E6E2BBC13C89424546E6B37036631267CF06A1C7794E236EE7D35B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d8d0f632d6d54ed4e5519dbff4aba8d0c1a4eb4ac8b668dd958bebf15b61f87c
MD5 0e403d196a456db77df55742defbf177
SHA1 d7d5a8145020b6ff26ecd8253b5a7d6656b176fa
SHA512 a33bbbf0db0db28785b0197ea10fa996f243f42614e326f874acb580bd76848bc412760781ed3bf2dea7f45086f126f64fc3dbae0f3f5c169dd0b41cd7d58287
SSDEEP 49152:ODL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3TEtm/EXT6/H:P3Upow8sByEtm/uuf
TLSH
T119A58D3DA2E800A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 45112e0ede3b8d6221f4631eb6385898714bfe22a88ee459226d795787921eeb
MD5 6ee5202b4e5ccc8551f1df437317e2ec
SHA1 43f30238cece766718dafc489388d492b9e63c8a
SHA512 a1452b900ab13c0d1040785787626b8b93f14bfd88c29212e1824d29abdecedfe88c19dc54cff7d336a45cce476fb42a74413e9e715f3f60837694f6faf1b53d
SSDEEP 12288:xHvUrBFrEjwaQSNKMUtmAaxRPkqM+sPBdJmOGMG7bFqXAUFRNM9l87atN3Zye6:xPUr+NQSNGtm/MzYvMnVFTelKa33
TLSH
T18E05E12F62ED18E5E67BE17C85828609F771B4571312A3CF0291817E5F23AE87D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-250-0x000001CA0A2C0000-0x000001CA0A326000-memory.dmp

Download

memory/264-347-0x00007FF7721B0000-0x00007FF7722CA000-memory.dmp

Download

memory/264-246-0x00007FF7721B0000-0x00007FF7722CA000-memory.dmp

Download

memory/264-251-0x000001CA0A2C0000-0x000001CA0A326000-memory.dmp

Download

memory/416-56-0x000002D93A7A0000-0x000002D93A806000-memory.dmp

Download

memory/416-57-0x000002D93A7A0000-0x000002D93A806000-memory.dmp

Download

memory/416-55-0x000002D93A580000-0x000002D93A673000-memory.dmp

Download

memory/2004-356-0x00007FF6ED300000-0x00007FF6ED44A000-memory.dmp

Download

memory/2004-264-0x000001936CAD0000-0x000001936CB36000-memory.dmp

Download

memory/2004-261-0x00007FF6ED300000-0x00007FF6ED44A000-memory.dmp

Download

memory/2004-263-0x000001936CAD0000-0x000001936CB36000-memory.dmp

Download

memory/2136-34-0x000002402A4D0000-0x000002402A5C3000-memory.dmp

Download

memory/2136-35-0x000002402A6F0000-0x000002402A756000-memory.dmp

Download

memory/2136-37-0x000002402A6F0000-0x000002402A756000-memory.dmp

Download

memory/2136-36-0x000002402A6F0000-0x000002402A756000-memory.dmp

Download

memory/2156-366-0x00007FF659AC0000-0x00007FF659FC7000-memory.dmp

Download

memory/2156-367-0x000001D6EB5C0000-0x000001D6EB626000-memory.dmp

Download

memory/2156-368-0x000001D6EB5C0000-0x000001D6EB626000-memory.dmp

Download

memory/2156-447-0x00007FF659AC0000-0x00007FF659FC7000-memory.dmp

Download

memory/2172-11-0x00007FF7CAB10000-0x00007FF7CAC33000-memory.dmp

Download

memory/2172-12-0x000001CE257B0000-0x000001CE25816000-memory.dmp

Download

memory/2172-14-0x000001CE257B0000-0x000001CE25816000-memory.dmp

Download

memory/2172-15-0x000001CE257B0000-0x000001CE25816000-memory.dmp

Download

memory/2172-62-0x00007FF7CAB10000-0x00007FF7CAC33000-memory.dmp

Download

memory/2508-245-0x00000271EB290000-0x00000271EB2F6000-memory.dmp

Download

memory/2508-241-0x00007FF6F4B30000-0x00007FF6F4BF9000-memory.dmp

Download

memory/2508-243-0x00000271EB290000-0x00000271EB2F6000-memory.dmp

Download

memory/2508-335-0x00007FF6F4B30000-0x00007FF6F4BF9000-memory.dmp

Download

memory/2704-2-0x000001E5ABAD0000-0x000001E5ABB36000-memory.dmp

Download

memory/2704-3-0x000001E5ABAD0000-0x000001E5ABB36000-memory.dmp

Download

memory/2704-19-0x000001E5ABAD0000-0x000001E5ABB36000-memory.dmp

Download

memory/2704-22-0x00007FF71FA80000-0x00007FF71FC83000-memory.dmp

Download

memory/2704-0-0x00007FF71FA80000-0x00007FF71FC83000-memory.dmp

Download

memory/2704-1-0x000001E5ABAD0000-0x000001E5ABB36000-memory.dmp

Download

memory/2728-449-0x00007FF65C2A0000-0x00007FF65C5DF000-memory.dmp

Download

memory/2728-388-0x0000024FAF360000-0x0000024FAF3C6000-memory.dmp

Download

memory/2728-389-0x0000024FAF360000-0x0000024FAF3C6000-memory.dmp

Download

memory/2728-387-0x00007FF65C2A0000-0x00007FF65C5DF000-memory.dmp

Download

memory/3032-409-0x00007FF6B8130000-0x00007FF6B81E4000-memory.dmp

Download

memory/3032-310-0x000002238A3A0000-0x000002238A406000-memory.dmp

Download

memory/3032-311-0x000002238A3A0000-0x000002238A406000-memory.dmp

Download

memory/3032-309-0x00007FF6B8130000-0x00007FF6B81E4000-memory.dmp

Download

memory/4088-234-0x0000028C49760000-0x0000028C497C6000-memory.dmp

Download

memory/4088-232-0x00007FF6F4B30000-0x00007FF6F4BF9000-memory.dmp

Download

memory/4088-233-0x0000028C49760000-0x0000028C497C6000-memory.dmp

Download

memory/4088-326-0x00007FF6F4B30000-0x00007FF6F4BF9000-memory.dmp

Download

memory/4808-448-0x00007FF6CE890000-0x00007FF6CE9BF000-memory.dmp

Download

memory/4808-379-0x000001C627E60000-0x000001C627EC6000-memory.dmp

Download

memory/4808-378-0x000001C627E60000-0x000001C627EC6000-memory.dmp

Download

memory/4808-377-0x00007FF6CE890000-0x00007FF6CE9BF000-memory.dmp

Download

memory/5208-43-0x00007FF65D240000-0x00007FF65D3A8000-memory.dmp

Download

memory/5208-52-0x00007FF65D240000-0x00007FF65D3A8000-memory.dmp

Download

memory/5208-50-0x000001643FDD0000-0x000001643FE36000-memory.dmp

Download

memory/5208-45-0x000001643FDD0000-0x000001643FE36000-memory.dmp

Download

memory/5208-44-0x000001643FDD0000-0x000001643FE36000-memory.dmp

Download

memory/5348-372-0x00007FF7C1E10000-0x00007FF7C2554000-memory.dmp

Download

memory/5348-282-0x000002DE25DF0000-0x000002DE25E56000-memory.dmp

Download

memory/5348-287-0x00007FF7C1E10000-0x00007FF7C2554000-memory.dmp

Download

memory/5348-283-0x000002DE25DF0000-0x000002DE25E56000-memory.dmp

Download

memory/5452-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5452-276-0x00000000009A0000-0x0000000000A09000-memory.dmp

Download

memory/5452-365-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5452-272-0x00000000009A0000-0x0000000000A09000-memory.dmp

Download

memory/5464-376-0x00007FF7677E0000-0x00007FF76788E000-memory.dmp

Download

memory/5464-292-0x000002711FAB0000-0x000002711FB16000-memory.dmp

Download

memory/5464-291-0x000002711FAB0000-0x000002711FB16000-memory.dmp

Download

memory/5464-290-0x00007FF7677E0000-0x00007FF76788E000-memory.dmp

Download

memory/5584-328-0x0000021AF3310000-0x0000021AF3376000-memory.dmp

Download

memory/5584-438-0x00007FF733620000-0x00007FF7337B5000-memory.dmp

Download

memory/5584-329-0x0000021AF3310000-0x0000021AF3376000-memory.dmp

Download

memory/5584-327-0x00007FF733620000-0x00007FF7337B5000-memory.dmp

Download

memory/5600-444-0x00007FF65BF00000-0x00007FF65C317000-memory.dmp

Download

memory/5600-442-0x00000282F4620000-0x00000282F4686000-memory.dmp

Download

memory/5600-386-0x00007FF65BF00000-0x00007FF65C317000-memory.dmp

Download

memory/5600-300-0x00007FF65BF00000-0x00007FF65C317000-memory.dmp

Download

memory/5600-301-0x00000282F4620000-0x00000282F4686000-memory.dmp

Download

memory/5600-299-0x00000282F4620000-0x00000282F4686000-memory.dmp

Download

memory/5612-319-0x000001C32E0D0000-0x000001C32E136000-memory.dmp

Download

memory/5612-427-0x00007FF792B90000-0x00007FF792E33000-memory.dmp

Download

memory/5612-320-0x000001C32E0D0000-0x000001C32E136000-memory.dmp

Download

memory/5612-318-0x00007FF792B90000-0x00007FF792E33000-memory.dmp

Download

memory/5912-445-0x00007FF6E7F30000-0x00007FF6E81BB000-memory.dmp

Download

memory/5912-348-0x00007FF6E7F30000-0x00007FF6E81BB000-memory.dmp

Download

memory/5912-350-0x000001EA1FC20000-0x000001EA1FC86000-memory.dmp

Download

memory/5912-349-0x000001EA1FC20000-0x000001EA1FC86000-memory.dmp

Download

memory/5916-338-0x000001E907D30000-0x000001E907D96000-memory.dmp

Download

memory/5916-342-0x000001E907D30000-0x000001E907D96000-memory.dmp

Download

memory/5916-336-0x00007FF6C7FA0000-0x00007FF6C82C1000-memory.dmp

Download

memory/5916-344-0x00007FF6C7FA0000-0x00007FF6C82C1000-memory.dmp

Download

memory/5916-337-0x000001E907D30000-0x000001E907D96000-memory.dmp

Download

memory/6040-359-0x000002B8A9A10000-0x000002B8A9A76000-memory.dmp

Download

memory/6040-358-0x00007FF6DB090000-0x00007FF6DB561000-memory.dmp

Download

memory/6040-446-0x00007FF6DB090000-0x00007FF6DB561000-memory.dmp

Download

memory/6040-357-0x000002B8A9A10000-0x000002B8A9A76000-memory.dmp

Download

memory/6092-25-0x0000028F25F40000-0x0000028F26033000-memory.dmp

Download

memory/6092-26-0x0000028F26040000-0x0000028F260A6000-memory.dmp

Download

memory/6092-27-0x0000028F26040000-0x0000028F260A6000-memory.dmp

Download

memory/6092-28-0x0000028F26040000-0x0000028F260A6000-memory.dmp

Download