f91e3a3b01babba544751d09d7bf34e63058d8e2a80e0fdc940c78fd497ca203

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Size 1.9MB
Sample260723-jpc46aac49
SHA256 f91e3a3b01babba544751d09d7bf34e63058d8e2a80e0fdc940c78fd497ca203
MD5 66a5731295559628ea6e4e1ee58b2964
SHA1 dfbbabba9958f54de14e020357d69705eb43e085
SHA512 7ba6f712dabb3b3b63e9f5e3002507dd0e32cc89a7867b7f3c05f2e49fd3cf0e0efb25e92e44a7ed5d06f183be194a756b0f81322dfbcbe41c189be4e26eed7d
SSDEEP 24576:ciBE0wqwXeAVmYpsqjnhMgeiCl7G0nehbGZpbD:sN5Xe6XtDmg27RnWGj
TLSH
T12595DF58A75841E0D1B2C27888539946E6727C018B71DBDF1298E73E6F77AE08D3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 11 IoCs

pid	Process
1708	elevation_service.exe
4536	elevation_service.exe
4628	maintenanceservice.exe
3464	OSE.EXE
5956	PerceptionSimulationService.exe
2960	perfhost.exe
1952	ReFsDedupSvc.exe
1108	SensorDataService.exe
4176	ssh-agent.exe
1888	AgentService.exe
2084	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4173d8b883806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000211a3f5771add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dad72ff5771add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003dbd5b37781add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc90bdf6771add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000caa57337781add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e4a3d7f5771add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe\""	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1708	elevation_service.exe
1708	elevation_service.exe
1708	elevation_service.exe
1708	elevation_service.exe
1708	elevation_service.exe
1708	elevation_service.exe
1708	elevation_service.exe
4536	elevation_service.exe
4536	elevation_service.exe
4536	elevation_service.exe
4536	elevation_service.exe
4536	elevation_service.exe
4536	elevation_service.exe
4536	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4712	2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
Token: SeTakeOwnershipPrivilege	1708	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1888	AgentService.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: 33	2084	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2084	SearchIndexer.exe
Token: SeDebugPrivilege	1708	elevation_service.exe
Token: SeDebugPrivilege	4536	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 5696	2084	SearchIndexer.exe	100
PID 2084 wrote to memory of 2892	2084	SearchIndexer.exe	101
PID 2084 wrote to memory of 1512	2084	SearchIndexer.exe	102
PID 2084 wrote to memory of 4248	2084	SearchIndexer.exe	103
PID 2084 wrote to memory of 1100	2084	SearchIndexer.exe	105
PID 2084 wrote to memory of 1468	2084	SearchIndexer.exe	106
PID 2084 wrote to memory of 1516	2084	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_66a5731295559628ea6e4e1ee58b2964_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4712

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4628

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3464

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5956

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2960

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1952

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1108

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4176

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1888

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5696
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2892
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1512
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4248
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1100
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0496fbc21624a6daa853527e7cce776a3b67867de367ebfb0eca1253fd1cc8aa
MD5 a35121538325da2bb0bfdb89ccce834c
SHA1 d28695eb45ac1f75da3e8a03c413c6997ba7d340
SHA512 3dee45cb1c4b29c0c513cf74d1b5b97f5bdda2f2d7c8018efc3d93fb9f6295f698b8760606d3464dbb6a9fcedc482d864df8c5c850df5a323ae5523744de616e
SSDEEP 49152:yb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnZDmg27RnWGj:U3q6HjBKD527BWG
TLSH
T1C8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 1ee6844b9efb65f10a48ccc1808da85c1e3366958df2ffbdeaef162fea3c0f74
MD5 a76290fa2b9adb80fddec592b876eba8
SHA1 84f30da20978200642127ff80d40771fda131acd
SHA512 aef445de1ffe8ec0171163b14adff5ead29cd96cb079f8b0af1e58f747b0ea0fab8328ebcb7b2f67ae7974d9dabf0b9e3f5c22dc0e4dcfb6fb0d286360480be7
SSDEEP 24576:fXYfDtczAysqjnhMgeiCl7G0nehbGZpbD:qtcTDmg27RnWGj
TLSH
T1CE85F129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 b1f6173538d949f13a88c4791a8af7788036554ccca7fe5ce337a188cd79ccf0
MD5 9b11de9bc3f98c2293fb5efc8da9e8f3
SHA1 b7c32cf4ebd502a7b10665ac0ad2ee23c91ebff4
SHA512 edf42de0e2d911ef56bcc9ecefe1d8f19d3743cf1a213bb2d2edca09eeb242196356dbbaa9cc4b7c461f36e311ed110cb33ea2bf3296fb0ad6e96eac3943466f
SSDEEP 24576:h0Le5ji0hmx3rM9sqjnhMgeiCl7G0nehbGZpbD:hPji0AZ0Dmg27RnWGj
TLSH
T13BA59E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b3a16ff22b165eda1546e1d97647f84e9232e3c06bfa33b99924a311c665b23c
MD5 8f9351c4f97892357e7634eb12d22c5a
SHA1 22ba9d303da4b0b1f53defaccd248f0a5a1c69d4
SHA512 3db2ff76727fc8a8a6e659bf8aa10bb9f09ae007765ef4ff2cd354c77071a8cfaaaea8e731e81ab19288d808644ee193b8e50db7548ddb7aec29ce2fd6a4ad51
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWE6q8wyufsqjnhMgeiCl7G0nehbGZpbD:1/ezSC6vUzPvxHjygDmg27RnWGj
TLSH
T1BF755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7b681052c6ae47eca6b9358a303df74ea8f5dc3019f00b34fcd3a4f39759219d
MD5 906ef25ef83d618552b406c889f382d6
SHA1 321bf63cca5139619069edff7aab218fb1fda260
SHA512 fcc81dcc1ca83aad8e9db6419a14fa9db3dae4dce4a3b91b5edd0f8ce9389209f3eb33ac728230b27266eeb00ad73b38092d52c3680d656bc2808b5b73f1a5de
SSDEEP 24576:/VbqPb88hv/l+62sqjnhMgeiCl7G0nehbGZpbD:/VO88hXl+9Dmg27RnWGj
TLSH
T193559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 6a2175638c8a5700ab46c244e151973f1c1fc35012165d39f0b2636962396f7f
MD5 7424a873a4ee95b7be5536b061cab994
SHA1 9d91a1a231bcb2b4f28dd03f2ed3f2279797ac19
SHA512 3e60a4fb9da92ef47488bacee2a4ca76080ef690294ddb82732a7498c1475a180ae14858cf66fed8d751135877ed9768ab908a0d2cd52184d08340525439da96
SSDEEP 12288:2XhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2XhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B16523BF964C50CAEB7608B5C3E9F51EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 9c01b7519a0af5af8f972546ef70e1d8e8e1d36ff668cb75fc41cc735c3cb454
MD5 5eb30772fa1b5a0cc117a4745e2936da
SHA1 2ab21160a7dde9982862eff09229ad6e43f5fbf4
SHA512 4123eaa369fe3137a0e43542c6ff47934183770e62ce860f6cb222211bdd547a9b8c2cec37084a217feb5edad171160fbf6ba7e7ab5e96814bcdc103d97cc71f
SSDEEP 12288:+eBNUbTVO86UOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:+JIUOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CB85CF7BEE28FCD2C27A4DB85791C600E76278314F61A3CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 82b8cf0b2afea27dbeff2c6276ccb04d5a9944625c8de4b03596a47802e995fc
MD5 dbb666f7e7a689a6bf57cb5503079442
SHA1 d432dadf808c84f52ace8e54f41b4f89ca67b58c
SHA512 91d99a2919d1ef8dfb80fa7acf2086a6b4c61ef28e59751f296b0c22eaa105591d04a1c4d93e63e59f2df23c4f8e8d627dd0c5775f742b2bc84b39530212304b
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THJ:EQvGAdlCEL8c/yRNw5CzD527BWG
TLSH
T1BA266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 6ff82056ac1de8ede1892aa24da8f8f0d6582405ae211f6654867a308abdb232
MD5 ba3c7303d7afc98b2212a1262531e3f4
SHA1 22b550c3f6093ed4aac7f986863fe63b7d5efcbe
SHA512 b8635004465786f31d7b622de809d57c6f78ec2ddac13a475041969718c575893faf145779ba0341ccb70152ccec223f9e6e7c236579fe6fe34cfbafde8f9b40
SSDEEP 12288:RAwSfxL/2Dc3RDLLmt0LDQewsAj4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:yUewsAj4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10295E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 35584254d49c68b0a0130d2d60a54b69fe9c2f9dc6b751259745cfd95a1471ee
MD5 1256e89f4b8e2ea11a06fc3578212e5f
SHA1 46abaa46409eb07b226022c42d44bb98b0b05c38
SHA512 13612567805f6e1ce137cb12fa3784d8b2961f7fd7650da93057d717f2348e80acda5b86a78e48e422ecbde64104ce2cd5e4958a62ef675beb8a127961956482
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH8VQBWG:rUEtQevvqc2W1cpV2EI32DB
TLSH
T1B7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 25811af51650d2ed3169dc52ef998cd249846c1e7adf7c1bc3b91f9bb34de1cc
MD5 7e41a690f424dafe5f2d94dedda92e4e
SHA1 2ba829337c79710f0b908329a0659f54147eb27d
SHA512 da409b8c91730961fb2e19d1b62e2c8d623647af28a60f33fd10f6da6e4dcc78117f53879ae364242a0b5d02001c2529e47fb77e4e1109427517ae2630342ac5
SSDEEP 49152:NCbRquA/m2yL5zQfFiV+XenmE3/zEDmg27RnWGj:qoqtVjnmvD527BWG
TLSH
T14ED58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 929faae021a8eb888f8c4e413caf503385e593464c4547a824c9d69af08e2e74
MD5 eac04afa862c03c50ca5c3cde09326e3
SHA1 e5aa9a6013ed67e9dcdeae1f496dbd56ec6c118e
SHA512 1f81817ffa70f2a9b4c200ac159fcf7321db355c7810184e77bfa3619c98a58036bfd825dcc42035190771b84f1c90ba53d25e8b30cb32df1229898332281f55
SSDEEP 24576:6AhGLJIFoiwtA5l7S53bsqjnhMgeiCl7G0nehbGZpbD:6AMyFoiq5fDmg27RnWGj
TLSH
T1D4359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 285827af1c2b70b27f9b1bdfee79d1f09b274ac5e48d3beae4536d7eae22aea9
MD5 4ace0e9c8f16f4e060624c3c8df19e04
SHA1 323fdab59481698a0d1dbc9d799a5305a7f3d1e0
SHA512 7bc2664caec1ba91979d74185ba20a96bcf80d530ed7168c20305d2aab1fe7c6cd152eeff494f7a3bb24f035e2726bbc32470f25f5fabc8a31944e99e22b5bba
SSDEEP 12288:wmw5HEjsChNzBFgl0WDm+C/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:twuSOWksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F885F14A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 bd5da4f481fe7a20c15c7181849f904080f411f9bb050827fdac203d59e0fbb3
MD5 3717b4307e7cb4cccbe1b444ab31902c
SHA1 862c0dcfa6f2d341a5f0a4ca62147f1a9ad0487f
SHA512 9d00cbb19d19b65ea10e2ae2edb4c213c5158bf28820005dd21044a0f4d6f27632233cb0e4f849f4a69b5f819480713e9387d7873c7c2f56058b926c8ca174e0
SSDEEP 12288:1zZ1IyoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xZuVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D47512AE239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7d488129c32e7b19e28bb3fed2dd447395a3b88aed59e99d173e6b183166ec39
MD5 c87b617d563d14aa3922d1f422df1fcc
SHA1 acebfc248f9047146a76a33898d46957c5699f94
SHA512 25805b8cd4546c38302f7b202d50fc0507de425dce548540ae69e88b4073c0c028e61bd57e76785a719ae69170006f848babd638db1bf95bbafb627ea18a7641
SSDEEP 98304:LQRQyi36YOcPQLvw2gAf+PN3eD527BWG:6QyiKayX+PNuVQBWG
TLSH
T111667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a29e9bb1392ad3ca73bd5ede239e6e2629ed44b083ad073947084f459579dfd0
MD5 a9662db47fc6dc92b4c0e7b92a5face1
SHA1 e9379d81d4eb410f180ee127bdbba48b6d9fd254
SHA512 c851b94a596c11c7151926c9828f3857398b91a5ef48ebb9db1c0e6b68ab931acc36ceb7e42326f32b20497abbf3b3fc4d74b6af61bd0a1e9cf0a60faeac5230
SSDEEP 98304:QQRQyi36YOcPQLvw2gAf+PN3eD527BWG:HQyiKayX+PNuVQBWG
TLSH
T1F7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8c97bb10cb795f732336942042560fc2421025c28d4c6921b172ac04440fcd2d
MD5 4e3ed2f7e5ebeb4e6c41a3354814c55d
SHA1 2ea04cf363acb94d3782e5fe08fe72937bf3931a
SHA512 b4649981bb413a64cbe7ae7e27d0965f6fea91a5ad674065f2b27340f5d9c38131a4423917604bc4ba943ee0186a5cfd7bdec10662b5499f7ec6457e5d435029
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0lsqjnhMgeiCl7Ge:F68Qg55nhheWu7PNU3/0Dmg27RnWGj
TLSH
T132B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 61b575ff7867fd8c92e280cb02f2912df3689c2dbc3c1fa05fa85e585522330e
MD5 d3b771f1f8ae2ebe8c4c786988ae5dd4
SHA1 33faa36765d2b13cca78f384eb3863a15ffa9761
SHA512 3d48e2c98e2d91abf1cdd4b0d4d3c057c61d86b22280bee4fbd2643f0374ba9037f0b8f7d37e489de65a7c0d5e72e2938ce319e278f5edd00babdb1b288f70a0
SSDEEP 98304:My5112gYy5azzVvL69nLKnhZ1D527BWG:NLIHmWhHVQBWG
TLSH
T1F8167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ea9134f7b4d70e4a7e245bcedecd0185c0e34642d7f4a45f518a047e7ffadbff
MD5 49fcf1732373394b904e854464915608
SHA1 73366f3bd61c9d030aa2fde6bf04b70d788c0522
SHA512 cbfc94c158f47c888cffdbbf3f07c493beb400ba87e208286da61002c257516a01ae8178ca2e6374cd8e79e14b60e1903545b2f4a81569d2917ea0b4c9dfd32c
SSDEEP 49152:cB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gleDmg27RnWGj:2u6JmVxd2deD527BWG
TLSH
T166D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f06b38d40c1f40b9ca634677529a9cd5f28231b84346280fba7b965b7ba467d7
MD5 614da2614e66aa034d20e62a6d5eb6f6
SHA1 3035c3af7e9ede141fecd4e66ffe06e6491c17f5
SHA512 cbf1b178d9f55dcef2eb71d07ddb538237deb85fa3986e43d2cd1d58c5304e5065cba320a26df75912d53646ce294a7707aa7e99b0aef8c7914c899b66af819d
SSDEEP 49152:u1hpsNoJpF1A6UU44CwH7R4xCDmg27RnWGj:umifPbRvD527BWG
TLSH
T1D3B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 331103c3cc438421ebe26aad161eba0e7bd494fdb821d8d1719cd931f382de53
MD5 6ab12038324b95f910bc10ec276c354e
SHA1 09736b16b32ece199d4de63e40f26c9a9166aa27
SHA512 d2942436605fa221b7f0e477951e2635a7182f76cf3b8d26b2ac7b6957ae9765f10cfa2bf6712a254eaae3cef7a48495e07794227caded6998d4f4107b52488e
SSDEEP 49152:ISuZQIY0Be2KRRVtOnks6NMHqJDmg27RnWGj:S5dKTi61JD527BWG
TLSH
T11EC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a73b650ddf2ce8d544b925c91a27a103cfc13623ab83f7f394d167b5d9c9b3ad
MD5 1f15c466f66a1380a562ccb5f0b5f371
SHA1 1905271a7676a93c64d024552625c117e5aaea41
SHA512 0f8c474633326abb207b7a3f34e9ef111214f3da0b3a7ef5dcad0af94259227410742b21c62e03eb4f7cc11b1697e0cc077427d1d87e67c0a6120e35f18b8e81
SSDEEP 49152:qhtSn8EApI0figngiDn0AP5w2Dmg27RnWGj:LX2iyphrD527BWG
TLSH
T15995BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 dba7267b847386f8eae22248b5258c916471a940163537057bc5a5f5089c28d7
MD5 55fbdc477d612827206cc95da8e10836
SHA1 e2ed6d74140177c87e3f7bb2e3061f96a91951cc
SHA512 cede4f21aa1b81d4dd53ec280dda22da8091422b6c7b85474e015737c7fc79f67a7ea48dba8652215746637846426fe70e0b2aa32c575074911c21239c801fb7
SSDEEP 12288:h5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:h5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AD6523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A9B7CBEEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 fb73fc213b758cb18fcf05caa7cdd561497d9ec8649ef10f32be9542abd4ee09
MD5 ad225716ade12d57dc4567b20b58d118
SHA1 7551bcd0c17178f93f97ff30e101093c8157112e
SHA512 e6bdfad3b856daab5cfcfbe82ebd09d8bf3fd55ed75eb77c709bf3f3bd18a265b44560b9beb246ec4eaaa706f2ee99005574751f7aec808c21749057d24b5a1c
SSDEEP 12288:YMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A46523BF955C41CAE52608B5C3E5F14DAC073E5BE92004937A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 dc9f04defc796a699a71280a681724987d374b7cc5149dda94848518a2249ac8
MD5 60929616e505b0ae0362817d6750d3c2
SHA1 41bc550da6b26481d2e6018bc00a616f2871d302
SHA512 24da09a7da7f1c633ec16f803c7a340f5e11711457656a6dbcb590cff20747f31db2feba858931193103c962507b1cd3c9b3318af0ce8b459353c9f1fdfc67ce
SSDEEP 12288:WGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16D6523BE965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 7e4653169cafcb7cf5b5fdda798b6b58dc5b250fe67f6d46daad6fcc8fd89208
MD5 1f454c95f9315c78fdde3540cdc719f4
SHA1 5d2a14bb91a9f82b1f291ab6ac2983aa7a2c048d
SHA512 6e266754f1f79eab56a721ca265026b4f362f2129b3c3b6cdf84c830669bce3f92a4093a5f536ec1cf089a4c46c973753d3ada78959f8d3b59f6ad898c4b65f0
SSDEEP 12288:oV7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F375236F675C00C6D83685B4C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 d91c97b41b66715918564a1815f18728b0e212aa717d35543e211e5f49a17d05
MD5 948fca3e5989a0ceb95ad7ce8f13c906
SHA1 e55d77d6878bddeba8c3400fdcb5224a3eaa7d34
SHA512 5d65d6ceb98ebdf4a2945710ce478753cd14f9fe1dfe87ac42b67b80e51d5521d8e3bd52dba73d2131dfb9aa430b75d8e415c3ed894416e3137e6db5989d64c8
SSDEEP 12288:zjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B76523BF965C41CAE52608B5C3E6F14DAC073E5BE92004937A9B7CBDFBB14584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 f2f8a631e5acd4e5a84277415815053942f1b7b28a3d45e312f02d3ee0b1695f
MD5 ef0d74c8a04095192199b697a314c804
SHA1 f307d91568da4084a0380fc38a16be6e662b292b
SHA512 fb3a99c0604631d37053e94f8d7f860dd4a7d2cb311ea39be584f811bed718f33488dc8848916c2513691801f2aaa2eee416a90f9cdb3428f9a19911944d5d2d
SSDEEP 12288:vwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F66523BE965C41CAE52608B5C3E5F14DAC073E5BE92004937A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 3badfed3b59010c3b62e0088a15b1cbd1895674f6385e106b4b0e62bbdb054b1
MD5 1072a434401bf23ed6c51fdf143137a2
SHA1 229dad980edb022268b404c849b82764a6b37f3b
SHA512 61e4cfa42ddd71b938cc6b4faee5a17e97b2ea267246143a6470e7eaebf1b8910c9fe24a810c1b1d7ee752aae7fc984b7c19133ce2a8796c610fc81a2a44d647
SSDEEP 12288:c0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:c0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B6523BF965C41CAE52604B5C3E5F11DAC073E5BE92004937A6BBCBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 170d672597871412bfdb4d54dac902c83a557338cc3bc97e4709636b7c47867c
MD5 00ecab77bdf69da7ff2a898154dc566b
SHA1 a0d9a734f636f8133afb0f990d5bfda23b77c7e3
SHA512 8ba30552c3a62d48bfd9954aac69d5b6e6e082cfa697d7bf332c62ff0156cfd25b538473b57afa02d004039a8cfc3a7cdbf2c13245607a4aa4a2e986c46a60fc
SSDEEP 24576:NZMjzFVSOssqjnhMgeiCl7G0nehbGZpbD:NZMjzfcDmg27RnWGj
TLSH
T11D8501A9B35018F8EC67813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 8c4f09b26eaffcfa88031b3a86431435db15fd3ac5687616ba17550ea14dba89
MD5 a9d1d7156ed74b245aee55b430a39347
SHA1 e87d62a4a2fae3ff24be5ed8aee0e1d01de2f279
SHA512 698b648472cd1863e411d621806b6959e2ff36b2cb232ba2ec8a4e90a7b52fc809a3676372b42a66a950917b7466014b546cb44852ec60d9d4d6f88d9c0f00bb
SSDEEP 12288:+FXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+FsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1516523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 568ff9cb0343ae972c5858a7f95b09376af4a2b60d16b0a3214125e84fbd586e
MD5 9764d83c038896765151bbb9ba740409
SHA1 8543e1d96bc4e94a2834d17d1ae96ae9e112760a
SHA512 6117c6da9e1f7106185210172ac1c28e64b84f07c3003d12df450b25de69bc0d9442053181e50fbbca48c1d97854afaeea330b4beb04c5e1f7cd61b70e59c005
SSDEEP 12288:BRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CF6523BF965C41CAE92604B5C3E5F15DAC073E5BE92004837A6B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 87afd714b11d611ab2b67fff2e28ba63a3180c7dc4f58780ec18bbc290eb4bef
MD5 f448dc114d8118cd673ffeaaaf80010d
SHA1 ef87fb31213aa1069096595df8301d7876fb0613
SHA512 ab5393609b7032de9fb7a672c83c2c92f53b950d6250929e357ea2039b7a48e42ad3ec44539b6eefbc98ce2285c6d1bb7920d32daab2e5c88648f2e2869e2f7b
SSDEEP 12288:ryPz5L8oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GzyosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DD75125B73A430F9D1378178C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 e710c1ce8da05c4b4f5b4a7f6f9605b98551adc1e5b669979ff568c5088f2b07
MD5 607a6b29a7237a298b0c87d006137b17
SHA1 790f590e4d4f14078aaa5afba34d336ee95f9133
SHA512 01cf00ae7e3fd59b52ec6feffda74575c445bee698f52106a0454a39d2ff6e3b4bc8c61631e17ae80717eca5e62c15648a48ec30358ab251de66d6e9086db1db
SSDEEP 12288:GFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1246523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 39211b70c94ae6329054307d118f1faf41384a10e5aa7317fc6ded249516f258
MD5 d60008837c923ae6b60d5b8bde1f829c
SHA1 1fcb0cd92e3af28b2952fbe536f79273aee51760
SHA512 4fa0191d99eefeb235d93dde2f1656bb6ca9f5b28d30376fc354e5cb51f541e14d4c545a0ac1ee99ecb395a2d2f8d5519b159004da7aff755e374e1a57358cc0
SSDEEP 12288:WFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B6523BFA55C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 3d974da57c5da4dfae9dff71a97911b672c1607133ea4c854bb1a9799a82a163
MD5 a6ee3c2bac302f8539f536f0d9c2af0d
SHA1 361da7eeb81d16e1cef021f4f15b91bd97918a52
SHA512 0f961b1a89aa1293182e9319ca696453dba73fb72ad119db2db1a84505ff5ee598146e72e1fc53e90725b534e3ddb4b3f503eafe89e43c6a188367f45571fce6
SSDEEP 12288:AyPz5L8oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xzyosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D675125B73A430F9D1378178C5A29A06F7337C3647204AAF17A516BA6F736904E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 62b26e3ce6b3200343dfa59042cdf269b3a74ad6448da1fd0ef1a66b76da9a9e
MD5 a226969504244078340df801aef135b8
SHA1 132a581f87051a88771a124e2cc5c43134c050d4
SHA512 92a4586a4b6b0c1be8cbca56e903749ce98ced1b231b42eb7b70f2533b4e109f1d0981a6548d30064a47f6a63ace27b48442fbffd733cd5d21ca5ef4d44143fa
SSDEEP 24576:9TYaLl3z0zDWsqjnhMgeiCl7G0nehbGZpbD:9TvLljDDmg27RnWGj
TLSH
T18D8501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 d0d528d002b18d911e080a24fad525b882280e5b5133ff03c6380fa8604d15eb
MD5 b220ebb39e6a0cb3434f59e94a356136
SHA1 8bf16e2259b49561a4cae7ddef6d21aa5c95863f
SHA512 7b866b9de3fd64d23e5a54bc86b8529ac84f63d1e3233ed557ed4d30a6b8bdafc7bf5f8c17f9c0a4ddddf1b7f4bd24eb2f3d00e2afb540e6078d2953bf1c9050
SSDEEP 24576:q35d9CHKy7GZqsqjnhMgeiCl7G0nehbGZpbD:M5d9CHKyacDmg27RnWGj
TLSH
T1F095CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 21dd35a5ba18d44a70adefe4ff83178c2c45c65e2f6e0e139f2c267c8101c483
MD5 92921af04d295ae138a15708581639ec
SHA1 118e496e35c41814121853e02727c6f64bfb5291
SHA512 d0ec4c3fbd92071565976da2b79108fcdf27fbec256d8f0243201c24660220c654751ee4e43d173f1de8d103fd8ef3f921a5443d1a0ebd9075de20981a3945d3
SSDEEP 12288:WmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BF6523BE965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CB9FBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 c479444a1304d2209badc8c24a9baf3e48063bcefcd40a3db8376caf9b3098c8
MD5 f37fbe91ff5a5be5d7377c5eb50b9045
SHA1 15849e84159c0716b99160a35b22c07e582b33b0
SHA512 f97de5ff81804cc21435eccd9a5da1c3fdd7eae412a0b271c52b74d06f824cf5180cc8cd4911ae0007168d6e520675cd29a5a089f32ba5494888b7b697f48bac
SSDEEP 12288:1IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1IsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1556523BE965C41CBE52644F5C3EAE10DAC073E5BE92004937B977CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 1dd852895963177900a4f963697931e528370a63471d264646b6985e4789959f
MD5 1527967066af8abe363bf1c43352f6b8
SHA1 6cf2e9b1ebddb26809c9ae7f8b4a00eb962ecad2
SHA512 46cbefc4fa7e92f8b4de60475f79444aaa5d5af14535a5777ce7bc8ef0083c08d9964b8c2e99cc0e529b5d1b1a4e532a574df370a7668bcfaf6c87f1e2c3f042
SSDEEP 12288:aHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15E6523BF955C41CAE92608B5C3E5F15DAC073E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 6cbc293daf28ff6e85effbe5163ee07e9638064cb6ca0d525e2cedab270b55d0
MD5 1e349b4ac872c9cdad35ba1631b9ba31
SHA1 6bd16c8b624c442b762b7b759de632f36d979ed5
SHA512 0471fddd0ad209164963fa102c565515cec6cd0f11143d20b2788d1cdb35c9ec7b459d35063ad748c98fde8c72280947b8cae70d27c91814b7da5110633bcac7
SSDEEP 12288:sFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F86523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFAB14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 f9351a56bc1a7338b8a7c91319922c66a3172eddccf908ad5ea42b4df2bff409
MD5 a28d1d4c04405c330c5ad1c644edc238
SHA1 cd81c5096e49e068f05263b58d83176ce6d20b73
SHA512 5392be98ea4deacaa9d78e8927af884802f01f2c48ee7b7074920bd7342a65baf40af4f2250fa851f8137bd14823f9a4cf040df6eb092859aa99fc9e30688af3
SSDEEP 12288:OmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B16523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDEBB14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 340a3f81818ab298b6cbdf93e8f8b6113f4b6b768b4fa120fd73aeeb082fdb31
MD5 e1200e033a5a6d3930f02313511ea316
SHA1 fcf650d5072b613a1395b6cdb691762fa8421e47
SHA512 881145274595bec16428c3a71e2790c463c5ed8edfb90e36f865debdbaea212de69658b8209f74bc41018eb4b3cd1bdd5b5da973b73a9e020e7371c48723c7d7
SSDEEP 12288:aNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D56523BE965C41CAE52648F5C3E5E11DAC073E5BE92004837A977CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 3a939ea984e1be864ebdbf2da164674559430536bad5a90cb634b54fac70833e
MD5 4b5fccb7ac77ff04b245585937ffd6bb
SHA1 2e02e4f8a999e0c03edee6c7120729221a6e19fb
SHA512 2cb86b64c1eca606d7a3f455f60fb1813ce12ef6fa4a09b8bd012939b205546fb59e0b35795267d7d920aed19f2ed34751a7ca92634c3943727794dee6cd2352
SSDEEP 12288:MjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1656523BF965C41CAE52608B5C3E6F14DAC073E5BE92004837A9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 cd1ac7aa4004fa0fcf7acc553ee360bc245b3023810c3affacbd784c3f7133f3
MD5 6041dbfc93b584b246b3cfdd71072a03
SHA1 ad2b25e4ae5cd7747e48eee656aceefb83bb7166
SHA512 5aac1676d02d18b7d8a30ced9677815fbb2a19f64f7846df1bf1d0843f8599ee5a96da06487c9352cc521f970140abd196633361cdc3628d766ee271fdf6f9bc
SSDEEP 24576:KfwvTk9RX6wkyAIBsqjnhMgeiCl7G0nehbGZpbD:FMnYIVDmg27RnWGj
TLSH
T16495D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 005c0adb3bb94a773acabd942cdb5cdb93ad17aae3402eca2e228208aa2f3a50
MD5 b6e20decb833852d715cbfaa5d8694f0
SHA1 d92a2e2d903f76c1a0b1be486a20690ec600389a
SHA512 a482297d47808460b00854a9c28b866d87988331fcbefb0b19ed2eee64827d393564d3a5b48f6e431c7c77e9ea8ca0b5ad189accfd59b030ec040aa6de1471cc
SSDEEP 49152:rYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0WDmg27RnWGj:PySzP+D527BWG
TLSH
T1FA066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6d007ffa1dc469291afcc4ac8f92cda032d5ca7989c8ec1544ba50b63fc6dc8f
MD5 39964ac1ebeb08e7d3c240a1fffe8e33
SHA1 57867955a529d7861b0b56065ae6c634acba5d03
SHA512 c338f23c2a49e46fd4e127a979b629c82916d88a0b9635c1f4793c4613174c5b368be5895656793026e98f805691f19a4b02e057d22aa7fb0751a219b83ab8a7
SSDEEP 24576:U47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYcsqjnhMgeiCl7G0nehbGZpbD:U47JUQj1irIhCnDHUPfF/GDmg27RnWGj
TLSH
T1FE65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 dfde1d46f2ea206f3a066bd9c533e92b86b94ad6a603d609e59367b4eb2cb350
MD5 d506e947e04e2421a53279533c9940d3
SHA1 2959c4639e7a5cf0fcd8fb97843899b2436cc635
SHA512 21d98ad467c0acd93c81804d928b1d7b6479b53ae7896e1d7cdf240504b246a6f9543f58af00dd9f3468687e7518b1c40c1ed6ff02025837ea1c2c9a3119bae3
SSDEEP 12288:+jsfVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5VsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17675015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 944KB
SHA256 91f301e7cadc4264d2cecd7a427b7bf5ea099bd523115f6abb74002632ccc4a6
MD5 cf8d4aac5a6051d57639293d0787a8b8
SHA1 3caad5182c31a8525b7a8be707f8b5b381b5b9cc
SHA512 23bd7ba06f675a41b2d88191c3363e7729b85acc212dfe0e21527250abf961dca7b7bc643b388ac44912b857bcbc938c8cf1df865d07e6e916f5028b0d148b6c
SSDEEP 6144:UsBC2na9sncR9yH5cbPotMxZPAwU3fUkpnCSDVxI17osqmJ29vwn/VV522nIMO2R:d6qQU3f0UhU52aOUrDHLpMijVC8
TLSH
T19A251600766BDB5FC6AD40321E36D6CCAB707D01EE059B0772C9872FC576668BAF2192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 309KB
SHA256 d047b6c708a1423c0148f433b007b266e76c9abef9e8c0bd6f66c73349f8eba9
MD5 05091637dd142129c5cd6a2f74638ac3
SHA1 196f5b3232d258e67b832e724a1d00c373e344b1
SHA512 6b3b34de3c53e6d7505cc5c9115dc356b75b3a3f627e40a0336bbeef5b4d59a0e6e758e702dbb81dccf8349025130f08961337081555362613ca25bf9ed92ede
SSDEEP 1536:VzFu+XO6xHtcZejQH6wlYl6LjdEl43mwuyWu1:fwhEl/Sb
TLSH
T18A64A615B758B32DC4BA4077887095ABDF7DB5228F1342023BC41D99DCF229A377AEA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 9ab946ed6d13e4dc58a5ab08e92ea3a73c4ed4a4beced2a5eaf4a091ff743ca6
MD5 8374e28167ba7d98a1f2f53601bc1976
SHA1 3c64c7129d433825828b5d42aa276d39b3beda55
SHA512 3d23ee86dc95e64f10b4f50df31c98a98d78ec19e55b4d3b1bdaaf1cef5dc4fd19bfee8b6ceb997f574af81ca222fca05871bdac2548c99acbf066a3040c63db
SSDEEP 12288:cO7dXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14265237B934C518AF93605B482EAE12DA81B7E669F1044C3B94778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d984434f8ed40094137a9963ad72033b24ea7e1d441bb8434236217f9710a299
MD5 5b0df82186b2446d2d50c57ca45f299b
SHA1 a1e92e744a40dd770bccfe174e0c90d3b3a5abbe
SHA512 aa48d3bd81f5fddfd285583e4529094e04e9469657f4560b2eaed86e092ece33eb8d6ce38b2c1f801fd454516595ede80d36bd74880655040fd1f85b5aa8feb1
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bYfsqjnhMgeiCl7G0nehbGZpbD:Sgb4mBIBhGFIDmg27RnWGj
TLSH
T18A659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 91d54e614a8df066fe6ff88568ab608006e46fdb3bf760f331e42f41ac7d5a7c
MD5 1a856785b478d1301fc42bd2645f450a
SHA1 35533980e1ed216f088345a67a859dede0f68f25
SHA512 323451f9493ab5b3e011ef823e84d6b9a9361dc158dc7a8a681c6e6dba365da376ce729f910666b4f4a25083ceb9d08c87fe129a444549537ce76abdd218d65d
SSDEEP 24576:GG88u8FpJqH1kzria7/mssqjnhMgeiCl7G0nehbGZpbD:N7ZFPqVza7/7Dmg27RnWGj
TLSH
T14FA5016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c08bb2fe5cb4174c9e95df3f6c4670f6c6f836b06a40bec2dbd5171b2e525b1f
MD5 f2cad5d0dc4e96d6e096b03ef0fa2c0a
SHA1 1fba16507024b6eb7fc99e05608fbd0648d38a78
SHA512 32789207f540dd40fa4e6e450ae1ddf55e0f7b74c59e56a2cdf9f23e50fbafb2cb8aae9aa50a830bea3d7650e28f9f793b747e4a7e2c1ad8fa79c7782d880d27
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjsDmg27RnWGj:WG05lO43btD527BWG
TLSH
T1C4D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1aade78a05f39779e83ec8c28ec3f468de5463c3bc1d18277b08fd7b3796e9d6
MD5 8bc99060705cb614bd1fc4dab5ad6b7a
SHA1 da36e66ff63e62ab9aa1a7bb7bf28733a8f01a0e
SHA512 a1b31514ccb40d58c229164250b13c6f491c27702b89b16d2831de7296a643b661f0d62f9f2d9871835571a781b2b8446f9c76c7a2f0c728899fe5c9302d4521
SSDEEP 24576:ffa5POZ3dpFWVM50JicR2hG0lasx2+47eidnSsqjnhMgeiCl7G0nehbGZpbD:na5POZ3+Jt2pasx2+m0Dmg27RnWGj
TLSH
T19665BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 db21b15b4f6ed3f07fd1d2358a9dd28222fd88622cbb9297db6ecf021f43fbbe
MD5 ba3bae1d751970eb113eea4784977314
SHA1 24bb3c09c64ea7378eae1492f1fc1a198c450c71
SHA512 3f4cc88bef2502312e7de1fea1f3eeb8c24341cd28dea1061006a323b7ec014b35dc53638361ec89c3e9ae1c02e7017b3eab8abd7f82d9e505264a666f7b57d9
SSDEEP 24576:zNcwHdjbyQ4nLC18lb/EOjowL7FkEsqjnhMgeiCl7G0nehbGZpbD:zNc/zEOVHFbDmg27RnWGj
TLSH
T1AB857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4446b2c2784b5dbb86c8f7219800fd4865a9d85d2feac1bcf38beba6111da2e0
MD5 877605c4afea6b46017e8da6892c0928
SHA1 ae2a6c5973bb8621b527aba42e98d7126c4ed879
SHA512 c13f8861613e403f684ba63040e94f37904294d53e477f5e155b39d13c33ebe3e7c24e1a4939f44bd2b3cc3647591fbaced1affa977de73669295faeebc5acee
SSDEEP 24576:/8kNvNnaFeYhJNtmZBm+sqjnhMgeiCl7G0nehbGZpbD:/8MwBtOmSDmg27RnWGj
TLSH
T1C755AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 fd8729485425f8f0887ea5190caf5cb5ac78cf845820fbe4c439c7246e265441
MD5 f2792e1f8165ed3e5993af559545a7e4
SHA1 c0def8292bf706912f4e8ea1f9146f259e794bc6
SHA512 8f1c621b4d1032c684250fe60fc724105444113663287b50b533e89dcaebee57c21382890ee380691b00e769d46338a43693cec11f4fd8b9cb5263cac8d725bb
SSDEEP 12288:WHvUrBFrEjwaQgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:WPUr+NQgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18785F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 e978697fceb92883e9aead92bbb7223bfb9e8a9fbb36a6c8201a327439672f84
MD5 a7d75753f820069f949eb81671cafec5
SHA1 71f6d76e68678c1bbce278a3f1c28a0c955f5da8
SHA512 9b02298afeee5a93681be0b37f8e6673f302f81c8a6bd5ae9a8133827a1a11bf6c867b543bd8917871310d0f740dcb92d749bb26755dd4358d1d3946c3c4e5f4
SSDEEP 24576:ID3FHshBIYQgAZsqjnhMgeiCl7G0nehbGZpbD:IDVHeBIAAdDmg27RnWGj
TLSH
T18F95E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1108-111-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1108-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1108-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1108-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1108-105-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1108-316-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1708-25-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1708-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1708-24-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1708-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1708-18-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1888-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1888-130-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1888-140-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1888-136-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1888-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1952-98-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1952-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1952-340-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1952-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1952-92-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1952-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2084-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2084-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2084-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2084-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2960-81-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/2960-82-0x0000000000980000-0x00000000009E7000-memory.dmp

Download

memory/2960-312-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/2960-87-0x0000000000980000-0x00000000009E7000-memory.dmp

Download

memory/3464-280-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/3464-58-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/3464-59-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3464-65-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4176-116-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4176-118-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4176-124-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4176-315-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4536-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4536-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4536-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4536-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4628-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4628-43-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4628-42-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/4628-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4628-56-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/4628-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4712-0-0x0000000140000000-0x00000001401F3000-memory.dmp

Download

memory/4712-13-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/4712-15-0x0000000140000000-0x00000001401F3000-memory.dmp

Download

memory/4712-7-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/4712-8-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/4712-1-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/5956-71-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/5956-77-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/5956-69-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/5956-297-0x0000000140000000-0x00000001401B2000-memory.dmp

Download