Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/07/2026, 01:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
- Size 1.7MB
- Sample260729-b2ws2aem2v
- SHA256 529c7aeae9d0c57220f0883482e04cf919e1af3532318079abe19f5419b9d105
- MD5 234b992b17b1859e43cc74f0ba62b606
- SHA1 326974e4ea2351093de16e3c34591f14f67fff84
- SHA512 e2a79267d818e98acfc93b7478d38248a19eb82e1b5e9dc695c66fcc2dcfdd6343b527d87450e62b990846c80ab857866cebe3f6cc0bff917c99968c276c8469
- SSDEEP 24576:k4kNd8FcptWJ6iNWcASYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:u8aWMsWWDnkyH3uJhjxj4
- TLSH T1E185DF58675440E1D1B6C23889539906F672BC004B71DBDF5398E33A6F3BAE1AD3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 22 IoCs
pid Process 3940 alg.exe 1208 DiagnosticsHub.StandardCollector.Service.exe 4556 fxssvc.exe 4236 elevation_service.exe 4656 elevation_service.exe 3816 maintenanceservice.exe 372 msdtc.exe 1216 OSE.EXE 4208 PerceptionSimulationService.exe 780 perfhost.exe 4756 locator.exe 3200 SensorDataService.exe 3992 snmptrap.exe 3388 spectrum.exe 396 ssh-agent.exe 1688 TieringEngineService.exe 2276 AgentService.exe 3836 vds.exe 3376 vssvc.exe 3304 wbengine.exe 4712 WmiApSrv.exe 2984 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\8aea0954905883c7.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86218\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000811781dfb1edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089f6591cfb1edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af09131efb1edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7cc551efb1edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008eceaf1cfb1edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e84ac1dfb1edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fcc20f1ffb1edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003edde11cfb1edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList SearchProtocolHost.exe - Modifies registry class 52 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A} 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40} 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577} 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1} 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe\"" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577} 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe 1208 DiagnosticsHub.StandardCollector.Service.exe 1208 DiagnosticsHub.StandardCollector.Service.exe 1208 DiagnosticsHub.StandardCollector.Service.exe 1208 DiagnosticsHub.StandardCollector.Service.exe 1208 DiagnosticsHub.StandardCollector.Service.exe 1208 DiagnosticsHub.StandardCollector.Service.exe 1208 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Token: SeAuditPrivilege 4556 fxssvc.exe Token: SeRestorePrivilege 1688 TieringEngineService.exe Token: SeManageVolumePrivilege 1688 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 2276 AgentService.exe Token: SeBackupPrivilege 3376 vssvc.exe Token: SeRestorePrivilege 3376 vssvc.exe Token: SeAuditPrivilege 3376 vssvc.exe Token: SeBackupPrivilege 3304 wbengine.exe Token: SeRestorePrivilege 3304 wbengine.exe Token: SeSecurityPrivilege 3304 wbengine.exe Token: 33 2984 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2984 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2984 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2984 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2984 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2984 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2984 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2984 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2984 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2984 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2984 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2984 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2984 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2984 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2984 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2984 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2984 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2984 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2984 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2984 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2984 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2984 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2984 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2984 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2984 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2984 SearchIndexer.exe Token: SeDebugPrivilege 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Token: SeDebugPrivilege 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Token: SeDebugPrivilege 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Token: SeDebugPrivilege 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Token: SeDebugPrivilege 1668 2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe Token: SeDebugPrivilege 1208 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2984 wrote to memory of 1576 2984 SearchIndexer.exe 118 PID 2984 wrote to memory of 2972 2984 SearchIndexer.exe 119 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1668
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:3940
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1208
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2804
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4556
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4236
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4656
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3816
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:372
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1216
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4208
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:780
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:4756
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3200
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3992
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3388
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:396
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:1620
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1688
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2276
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3836
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3376
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3304
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4712
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1576
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:2972
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 7612fa2049e6134ebc7232c563afcaf310368d333a425554ef2ec51d7fdcec07
- MD5 cd7cd34b786817a5623389c5203002b0
- SHA1 49553f34d43990114b52d56e57acfd4a09363537
- SHA512 2f4be9919ad26d57902b8166ef47d9bd8074ebbee440260428ab57c12cf103900ba0faeb9d3de6dd82f19afb5cd98be3dd0710fbb853b874127bad9cc22bc0e3
- SSDEEP 49152:sb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnWDnkyH3uJhjxj4:W3q60jBRnTErj4
- TLSH T1E1D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 295345d0405560e926e50a77abc85bdf8964e13d79735ddab355223fc36ce4b2
- MD5 c3dcabc25c18a09f175f0178ebc96d33
- SHA1 fb5a12f00cc9b989badf85bd50ebf4e7c6e92654
- SHA512 f3c061b4360e2c246cb7f95132d34fe4d629899f8f683b0f4a160c07415b7abb681c2b786939da058b4c39d5edf493e7cb661540d14fc21ef84fc5ba892d0ffc
- SSDEEP 24576:sXYfDtczAVYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:LtcADnkyH3uJhjxj4
- TLSH T18975F12877E509F9EC67423CC962C501EA33B8854760E3CB03A4D9665F376D86E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 570fb8d2e99989c10480a69fed818701bbc8ddb5c4639d20124a8d9e891375d0
- MD5 65dc0d4693e6b7cc55227f5d8e7cef44
- SHA1 c5cf2e2c00e2bc63a1379d74ddc7989f3befb958
- SHA512 91d1494e981f242aa34c9716f00a8bad6b85d8709475e066ae49f4c4b404bd65bc117024a836a5b9474b8bbc6ee9d4c2e64525a0653db5efcd60d845d3cb620d
- SSDEEP 24576:50Le5ji0hmx0rM+YBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:5Pji0ACrDnkyH3uJhjxj4
- TLSH T169859E15F6788731D073C0B9C5D2A68EE97230865B308ACB4286D77C7F67AE68636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 2609f5562aacbed930c79e294d28442ec4b1524700d4edaa67b0683286626aa7
- MD5 44631aa5715c93a64f43e828297b86cc
- SHA1 fbab06b52668b59d96ea9f236c9b8765d9eae29b
- SHA512 28265737c1c18f5feca237d0af700edac52c08238d88064d5abbec8dae2bfab005cc4dd22b02b3ec1ccb26438fd1606cc7f3cebebb6bca69e9e311102c1d4b70
- SSDEEP 24576:ea7/ezSC6vUyD/aqgrvWr6q8wyuwYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:Z/ezSC6vUzPviHjyPDnkyH3uJhjxj4
- TLSH T11C756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089CB4246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 804d471d34ea2c88db873ea4e9c8af58dd3d354b30bc24ecb3b3f3569764556c
- MD5 368d649a352e6ad4fbfb4e022f5a4f87
- SHA1 5a61a48902c627bd0a5ca07b36db4d96ae73a7c6
- SHA512 d71773e3be169dae6b127c3653c9572ce03816c7a804f9e42a743423923dfe3a18ae67d653ba51194a0c5a8d3fb81b52a7adeefeeaead079c879a21cfd9007e1
- SSDEEP 24576:YVbqPb88hv/l+bRYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:YVO88hXl+NDnkyH3uJhjxj4
- TLSH T105559E65F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E67BE6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 14b9de59932f406a2cfa2d997aa80aa8e3b032663a731870bd4758d3ae213e4b
- MD5 1d13ea62c0fbf9314069044553c1fbb5
- SHA1 64183b8f2d800d0d10693adb26f25587610817d3
- SHA512 d63a7b11e1acc2e595b4c2a032901659ca8eb89c059ad7fb4ea764d0ae9debb96b34b6fc9ef1386b5c751ba33e06357fd74c4770615649bae567ad6f57cb9e5a
- SSDEEP 24576:Cd6YBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:HDnkyH3uJhjxj4
- TLSH T1D6552348292F0583E93B0D34BA25DA06F53EFD8D7C50C083CB59F96A993C997B5B0297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 f5153df88cb7be0e345b1702ec9ff687ccbb5093763ce3dc7efc686302609ff4
- MD5 8a59ae8cc8898aaff6843591d88f5e39
- SHA1 5f54efa1a0bf7bce7808a39c0fb9521f5e8e4811
- SHA512 5ff5d8ebf4325f872e8a6b199d76835a61c40d3c423e39ac8141bdc90c789a61c95079c664f6120d65ef6caf64a9b95a58001e204f7fe17ba060bafff147db0d
- SSDEEP 24576:oJIUZYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:oJIUZDnkyH3uJhjxj4
- TLSH T1BB75CF3BAE28ECD2C27E4D785A51C600E77278704F62A3CBD265C20EDE275E15E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 b8425b300f89c5bdd51b49004018ee6b1576ee8f8523d4d4779122ab7e963549
- MD5 9050c244efa6a1bf6104d004de67e7c6
- SHA1 4f64e578961509f81c7aaf1ba96f1270cb62b5a3
- SHA512 40bdd14bda1a7b5589cde2067f3875bb8f17838421f330711716ebaab4bf503fd2b9feb936e2df8adefbda680a3aadb241fff6fa50607421b053ef4c2d5f432f
- SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH7:wQvGAdlCEL8c/RRNw5C4nTErj4
- TLSH T15D266C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 8bba9782a32b4507f1b4831f4729fda3541bbcb7e90cd71bd8796c87ee10f3b2
- MD5 2af2ab2978094e0045f3ec479d0b2c05
- SHA1 fb242a28199237905a05838846d1d9e670593b38
- SHA512 987a25e947e54ddd185936e7f4478d8296b46cacd43c6828fccf4bf12dedf4cd2ed35b00ae182b2f01507b183a291475ca0baededf7d5396203c82c3fc30ee1a
- SSDEEP 24576:QhewsAjbYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:YljbDnkyH3uJhjxj4
- TLSH T10775E030FE75D032C67B0DB62B36C706643DB9604F6119C3E3A88E9E99342D22776A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 cb37231017e1baf8bbf0af2463a38c20eb4ae0825bb32a5dcca32579b5aedcc5
- MD5 7151ab8ca6cfe62d12022853df18d0d8
- SHA1 de0cd2234ba3e6c8bb7064c4774b7e5f3027628a
- SHA512 4dcf9892b633fcb02ebf5246c073e9324e005f0bce85c856c97e6553c2329c160b1f1b5dbb54975dcaaebe25035651c4f02afc5c1f4bd630be6df0ecfef0b321
- SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHHTErj:JUEtQevvqc2W1cpV2RI32y
- TLSH T138474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 987b2880a55a220614074154fa7aba368406726eda18f54b08530b07ce8a0e90
- MD5 fc5780bfda3f3bf08c96d0e35f4c1556
- SHA1 628bd8803b154e02c69a71a0e74f394878c042ed
- SHA512 071024404098199b112340372765c45f62f26dbd6cfbd77e703cdfe0eb5818367ae420d73410688ecf09772b4b88b3a0fe8c24786bcf97f8e796eea30176b46e
- SSDEEP 49152:FCbRquA/m2yL5zQfFiV+XenmE3/z7DnkyH3uJhjxj4:SoqtVjnmknTErj4
- TLSH T16FD58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 6e56a0dac0770687db4aa16f28248ed398561a05dd01d675bd5d01df066e9a31
- MD5 de50dcc4377f57d376297fbd915fcd1a
- SHA1 e2de6681ee9e9be2206a5803f4e1c2f9141214b8
- SHA512 624f5880fdef16b96589661031992554f85d275c2f041da92cbd9c747666d0780c7582dfc2aadd5ed7c89cd993a5c927b517e76a778d6a53a5a44e515b6264a6
- SSDEEP 24576:bAhGL2IFoiwtA5l7S53UYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:bAM1Foiq5kDnkyH3uJhjxj4
- TLSH T14F35AE80E7F945D4F5B3AA7899769171EA76BCAA5E31C20F1260D11F0E33E509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 8a25bd921030e8e532969099d668bff760449eaa0ad4428e55637a8d64934f94
- MD5 a35b7696a4ac20ff57d3cd57bc3dd085
- SHA1 7ebe0bba75d69903962dc6698ad248c15fe36555
- SHA512 a2d976d6853ceb52a13658573e06f5ed2ba9f05a5bb989e0c0b429351117b4f3c2d10cd3fc82dde9b8f5e65c35511f4bd239451b694fc88fbff0c32036a5b625
- SSDEEP 24576:pwu0OWvYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:pw/O4DnkyH3uJhjxj4
- TLSH T12765F14936A90CF9E9774638C657C136F7B2BC062A21C71F4760C66B6F37261BD29B20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 737375de4be357d1fbf88f6a41cab830b0903ae96047218e90fc3fb84ccb8d55
- MD5 fa3a182cf62d1bfb2f0b5937248a4186
- SHA1 80612cb478c87cb61ea303e49f7c534022eb9385
- SHA512 4ac3de0d6b5768f1d37599ac6a2d8c9c9d03cab00be43d03c3fbd0e8f446ec8f5f28c94d6ae7f0f667a76f402481da9c801dcaeba70ebcdf1dbff0e24584c447
- SSDEEP 24576:/KZuGYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:mDnkyH3uJhjxj4
- TLSH T10255124832A921F2E477063CDDB1D605E776B8862B3183CF8725866A5F36ED26D35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 435631e2a23c7ab8e4d89b62fb7393ca0ebe03b30d3851d95d4a82568792f84b
- MD5 dd86e67129a78e6ba9b34a9f4fd8b6e8
- SHA1 7c9222ab10b6bb82b161aa53bd5ad9f654b5a83a
- SHA512 0d0378b7d142c543c703a8cbe8f2edd6e95a20e9f34b86ba197e82c1643b32ecf15d637b82d7f314be6c21eccf8c62274f91b6298b01a20b561198b4d228b7e9
- SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UX:GQRQyi36YOcPhLvw2gAf+PN3lnTErj4
- TLSH T15B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 6ee0b716e58c7e5d1be56839bbbee08afcdded736dec397b09ab5d97a2d4d79d
- MD5 a7b90e08f3726a58cc43eb6a7d8b39b6
- SHA1 0702e51d84a2bd8793ecaa7a66e81842abaf26b4
- SHA512 8c7bfd0e103fe46da8d0275a7f1f01af0a87a1ce324281c36c98a64f7bb6b287a9c0806a6654ea021cc27c51752e358b914a043af0875bebe4df49fcd95cfebb
- SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UX:XQRQyi36YOcPhLvw2gAf+PN3lnTErj4
- TLSH T16A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 3482eec1a804742bd0c21eb84e2a9e4fd405bf7654e641ec8413e8e70341ae63
- MD5 11b964478d59e73184d16f210318609c
- SHA1 cdd913791fcbead27e129e0a140044cc8c2afb9b
- SHA512 94f9f52d29b7b43f2fa1b4e4b4b29bc4bf881594091cc6317a696132aefa777b4b3dd1c597748989ad9418cac93c4fe535100b3638ea9e53c52cdc9a53357095
- SSDEEP 49152:k68Qg55nhceWu7PNU3/rDnkyH3uJhjxj4:OthLRc/PnTErj4
- TLSH T158B55933B2F60099C44DE1769F4A872196D27C758FE0E3DB861172161BB2AD07B3A71B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 ac7bc05363a63661be15314182e7a6d4aeaf89347746a5b8d39f206cfc9b256e
- MD5 6f03f15236c97c2d11f2aaddf639b4af
- SHA1 969d90e3222085fba78943e7dfd5911b472b9644
- SHA512 c598e415509312ff32956104a870c4ce6aa7f7d9b3805f3a9f0a3cc33c745911895ee316812f193d63a55c729bf1e255969f1d034e89c1f353e531d63eea70b8
- SSDEEP 49152:j3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99N:2y5112gYy5azzVva69nLKnhZunTErj4
- TLSH T1CF167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 32f64e1ccdd35835316eea97e142b3d67d2b39fc993dd1cdf40cce9be08144fc
- MD5 fd3dd2650969779fe230b48448f6367c
- SHA1 6f593302f135918c918e5f0e7cf274b0b10d4406
- SHA512 bf793b7ef8355637f0e2d5215a6ddee8f5d194c9bd0c1348c931498324306367dbb51c059f3209b221cd38b199719ca3e4153d31ceb2d61a25aa4161e79df950
- SSDEEP 49152:wB+taZ3usBWOBr4tEG20bqx0z+n217aau1gllDnkyH3uJhjxj4:qu6JmUxd2ddnTErj4
- TLSH T18ED59D13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 02dd320d7aa8b92b5cfa1119c0b36fa3c74548e37d8d2e3ecfc3450574aba827
- MD5 f82772ae432aae4b6ece414a8d2b2f7f
- SHA1 96c6af031e532eeec3003638ec5a70cf117e09dc
- SHA512 4f78d9827b0ca1ed168db68f212e0a4b9e559dd600e1f310c0502ce4fe346e3587a1569a3b1194333f25628b8394eff23eda562e8cda55fa13cecd8d09d201e8
- SSDEEP 49152:51hpsNoJpF1A6BU44CwH7R4x5DnkyH3uJhjxj4:5mifPkRknTErj4
- TLSH T1ABB5BE13F2D901E8D06EC17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 5360bd5bd1f4d69735122651cd3d57e439b8124f8d54304e116db7e191091895
- MD5 43620534258d51c22b991ed3d3e6f834
- SHA1 37ca36da80f08b2e98b4dfce830a1ae643133854
- SHA512 b97f32d4f493985eed161fce170548744307cab5fabdcc899027eaf11fd24cb61a2138a0d1de6af4e0713b34697569b31c5da35fdcfaa1f5f28caa086fe9f9f3
- SSDEEP 49152:ZSuZQIY0Be2KNRVtOnks6NMHqGDnkyH3uJhjxj4:35dKvi61SnTErj4
- TLSH T104C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 621e5e44c3dca2c3c9bedcd3be548c1e1885e1e557170b76ee26fec387654545
- MD5 2911ac43394516341fa6cd763b820287
- SHA1 ade3fdb7765907d5a98e1b1204a498f647039686
- SHA512 5f2de0e9ad6db64c74cc3a96988f025a22542543b84edbcd9e813c848679e9c4315c0ae8f93e5496c2c612550c1b2d227d6c77489e2ac27145b3de94a7d3712b
- SSDEEP 49152:ghtSn8EApI0figXgiDn0AP5wVDnkyH3uJhjxj4:xX2iyphAnTErj4
- TLSH T1CA95BE13F2D901E8D06ED178C7568632E962BC060B35A6EF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 d58a5b8309945438cdccd8dbb0b79fddd734faae7ff59f864d0c54cfe79b1769
- MD5 51eb17111126afbc2672eeb9572e15f3
- SHA1 676629a97aafceaa9cd3a5206b2597893431b6c1
- SHA512 d9711a9d8eaa9e96bd7ffce251fa9c3b5b7f8ac35806bd9213b12101b5a6324904d43c985e90441a1622b9b2e4325d68e9e2b52c871fb0e619eb68984bae6d44
- SSDEEP 24576:piYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:QDnkyH3uJhjxj4
- TLSH T154552348287F0683E8370E35EA25D605F42EBD8F7D11C093CB5EE52A9A3C9A73570697
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 c6313ea6dc0ec78916684f317893066abf09275122be0b1445ff69a60b00eb38
- MD5 7e000fa18598807060dd5013a91a10b1
- SHA1 3ee21828f8508763ab4d6c181e08f6777fb89c5f
- SHA512 51fe4ab7db5a9a1469c76e266668e151cb621336b5ff41a298c9bb8f5854ea63c62647e378b5b984c8a45f64e46e361acf03a6e26a1b971609443997b9fb567f
- SSDEEP 24576:VHYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:RDnkyH3uJhjxj4
- TLSH T1C3552348287F0683D83B0E35EA25D605F42EFD8F7D11C093CB5EE52A9A3C9A73560697
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 5a1c56bee784e263def957a4e7e82bcd759a4cfb576c1cf0d511ab090ce6e79b
- MD5 01cf8642dfdb208b917e24b52730ff87
- SHA1 b3ad5256a289668ec9eb6a19e232d3a6470315cf
- SHA512 cba8d29cab7f7986838e368fe35648e8dab4fe7c4a31117c39e01449570422637140a35d68c3bc4a6719dde7d7479c880a829313b1d444c83851b297fba2391a
- SSDEEP 24576:lhYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:7DnkyH3uJhjxj4
- TLSH T1DE552348287F0683E83B0E35EA25D605F42EFD8F7D11C093CB5AE5299A3C9A73570297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 1e0d731cb6b2a43ee9061bcc691cf79dcac3a9520a9ed3810d49237472921641
- MD5 fe2b703304da0e1c657e270ff9f89c66
- SHA1 3cbb2df556693903c024155924e7277fb2a7693a
- SHA512 a0e279277fa590d0376214d024d44242d2b6b0adfd9af0b4a5c951a7107ceb0eef31618fe2ad0dceb014b334a6394719ab8d0a59d810ea455db8dcee8654e1c6
- SSDEEP 24576:1YBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:1DnkyH3uJhjxj4
- TLSH T1225523482A7F01C3D8370A38DA21D605F57AFCCEBE21C1DBCB15956A4E38AD67970792
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 926ff2210700ba19c585a4e10ce95ca90b27126c3dcd117ef64535e6efa4d009
- MD5 12781ef3b97e56b98d72e831e2ff12bd
- SHA1 4dbb3efa245139c83854549092a3af1ed5ca0c79
- SHA512 259f81064901894eb4dc3835c94285558bc11e1c81bed2184163785d910c028a7ccecfd25bea82d6104524d69f238b62bf1449ecccc51d4b2cb6c72a7a1c8423
- SSDEEP 24576:wMYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:vDnkyH3uJhjxj4
- TLSH T101552348287F0683E83B0E35EA21D605F42EBD8F7D51C093CB5EE5299A3C9A73570697
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 dd93e514cfd16678f64f64651502d8476614c4037758e17025bc086085f87120
- MD5 2d06759bf1b75e0e6bdce9274b07775f
- SHA1 fe250f4d3d3316937dc4032e2c08dfc5481b6656
- SHA512 154de54713b0bf1c66c594e7efb6960030c059dac876f6442facbf9f55e6748df8151b450cf421b709ae5876671c69d137858275b4d57ebc36a853240d97695d
- SSDEEP 24576:IjYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:4DnkyH3uJhjxj4
- TLSH T1B2552348287F0683D83B0E35EA25D605F42EFD8F7D11C093CB5AE52A9A3C9A73570697
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 67344b4128b5fa5921c6742681640f544dacece70552292d0839c175467c7c96
- MD5 d49409baf9c61cea51951055b06e1a69
- SHA1 1d5da588b20ad4fb80f22e4183c3fec51703d81b
- SHA512 8fb9aaa4523b607b6ce63db274a75a05a339cf30ecc3fb85e1b87aefdebbc32a53f90466c5274bf9924456ced9f3803a21b81b8c9a9c97c4051acaca45c1197a
- SSDEEP 24576:Z/YBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:tDnkyH3uJhjxj4
- TLSH T128552348287F0683D83B0A35EA24D605F42EFD8F7D51C093CB5ED52AAA3C9A73560697
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 4fbaf6cc8c8685c862e7395a78ec57d26cc9842fbae114792e0ca7b3c1b9a933
- MD5 d0fb47023472980a0bfc671c7d6c6722
- SHA1 39056f5ed1d731dae6157ce2930217e295df11e1
- SHA512 0bf2b6beeef40991c0bd7983f55264974d2f882ae200f3baebe11e9173cbb8d2610a33eb761bcc66f0bc413cde319a16580c8d7696771972a0771add666796f1
- SSDEEP 24576:IZMpzFVSOnYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:IZMpzfTDnkyH3uJhjxj4
- TLSH T10675019473A108F5EC77423ECD258906E6B2BC4A1B60C25F47A8362B5F373A11D3DB96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 e775c47de883e2805d60c36008d46176ef7fb2c9bd5f46d0d0baf92aa4056546
- MD5 10d676ae9bcdc4bf796e238f640fbb92
- SHA1 c0875d4fef7b792abc6c118d2be559024622f987
- SHA512 233ffe64b61f627f1e4921a3d75bef22c4134d28f8d59db69b20860e73443f029dbe6178178081154dedc9683ed60fcacb0fe3d78ca7715bdfe04b70580abfe2
- SSDEEP 24576:N2YBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:sDnkyH3uJhjxj4
- TLSH T196552348287F0683E83B0A39EA25D605F42EFD8F7D51C0D3CB5ED5299A3C9A73560297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 7bc96a0c8ab6c8234fb3d8f43a0db7b18288f42cd83b038d2f1555104e1724d4
- MD5 aaf8729ea9afb80ef6c5f17b051f3d8f
- SHA1 8bca140a75d65d2213f6c6c838554ede63bde3cc
- SHA512 c40954bb2164999e04c4debd82f7bd5d0aa40544c0e5e00ea68bce81badd7190ecc52e52889fa875d1b397d17563b63187869466892252e291d695c97cc99806
- SSDEEP 24576:PqYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:yDnkyH3uJhjxj4
- TLSH T1B4552348287F0683D83B0939EA25D605F42EFD8F7D11C0D3CB5ED52A9A3C9A73560697
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 ce990e24b183076e676c56a5f8f21957976c8338bfd79ac56adefa1959cd915b
- MD5 d870e10f259020cf20cc20f802d2deec
- SHA1 9d3e03c71453046ac62682895d7fe0dd8dd51279
- SHA512 e6a57681d52c979496c4b98a211cd0da023589e821bd163e1232f1b8e5b68b858ef1f6b94d8a6fa38e498566f5033f77fb258588729f29eb1d8f2d38dc0442eb
- SSDEEP 24576:1zyLYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:1YDnkyH3uJhjxj4
- TLSH T10B65120733A620F5D0374238C9625A02F776B8761B20C6EF876447766F376E16E3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 763d1c62c3786f1dd2075ee5d9ac241221d02565e1cfc2cfcfb3b3de52ea5405
- MD5 9f94f96297364a1ee86e5c3cf589cb48
- SHA1 4ebc6f1522ee6c118fe35d2308d8080fafc2b1b6
- SHA512 072010033db04d58fe63d85e8e99b06b29cebcb4a239fdc5a6cf29e477fe094ca25a4d036fd7eb0e472a3f0800b61190d795f9c360e4bc8d8d593a752ed9fcc7
- SSDEEP 24576:42YBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:dDnkyH3uJhjxj4
- TLSH T171552348287F0683E83B0A39EA25D605F42EFD8F7D51C0D3CB5ED5299A3C9A73560297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 9ea6aa8c6b0cf54f67140f62b941abe34529144043dd60fac44241c60c6add58
- MD5 22afc103268211218c9e20729ef4cec2
- SHA1 9aca2f568e7ac08d615524d83861882be7bce4d9
- SHA512 0df0e4f32fdd378be6ff17a7209d8061597f7885e68d567182acd7e0cb690b08a8e143fd11289936d303151cacdc46fafc4434ec345a2eb7f250be9b8acdddb2
- SSDEEP 24576:z2YBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:iDnkyH3uJhjxj4
- TLSH T186552348287F0683E83B0E39EA25D605F42EFD8F7D51C0D3CB5AD5299A3C9A73560297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 14b13a58d382d059bed259037a881d521dd4518b8123166e6e4bb30efe6aa41d
- MD5 4ee35fd0e120e131542389f923214895
- SHA1 68d052098d0a3ebf6c4aaba3184cb64027382388
- SHA512 452a00ada70be7a518ffb8aebd319ccd050e9311220e37eb889aac79dbc7a4c3cb419e869afaa51290c0db185715add1dcb664fad2ec056a194331c319fe8223
- SSDEEP 24576:fzyLYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:fYDnkyH3uJhjxj4
- TLSH T13765120733A620F5D0374238C9625A02F776B8761B20C6EF876447766F376E16E3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 d63daa8fae414132a73bad629130b30b5fe76b7bda5afc58e9b1d612ac62d2d2
- MD5 cb087f996f0c216e827783559026ff37
- SHA1 bebe8e71dc004195deeeeda96eee451c980450ba
- SHA512 de8ceb9f1713306af86e1864fef7d7e3a85e5802e1154f8e3db6261900c1400673f446a575d4969b448129c83307fb9549f44fcb45f068b56880971412dad2e4
- SSDEEP 24576:jcP4mcvIjkGOxhKP2l71nNKbrh/8KBOYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:YP4m4IpOO67W8KgDnkyH3uJhjxj4
- TLSH T19A65AE2DABDC0096D0BB913885658A49FAB1742A2F3286CB1160933D7F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 f83a71ce08d9b7e1daae3b21c2378075f716ccfbe75b011fdc8b7bc1193e1c52
- MD5 526c2210a92e6034ebead6348d944a7b
- SHA1 c3fba21b01386e7a4c0670134906da8ee658c6e6
- SHA512 bc74f3b3e537524b305d85a3e1e0d50b3621f79b8d57c968b8b698152b48f895ded9a90401a7210d44fd12cc92cef5061392e9f3448c5faf060511e2114b929b
- SSDEEP 24576:kGYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:pDnkyH3uJhjxj4
- TLSH T13B65F008E2A902D5C02E1639CB169A01F3377C5A9BE1D2CB97D0F53E1F39A916DE9743
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.3MB
- SHA256 77a0aac01a8ee4db89595c7865d44103f96586302384da12c147d4d795ffd716
- MD5 b82a11700b8e46b70eedceb88cf5d558
- SHA1 1c7cdcf06088890a363662e30bd1741caab46932
- SHA512 8e7d342eb6f109e02f603328f0f4ea33d7aa23e5af77683c3d270e9f87653bbea693f7cef5e3b12f270f270437da6895ea0363ae379fc34e797269dd60a1e5fa
- SSDEEP 24576:PmYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:PmDnkyH3uJhjxj4
- TLSH T185552308266E4A43E83B0E34AA25D615B52EFD8E7E10C0C3DB09E569993CDE77D7035B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 40ba0af72c38c2fcf6e99a64d3ea038c3e33f33d25454504fd0467cfea4edad8
- MD5 da7958e8c05b07c8c7cfd97a06baaf4c
- SHA1 7dd373d0d68049c3c6d0a2644974df58a02706d1
- SHA512 bf534de90bb6bcc1065a14900d2be47bd76683e1904821147d1a9ec8619de8ba879cc9a99b4a96e402e0586dfb6d2e4eb5e687c063d60362abb2a4238f086952
- SSDEEP 49152:Oa0h2GEkuAe73q3pp46zwwQMDnkyH3uJhjxj4:Oa0hNYG4JwHnTErj4
- TLSH T13585AE1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 87726f7f1e0158a47e178d0a352621eea6ce1fc67641bcc4fa7b43378f0dd669
- MD5 d5b824392106bb5773f777af14d932b1
- SHA1 d302f67fb139155d0f75164e83a1610d874ac924
- SHA512 4723f8fc84ab2c6eb626531aea622f928b21877f39535731b1dd4f17a34421abfd1f2a03b666f3d9b4c41fd7cf73575092a288e11e8b4ff905d46097d81039e8
- SSDEEP 24576:thbHjPXYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:thbHj/DnkyH3uJhjxj4
- TLSH T12055126C26AD11C6E436963C9611C606E331FC5A2B1193EF9795C27E4F3BEE52C31B82
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 db4d00f24d851bcde6313cdecee57bf9ce9cc93b79e59e9e6da22675b6569053
- MD5 6ad7a2447cbc192d43b41e70345301b6
- SHA1 b1dae92178ddd2979e5ebf3ceaab0f55ba72ecae
- SHA512 7de60bcaf072c06b0d2ddaf5cc00ae600f31deaf93fc4fa917c49758fcade468c04e2c5d7360b62c9e95c8a86ef292b2d716ceee6a11ab314e9993f19dcfaf24
- SSDEEP 24576:O3YgnJcRTk4yti+R5dBR/vYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:OIgnaTk46pBR/vDnkyH3uJhjxj4
- TLSH T18645BF2DF2B910B9D8AAD236850147B5FB71782D1F2096CB0170C538AF1AEE85F35F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 1c110af149cd7606491045694bb7f3eb7a88712b4aa1980d29b2fc98992e1f6b
- MD5 64bad91f29904a4cfe423d4c0ddac4d3
- SHA1 81be8f63c04e7f9108814251441835da7d3fc768
- SHA512 a6bc42cedd5ae17df0662278d09c055cb470801b6793a7505616a84651f9d750e4a61c48126767d4522418cec95b95ce90ee6f420f10d4d1273fc6c4c1ca6837
- SSDEEP 24576:paYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:paDnkyH3uJhjxj4
- TLSH T162552348252F0583D83B0E39AA25D605F42EBD8E7F11C1D3CB5AE5699A3CDEB3570293
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.6MB
- SHA256 53094c31fa5c77f0601481f708ef14ea82db4692a72a29b0fe8dc291c842cf13
- MD5 4808de7f5154310ad0256c8893049202
- SHA1 20711f76100f2db1d16bda8e90a4664a85f1e570
- SHA512 b1cdea76cd3aa3c84e1ee2e0f4efc9505dcab6e9f28b42e7ab97d223af954c6ba36cc48fd46e0fe2d45e1bd6d6e2b73299ba5ca4c32ba39c6a311e36d25ac33e
- SSDEEP 24576:RWL3UTVYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:RWL3UZDnkyH3uJhjxj4
- TLSH T1CA75F154F7A500F5E87B813CC962CA16E272B88D1764E3DF47A88A651F237E24E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 8a522c0f7065d3a8bc9e906e6c4a2a410a1d290d3728cc3593ec09bce6d7f478
- MD5 f3599d8aff59313007b92bcfaaaf559a
- SHA1 63a04897606a9641bd1609f68ab24c4e06541c59
- SHA512 0e065915a6316debd5dfef995353882127aa5960634f87bfca03fe98b35e6032ee258405d576dd0269b44b3a443eb1d307ed2b5ced2c2698ff28847243f1ef29
- SSDEEP 24576:XO5YBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:XO5DnkyH3uJhjxj4
- TLSH T15D55021836EE00D1E43A553C9A52C309E376B89A1B2293DF8790C17E5F67EF86C35B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 e3d11aebacf8f1e412d39e919fc5894d7ab633a0bc84937b4bc9c5556795295b
- MD5 227c442cbd49121bdc1584d5e8c36f49
- SHA1 e56649fc99369c1e84f7af4637d19a56ffa331b1
- SHA512 40b1d7bfec9faf1f2962168624b1c3c4dbaef5b0f22d6f7ea5bf5c44673a353286ac9ef68a0dc770877e00930c1c3cf16abe64c1465693ed206817580906ef38
- SSDEEP 24576:i7NM9YqZqmWMUkPjZM48Mv6bEhs2YBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:i7cBWMpPjN8DbEh3DnkyH3uJhjxj4
- TLSH T10B65AE2D6BEC81D5D477C13DC9A28206F6B2B4611B318ACB5262833E7F37AE45E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 aa3666a055a5a17dc7d851f57ecc5b1408657a78debb486de88219dddc5e7667
- MD5 bdde55f1f6cdd167a688ef327a52e13a
- SHA1 e80dd0c4f16f8f2bb68fc93f2eb59f47655d78cc
- SHA512 69a007b343d991040d8418cbe9327844c0dd5505da41f006617b515eae362938193b9421c629633647a8bd310080a8dea4deaf178c4a43d4ecf44ae1fab5b024
- SSDEEP 49152:eF2YuHNETovAvNYf8kmWDnkyH3uJhjxj4:P6BCf8k5nTErj4
- TLSH T125858E2927ED80A4E0BBD27D85B7D246FAB2B8511B3055CF4255862E1F33AF44D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 f16ae9d103706f005d3f449c8d9946f92f48dd66630df0272f4af627d2de0523
- MD5 905277aeb992161946f017450b14270d
- SHA1 7933245375fe974b6b6f9fa2c6d3fb873fa33017
- SHA512 9b03393a1ac03351e8235b86522f37541a9487743e5c09431f98d810fb17691244d713d76746a06da6a44a9611c7058435be1c692c892b518831d8e6a517ebee
- SSDEEP 24576:RAFs06+OmlfQNXEbTodYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:mFs060lcXusDnkyH3uJhjxj4
- TLSH T17165BF2F62AC00D5D07ED17D8A97C91AF6B1746707255ACB0260C63E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 0961ddaff41d02dfaf643768c65fea9757606744c31a618d7b5611396e725441
- MD5 aea27f7e0bbf285c61a1b3984181b5f7
- SHA1 58c14a6437d6edcf0f50c6f70fb53fc782f2f19b
- SHA512 424c34f3ac5592e9291055d981a1c89ba39b164dfbfcf6a4c9d15d61d5ece6f41dcf5d79afb1dc21fefabd387609fc40e473de3dd6c95822fa11ec8949d19549
- SSDEEP 24576:/JnJ5D3WqsYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:/JnJ5DGqsDnkyH3uJhjxj4
- TLSH T12475E02CD2A810E4D4B7C274825A5B46FF72386D2F22A9C758B4D5357F12FE0AA79F04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 f2dcf345b040ac93f8d0c7a90dcca6d97c5926e0861098dc136519bac698c747
- MD5 5458226fe3d131758762228b2849a811
- SHA1 362037e871f9b9035297192c9c26a00c42f3f2ca
- SHA512 c1fda21c5f619d85fc79acdcf5a097db04976311e2b5094adf661f448fad3cc00cba93252e07ac506e97f8aaeaf5a71388b3745290c642df86fcaac89528c597
- SSDEEP 49152:7g06DIKdwc+eQnSt65aViDnkyH3uJhjxj4:0QnTErj4
- TLSH T1F5956C15B7EA5294E8B3CAB1C962A5169B327C509B34F7DF0AC0C92E1E33BD1D934B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 fb164a1d081d3e6876f84da05def964dbd50e5e6a931ec4e6b72af22a1a2da75
- MD5 5450bd763bde478da39a2e6581741dfd
- SHA1 8ec97517ee2e611675fe050004b36edb6626f32a
- SHA512 9848d805fefdd4e1df4cc5678d30e10cc8a50e92ef8335ff5719fd75b84aad21a8d97f60a8548e4ec1a480da796e010b750df9bcd998b8cbe2c7a380e5271b17
- SSDEEP 24576:v2CQYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:OCQDnkyH3uJhjxj4
- TLSH T11455125C27AE60D2D43B413D9561C605E376F0A52B1253EF8791C23E8F3BAEA2D38B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.4MB
- SHA256 49018184069b9255722c32a46a75c86d74999b02b67af82a8ee68e23ed5b626e
- MD5 ba7b2ffd82dbc7c4724ef4156e493a92
- SHA1 34219c0716b78e79cb271bc972b28aa7e8ffa77f
- SHA512 45e2a1cac1b3605ae51e167241e7fb04058b706ce7e2d8f003e2c3d71df4cdf3be0b09d4d54338269657a4498ce37a4d0cc6dcf506457a32c664543edd4dfb7d
- SSDEEP 24576:4IyHYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:4I8DnkyH3uJhjxj4
- TLSH T19A65120823A95081D9770A38DA32C255EA39FC556F2182DFD690E63E9F3ABD57C30B53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 c7e4ef4354b6f3a53256434ee44f4b10cafadacc874735aae496b167697f3ef2
- MD5 14c98b4160cbeb9a5f13692cb3d52b87
- SHA1 324d93cbb8904400400eb1dba7cf4477431191e2
- SHA512 7c5e216335b8a6fc5ba47ec23d771bf4164169613a440400c43b8bb100fba3deb6a366bf6a444de77acf2d685b832a708abadf2785d2aff975ea2a86216b93f6
- SSDEEP 24576:apYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:apDnkyH3uJhjxj4
- TLSH T13255230C257B0583E8370A38A625DB05E53AB98E3F1190E7CB99E579CE3C9D73570A83
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 188518023ab7264e6798d5da8669af7db7a2cef78421b155381d11387342eb2e
- MD5 a7e30a66d312697e0a51d88a07d402ef
- SHA1 9077df729ffa8d877cdb6855b4f64d8570e9baf1
- SHA512 c768541b34eeadeb19c2cf8ec6ffec7a816e99efdddbb405be12675acc7637d197eec3c1c9dc6f62e7f7ba8d36d004d9d9b9c63e610f02c906650047e246eae4
- SSDEEP 24576:UQ9MxZKdcz9dw3eYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:UVKZeDnkyH3uJhjxj4
- TLSH T152557C2DABE9058AE177D239D5A250C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 70c6e4a9e24589a9a535b6a6561ab1e8a1939df9b8533293cf29f890e31f5bc9
- MD5 68f962537ae43f4d4ad6ae9c8cf7ec4d
- SHA1 dbd0069268b1056d5ae658e9aeb8a4c3787b9d83
- SHA512 7b1a23c7c46b93dd5fa7739396d0f0f5121d4d3ff0048349908436507c09e1a00cd36883f6ae110ed63b7dc1d3aaaeabb8e0bcaa85b62c6033b5a4118281bafb
- SSDEEP 24576:IyociApbYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:lociApbDnkyH3uJhjxj4
- TLSH T1C765E01E7B6E40A2E036813C89858745F773B0746B6253CB9691C33D8F27AE9BD34B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 6f9d72c0419a7846c3810c5c1db84afc0b1797eeebd66c7eb964e4084008ab16
- MD5 5d88d771c317fb802a09c627cf44fc9e
- SHA1 c27790371bcae510ade3b745b1ab6412be226af7
- SHA512 d625344f913de5319c2aaf453f2f3e7d2390567538938b3cfe647baf39e3d7f58d0a7a7b1a1f723f3e772090507d90a61ef868d92d3d45a5c09d10a456051dc0
- SSDEEP 49152:eWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKbDnkyH3uJhjxj4:40zuNItnTErj4
- TLSH T149A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 2fad996088f4cabf1e110fbc1022a49a48b5e13b0037b08631d4ede3b3ae4595
- MD5 bf8608a70935e4ea80abb71cd3f2b7e6
- SHA1 c4c7c0b1269c2fd6860d60acbc35a8e32683d8c5
- SHA512 1a32a3c3346dcd33450cd74d2cea33e92236b92b495cf6958efcf17b33091d4019bede0517d799dba6decf3e84b9da5130adb51427686480ce6adc4604ef98f5
- SSDEEP 24576:T1QT7EcpfxR+N5AWAz3ooiYsjMqbQYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:OTDxR+N5YzTujMZDnkyH3uJhjxj4
- TLSH T13D55B02EA7F905E9D17E86789B23C502FA727811073193CB43A0C17E1E6B9D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 26d2f639dbb4e67735ae7fbe1d56a9d5c8aeea3426fb147bd98ce45fd1ba5592
- MD5 af4404bcc152d4e7e188997a374e0296
- SHA1 b9c6b345a250b4a3534a1597b4ef2a9caf092784
- SHA512 eaa5edec266dfe9f3bb525ee5c75fe609ba1e580a313ac71b79d13a454a0493cf0ef0c81dc87a293dcda03bd6fda3943782cd87a1c93468e2a3d84834b96916d
- SSDEEP 24576:BTMdOz0FFS+mmSL0YBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:r0K+mmSL0DnkyH3uJhjxj4
- TLSH T19A75E13D63AD04E5E43BC27CDA53C906F67278660322A6DB4790C1792F6BEE43939B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.3MB
- SHA256 760e9260605b78b7776c835e9adcc0d1022af867fbc13a6389e85c832bf28c3e
- MD5 fdf1e4027f199ae5e95c72302ae09be7
- SHA1 556b1d01696d91f65fb3302775f24981af907151
- SHA512 dd568c2f30bf78c7ff914bd7d05e0681c7fc9f372e460a1c415ff079d07e3309f5805baa23f2714475f0ed36b5d7625d3a1c69ff3709a87a406fe49d7b7ae2fd
- SSDEEP 24576:OVYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:OVDnkyH3uJhjxj4
- TLSH T19955120C27ED20C1E4370638DA368205E635FC5A2B2191FF6AD5C57E8F3AAD5A934B53
- MD5 SHA1 SHA512 SSDEEP TLSH