529c7aeae9d0c57220f0883482e04cf919e1af3532318079abe19f5419b9d105

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Size 1.7MB
Sample260729-b2ws2aem2v
SHA256 529c7aeae9d0c57220f0883482e04cf919e1af3532318079abe19f5419b9d105
MD5 234b992b17b1859e43cc74f0ba62b606
SHA1 326974e4ea2351093de16e3c34591f14f67fff84
SHA512 e2a79267d818e98acfc93b7478d38248a19eb82e1b5e9dc695c66fcc2dcfdd6343b527d87450e62b990846c80ab857866cebe3f6cc0bff917c99968c276c8469
SSDEEP 24576:k4kNd8FcptWJ6iNWcASYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:u8aWMsWWDnkyH3uJhjxj4
TLSH
T1E185DF58675440E1D1B6C23889539906F672BC004B71DBDF5398E33A6F3BAE1AD3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 11 IoCs

pid	Process
4896	elevation_service.exe
2152	elevation_service.exe
2884	maintenanceservice.exe
2680	OSE.EXE
5076	PerceptionSimulationService.exe
2684	perfhost.exe
2760	ReFsDedupSvc.exe
5820	SensorDataService.exe
5956	ssh-agent.exe
3176	AgentService.exe
4868	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b8921339238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009bcb7c17fb1edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000125a5616fb1edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006fe3bd54fb1edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031eb5b54fb1edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048128314fb1edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000798cb18fb1edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006535b115fb1edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000686c1a1cfb1edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe\""	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
4896	elevation_service.exe
4896	elevation_service.exe
4896	elevation_service.exe
4896	elevation_service.exe
4896	elevation_service.exe
4896	elevation_service.exe
4896	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
832	Process not Found
832	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Token: SeAssignPrimaryTokenPrivilege	3176	AgentService.exe
Token: 33	4868	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4868	SearchIndexer.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: SeDebugPrivilege	6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	6000	2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	4896	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 2968	4868	SearchIndexer.exe	100
PID 4868 wrote to memory of 1352	4868	SearchIndexer.exe	101
PID 4868 wrote to memory of 5152	4868	SearchIndexer.exe	102
PID 4868 wrote to memory of 5124	4868	SearchIndexer.exe	103
PID 4868 wrote to memory of 3292	4868	SearchIndexer.exe	107
PID 4868 wrote to memory of 812	4868	SearchIndexer.exe	108
PID 4868 wrote to memory of 3932	4868	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_234b992b17b1859e43cc74f0ba62b606_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6000

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2152

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2884

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2680

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5076

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2684

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2760

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5820

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5956

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3176

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1352
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2820 2828 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5152
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5124
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3292
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:812
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2820 2828 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 dfa13ad7d58d85ef52dcdba36a1baa23bfa39b4d0d95a8c06267133da05dd1ec
MD5 7b2313f837e494a2e217971e7810ac35
SHA1 8f6f7301551afe15c4009ea51f8e392db3fd44d4
SHA512 7a7462c67845122a5369b90375aa3f0bd5cad3cf2c884e21d613511922a49120665bcede7776f1e78710690010df7d203e3b8d72bdba0d31755047ba0432c4f3
SSDEEP 49152:vb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnTDnkyH3uJhjxj4:t3q60jBgnTErj4
TLSH
T14AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 c4cf63a6b7c86a7543d526ba0ba80b8e1f34f9c23fad3f7dacbb00a50ed537d3
MD5 eb5451ef2da8013f04bab1436e7ae6ce
SHA1 fdc63b03aa89ce0a170df42592d42882045d9d7e
SHA512 5b2a3d98eac65da686892050a952a36c737f3738cd33ce41c96d18e6b25c5cef836842c5e135626ade70ddfa3a02ebf237139f5503de5cf8f5bc267187d2143c
SSDEEP 24576:YXYfDtczAcYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:PtchDnkyH3uJhjxj4
TLSH
T16C75F12877E509F9EC67423CC962C501EA33B8854760E3CB03A4D9655F336D96E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 05d5217b2808c0b19c2164af2b552145f727e58d9fd64b8e2c0cbeeb34fd0e80
MD5 5bb00ed94236f8ecf3d557d7a28cedf9
SHA1 310fd90a0019c8f683db4ae7c45bf277224fa641
SHA512 3d19bae3b919ca9002b4ed3646022dcb0d55e1acfbde9c1b7ff8fe50953dda0720c285b5a1b9ad8e53c14f334fedf7fbe9630bedd2de696617e55f9298cafde6
SSDEEP 24576:E0Le5ji0hmx0rMLYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:EPji0ACuDnkyH3uJhjxj4
TLSH
T14E859E15F6788731D073C0B9C5D2A68EE97230865B308ACB4286D77C7F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 460f54f9d00dfd972cfffe592b7499785dffd724cb92b0f63b0ec023188763a5
MD5 73210faf346aedc39c12a6f4fdedf6bd
SHA1 f9fb40f4db93540cd070872d83ca87ddac6b11b3
SHA512 76473315c23865ff971c49470acac95d9be67feba2cf6ba53d880aba204dd61d0eb0f98b2ac32c2ecbb362feca6f050987efcc0b380a9aa3e7256a5c4fdbcc7c
SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWr6q8wyuxYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:I/ezSC6vUzPviHjySDnkyH3uJhjxj4
TLSH
T11E756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089CB4246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3f2c9fd12340cd6182834f697b01eb24a115abbef541e4e3b99b9d09945ee5f0
MD5 b9a29c5913f5542fec9892a2b99a8c9c
SHA1 07d1aeabf5925b2ed48fb44a84e13ee7487ec12e
SHA512 d972edfba5f87de3453399241a82ac5972df76362fadf90b27a6616ab2a67d1c7805ec4030b9f82dc1d72fa65832b2dd35e6ad6ab9256d822cc79ca20fbca152
SSDEEP 24576:nVbqPb88hv/l+bIYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:nVO88hXl+kDnkyH3uJhjxj4
TLSH
T1EB559E65F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 3d8e209e664e4b7e99856659f773453aac70df64d50a280b7b9100475df87f5b
MD5 c3e86da26e3bde1b871cbcbf678fa8f2
SHA1 04d8b4dda8df7e5914824e2d5d896b4e427e5644
SHA512 ef2fc70ec76c3295538f826402f400ac15f08f6a32be133bb257862cdaf5ff1f417a3a6bfbb83a6f04e9bcfb26963052a2fd797b7935aefa8ee11ab36f7b4608
SSDEEP 24576:wdnYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:EDnkyH3uJhjxj4
TLSH
T161552348292F0583E93B0D34BA25EA06F53EFD8D6C50C083CB59F969D93C997B5B0297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 3e68a22b44e4c6b38ca7f47d6b02518c0478d01451c1f7bbd570e9875327ff0a
MD5 4df6d497ef4a368a1934573bcf8dab56
SHA1 7fdf65982da0511bc872093f5a6c9af9dbad5e14
SHA512 b1b48e3f17f653dec549bdab59d39d947a76fb40ccd0555e336648ce3cb85b133548afec1c294e4d299012624b9c948b0416bcfc3490561aad057646a500fcb4
SSDEEP 24576:zJIUAYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:zJIUADnkyH3uJhjxj4
TLSH
T14975CE3BAE28ECD2C27E4D785A51C600E77278704F62A3CBD265C20EDE275E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 30a9bf5a7a57ed1cefbc1250fef1efafb9682ba84bee7f0380312f207f634a97
MD5 49abd70beadc58b022302aa1dfa625bd
SHA1 7792c3bacb9387342702d9f29cf7103976dd8c12
SHA512 5b6c04d57fa002a013a35115f6dc5b746b0db458bffa0925435fcce4cde9af2b2c94e19339b8fc7327a7f4fa027d34a27e25ff9e008d61fad032fc28d6e1d600
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THs:IQvGAdlCEL8c/RRNw5CxnTErj4
TLSH
T136266C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 3fcb32d970110b7cfe89a5cdd2a04dd2412a6a9f1e5dce74723377b68498aef0
MD5 99dcfa280b2f74943c563dfc30c61725
SHA1 628149789c4592db6674e6e799f1f80b7f65af3c
SHA512 6ba3441a2573de1e8664602ce1eacf4af09f8a75839f565c7b90b2e319ffda732a9cbe5e47e5f28dd0a912dcd1d5d74649dfb97308cd4da4f1b75ef2a887ca72
SSDEEP 24576:DhewsAj+YBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:dlj+DnkyH3uJhjxj4
TLSH
T17275E030FE75D432C67B0DB62B36C706643DB9604F6119C3E3A88E9E99342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 470f811cdeb94bbd9f448b8df595198448923cc24ff75d89110ddf63a61e205a
MD5 a52e910753ac18e5850840b6df1f3910
SHA1 d37a0c13b6d8188701f7341fb5ce9fe9b4da3ecb
SHA512 6dd059ce5ebdf988fa89fd2753274e5754926adc4335bab6143a1c6c520a1fd9b86cdb9e8eeda145f8fa7500a156f4a4f2f1e38a40d0743b1019ac586b7295e9
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHyTErj:jUEtQevvqc2W1cpV2RI32N
TLSH
T1F8474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d8db0b8aaef53392da7e6311bffce7df270ec4d1fd4bc51bb2db66209a1e1912
MD5 6cc29932a212210fc8c2649a7c0bb8af
SHA1 0856c54129f2808794b3f0f17d0385213ae359cc
SHA512 ae25602239de22d8896d0d84e0dc2608de40051d10ed935d9ffbb7bd874a62324ec1af2a4d7c185638d28727c57bd3f6c8a75b2951b48268f131cc998695dfe4
SSDEEP 49152:vCbRquA/m2yL5zQfFiV+XenmE3/zeDnkyH3uJhjxj4:ooqtVjnmNnTErj4
TLSH
T19BD58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c33efcfc8eb74431e21c08f76d97888d0c2a033b0cdb0e897f806e53435b16b0
MD5 3c2ac358c8c4687460a19b10c14045bf
SHA1 4c60d41dcb3337cccae3e8ee04d8aaf8ef0a96a8
SHA512 921692b5728f3e6847714b7917582e6bab503ccd78e8289dd4c2a073fde0129116c445436eb9f3beb799bc087db13f7f191174e1798f4b2a3d5e20b5507d11c5
SSDEEP 24576:VAhGL2IFoiwtA5l7S53VYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:VAM1Foiq5FDnkyH3uJhjxj4
TLSH
T11235AE80EBF945D4F5B3AA7899769171EA76BCAA5E31C20F1260D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 d6f9409ca39b27d7b6b11716b483bcce5bb4bedd4bc1435f53c687bbcf59d11b
MD5 e5b841c4e62c83a7c3ebd5fd09334767
SHA1 265dada134ae0cd69c65bd0351ecabf3423645ca
SHA512 be5b12761a864c4314345ef408616aeb8fcc425792751eb5ea340d63cac98cec9e63dc6203dbf0bd17e8046a976c9b52074229ffbdcaafe34369c64ba0dff84c
SSDEEP 24576:Jwu0OWyYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:Jw/OJDnkyH3uJhjxj4
TLSH
T18F65F14936A90CF9E9774638C657C136F7B2BC062A21C71F4760C66B6F37261BD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 63fd8ab75b672a1325ad619e76967923704c53fdb9774ffa6a6731e947934795
MD5 b262ded648a9271b76ded97b91e73066
SHA1 32f945c0889be071e88f8bfc8b8bcd585c1f90ae
SHA512 07a47756cc2def5ca709fc33d9e1cd86672b1eeffe1e361b4e743de870b0e9c00f715b0e250f944e29bbec57899a5b3ba4fd593718596233ddb9b49206b41e13
SSDEEP 24576:QKZujYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:SDnkyH3uJhjxj4
TLSH
T1B855124832A911F2E477063CDDB1D605E776B8862B3183CF8725866A5F36ED26E35323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e53e017339fb389fc9f9bca9ffb177be982ce23c6a40e4e37a7ed5c515581abd
MD5 e805d508a2ed98612dc081494b07c1d7
SHA1 b58850f8cac61c3c97e25af597d59d3e10963e94
SHA512 9bc9050b1362431fd814e188832d2b601854b89f36ed83b9cfddae4a74ea11817c297c55bf16ab2ee400a3c50a4970d8158ba8da01b53a5286e3a3e96fd21ff9
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UI:JQRQyi36YOcPhLvw2gAf+PN3knTErj4
TLSH
T17E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a84cbaa52e4240fcc080075e6ad12c1a5f125dee9260b222049d5e591ae5702e
MD5 cb29b529a67b718b1caad7a385fd2190
SHA1 a53593ed63dfbefa6769a6443a9147587cbf180f
SHA512 e3afadc5f6bd902a357d2cb192ffd02c06ecafe21ad667ff23073f4205c5575d11bc0c9cce8d1475715917ff84b688d208c105b0a2dda385e77273f23cd89a3e
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UI:QQRQyi36YOcPhLvw2gAf+PN3knTErj4
TLSH
T1A5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3186d1e9b8ef4c229f18cc2de25286b0e9c6b42a8ef570b6f1f73a4a732cf194
MD5 91bf52b28ba1e0727a3d1f57cf8c7c86
SHA1 32d1c00814bdeff46e4fff644ec05f0e31d50c89
SHA512 f829efbd01ac0f052b1f5aced19dfa88f1b88fd7b1bf9336fc0cc5086130219dbb7b42b19c168c0c784840057fcaa93ca94fcfa6aeb9800faf0e4b001b0bbbd1
SSDEEP 49152:A68Qg55nhceWu7PNU3/uDnkyH3uJhjxj4:6thLRc/qnTErj4
TLSH
T183B55933B2F60099C44DE1769F4A872196D27C758FE0E3DB861172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d979293b804b0df78c32a0182538cbc73192c1262d97ca93957dcf70669964c8
MD5 68eec7af776f05fc03ab3f50252b0962
SHA1 2ff8c353280f824164d0be0532adfa65daf0d174
SHA512 60c4b526c902b7c6644fd1799634a1e08b18c3b00a196e60c24642cb21317628228427cbeae7971b8e254568f0170c9ca1b70535662660758a2efa933bd1d49f
SSDEEP 49152:P3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99a:iy5112gYy5azzVva69nLKnhZDnTErj4
TLSH
T1C4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 428055d26d1604098e33765d17349c7e44955735a3b7f907726a66f621229d37
MD5 d37e6a91f1e9aa97bd7f552147270501
SHA1 c34f7e4c40dc5543a34b8088da00653a27f19cf5
SHA512 74d8fa06945db873f87cc283fe1e65cc4c78f036f942d511d390e9e56635fb74244d788f46addcbaeeeb1cbded9274b81021e4ef4b2f126f121e856c6d19f5e0
SSDEEP 49152:nB+taZ3usBWOBr4tEG20bqx0z+n217aau1glMDnkyH3uJhjxj4:pu6JmUxd2dMnTErj4
TLSH
T19FD59D13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 88a5d7c54975c275203efcf41d5e6fd8a804ea2ce2ba8797ce177ec6cb4175c2
MD5 89121bfb8c72d3facb636833d404a523
SHA1 6f9687108b22f808329d2ccccc61daf05ae1ee6d
SHA512 1742fe7ac29a2ec6d63c12243492784f8017febe609c41e8fe544c88b3b4e3fb1ee38592f4fd8fddfbe6dd4d85cd1df7cd49386eb91d9d1b0b49fb0fba5bfe6e
SSDEEP 49152:71hpsNoJpF1A6BU44CwH7R4xgDnkyH3uJhjxj4:7mifPkRNnTErj4
TLSH
T1FCB5BE13F2D901E8D06EC17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ecfbe4e144d6985c5d7efa2c1bb582df5750e4d11fdf83a3eda5aa2be552e06e
MD5 0b412931b8869427cf3888b8f51ce685
SHA1 de714248636b934e7394b9cf0f9f6a2b04d907e2
SHA512 48bae7c0c47892de68a96f66c0688b5cbb8aad6c2c66ec4d2bfa1d05f637fbe45c21a7157e80ef0ca3b5d86c75f166f9fd266d97f215154395de016b93e1807c
SSDEEP 49152:8SuZQIY0Be2KNRVtOnks6NMHqjDnkyH3uJhjxj4:+5dKvi61XnTErj4
TLSH
T173C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 242c5855cbb63ee03a26ae59013ccfec642cee7bd57c8f3066cfb43c662e26e3
MD5 c8dc5b40f9baa868cdca3d2a67284088
SHA1 c4f3cda0a10d0dc3387a53ee84bde6b4d551428e
SHA512 8cd0a2156d7204a655cefdde4cee6121772a06090dd583bf8a8a3c7a798d324c36b78463910182145df3b7f03350222c12dfaf21420f80d576957054ce432752
SSDEEP 49152:zhtSn8EApI0figXgiDn0AP5wcDnkyH3uJhjxj4:yX2iyphJnTErj4
TLSH
T1AA95BE13F2D901E8D06ED178C7568632E962BC060B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 73a9936c4a2a9ec0865046cab0d2195077cc2e33c593ead1a926a95bb60d7b08
MD5 2097c0ce5085addd4ebcb543243b5f6e
SHA1 1064000ef6bc2109a9a46df42bc4b400c6d5a527
SHA512 213f40e9d27f6a72051ad29895abb1cf8e879aece9a34d2d24c25094d3783a5ab76516a05b61d5805b36dcf9a73b32c7ada6d2fecb576ee42bec4ed54d8f9d0e
SSDEEP 24576:afYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:wDnkyH3uJhjxj4
TLSH
T12D552348286F0683E83B0E35EA21D605F42EBD8F7D51C093CB5AE5299A3C9A73570697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e40a7865e91f79a5d87b3f86c700572a3e990035b39bcbbe40337eb7d115ff5b
MD5 7f8d8a8bd490aad7559db4b762a9ff39
SHA1 323854078e69bc6c62e8a17d61e71881a939ced6
SHA512 ffad8d9b1f6af346c039be08d6365ebb6e37e282bbe364beae9bae337ff5369041e4ff6431a8ffb30cc4c8aa9ced08c44c3494834f9ff76ee9a3bdb79d57148b
SSDEEP 24576:XaYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:KDnkyH3uJhjxj4
TLSH
T182552348287F0683E83B0939EA21D605F42EFD8F7D51C093CB5AE529DA3C9A73570697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 58b552146651a1dcd0ab410b10b2f1f055ba828bacd6f4fef20dfc18c548d583
MD5 dc301628a2e605fde31811ebf27634da
SHA1 0ecf4bb54a99ec3e8122d2f207cd7e13d5efad00
SHA512 eaeb5385e3010f295497471a13f144adb725d323d1ef600972e883ab43083a8f738762a71a2b0c1e737275e79f18426047b585de08a23f54c9a64fa4283bfa0a
SSDEEP 24576:b4YBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:UDnkyH3uJhjxj4
TLSH
T1D5552348287F0683E83B0D39EA21D605F42EBD8F7D51C093CB5AD5299A3C9A735706D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 4cc6be1391418d359a5f4f188979aa8307e77c1c0e543f160673b494e93014a0
MD5 ab699d01c8e412340f391739901b100a
SHA1 c11938692507829ef346a92e8f1b929dd86ace3c
SHA512 9c2c0adcc9824c1921795eeccdb69a8de66cec1e63298af56fc735300fbaa1ec740f12f00168c78ef2ca4f9b71dd68068ccfbdfa3f1ce1d1c3ce43c284f444f9
SSDEEP 24576:vYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Zi:vDnkyH3uJhjxj4
TLSH
T13A5523482A7F01C3D8370A38DA31D605F57AFCCABE21C1DBCB15956A4E38AD67970792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 949331bf177efcb25252dc8cfed0d60ea524f35f8833aabaccae002bf4b24373
MD5 fc881d70221ec35be2d8d58d4c3b0e0e
SHA1 928c19673cbe83c1fb2e8a734eddb9cbc86d67c2
SHA512 8743b0340c80d5b3af8703b0446258d7c172e75c27e17a3ddc815f556f2ab11ad94008b868a8ee8d9de40ddbca25a65dbbf888c3a87f54a738299f1dc6a63267
SSDEEP 24576:O9YBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:sDnkyH3uJhjxj4
TLSH
T1B5552348286F0683E83B0939EA21D605F42EBD8F7D51C093CB5AE5299A3C9A735706D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 bd1391de8d8303b07b6ad26900f9a8ca7a1ad6804dcdb384961950b3a3318696
MD5 1e243010e4d5f6485afc60f87f43b9e8
SHA1 4be47a0957093620113da2943397f67a44cfe946
SHA512 d0012bf52098e9a80eab01a9b5e417d9385c1ffcf36c4fe586df1d7637714dc4413672662acca525c983958f60f3ddff180870ae46eace6b7f28c38c8757a611
SSDEEP 24576:z2YBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:aDnkyH3uJhjxj4
TLSH
T1B2552348287F0683E83B0E39EA21D605F42EBD8F7D51C093CB5AD529DA3C9A73570697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 5abf6b71579e7addf7149dc1f64709e3291987d19dea93ed38a808d1abe00741
MD5 bf3a0733e617927f977f17f0104e6b11
SHA1 a78ac15789646826c105eee0869815fdab2b0c11
SHA512 3f2515e9e4348a520f5384efd92fa717bd68b1feb5323f37a15292c1df7ddbc2dc0061486730e7414e1e4a662a3f299333f50ef716211da5bcd52cd9f972be1a
SSDEEP 24576:yiYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:NDnkyH3uJhjxj4
TLSH
T175552348287F0683E83B0939EA20D605F52EBD8F7D51C093CB5ED529EA3C9A73570697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 ae2d0518d37abf69faee32ef47875953e355934dc818412cbb104faed2426acd
MD5 558595f4cc9fd66068749af4e93c4d6e
SHA1 fea11839753abf0cba6cd58b434b5829ec07b0bf
SHA512 54d06e86474a09490679dea75b8c12ddab0f9a36bcee4443e2cdfe84041eaa192388e6a1cd8dc9625a8c68249ccac1c949875328a7345a898624a43ca16e773a
SSDEEP 24576:+ZMpzFVSO6YBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:+ZMpzfGDnkyH3uJhjxj4
TLSH
T19375019473A108F5EC77423ECD258906E6B2BC4A1B60C25F47A8362B5F373A11D3DB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 74b01642b048d28b2c6ed4fdd3655c5fb22e6494210f8c98fd480684eb880043
MD5 af4cc93d743492694f71cb4f03844dfb
SHA1 2ac67459a20e472c681f5ede7d7bc4a41b321ddb
SHA512 16738e747fa135acdbc18307e0f8eb33a5766b93df69f139f5cbac31708cf7469da4cfbca449cac7c8e9b2b2101ac6f40f144bac41c0d1cac7694f93695bf347
SSDEEP 24576:5zYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:pDnkyH3uJhjxj4
TLSH
T1D1552348287F0683E83B0E39EA21D605F42EBD8F7D51C093CB5ED5299A3C9A73570697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b0988454a25734621c802b12d1eb8509227930e3aadabf6ed599d360f021ebcd
MD5 d152a50bab07a34f4615cd09eba70590
SHA1 c79b312e7554f207ca5dea515fea7e332d5f02b3
SHA512 b78bec1cb6e404dea73d78042ee25cd8a7db44de2446061a14bc83d841dc8ab04b65af5c80645aadff571dbd4491de600cec3ff60023d4675623e4f2f6b879e6
SSDEEP 24576:W3YBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:mDnkyH3uJhjxj4
TLSH
T179552348287F0683E83B0939EA21D605F42EFD8F7D51C093CB5ED529AA3C9A73570697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 37f5a43f29a7b3ff16007318bd20b5d417200ab273d3c44c11a52289b2da290f
MD5 fba40f82957c3ddcaeb10854365ee054
SHA1 c5840a12d13beb27f030337ff9d7d050eff0eb25
SHA512 f515623bfd100c637975ce6657bef9c5c78d74f7e92811bcfca9c51a07b1d87701ab1bb51576bbffe5fe5110a28f756266351b83b1cc91629ecf7b828d521bb9
SSDEEP 24576:2zyOYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:2pDnkyH3uJhjxj4
TLSH
T1E865120733A620F5D0374238C9615A02F776B8761B20C6EF876447766F376E16E3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ddb9b26950b627c534efc6672d92697157935048b0bcad1ea925b51b20f087a7
MD5 3aa0d0812297366a74f19d45deda2f9a
SHA1 405dea13a0e1d6ce10b7ce0c1b3dbca6c5432975
SHA512 f3406f8d9aa1a1b62600ad787c8c2c6ee850e707de2c31e4785bde1955297c4db17317e104045aead0bea987b7df371c5024455e4e45cbf2322476e7368a8ae9
SSDEEP 24576:hzYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:BDnkyH3uJhjxj4
TLSH
T1A5552348287F0683E83B0939EA21D605F42EBD8F7D51C093CB5ED529DA3C9A73570697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 6d95ba60c178ac82848dae3ab2553cc16ffe05ca8bb34d2a7e52d5bd62f85cdb
MD5 40627ac35bb89ca6f1abd17a3686cfa4
SHA1 8922dea2ead13e45be9be2774a6ca872d0fa202c
SHA512 7a4a293cab9bbc53e8ff95a45253ae3077ad171c4ccf8564d946405e189b0accf28f87444b03295ee5476376d6cc174476896a01c2055da998b2853b1b3041e6
SSDEEP 24576:rzYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:nDnkyH3uJhjxj4
TLSH
T1E7552348287F0683E83B0D39EA21D605F42EBD8F7D51C093CB5ED5299A3C9AB3570697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 af6a7ce3020f86f11d07202841b2b04adaf51c6dec976388e87187b1fde756aa
MD5 fe06e3ab14e06394c20f62987b833c2f
SHA1 896b6fa86c5a552b86050e54170338dde8bf14e9
SHA512 b9bae7545824c754b8c5c44061a2188a43cbb0455f2cd7a3072c07dff4e52d18a2ebd0dd1eeea5da9175bb1b1b8a19a28d9a9d2fd83cbb8f19ff729e9562ffa8
SSDEEP 24576:OzyOYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:OpDnkyH3uJhjxj4
TLSH
T13865120733A620F5D0374238C9625A02F776B8761B20C6EF876447766F376E16E3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 ec980d3eb7dcb7ab1f1afc7c309f3eba09ec7d9310575cfc803e1aebdfb8c309
MD5 7c8581ddf02c5fd0bf1df37416b8003e
SHA1 cfe607fa88deec2674331cb552d4c52d5f208797
SHA512 a96b5b8d01be13945516121112e86945ee0d24f1c169965f6f275c079ad745eb0d629d2e91c3059fd65383ed8ced5ca418be15377bdbeeb3acfe531396cc7bdb
SSDEEP 24576:5TGaLl3z0zDoYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:5TFLljxDnkyH3uJhjxj4
TLSH
T15E750198736108F5EC77453ECD258906E2B2BC4A0B60C25F47A8366B5F373A11D3DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 a8d1f5d2aaaa788b825d31be3ea2b8ebff9419fcfed64063960083f5805acf01
MD5 c07de81e1552d0945aedf6881ad402ac
SHA1 52032ab81b2a19b35eb8ba24fa85366828b01c16
SHA512 76ce8b2b743038e2df58b608ada7fede40b162230be1556e368ee04124f8da13be957bb4606451dda7a422a3dcd36eb8f2885c7d5e7b3ba253e76452944f3d7e
SSDEEP 24576:t3Gd9CHKy7GZUYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:NGd9CHKyaGDnkyH3uJhjxj4
TLSH
T16185CF90B3E414E5F0B78A35CD769511DA767C9A1B31CA8F03A8661A1F33BD19D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 f17ee6f28a18cab518db059c3d096634ac3542aa53a18f1e10fa9b664a38007e
MD5 e689ac3aeef9e9b91054e4acc715e959
SHA1 26879897e4548b6eac056f51f94f6acbe6b2694e
SHA512 a3ad73bc3c18fc034223f539a913f2de296ac96fe5d7e7d21342af6a214fd8be32d4834d7e2a233d5d1d21fb2a9db1f6d56e4ff9f0057ca9e2c9341186540279
SSDEEP 24576:XYYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:oDnkyH3uJhjxj4
TLSH
T1B6552348287F0683E83B0D39EA21D605F42EBD8F7D51C093CB5AE5299A3C9A735706D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 b3450946c49529cb7789f0381c6fbf76ba6fa9013bc0f7e349f3f75e2e919325
MD5 5b76797865bf1dc7f2202e49bcbc2d91
SHA1 3a9be8c98944f29602f0df43da792fe5437bb565
SHA512 7853007b3418189b0b59952b2d331a5ea508b7386eff784c464477f5da407bc566885f65f1832a70c2a8cb542251e2c0279f50e2e544cd0c41e17e99ef58ad5a
SSDEEP 24576:6uYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Za:5DnkyH3uJhjxj4
TLSH
T127552348287F0683E83B0A39EA25D705F52EBD8F7D51C093CB5AD4299A3CDA73570297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 60fc8a67b0ce8dd7f2f533952cbc68c1295c014af249a3d4942eaf81a420903c
MD5 df500ba0f2574f975672414fceb3a335
SHA1 97890e22de5a3143579f3da5e7eb3bd93dfd5824
SHA512 0e33a0f39d154e8759da27ac57e74d57d86b8e1ac2a1901e554df7f039bcb3177785d21576132979210df8e21f66aaeb71264a392353b352570df88cb34a4531
SSDEEP 24576:l5YBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:LDnkyH3uJhjxj4
TLSH
T17F552348287F0683E83B0D39EA21D605F42EBD8F7D51C093CB5AD529DA3C9AB3570697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 4d2735a2f044544a3f1935066591f9df8f1c41957a356608f4776a7d73f4edb6
MD5 6f8f9d976e388f29b5406d0f8524cc14
SHA1 467b9fa027c241bab28185791372226280e65cd0
SHA512 da29c3a9115f39bbf5a1fdb0c865c0b81b5f7a25b702a735523785d7cabdbe45052dbc809ce700a50a5140f26b5a8e9253d1b8e85964aee1a07dcda355b1085a
SSDEEP 24576:9zYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:NDnkyH3uJhjxj4
TLSH
T184552348287F0683E83B0939EA21D605F42EBD8F7D51C093CB5ED5299A3C9AB3570697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 5ed1632ec31e94270a6f8cd3f2ab627ea2d58633d125e46aad686b452c59df44
MD5 9a091de78567360294d2f2fb5720ec01
SHA1 dbd2326027bdec5ca9a320af6906f8b60856840d
SHA512 96fd2be724631740f8686c6e8ccf3030e151aeefd18ba100174e91b1e08a347ba485332a62fa74e2cd6fe014974dcaaca5bc7853e6e5c77fd8a4056c06f28200
SSDEEP 24576:fYYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:QDnkyH3uJhjxj4
TLSH
T1BB552348287F0683E83B0D39EA21D605F42EBD8F7D51C093CB5AE5299A3C9A735706D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 140011b4853da1c1491ee9e9e4734c6872de501ad7cf2a66ff3a76016f31be50
MD5 ee9a4723136d52e7ec1b5d57277cae2d
SHA1 14c7f95d0abc9180d4024027f7d82778c90d6162
SHA512 dcde23c59818e1c3723fdad14e6390f46d2abd5adc26be6df05b7704588c6b8b217b23d61fb544cce7edb650afe44d5b49c5dfbacaffd820b8c336fc28e63ba1
SSDEEP 24576:Q7YBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:kDnkyH3uJhjxj4
TLSH
T13E552348287B0683D83B0E39EA21D605F42EFD8F7D51C093CB5AD529DA3C9AB3560697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 28629770921ab5bd829073c6672d62bf0901f0eb5c4778de2fcefade05781541
MD5 b50d73a2fe2fd45eead59b2e5240edda
SHA1 8b44ff7ef7e0d65e432f873b9b4640329ee4ce44
SHA512 2a99f8dd11678e16289454fa35f6e6365bf23e0a7b8ae2337cac87571eed8e1bce1f0aa4a651dea55bfd197a7fcd1a59f0afc16f451904efa53f6bc25eb0e034
SSDEEP 24576:j9YBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:pDnkyH3uJhjxj4
TLSH
T1EB552348287F0683E83B0D39EA21D605F42EBD8F7D51C093CB5AD5299A3C9A735706D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 d0d1661bd8f95e34d3719a4986baa92ece2c6de4d9b4a498b38e1ac86d251bdc
MD5 fc0e2109eeb5ecc0ba09b1a89ce1431c
SHA1 1a5916e5a47c89533394800831819e453a9063d1
SHA512 3d5d32b6685be18ebeb9c1a2065ab42fda9f1a4bcdf64548495751ee536a769348fe9ca9d0be25c2e70c5137b9754fda39e8ec0d807e6ed3a179d84013ff88e5
SSDEEP 24576:Ufwv/k9RX6wkyAIHYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:DMnYIHDnkyH3uJhjxj4
TLSH
T19585D029EBDC44E1E077923C99B7860AF6B178591B31C2CF029A536D0E37ED46E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 04d6d3b15a331cfd2a4515d87ca1de058760136ab1a01226bf5234ce5e1f69dc
MD5 f3cc283bb5e26535bcd6a8efc4882119
SHA1 ff2ba75db612aa29671ef303d63cc06266e83991
SHA512 f7c745f19dc211084da30e3e6f0279093c9decae49a0710185a047770ab7dd2d37a1384f4ab1138dfd456a8c61e5a5a1a41b8a827e7a65ccbd11c22f7b464ed7
SSDEEP 49152:KYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK08DnkyH3uJhjxU:2ySzPEnTErj4
TLSH
T15D066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7386545b994052914dafb7103d26bc31906849c779604058eaf893e0855f324c
MD5 35dd7045521d164e264154e16562c264
SHA1 ca6d5b46434586f6c110ae39996e0cf4756a6425
SHA512 87d458c40091a2a57e3dc6b4d5cdb51b24201f6845e1fd691500014356da91fefc4b00f7c085ee1d2d396f93c997b6acaafd836cf4255cc1b8a312ed8b27817b
SSDEEP 24576:s47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYKYBAfPZ7l12XCHhtGJlouNBjjd7gVr:s47JUQj4irIhCnDHUPfF/MDnkyH3uJhC
TLSH
T1C665AE1DA3EC01E5E1BA927885158A1AEA71782E1F31CACF1270837D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 069bab1a00cd0c31ed7a232f0e706a6178df3ec561dfe115acea44b2d6214a58
MD5 5b269bd33832600a5fb639fac30cd2bc
SHA1 0182ca1f2c05ef89838c82de366b897f36914a2c
SHA512 ca85a53b9f9900da4bc538293336bb67f49b2050a24354edc8a5e63755b2a8bbe9410be3b811f00d945f318d135a4e02cd1970ba1b6d2b10d986e036817a20ea
SSDEEP 24576:QjYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:UDnkyH3uJhjxj4
TLSH
T1B165F008E2A902D5C02E1639CB169A01F3377C5A97E1D2CB97D0F53E1F3AA916DE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 056e5ce84e771e7933166d3cdc162fea7c53c947486924ee9bf804f21063e09b
MD5 99c26b57c8503c62dd6f23f23345ef43
SHA1 c7e2e81991511184a3231e71a89ee61a1b100f96
SHA512 46c5736dd9f7b3de3d5d4136dd761dd8621a52fcafc849bfeb7c65305d8142a00b68872476ce0bba788eb38c1608e137f416e1bcda3a77e524952895b926deb1
SSDEEP 24576:VrYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:VrDnkyH3uJhjxj4
TLSH
T11B552304266F4943E83B0E34AA29D615B52EFD8E6F00C0D3DB09E569A93CDD76DB074B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 406fdc22b315a1022847a408d0158257ea13df129c232914a02b45dce0975f99
MD5 5859a2b553acfc06655e698eeefb2d10
SHA1 0e15046762afa4a8e42f181cb4c3481484683f62
SHA512 7ffebcc462c469abae390e3b40e3c06a52c2e65afe20a258f26e93425d6377df798305f382a6a63e6593348566dedc1ca807d0bf3dc0ad068795eecbb4a2715a
SSDEEP 24576:Pgb6bmBIi49WNNFpg1rSvFv7bYxYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:Pgb4mBIBhGFKDnkyH3uJhjxj4
TLSH
T126659E1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 d85d58ae1c2f3794c5a8873f51f091962651fb7034ca93cf30573933546f97cc
MD5 835f16304bd1cec6ca762c739a19a970
SHA1 213c1000b12cc7c61c07e138de436423d8045466
SHA512 b49858b8342909af9548c506289668c16032d282072349533c77d5aeeb86bc5d782b9471a1eb2f86cd496eaa8c67d83ca9e1289401771bd859f421127ae7a323
SSDEEP 24576:hG88u8FpJqH1Bzria7/m6YBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:k7ZFPqVIa7/ZDnkyH3uJhjxj4
TLSH
T1F185016476E101F1D47BD138CA428663F6B2B8151360EBDF4BAC8B551F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 10e30c5e7975ec393c8cb514110233094b83e27458573b41999853bc33e389ea
MD5 58e77477684447ee68169c48591d204d
SHA1 cbc7e303377964a6816040417d5983264bcc756a
SHA512 74ca776eee0827b23d5ac7cbe87995ba924bf7beab1bbbb1142ae5e34adddf022245192d228df917300f57ba52893a3b37998e9b69c68f887c29ed8ff36ad313
SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj2DnkyH3uJhjxj4:tG05lO43b7nTErj4
TLSH
T192D5CF6E62EC11F5D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0e91726464f6cc61b97dcf5062ab6121c10ab9e221463d9a2f7d7a81e5ac17b2
MD5 9aacd60a4c5d6fcd062d79fe4972a979
SHA1 9ab2560a815d06527052e9f6a5bda1ee17dcce5c
SHA512 1a1458d120e3b293fbf6ed5872ccdeecfe9c11afc40c9a1bba0f4c2967fd659d53ebca9553b65fa7eaa9fcefa21a675563bb333aaa3139a73793a05993a01f05
SSDEEP 24576:Tfa5POZ3dpqWVM50JicR2hG0lasx2+47eidn8YBAfPZ7l12XCHhtGJlouNBjjd76:ra5POZ39Jt2pasx2+muDnkyH3uJhjxj4
TLSH
T1E465BF5DA6FC01D5D57AD17DC583860AF5B1342653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4a09b2f4123a04931b1c9c326a428632319934a216359abd2df5537b8b218194
MD5 31dc61d55273feeea09dd759cc9737b4
SHA1 61c94cbca0d28ba1757023cf8ff9dd5448f80768
SHA512 c20c0ac9de3a1c43e37874e7943c1388447ee3039f101312a6da5efb07c927aa6d81ef77eb901f9a882d752fb02b8f9f8a3c400c89b85a0d850937a32ef4731e
SSDEEP 24576:iNcwHdjbyQ4nLC18lb/EOjowL7FkSYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:iNc/zEOVHF5DnkyH3uJhjxj4
TLSH
T1FF857B1622E901E4F5BBE1BE89779546FA717869173086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d603bb8a5672c83813caf47e9547a294f73a01f2de3814e0d7f9ee612910fd4b
MD5 5021be6307e7548c4f28bfa87f1f2613
SHA1 06ffd81b51af393817e368a00f64b4879d019db1
SHA512 63efd7a94525517de098000c22ea3af8de749a3bfa4fb83b1934183ec06cbc90481822ca858b5495dcc70bdbc8d417477144237decbb0079e2ae3a541eadc795
SSDEEP 24576:ZtkNvNnaFeYhJNtmZBmQYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:ZtMwBtOmQDnkyH3uJhjxj4
TLSH
T16F55AF6EBAB806E4D1BEC674CE238512FA727451173292CB9390C13E4E279D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 faceeb5af790f418d7a39bfb48a2690c87a3d11790fb83c6345539e412d2d366
MD5 093e6f5611c361de883a67c447c8bbe9
SHA1 8e79b9477f03bec383fa2dc13908e83da6f8f17d
SHA512 efdc5f7a41aca0842274c03820389dcb02443b3d8b3dc743553396babd3d892fd16af7b4d3cc470bc85d73017a9e0db7f42907247da14b9d8fc734a269137243
SSDEEP 24576:VPUr+NQGYBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:VJQGDnkyH3uJhjxj4
TLSH
T14565F11E22AD18E5E67BA13D89428709F772B8561711D2CF03E1817E4F27EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 e355fafeb9db3d15dd62385282991174905b392810e0b5148d7ed2292bd47c51
MD5 3fdc92d7d14a38933e52b6ed23e2d413
SHA1 d73434d9970b407cacb0f4aa6606f1225ab14fd4
SHA512 e7c812658df4f9cc3f4bf48e994a2e6bb3dcb07a1df541d4ff20baf84a8bdd004b75457bfca0f9d9c3362829d09949d338a85d3b7bbf5e28acc3464d4fce54fa
SSDEEP 24576:SD3FHshBIYQgA/YBAfPZ7l12XCHhtGJlouNBjjd7gVIe9Z:SDVHeBIAA/DnkyH3uJhjxj4
TLSH
T1C375E13DEA6D04E5E47BC17CDA638A06E67138AD032255CB0694C1BA5F2BEE43D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2152-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2152-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2152-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2152-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2152-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2680-281-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/2680-55-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/2680-62-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2680-56-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2684-311-0x0000000000400000-0x0000000000545000-memory.dmp

Download

memory/2684-79-0x0000000000400000-0x0000000000545000-memory.dmp

Download

memory/2684-85-0x0000000000860000-0x00000000008C7000-memory.dmp

Download

memory/2684-80-0x0000000000860000-0x00000000008C7000-memory.dmp

Download

memory/2760-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2760-321-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2760-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2760-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2760-96-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2760-90-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2884-53-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/2884-39-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/2884-48-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2884-40-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2884-51-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/3176-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3176-136-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3176-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3176-134-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3176-128-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4868-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4868-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4868-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4868-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4896-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4896-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4896-15-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4896-23-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5076-74-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5076-66-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5076-296-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5076-68-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5820-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5820-103-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5820-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5820-109-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5820-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5820-315-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5956-314-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/5956-115-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5956-122-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5956-121-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/6000-78-0x0000000140000000-0x00000001401B9000-memory.dmp

Download

memory/6000-0-0x0000000140000000-0x00000001401B9000-memory.dmp

Download

memory/6000-8-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/6000-7-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/6000-1-0x0000000002140000-0x00000000021A0000-memory.dmp

Download