d969f3a87d06ff639dff64cddd01be70394ed5cae4b6bab5a961ca8e2c40f4f9

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 17:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Size 1.9MB
Sample260731-wccdbaeb95
SHA256 d969f3a87d06ff639dff64cddd01be70394ed5cae4b6bab5a961ca8e2c40f4f9
MD5 7dcf440ee0f77716b56a95e0a83d0654
SHA1 3db82aefa055eb805d3bb10c91579a8402dfeddc
SHA512 0b560dc249c0b9b8df0b675d5b40f7ad015d233c7d0f08c9d6e1ab5261e44727d3dcf17395b4f59f44e3afcfa3c9d084a1ab7b87d0ba8a0e7e7cd939b06bf1b3
SSDEEP 24576:KiBE/WqwXeAVmYot08qa959YZHy79PdNmjZFJtq/:y+5Xe6XoHqahgy79DmjPJtq
TLSH
T17595DF58A74840E0D1B6C27888539942F6717C014BB1DBDF43A8E76E6F77AE09D3BB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 11 IoCs

pid	Process
3732	elevation_service.exe
2640	elevation_service.exe
1812	maintenanceservice.exe
6528	OSE.EXE
2916	PerceptionSimulationService.exe
6596	perfhost.exe
6900	ReFsDedupSvc.exe
4804	SensorDataService.exe
4720	ssh-agent.exe
1336	AgentService.exe
1152	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2d7403e1957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b8413b891421dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ae867c91421dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe\""	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3732	elevation_service.exe
3732	elevation_service.exe
3732	elevation_service.exe
3732	elevation_service.exe
3732	elevation_service.exe
3732	elevation_service.exe
3732	elevation_service.exe
2640	elevation_service.exe
2640	elevation_service.exe
2640	elevation_service.exe
2640	elevation_service.exe
2640	elevation_service.exe
2640	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5024	2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
Token: SeTakeOwnershipPrivilege	3732	elevation_service.exe
Token: SeBackupPrivilege	6900	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6900	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6900	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6900	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6900	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6900	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6900	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6900	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6900	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6900	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1336	AgentService.exe
Token: 33	1152	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1152	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1152	SearchIndexer.exe
Token: SeDebugPrivilege	3732	elevation_service.exe
Token: SeDebugPrivilege	2640	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 5532	1152	SearchIndexer.exe	101
PID 1152 wrote to memory of 4560	1152	SearchIndexer.exe	102
PID 1152 wrote to memory of 5668	1152	SearchIndexer.exe	103
PID 1152 wrote to memory of 6836	1152	SearchIndexer.exe	104
PID 1152 wrote to memory of 4168	1152	SearchIndexer.exe	106
PID 1152 wrote to memory of 2572	1152	SearchIndexer.exe	107
PID 1152 wrote to memory of 2612	1152	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_7dcf440ee0f77716b56a95e0a83d0654_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5024

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2640

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1812

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6528

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2916

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6596

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6900

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4804

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4720

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1336

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5532
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4560
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5668
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6836
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4168
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 09542eb4bfc28f0e44e08b56ee14ca2b33f5084aa2182fa4766c64dc00a6b85e
MD5 2f68997bf9f0ec091fa81517d243c2cc
SHA1 ed513123191d24d43888ff7462daed84c904256c
SHA512 42daa74c372b1467abb040d3dd501ab89368b46309f856470a5e636f0dce36f33df5b30e3282f9d0cb67f001ce0ed49b9c0ca17863c301fb5d3811774344afee
SSDEEP 49152:Lb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnkHqahgy79DmjPJtq:Z3q6mjB7pHD+PJ0
TLSH
T1BED59D03F29900E8E06AD178D7469133E9A2BC890B35B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 4fcb6d684453f12a3d5b335f5ddc3825fbd828eff84ad9fb7b1acba32b6b2670
MD5 134ad6e91165bd619d8ccf15c3b9c020
SHA1 27f2a228e28d4a5bd38e34698707f3f2264b8a2f
SHA512 31952df08a84d40909d3541d41f509369b4d4a9d1c4d23e8554a9cbf00e2a055277e983a6f6e85420a2e276c3215c4d2cd2be0c6b55a7c0a6416ede923e3be0e
SSDEEP 24576:sXYfDtczA/t08qa959YZHy79PdNmjZFJtqt:LtcWHqahgy79DmjPJtq
TLSH
T1A785F129739508F8ED678178C8A28511EA737C440761EB9B03F4DA6A5F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 52fabe5072ecccd26bf4a67ec26002f707353b5a59f5dbdeebd0ae99befc3bee
MD5 7f33d789a67ecb8aea32f763154f4774
SHA1 673bc826e74c2e39acdbf602ee28b5e1d3b4051c
SHA512 556120289943c8feaa01531028fe2e9dff06abadeaa1ca3898467432fd3f7b20c7c822ff9c511dcbccd8009c49d254d2aa9991d5a6725e980677b5d5badfa737
SSDEEP 24576:x0Le5ji0hmxPrMst08qa959YZHy79PdNmjZFJtqa:xPji0A11Hqahgy79DmjPJtq
TLSH
T1DE959E16F6748331D073C0B9C5D2A69AE97230851B308ACB4296D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c129dfa6e3e206283c4776ba295bf2d258d40e7e08e074f9990d576ba5808991
MD5 50f0e2fff04532b964944c28f2430aa8
SHA1 826ab3e45e0cc361453c75f4675c5dda035222ff
SHA512 1a2d2928897104899b4d0a481a7b624a463a27ae583928d57d2985d0b406e43f5c8313e8c1c98453af265bf461d9946643a379a20599ace0cdafcab41bd43ebd
SSDEEP 24576:Da7/ezSC6vUyD/aqgrvWj6q8wyumt08qa959YZHy79PdNmjZFJtqF:u/ezSC6vUzPv+Hjy5Hqahgy79DmjPJtq
TLSH
T155755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 08d80fc024d44567473532d95a3077a18baeccf69d44626479ae1d325c41a911
MD5 2713961c8d96a555bf4a57c7e3596eff
SHA1 74ad2b0706b93404d127a004ef14f06ee4a75228
SHA512 a688e1cc9d4915e34b8bd0b4750b088041b6643d4e0206ebfddae42408e105ec9110e0a9ad06e834863ab7f58d71fb6652c841fb113334c69d83b766d6f0fa3a
SSDEEP 24576:uVbqPb88hv/l+BLt08qa959YZHy79PdNmjZFJtqm:uVO88hXl+VHqahgy79DmjPJtq
TLSH
T11B559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C2F677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 f8c22a7435469fc50f03b6419e713b3ff02b46d10d48ae87310777cd281f4a59
MD5 fd0d4459ee9231d09af6b82ac44487db
SHA1 1d79d3b7891a08b2950cd71a2f34be8e5f858281
SHA512 04ff578bb71ea5b306d7d01eebc92e08aba427491e3844fc1eddc6065926bb722184f306266c185f5ba804a2d551453c639cb09fab8fe638555e79d178a19150
SSDEEP 12288:HloRf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rO1f:Hlot08qa959YZHy79PdNmjZFJtq1
TLSH
T182652356630E74A0EBBF09B011EA78A1F4924D082A932D22C674FBCFD3B6651D857377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 0fb8925ccfccaa50e1b3d42f94765c717fa58fd37907826134dafe079d1551c3
MD5 bd97832118d9c725cb4af0fb0cf39970
SHA1 92154985ec54801c15cf36256f3258839a46134a
SHA512 225d0a6ca1eba7e2ba9617ce7ee19fc82826473178623d64dd4c4e7b8d866a66939e25b42c756de6e605708764e34897f440a9bcbeda0f319bdd7fbd05ed623a
SSDEEP 12288:EeBNUbTVO86UzRf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rK:EJIUzt08qa959YZHy79PdNmjZFJtqH
TLSH
T16985CF3BAE28FCE1C27E4DB856918640E76278304F62A7CBD174C24EDE235E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 266e197126b5a3ff2ac398c3f113df3370fde1d1e97d5b5ba7bde50f78fb50c4
MD5 7a65788ac29fa240e21e0d87f38db8f2
SHA1 f8d94759feb291092bd7b75bb0680391f26457b3
SHA512 102f1346f3809180a7bf29dde92fd50c0115017342b779fdab3822fa6d7db28fef7041c9cbb419a9630105122dff9dca237b8b2ed72de7f58bc9a924388a166a
SSDEEP 49152:uQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THZ:uQvGAdlCEL8c/WRNw5C2pHD+PJ0
TLSH
T100266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 4058c6c3f62779346abe2240e2fd605e9eaa995eb47ba56bc4f5072d6a6660b4
MD5 db8e786ee8de4c5aa6007611444192df
SHA1 020ce417feeb8f0d641dafdbf1764e44417f587f
SHA512 9d756e33ecc5c7606e16973abf5ac1378d26ae5f140dfda266cbc8d5ac87ff082edb9c831a6f66fea1e931875c9dacfa8370ea22fc80d261a386d9c6f5115e18
SSDEEP 24576:p9ewsAjFt08qa959YZHy79PdNmjZFJtq/:3ljFHqahgy79DmjPJtq
TLSH
T1E385E031FA75E032C77F0DB21B36D716646D69200F5219C3E3B89E8E5A702D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8d3e1040f2b5706e26403ffe1c841aad451e08fcbcb92d951221cff958522c41
MD5 10c1af1b0f2b13ec20588a0894f33e9f
SHA1 4b2c45566654eb52ad464e225a636c0aea469eea
SHA512 7a997da31ce5c4c9cceff4a472f19124a51464cea5ddf2de67dabc5fc3c2f7e8b35e3479fe2b2dbbb32bb4ed78ae21181c50633d147b4a4c8db143ed6d63cf77
SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHDsJ0:cUEtQevvqc2W1cpV20I32D
TLSH
T187474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7984992a10eaf2f183978e71930f5190882e0b8988328a21d9968ece6d7bba38
MD5 f71c4d0b56de18e5727c51f64ba65813
SHA1 f3e75827f2092f2988cbfaf4a0653ae4a723ac04
SHA512 43b2ec40bd8afce7b470bde50b63a0908f776fc22fbbfd2aa3e8f1107ff620f8ef7b224fcf3c8ceeaa43286b402c0545d7a3c03402117f4c1011768cb8878021
SSDEEP 49152:4CbRquA/m2yL5zQfFiV+XenmE3/zlHqahgy79DmjPJtq:xoqtVjnmqpHD+PJ0
TLSH
T148D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d0530f7b88d494bc2608d1f7b8dd42a0e11d4ef0b97edb993fe5799c4051820d
MD5 75caefd9696b7996e874e8ce1932eba1
SHA1 a28c1d836c68f155eb004d8f8fea282c386b44c8
SHA512 691ebd45d9a9908b5e6d5144531550857005228cd3273dfaacc29c0f570c711bab9046723152dad43066d78137ebaba6e1b6247977c43d906c849d6182bc9109
SSDEEP 24576:9AhGL6IFoiwtA5l7S53Kt08qa959YZHy79PdNmjZFJtq6:9AM5Foiq56Hqahgy79DmjPJtq
TLSH
T13935AD81E7F955D4F5B3AAB899B69171EA76BCA95E31C20F1160D20F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 fa7db32e675f6f2cf499003598d1b704483ab97fbb468aafb07c9ec954d8604f
MD5 d793b1e4316a57bb03f1dade56ed7c7a
SHA1 aa5c96915f11bf3ed75779c9ea9ba5a050972ceb
SHA512 739869cb9cb85b5a70c4a29de5bb0e2693ed0b5ba0a82e6c7ef7408f970a82503faf8fdc0fb0520ab85870156814053891899266ba53e5c2e3993a161abac3f9
SSDEEP 24576:nwumOWZt08qa959YZHy79PdNmjZFJtqL:nwtOOHqahgy79DmjPJtq
TLSH
T1FA75F14673A91CF8E96746388597D132F7F2BC052A22DB1F4760C65B5F33361AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 013b937e9171725dc62ebd7270ebd53b0c2e7b07908093f779705fa72aa8f57c
MD5 04b8add544dad47c0f3ddf9b9f830225
SHA1 4eecb5dc34d8dbc7471d5d8a11f5a334b88cf99e
SHA512 24e2efae3ca2af57cbbfc9e2ed82b724965ebc3d1dca76c721a4a665c39542aed84cab06382cc020d1e85186209d454a922c80baa5f7d6840e3492d6e99f1ae0
SSDEEP 12288:ffZ1IyVRf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rOMf:3Zu0t08qa959YZHy79PdNmjZFJtqM
TLSH
T1B465129A339830F4E2A7067889E56941E7B27C05277307CF4674969B9F73AC19D3A332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a66a762e924fdd545e907e3c36cb7bb74dd703d7f21229c2bdba6d06f2c53175
MD5 239751dbcde25b33a2ac5ce1181a96ab
SHA1 bd4c97d4f80d120384efc4d3bbb89aefee3581fb
SHA512 d9c682672387e95efad8a823f3ddf9c2a446c8bc38b78d28276e57641494570611e55972f9708257aca6a08317e51a7858df9747fa45d97a55c3923d69c26931
SSDEEP 98304:XQRQyi36YOcPDLvw2gAf+PN3HpHD+PJ0:GQyiKanX+PNpsJ0
TLSH
T1AA667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4c750cdb351deaf1644211148a0be5a1f56917cefd739736d8af37c22c14ba93
MD5 e3adfe00ffa516fffc1d0535811449b5
SHA1 a195e3a45f001626c5242c6f641877c1b539ea58
SHA512 22f9a6c59f5a30ac017679bb7a861dbb4aaa9a29afc86bb5fe5eed8de9db6088af6a3600bab59daeeefd50c0d1ac2e748b987ebd8184c82ad3e0856543d08996
SSDEEP 98304:VQRQyi36YOcPDLvw2gAf+PN3HpHD+PJ0:sQyiKanX+PNpsJ0
TLSH
T150667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e1926f362d00497209c61dce3fc7cac49d5b563ea02d6dc36f67a5bc5cf0aee5
MD5 8ea6b912afadcc69d957c2a617e99bcb
SHA1 75bad37998ff1030bcd1ecf7e35d713460eb7a9c
SHA512 59150089e73f51ec18217417acd41e02ade9240831e217c3fd5b656f8a5d8c0e52f6c3971c75e0069e79993a12243ab4b79844a174299783dcf91ab46fac2f19
SSDEEP 49152:w68Qg55nhkeWu7PNU3/1Hqahgy79DmjPJtq:qthTRc/1pHD+PJ0
TLSH
T1A5B55A33B2F600A9C44DD1769F4A873196D27C758FE1E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a735327611312d42bdcf53046d298323e52c5f3f6464e25d8b01ed775e20e814
MD5 7268c88fc0d78db1e2a6333ecbce2abd
SHA1 2a779605eb9652edac685b2658f5ca3fca6e3486
SHA512 5efe3fd92ba814849ea0d737d4889c8d7fb37b1c04316ed422d12dc1b6e100b536d077ff181121bd185de0b90cbf0d4692e2176365b9660460dd7d70519dc6f0
SSDEEP 98304:Uy5112gYy5azzVvU69nLKnhZopHD+PJ0:VLIHRWhisJ0
TLSH
T12A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b77670d7e8e9849f7f525d1f33d4dad41784babe6cb5d2516d4637df870fc1e1
MD5 c73d2423c10733abd4f9070c0396df99
SHA1 fd87de634fa2b1e93eb6aa94c04e946105fbe90f
SHA512 867515415bd414011cb0a9278166fb5c48fea97a3a82e73683a1dfe6acebdae9b1f4ec876bc66064f8dee56ed18cc2f5da79b25ea4b9ac1963059751a89cbc0e
SSDEEP 49152:OB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gleHqahgy79DmjPJtq:cu6JmIxd2depHD+PJ0
TLSH
T1A1D59D13F1DA01E8D06ED478974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 124473ddad3476ea8d119bd9408989d1e2d5c880daa0e2e9c666f3fbd7e05cd8
MD5 1d023e9f986631e0e0957884555f70c9
SHA1 3b3667b2553b964074b8dea95cf8875e0f3d4f85
SHA512 7314eafe73bfa50bd4fcc410d43a229b87db819886d6db84e86e1203a9189060960be4914ce889144598e6023e11a34f17c082d7203e5d1938eb8304859a1905
SSDEEP 49152:S1hpsNoJpF1A67U44CwH7R4xTHqahgy79DmjPJtq:SmifPqRqpHD+PJ0
TLSH
T103B5BE13F29900E8D06ED17887569232EA62BC450B31B6DF0A90B7961F7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b5323ed347a13e8e7f809c6bb2b408c630736c9190c9f9e02cb69ae17e6ffba8
MD5 30d569aea307a5e6dfe7c558ce96eab6
SHA1 7db4b0663994408dea73527c9ca7d57a4a628f87
SHA512 6e18beec81912332fd60cfe7b347aca88b6de3a6464f9507132d88af09c81a3471cf289396448ff537a93dd693dc7dc4ab3e36b091e82410b1d454179c0d4e7f
SSDEEP 49152:/SuZQIY0Be2KkRVtOnks6NMHq0Hqahgy79DmjPJtq:F5dKqi610pHD+PJ0
TLSH
T1A3C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 09d5b993846ae1a4c21cb88a2f66b0ba623328ced8ea2ddefd90f9cee3ce1808
MD5 1d7ea36b331e329e58b2453f2c4aef10
SHA1 5fb240c5f377b0412c041d82c1cf5b6e65b7c386
SHA512 d46df7a4da46e1ce78f0b7e66b0ec89e9f4c2b4445fb8eb6da3242432fa32d5cf3f9c08b1dfb41fb28ed2a51befbe9e08e6feac38f2de97acf6e217c13bf4d37
SSDEEP 49152:KhtSn8EApI0figjgiDn0AP5w/Hqahgy79DmjPJtq:rX2iWphupHD+PJ0
TLSH
T18D95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 02d7af7e928b31563872c26a3874c94ba1c4fd7cc45c208e17a71d5bdb317767
MD5 77406464a3968e78b5909e0393720c67
SHA1 3a96c9b97644b48c7e02448e82f85b8c9b12ec3e
SHA512 6d91df9c3fb05d332bd18dd7a27ba762a76f7c4a0f4a5fe706d2b9a88e30a9d847c95daad20cd866df8a088a6bc7a836803bbdf71dbc975a70b1d17c86690903
SSDEEP 12288:3wRf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rOwf:3wt08qa959YZHy79PdNmjZFJtqw
TLSH
T1C5652357720F74A0E66B0AF041EA7491F8924D0C3A931D62C778F68FD3F6691A8077B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 becdd3838164c1c2b64b7f02bde16d7985000845b0968e7c96e70bb16ac13b66
MD5 de958b05dbc441e89f33175a4bd6ab19
SHA1 2a7d67cbc3a840a25d6147bdd8b05498e5422d6e
SHA512 02c770177822877e31666652823f94986fe89e6db03184c11799bfd10cc2c10eb9462662ae7d37353d63d0890e86fcb8eeee8ad4139f1f687d0d5aa40844949b
SSDEEP 12288:DxRf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rOwf:Dxt08qa959YZHy79PdNmjZFJtqw
TLSH
T1A4652357720F74A0E66B09F001E674A1F8924D0C3A931D62C778F68FD3F6691A8477B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 fcd0ede2403b2b3076d3a198b0fcce99227cae3ba2cec923e1297226e4f4e663
MD5 c07564b6d412f7527c0dbb0edb43209b
SHA1 b5891d09336779901df6b37f6cba9ed777655720
SHA512 9b63334e810f7d89a91ae3b5dcd0090b10be92d49061df4d71e17356fb66d27a95bf20418c5af24e5b4c996ff816be056f6b118ccb2771ed9f37abe5c0e3ba29
SSDEEP 12288:17Rf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rO4f:17t08qa959YZHy79PdNmjZFJtq4
TLSH
T1A0652357720F74A0E66B0AF001E674A1F8924D0C3A931D62C778F68FD3F6691A8477B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 2a3f6560a90abe5f8d4c084c96c3f1957d77b10c5bddb18e0eedd0673cecffba
MD5 340665302aa1b5d3ffa25373e11b27c9
SHA1 234c7749ea66f2e76b6b54b4ce3a6a5800bbb78e
SHA512 d45c73459f30676c3ab1e5b4bbdc23865ad52b4ab321903378df30f47da209c962b820f24cc545ca68560e36d60a10ccb75cb732ff7bde0cfadd4a829d50e596
SSDEEP 12288:BVqRf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rOHf:2t08qa959YZHy79PdNmjZFJtqH
TLSH
T15E652357331E30E0D97B46B085A66451F5F27C483B731E5BC724A68F8BB2790A827B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 87a8044a7bcef302d96c71c9d447cb64fadfd18b1a62b5d1e4718490dc1b5c32
MD5 99baa3190aa69cccfd3cc9dac52685cf
SHA1 430cb7dede115070958e20169fba0117f5fb6fb1
SHA512 34edc1d179589566c3e0efdb37c9749dc0a3e431331f807e8d7502ed6493dfd1e243d6a93712fd8434bea901860e12ebc32a8124515ab2ff206b618dd14661cf
SSDEEP 12288:JCRf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rO5f:JCt08qa959YZHy79PdNmjZFJtq5
TLSH
T149652357720F74A0E66B09F001E674A1F8924D0C3A932D62C67CF68FD3F6691A8477B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 7836bb4a93e81f4e2087fca028636c141db884b17785c05e22b0250fe44b20c8
MD5 e2b3a7ece7860d5e69762a931efacc69
SHA1 2a480157f15548857ef1980fae5235c3624e3d20
SHA512 e23b77fe4be723cd7accf4bfdecb8b911e1965ba32806b01d65de180b359792f8eeb776796a7387bf1a3d98ee41dfcf67965401e836f435d0617046338ce48f4
SSDEEP 12288:wNRf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rO0f:wNt08qa959YZHy79PdNmjZFJtq0
TLSH
T19C652357720F74A0E66B0AF001E674A1F4924D0C3A932D62C778F68FD3F6691A8477B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 2322ba3ba6b094027e0689fd33644e4429b21e9b2278c2e1dc98870ced23344d
MD5 a4ebdd1e437c20e0fa16fca0083f5694
SHA1 97af465ce9764aa0e8295a85138c87433d01fdfa
SHA512 03a2c757948f5f0dc456292b723fd30bb39b1db5342e32519a0038630bcae7d8dc1c2f05fe10777f3790690eb32da5bcc80a95e30d49b1af2472bae55b7af463
SSDEEP 12288:QJRf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rOMf:QJt08qa959YZHy79PdNmjZFJtqM
TLSH
T19E652357720F74A0E66B0AF002DA74A1F4924D0C3A931D62C778F68FD3F6651A8077B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 4c2c28ca94dfb1df5b270e9f2c737a2074f3712e8d12b2308fa1b6a310eaa8ef
MD5 06a595b0aecab907f717143a2ecde82c
SHA1 04f6e5f86d4438b7b2e33917400e42002234c00b
SHA512 9fcac16c1a762aa660557a2245286c85c839187c8fc89dc1f542a74b356b825dbbc12d0078d49629fc091738837e7de480e307a6103a96569c6c68789ab658b0
SSDEEP 24576:bZMNzFVSORt08qa959YZHy79PdNmjZFJtqK:bZMNzfdHqahgy79DmjPJtq
TLSH
T197850295B35428F4EC67813EC9659902E6B27C191B70CA1F03B8365B5F733A11C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 0a15cd114252d56cd129776b77b329b7e4ae78afa396d201c3ece6e3fc052682
MD5 a0dccee78b6eab7553593b7d1eb6b867
SHA1 a8f1d6cca7bc5219c9f25914293b4e08b147692c
SHA512 8109a68250b3796011a4a32986a646469db73dcc7bd0b7d59588bcf10bee35e345fc3b1640a2cefbf6169c2315610145126ce7554e0c2c807cb0e7d2c36c2f36
SSDEEP 12288:LERf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rOzf:LEt08qa959YZHy79PdNmjZFJtqz
TLSH
T135652357720F74A0E66B09F001D675A1F8924D0C3A932D62C67CF68FD3F669198077B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 5beb4a7e5dbbc6e311e1407fb3a4eb936c55cd79f39e4a13f810b95e418710c7
MD5 0f48ef4719fc3be3c4d20caa4542187f
SHA1 8a0d401bd8faf66ed53f23918c6620413ac012ad
SHA512 cca7a5ab38b36541013b9d18adf9c78074e29e8ebd548fc6802a66f22d11b67bd8e6b7d2bef33e654505a3411b86224c43a7753e629488a9120b5366b3b330df
SSDEEP 12288:K4Rf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rOFf:K4t08qa959YZHy79PdNmjZFJtqF
TLSH
T18B652357720F74A0E66B0AB002D674A1F8914D0C3A932D62C67CF68FD3F669198477B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 255eac3e8eb0b786501a2f7d0f3d1f2ce4513751e47d1a534e1cc9dcdbddddcc
MD5 a812c7ec84f2bcc9e210983d70ed26b3
SHA1 b07f655b50f5b0db8c55f674ace7cad21233e0c3
SHA512 21f36c107f663c64c220f219c58aa139548bf9bd4eeca0a3691ff217ca26e3596fc3a8315d944a6a4d91fd0fa0feb3289b4d5e0bb1bb87356be8606433dcf2d8
SSDEEP 12288:6yPz5L8VRf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rOZf:nzyVt08qa959YZHy79PdNmjZFJtqZ
TLSH
T12C750107736630F8D13B427488A21942F7B2B8351B214EAF47A457AB6F736909D3BB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 890f8a4f82b47862f4fe3dc57749cf85230026bb84818d9d58c4993a53be55c1
MD5 bb5eeb36b324d011c1deec1353aa25d7
SHA1 2365da77a99fc0a43f15f467ba928d0351ee8061
SHA512 8c15114f35ac69b3eb1cb0484c47e18e0e1e6c8a54a3d86e0d512c0636a339e9e1e896915d4d8c46be9016ec80011354e6e76d125571b4616d3276f098884b06
SSDEEP 12288:iERf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rOSf:iEt08qa959YZHy79PdNmjZFJtqS
TLSH
T159652357720F74A0E66B0AF001DA75A1F8924D0C3A932D62C67CF68FD3F669198077B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 ff07944335fbca01d3ce30ac2b8b75eb2d87b04fcdce041ef306ac8918834154
MD5 d910e139b3e16ce38bba496b259b63ab
SHA1 13d23c57599169dd15a4835b3dd220a7f77c817c
SHA512 0e5006e3f036bd11a88b77ad2ad3a2a6715cd664b8f26fb09c44a66f380c41afb65e7aa13286d427c793e771f8cc91eddde9f92cfe3d043f1b1ce7ae58a4fb2d
SSDEEP 12288:zERf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rOSf:zEt08qa959YZHy79PdNmjZFJtqS
TLSH
T13E652357720F74A0E66B0AF001DA75A1F8924D0C3A932D62C67CF68FD3F669198077B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 1db0f85d11606363d984bbd6fcdc91596d2051b4b5f61806c64fbde5f26b8036
MD5 6fa129604a85bf7b80db4f019e1e401f
SHA1 fbe3b3489f446b57b55b45cdbd42cc71c3704d63
SHA512 dc5351c90b0e7a639bc8b25f440aba5bcfc56d5fef33b43ef6f6215ecdde3cae0eb95c0cdb2389d380fea0994cf762c88c07c8051874eff2dcd32e9b9719c6e7
SSDEEP 12288:yyPz5L8VRf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rONf:vzyVt08qa959YZHy79PdNmjZFJtqN
TLSH
T155750107736630F8D17B427488A21902F7B2B8351B214EAF47A457AB6F736909D3BB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 bc0739f68e5440884066e7f6267ca4a885e759cd8d4bbc9a2f5a00fa887589e7
MD5 4fe19af42e033d5e3e6036170eef7783
SHA1 9414bd0570b5ceaf78ee1506cf2ded2a01af8bb2
SHA512 8ada227806d4da5422ab2e66ae7d3d92d807033fc55e20e61fc16ab9f3e418f7866b75229243ef33f4a2c31a5eda214d054a549ec2fdbd585de2795c75d2edb6
SSDEEP 24576:CT6aLl3z0zDrt08qa959YZHy79PdNmjZFJtqe:CThLljmHqahgy79DmjPJtq
TLSH
T13E850295B35028F4EC67813EC9659912E6F27C190B70CA1F03B8365B5F733A15C2EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 ffd7a31871327247d6dfe9a67504abd7b0b2837f8ba992b88ceec5d82b577558
MD5 eaa47891bc99f9a584692ccae61201a9
SHA1 8e8cf3230e515cd3ac75c251617b0b284621132d
SHA512 7d3324be7a4a0e075277cb21f5cc21abd4056d36e7e238e6d528106eae6a131a4b443d7a3a7e22437fa1b76acbf4dfaea4fc115c3f66367fe7dfad42947b6536
SSDEEP 24576:030d9CHKy7GZnt08qa959YZHy79PdNmjZFJtqg:+0d9CHKyadHqahgy79DmjPJtq
TLSH
T16A95CE90F3E810E4F0B78A3589765512DAB67C591B31DE8F03A8665A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 24c8ee1304468c722d94b208d8d62c356b858f24d83de32c578929fea316a76c
MD5 e1e0229bd7b148e9cf6b320d36c5b7dc
SHA1 1539be32c6eaa882b8974543e9ec81719289f363
SHA512 61c32cd302e107bcd4fa206523957fbfd9395b6683457c3dfb8aa2999d5f55dfc050df7f48cde075f832a595e06cd3aaac75e5decb1192c3a6be88b7795d7d06
SSDEEP 12288:bbRf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rOWf:bbt08qa959YZHy79PdNmjZFJtqW
TLSH
T10B652357720F74A0E66B09F001DA74A1F8924D0C3A931D62C678F68FD3F6691A8477B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 526dfed61694d7a1ade1a7e0e7709724b15aefdab07733077942958f67d0b4ad
MD5 a27f765d06f9941cc8dffd820933bb78
SHA1 38cefbc886fa8353a8b55587b5e0843c419cd383
SHA512 6ddbc91cea76fdeea21ca2c751e4a2376fcaeb6ab9ec4cc5999c95a21ff8d747db2657994c1c49bc2858ac614eb7562f30cb7dd9541bbf6a7ca630541dba48f0
SSDEEP 12288:91Rf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rOnf:91t08qa959YZHy79PdNmjZFJtqn
TLSH
T1B9652356720E74F0E66B0AF001EA7591F8924D0C3AA31D62C778F68FD3F669198077B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 bdb925ad0b13599a6d782b4ab67afe19b3aa018c29882edf1514ce5e78dd1716
MD5 591b3b668fa9db7c468b4758b66bd6f2
SHA1 0e453b65a7749e3d82f1fd931e989a499b5c5b73
SHA512 f442d0259fc0466fe14615c275dc999851bd415a2d3b97df6896bef22ff0fb7e74c6e4d44a577d440502e1ffd709b85a85206acdd45d3f834803276a31b2f865
SSDEEP 12288:n+Rf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rOnf:n+t08qa959YZHy79PdNmjZFJtqn
TLSH
T1BA652357720F74A0E66B09B002DA75A1F8914D0C3A932D63C77CF68FD3F6691A8076B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 56fcfa8436c63d3227f137222b84580f48baa6d5d637b316202dc094c02db8cf
MD5 b43139137f703c6dc42d091d914e770b
SHA1 75ba8433731b5efcbc30501bd9e12367ce3f70c7
SHA512 467d53ec4fc0019338024c4fea7ee16dfd64b026d62a8bdf099845348f5dc7d720b779e22680f629de8f2b8e81009121e6721511270e3d58ac480658558470de
SSDEEP 12288:UERf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rOFf:UEt08qa959YZHy79PdNmjZFJtqF
TLSH
T1AF652357720F74A0E66B0AF001D675A1F8924D0C3A932D62CA7CF68FD3F669198077B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 65562628c1dd9fa41a5888fa3c2287fdd1165414b218ce65c6d88ff75ab0f6cb
MD5 b116251b1a950f13988b1a467cb05728
SHA1 63e6f3aba2ad732e3dad4a89fea0c49342c25392
SHA512 e18ef8f71946608884cf089d97a0bb53d5789078e77de69870ce9e698a690d8cb08022645cd2f84f93547f96c2b46184b7d36f780e7f79f9629b7992ae71d265
SSDEEP 12288:QbRf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rO9f:Qbt08qa959YZHy79PdNmjZFJtq9
TLSH
T1EF652357720F74A0E66B0AF001E674A1F8924D0C3A931D62C67CF68FD3F6691A8477B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 835a89b4226bc55e9e34de4d4899329e9979f03e68e52231d6d31de5b30a081a
MD5 42675a75b5a270ff91edbcce7ba50943
SHA1 748606d72541f78e25b1bb1cde31c087f82e0149
SHA512 f587dd34e553de5dd2501454c46512d99b2d74b3afa030ee9d8f11fdd14d7d45e6aad998e8236ee83c69ff6ed9f1a8d91366e30af769334b585f3b04dd7b804c
SSDEEP 12288:8cRf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rO5f:8ct08qa959YZHy79PdNmjZFJtq5
TLSH
T1D5652357720F74A0D66B0AF002D674A1F8964D0C3A932D62CB78F68FD3F669198077B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 abad84fac36ddcc2e7fc970b623ec454f13c077bf4992549e334ad57e0cde884
MD5 348f3945a3ff673685bc1f25685df3d8
SHA1 d83cd391a129d7a70f6e019282c1bec25112bd09
SHA512 c4aa1ecce80412b03869d269b60b6e018b0990334a0b63de0545f68b976220beabae63295c15ac9e9e0877c7380c4932be2570583ffc198a6ad23e997b0a57b9
SSDEEP 12288:JCRf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rOGf:JCt08qa959YZHy79PdNmjZFJtqG
TLSH
T1EB652357720F74A0E66B09F001E674A1F8924D0C3A932D62C67CF68FD3F6691A8477B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 6e124864094c96af355f8d03f9a54eaedd24911f0651b0c3452b0ecba9492017
MD5 28b28eb9f665ef93ff2041f227a82d88
SHA1 f3e325c0756c329c1ca3be92ffe67c87765c355e
SHA512 eae170aebd26bf43c5ce2c31f426b7c1f53822b31db2a0ba15c058fb94bcbd7d3f26de84acf604fae17e57c61027d8ce9dac20fa2dfae6f11e5f8c9e4eac3c0b
SSDEEP 24576:YfwvBk9RX6wkyAIIt08qa959YZHy79PdNmjZFJtq3:ZMnYIIHqahgy79DmjPJtq
TLSH
T1F495D029EBDC44E5E1B7923C89B74606F6B178581B32C6CF029953AE0E33ED45D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4624f71b8a7ea851ffcbef0f5e21218fffbe0a5380cce3a665e07d5ce096e80a
MD5 51b479e33b7eea5958dfc1d33eec610b
SHA1 4a6a728b62c5b42b6fb9b5ef1956012f90316223
SHA512 ea9b2a57efdaaf98a3c2a19dc7b43bd37024d99ddb88136e755731a041eb046a04fac3957f63afe22ad2bd359f5bc340d542f3da51549fde97fdaf8362692cf9
SSDEEP 49152:uYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0fHqahgy79Dmje:RySzPnpHD+PJ0
TLSH
T196066C97A16801D5C1B9C1B98B1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8e36e5869679c330832a89d1703cd0da168d6f170484fd917887b5538c26aa0a
MD5 848457d919cd27de4501ce5933dfd688
SHA1 a1ee8feeef29c6902cc0c2f8f7cd103adf9c5884
SHA512 329fbca2f957f0e55d5bb753b458faea48532d868ee4cd1ac94a91a15feacea63a820b2bfff1f309a1cc8764c9e943798cc8fc9d2f6450b5d74a08bc70abc0c7
SSDEEP 24576:247Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYht08qa959YZHy79PdNmjZFJtq8:247JUQjqirIhCnDHUPfF/vHqahgy79Dj
TLSH
T10C65AF1EA3EC01E5E1BA827885154A5AEA71782D1F32CACF1270837D6F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 0910b9dd5831bda45ee2b4d3336e59ae4af900e54eb4012b3f6e85066b506bfe
MD5 08503050c3b323646ef411337c54e36f
SHA1 841491a10baa755b53270d3627a5c806b49729a3
SHA512 3618664280ff365be17064c33b1ef84762651030f6de231199075a4abd4644e93281d3029189f07eb6e5e9d6016dcb6bf9343039f35f653e1378e45971ebdedd
SSDEEP 12288:6ksf0Rf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rO9f:I0t08qa959YZHy79PdNmjZFJtq9
TLSH
T11B75011AE25821E8C06E5274C7965A41F3737C1857E297CB83E0F57E0F766809DEAB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 4ab556ca75668da314f65cb9f366d4326c341ea9cc91904f24cd42668abca9af
MD5 5bb2d5ccee3dc4be467d838cb1c80e0c
SHA1 08b365ccd13c8f13b75a4f2f46bdc8967e7db309
SHA512 1aae6db239118a58b051394a1e4da4553642a8abf8f740ab730f029ab29e6bd581ae4bf00e134705da07510be8adf12692718dbab9c796e9989aa35da67ed5d9
SSDEEP 12288:mnBCqU3fTgCB9cL3l+XXOsfwUVSpIRzyJHp+660aRMF:mnEqUPr9YAXtPVSpizyJH4660aRMF
TLSH
T111352841766AC75FC6A940321E32D1CCAB707D01EE45AF0372C8973FD576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 8eac4a398ae5e85ae510ede819a93d1689f824b09fcd6a9e9648f8033029631e
MD5 22e322a562bfaaf6e1c18be784d24644
SHA1 f90e25c913e07a154202d5c4b3724c2629513938
SHA512 0340ee1ce896ecc3e45327d611b9cf7efc899c25f0dd216ef206a02d738398c1e390be397e8d43cf8f283dc5309b08653a08c5b1c78f9023b4769c4950595836
SSDEEP 6144:tZ1pr3/ACjFf71RNPptMxJPptMxuPr9z3MXBqv5GC:h71Rvqn
TLSH
T1D155C8815537A3CFD1FB6032072A5B4CB764EC06B3456F26B3C8453AD82AB25A4B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 eba01e84bc0e93beabf9de546ecefa1724a0f4e1a0096327a8523f0eacc49741
MD5 cab8387962c0b9ce57c1420a0004ed18
SHA1 7e3fb2c65900fffa6b5ed74ad1b5153e8e6462a0
SHA512 5c67d85a448750ba47a571b21b1898c73e859dbf2909167c7bfdb1a32f950f744d7ff56f6a5bbd0042cbd6a0397767aeb646b3320304e1fb367b722e63251b55
SSDEEP 12288:eP7MRf0TjEhxCWsxw9Q5m7k4IB5EIYky37JX38CPDpNJdmjZ8KJB3rOYf:kMt08qa959YZHy79PdNmjZFJtqY
TLSH
T1D1652356630E74A0EA7B0AB001AAA470F4566D082F535DD3D628B6CFD3B2AC09C77777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6b2295820cd23cc6dc0880758ba67e8b021b1fa6ade32a05a5975acc3bf8a25b
MD5 643815da8688580729916ad0d5eae16b
SHA1 29470d9c4ac68e087c0a25490b85125d440ee515
SHA512 4bd73e5df545915b397a54ce491dec43c50bc396d23fac3323967abdf796a873142d3483999163ec525f815e4e4048214d034c546cefcc273e562e92dac00fb0
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYmt08qa959YZHy79PdNmjZFJtqi:/gb4mBIBhGFhHqahgy79DmjPJtq
TLSH
T1A465AF1E22EC02F5E0FAD2B8CDA64417D6B278161732D6DF1150426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 8470ac72e6df3174d172e645eb3e442fd6842438c272849eff6d9c6933b07222
MD5 67e6599b8bebe925892205d009d4c881
SHA1 9beff908d337116a788a774381fa5d1ca15be700
SHA512 171cff1cfab1e80e8ff28df2736daa5cae49d6ff5c4d6235f843689eca97b4847d1686c4903322ed488a9d0ca0a794ca11576c5881abe49239b11c27c666d443
SSDEEP 24576:bG88u8FpJqH1Izria7/mRt08qa959YZHy79PdNmjZFJtqt:67ZFPqV3a7/eHqahgy79DmjPJtq
TLSH
T12F95F16572E501F0D47BD13889864663F6B2B8151361EFDF06A88B961F33AE14B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5aa192b6e62c85dbc38d1eeaf205651649b5eeac12c1d6f1c0fa91cbe1b4e1b0
MD5 c7b5a42262c23fdc6ef8e8bb04df8407
SHA1 97672a1cc7bf5581682301a4604809aafcc29a7a
SHA512 fdae1499496d8b0a523aedc9d0bf0429d80c89a824e727c9b2426ca26ed32d6e9beebb3c3e7ba9e063d4f52f3ea8f9a6197a03bdf99162fa0bd743e62bf034fb
SSDEEP 49152:ZBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjNHqahgy79DmjPJtq:6G05lO43bApHD+PJ0
TLSH
T1BED5C06E62EC11F9D1BBC17CD9C6460BEBB23815033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 40dc6849f1af908b789c4a5f58e22288e70b60e4fae266e2ba587c97975eaf59
MD5 47150def5356761624d860f58598deb1
SHA1 bbbcb091b5dbbf731ee6677087a2aa41703eacf5
SHA512 4acf2ed89388fb9a1d69b070d3b4abcfd31ca9976ad72926e918c242675077b5100c7c37e9c542de6c1147b52c923aa9bd38d6a3e9bfb6c48f7662e2f89ae27a
SSDEEP 24576:Gfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnft08qa959YZHy79PdNmjZFJtq2:ea5POZ3lJt2pasx2+m1Hqahgy79DmjPm
TLSH
T11A65AF5EA6FC01D5D5B9D17DC583861AF5B1342513329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 215b8031f8030e18c630506993a4e8e228c56d1986883086571e92fa4d95715e
MD5 ea7ed6bd5038f793e2c08ea101093767
SHA1 d9dd8b69ff3a2fdffd2d674021787aa8bb634ca0
SHA512 6e9f263fb0b79f8373a246388a789cc85e8b6bcf8bfaa9fa1ef6c64a0a8933090ab302f05797e297a89643562ce5a0980260af41e7f6eb8837d026d41fe81892
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7Fk5t08qa959YZHy79PdNmjZFJtqI:pNc/zEOVHF+Hqahgy79DmjPJtq
TLSH
T1E7857B1623E901E4E5BBE1BE89779546FA71786913308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 872d1dd9a145575416678831756b845fba035499a2209553232a0690b34a0ed5
MD5 31946ecfad94b205b751160c55085a00
SHA1 981f260cc6652daa8950b7df7c5d58d9f079dacb
SHA512 713472b49bcf33452ba62469da4efa33e1d8f5c970caa2223c4c8eab5a08f5b3c812967074e79c65e26028f9a2ca853157077d7b916204fa5fb5cc37c15eae0a
SSDEEP 24576:1zkNvNnaFeYhJNtmZBmCt08qa959YZHy79PdNmjZFJtqg:1zMwBtOmCHqahgy79DmjPJtq
TLSH
T1F055AF6EB6B805E4D1FEC6B48D238512FA727861173253CB9290C13F4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 b484c57cebcacd5e2f70a897d272c1c9d6e480718fe95975a091711be1a47322
MD5 5d69419217e4dbe63ad81540f70661e9
SHA1 f91757fb999e9655edf061160cc714b3839ca56a
SHA512 f1e54be651617596d36a27a67b6aa3db04af2db4695ab1f588ba504dc2cb65f772fe626c0607369d13a393755a26de14ed169c24f6252a9cab2e8bb25d6cd876
SSDEEP 24576:LPUr+NQdt08qa959YZHy79PdNmjZFJtqr:LJQdHqahgy79DmjPJtq
TLSH
T19975E12F22AD18E4E67AA17C85864619F771B855171296CF02E0817F4F73ED8BC3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 7d2f02d1ba5bcdb1f5f95000a45630d37ec13d752caad8bf46886bab095ad577
MD5 b6b62b9ac7994003b2fcefb43de3e944
SHA1 29c61f4a7afd5ec16282a7bc8132512a4448c006
SHA512 31e18ac1667a487ff141cf85934b3065720af418c515615138dd32c2c20f3ae6481a96754bcdf80432e2019e3504fe0bdb65b404d4e64ebf03ce64ab57bf59ad
SSDEEP 24576:SD3FHshBIYQgAQt08qa959YZHy79PdNmjZFJtqE:SDVHeBIAAQHqahgy79DmjPJtq
TLSH
T1E485E17EE65D04E4E57BC1BC86638906E67138AC032259DB02D4C1BA5F7BEE46D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1152-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1152-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1152-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1152-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1152-320-0x0000000002FB0000-0x000000000324E000-memory.dmp

Download

memory/1336-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1336-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1336-139-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1336-137-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1336-131-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1812-50-0x0000000001780000-0x00000000017E0000-memory.dmp

Download

memory/1812-57-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/1812-55-0x0000000001780000-0x00000000017E0000-memory.dmp

Download

memory/1812-51-0x0000000001780000-0x00000000017E0000-memory.dmp

Download

memory/1812-44-0x0000000001780000-0x00000000017E0000-memory.dmp

Download

memory/1812-43-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/2640-38-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2640-39-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2640-32-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2640-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2640-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2916-298-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/2916-72-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2916-78-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2916-70-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/3732-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3732-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3732-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3732-25-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3732-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4720-119-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4720-125-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4720-117-0x0000000140000000-0x0000000140213000-memory.dmp

Download

memory/4720-316-0x0000000140000000-0x0000000140213000-memory.dmp

Download

memory/4804-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4804-106-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4804-112-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4804-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4804-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4804-317-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5024-24-0x0000000140000000-0x00000001401E1000-memory.dmp

Download

memory/5024-7-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5024-0-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5024-8-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5024-6-0x0000000140000000-0x00000001401E1000-memory.dmp

Download

memory/5024-22-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/6528-274-0x0000000140000000-0x00000001401A4000-memory.dmp

Download

memory/6528-66-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6528-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6528-59-0x0000000140000000-0x00000001401A4000-memory.dmp

Download

memory/6596-82-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/6596-83-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/6596-88-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/6596-313-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/6900-334-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6900-99-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6900-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6900-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6900-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download