8732c79876cab39d5f7865a5b6ebcddb43684ffa49447c57a732acb4637364ff

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
Size 1.4MB
Sample260803-xpv7maec72
SHA256 8732c79876cab39d5f7865a5b6ebcddb43684ffa49447c57a732acb4637364ff
MD5 06de8819834f2290628a7f14399ab52a
SHA1 8ba7ab118411817eea45001acd12dc18736c4f8f
SHA512 e308cb82b9b62adb8f52469243f238ddd5d8fb67d3006c52db9eb9f0b592209a586014f0f66e7124528d260e3fd2f081067c58b899df7767d5e42fde0a4a5874
SSDEEP 24576:/8xtxIEKwc1klHP4IctnHRVWgCjOfJ4yL/tNCJPXUQrP6:UxTIbrklHP4vROSfJ4klKXnC
TLSH
T15E65BF15B7E940E8E1B7923A49618161F7B2BC521B31DBDF4250731E1F3BAD44E3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2496	elevation_service.exe
3936	elevation_service.exe
4056	maintenanceservice.exe
264	OSE.EXE
4712	PerceptionSimulationService.exe
6132	perfhost.exe
5184	ReFsDedupSvc.exe
5264	SensorDataService.exe
1996	ssh-agent.exe
1148	AgentService.exe
1972	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\74c72c36c618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d1aafc17a23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d136ac17a23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c86f6c17a23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000720b67037b23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000069b617c27a23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
2496	elevation_service.exe
2496	elevation_service.exe
2496	elevation_service.exe
2496	elevation_service.exe
2496	elevation_service.exe
2496	elevation_service.exe
2496	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
Token: SeAssignPrimaryTokenPrivilege	1148	AgentService.exe
Token: SeBackupPrivilege	5184	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5184	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5184	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5184	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5184	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5184	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5184	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5184	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5184	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5184	ReFsDedupSvc.exe
Token: 33	1972	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1972	SearchIndexer.exe
Token: SeDebugPrivilege	1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	2496	elevation_service.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 5896	1060	2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe	90
PID 1972 wrote to memory of 4500	1972	SearchIndexer.exe	103
PID 1972 wrote to memory of 2424	1972	SearchIndexer.exe	104
PID 1972 wrote to memory of 4932	1972	SearchIndexer.exe	105
PID 1972 wrote to memory of 4224	1972	SearchIndexer.exe	106
PID 1972 wrote to memory of 4416	1972	SearchIndexer.exe	108
PID 1972 wrote to memory of 4528	1972	SearchIndexer.exe	109
PID 1972 wrote to memory of 5868	1972	SearchIndexer.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_06de8819834f2290628a7f14399ab52a_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Delete /TN "EVKey - Vietnamese Keyboard" /F
  2⤵
  PID:5896

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3936

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4056

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:264

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4712

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6132

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5184

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5264

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1996

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1148

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4500
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2424
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2816 2808 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4932
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4224
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4416
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2816 2808 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4528
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6d9d7790a0c1a139f94c1e9436fc2a3e5dc6aa95476873d31c7c6ef5a155f9d5
MD5 4f929971417138dc3be64a32aa4d0ca2
SHA1 d968108e083938c010c3dc3a7044586f7aadc0fc
SHA512 0c25ac46fab35ca82b48aa8e7cabcd59b4fd41ff3128004fc9bdee901ca46c1d8e9c2c046734a14fd14e829ef5497ab9e4e7bc0d03255fe2d5ea4179493a6f67
SSDEEP 49152:2b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnOfJ4klKXnL:o3q6mjBNfJ4k
TLSH
T1DAD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 7e788f6c5040994bd267cae6539157b805bd633bb03ada030441610c1384f530
MD5 601a83d152a81bdbbf06c08b8189b8f8
SHA1 8d2a5c161bf41d62ecbfca3f6562cd7feca3af2e
SHA512 6cad10d564c2fa64825d48c43f3e6c0d8ce14c0bd8b4f4ab7b9ed0d22210c313a93d877cdbed1435e2e1705c22067f5ee2e3bd5e2027a8a0affaa5a50f95d49e
SSDEEP 12288:R1XLsswWkxy2lRq2czAZfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sn:fXYfDtczAZfJ4yL/tNCJPXUQrP0
TLSH
T1C865F12973E008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 31bfd7fa09b95d26b4e46b0365ce47b70331bed067cb9ee12406c8be1a2b9425
MD5 0ef31fa5c9b4af539da6847221f86c43
SHA1 9390bd98589158c4e8262cd9cb868687d27c22ff
SHA512 25b69f94e5232a13011a8cc901a051371064fc769ae0a0f212af2f6a314c6f8494ceeae4a1f332efb56eaf7309f1688ee9b8e180a829e315baacda9f66a966ed
SSDEEP 24576:30Le5ji0hmxbrMWfJ4yL/tNCJPXUQrPa:3Pji0AJrfJ4klKXnS
TLSH
T15885AE66F5748335D073C0B9C5D2A68AEA71308617308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c414b94ea0a9277a5e12622b1e8add2daf18a52e29eed49ef01a3e8d76cc3f78
MD5 529aa5dd79cd77334ab58bbd2556120f
SHA1 73f083e9f75fb8bfddb869f3b7e6c4c2bdbbfaeb
SHA512 9749ccf68886d7e81f7812de28aef765d414a6c80be01e5fa2ec021901f81512b84f502ab38ddb337d2cec8516ffc44b17769f93c3d28a0004172f5e2b9acbf1
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWj6q8wyuEfJ4yL/tNCJPXUQrPH:D/ezSC6vUzPv+HjynfJ4klKXn/
TLSH
T18E756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3c962c060f3f28dd9de63b5d463e053095a75f40ee759364e64ebc3f7d1513c9
MD5 5662ecccab42114c33fe586935ac833b
SHA1 e4818805da69b0d2a5d27aca33f86dae2b7cafc6
SHA512 9bd5d14a339868c515d62c21e3076dcf1673929dc65d48c84474c9be9f34142f82b706d17324f2bd36a90f2ac21a169403920081535377144c03869d3c2d1050
SSDEEP 24576:uVbqPb88hv/l+B9fJ4yL/tNCJPXUQrPn:uVO88hXl+LfJ4klKXnv
TLSH
T1B8559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ebd20d31582ae2ee53f70734eea9d022633fc39537cb8b73fc5ca38f5dcbc288
MD5 0699c631d763a0db215ce310fe3addae
SHA1 cee49e8c749fa587d955a3c3b5a1c8c48e31d92e
SHA512 25cbc256639e95409abdd7d3828ed28185bde904e1c08719fb7401a9315d53879ca16e6632fa6ea561d2d73a62923a83d8e2f5b5bf32f4be29a280c2a02eb099
SSDEEP 12288:/JKfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sp:/JKfJ4yL/tNCJPXUQrPq
TLSH
T11B4523E751909096DF6687F82A88F001C714BEC5162FA2F7DE82B8853FFC91A559C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 1652e3c9c3198c24d4f5791dd7b5f4710c7425b050a7aded54358701f12827c6
MD5 343a48dc7b957f894022d2e9b9be2478
SHA1 e6ba34bd018006fc4d2916cd73c3eea78cc0d9ab
SHA512 f3612d1f12f1ce453299c3cbdd092564e4d56d457477dc8d5d3d8b3471e8c601e0d4a5530386709b31bf5aa2c79a5f7ac1af8834231f5ff6cb1a5108afb77474
SSDEEP 12288:AeBNUbTVO86UlfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sl:AJIUlfJ4yL/tNCJPXUQrPa
TLSH
T13365C07BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275D51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 45de4d891a91a69fe9fd2c28994cd9c38ea6cbf75330310b1424c5cb31cc6d8c
MD5 41845ac0acc1f606d4986e9324a37920
SHA1 85584db6463aa3f383b162a8df536d9172805443
SHA512 7961d24a365b0011aee9f6d50997cabf7fb0e15b00e825dc6f5f05afff9ef4fa15615e88d213cb2bd8c5bf2a4f30eba545ef1c012b296d0c20762cbedcc9be61
SSDEEP 49152:lQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THy:lQvGAdlCEL8c/WRNw5C0fJ4k
TLSH
T172266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 4cea0e41d7b6260924242d8cd150476601d870c2a15727d3ed441a52bed6b135
MD5 3f19fe6396ffd69eb1062fa39107472b
SHA1 4be931c43d734e13fdce63c436565579a1a33789
SHA512 eb6ecd4cada58419b955126662fac43c57023654be4a2a9e1c8a866ea435cad44b6a3569be4cd3ddd3ab19d8c32c637ba71c01b0712c3c8b7dfd183b8ed310b7
SSDEEP 12288:8AwSfxL/2Dc3kDLLmt0LDQewsAjbfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW4:hRewsAjbfJ4yL/tNCJPXUQrPe
TLSH
T1FA75E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5021edf67123696af7f9d7f73026260cf5c81df71fc8f703f1c9a3a3becf5bbb
MD5 cbbda02d786daa9fa5e86a70ea00b773
SHA1 a9e2218e5959e7feb240a26d7ddd25d091d698a1
SHA512 b8162b33ee0b220ed13b0b3fa0aaf5739b3f7781b8086c5ddebf41fe8cb9e6c233aa1eab7be6a4c21c817314fe5e31eb7600edc6b7575004abb9339d61617ac3
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHzfJ4:QUEtQevvqc2W1cpV20I32z
TLSH
T110474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1cbda0565249eb60005369fb16e37dbbcbae1b20f266073c3fe747b1900de695
MD5 df8ee893aec257bd1b08b4c72ecb7381
SHA1 670a7a6dcb943791dfc8d2158324d774509a56da
SHA512 e27aa664d2254a8cadd58b78a7ea470bf1d625b35166e9c95bce583f6a60d00c46d8d89607471aba7136e465ef8a8f1867caa916923b2b73f50017d06c74af81
SSDEEP 49152:eCbRquA/m2yL5zQfFiV+XenmE3/z7fJ4klKXnk:ToqtVjnmgfJ4k
TLSH
T1D1D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 725e486623507eba783801991fe06f8ceea4ec9a2836dc00433e467ef96af3c4
MD5 415f2347b7d9fc348c80d0a0a393a753
SHA1 92f8f07940361b42c23f16558c332d99db2b4a8c
SHA512 5d375c0fa966f1c40dbaeda9372db1ef85a413b5823bc73750b87da555e5dbb4cc276c56da27d879047c725d981fcd3a838863c3506325bc0a56bccf375c1155
SSDEEP 24576:VAhGL6IFoiwtA5l7S53AfJ4yL/tNCJPXUQrP8:VAM5Foiq5QfJ4klKXnU
TLSH
T1DA359D81E7F955D4F5B3AAB899B59170EA76BCAA5E31C20F2250D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 bc81cc515cb3e81da83c0a0e6b8633c517c5d411af76dff0fb9fe9aa4099b1d3
MD5 96a88940939809065f070dbb2f2ce720
SHA1 021e3722d71ed8a3304df3682b45930c8d44a9df
SHA512 18309f3bc33036f8ee7692926420474cafbb09ceeb933bd4c121ffd1b9c64e726ae0f14bb6c47e7f61712bfe2e9921a442f8c834eb4e755800f61d8d62037bb4
SSDEEP 12288:Zmw5HEjsChN6BFgl0WDm+CkfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT2:0wubOWHfJ4yL/tNCJPXUQrPa
TLSH
T1CA65F14A32E41CF9E96782388687D132F7B2BC422A26D71F5760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 0a9a53e63809d19950cb5a964cdbf77a0741bb9794ff14e0695e547ba9d170b4
MD5 a15fabce7d45c7b661c0b9dccb38a893
SHA1 8fc517ef54b18d21c0dc24b0fdf6b65ab5947022
SHA512 119168cd47722b596a4b2a1d16e633db739d3292afc79777a225a36ab0def399c4cbcaf6f79903c8e96c302d535ee184d2fc20948842250c64b78bad461b558e
SSDEEP 12288:rrZ1IyLfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SW:vZu+fJ4yL/tNCJPXUQrPF
TLSH
T1D655129B32E460F9DAA782BC99D4D101D3317C92233A53CF5A5195963FBBAC61D3C322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7be0ad144fa572439f6b56413c94a7b9fe52426077ae04d1f4ea77b958838414
MD5 fdf454b14eac2f5c2d40f2df35803401
SHA1 f1e9cca3ea08b4040584c014ec0a08ccd42e3985
SHA512 91c83a915cfd267b68855363bbac3edfe34549de7dac57c01678022a2e6b3f16578d50f2d597998f4d221964413064d40921872f5ae5da91502e779fcc40610c
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UG:QQRQyi36YOcPDLvw2gAf+PN3BfJ4k
TLSH
T174667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d0b6bb746da6cea3c3c21d29a497c70f782a3e019ff3b9b2ddcbc44543694db5
MD5 51bcf36efb5e802df43a10cf31379e56
SHA1 7d7533f292ec0c62187031bbbe63beb83c67259e
SHA512 2a7a0ad825223df2b0a402b44c3dc2ab15535064cddfdd4d621586991af0be247de56a9eabafc5ff4ec8b44011dee6d09c14f8b891228dd9652193e17ad70868
SSDEEP 49152:cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UX:zQRQyi36YOcPDLvw2gAf+PN3BfJ4k
TLSH
T1D3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 26e57bb89acdb2f7a3aab9f484ecb1b03b048cc6f8f096bac4e214228207510e
MD5 6e8b3931812aab5caf6868c3be487674
SHA1 cf77c1b5596c0852ac143d74a8da35e112c21189
SHA512 e7b0f0048db37c39b794b5e7b28228b45435d9ef0c1cd53095529d118588c89e8f4a30879b44231998ac2aa95e26bcbc6fea23d5074527181ac1d83d49ef0222
SSDEEP 24576:zwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0OfJ4yL/tNCJPXUi:L68Qg55nhkeWu7PNU3/rfJ4klKXnx
TLSH
T14FB55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 76c995eefa8f4abe1079a223b3fcaac0bb23d94e29abb8a348801247b02f613e
MD5 d6d631a5ea263eed1004854867286629
SHA1 3d35358029361b4f192dea1034addb2509e7ee6d
SHA512 1169f3abb511127ac72e820344305af4726119273a13d5a7e993dea12f9a8485248d4d7cf7464aed68e3f9e3e63f991ef0ce6592adb38fcb8ef9b3489481676c
SSDEEP 49152:s3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99o:Jy5112gYy5azzVvU69nLKnhZKfJ4k
TLSH
T1F3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5506fdaa0043cd67f98f4b039045f1cb39727141deaac8cc257fd2e42684a4c1
MD5 b688fdaf9ce8bc12fd43275e2c61037b
SHA1 220db6407570d6b36bb54ca1ce093aff77fb8493
SHA512 fa8baf4a5aaa0bbf219fd21288904547131894fb5bc7420a2e25435c0a186f412fb7eeb36ab9717cc5822bbe53d15e62bb483594e8a8bbc461a8bd78bb8beaba
SSDEEP 49152:GB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glpfJ4klKXn6:0u6JmIxd2dpfJ4k
TLSH
T11DD59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f5e58c5269f78401a1d31e2f4659d89c9a0d01b4cb887526e72a4eb301980cdd
MD5 e4931028efd4ef3d5430d1bf3cea4540
SHA1 3c250875d5b19a9ab4a78d5d0a2163eb82c0eede
SHA512 7cdfa81c70adff36ce010ecc5b98a39f889e0dd6189615dd1d46fe43c3ece98caef8c68687b75aef83e5abe094066e2a3f8ccd6d67bc274f0d5da06c6ffd3290
SSDEEP 49152:/1hpsNoJpF1A67U44CwH7R4xFfJ4klKXn6:/mifPqRgfJ4k
TLSH
T170B5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 707a4d90c0f61f7f6aeb1df36a871e9d5519bdc1bcd0b7c4943d873777d85c3c
MD5 cd9a62f75b55b908e571967ee1fe363e
SHA1 31efc618fa3109b90a9552e5b09c4d3084ba3fb1
SHA512 953a6a2795f4f3be7db86220c64264bac67682ebaee688c7bd054d0b1649f745f89d8d0434ae4385cc79d90134c498aea114cfcc49a93c0d5c26396ad89a7d2b
SSDEEP 49152:VSuZQIY0Be2KkRVtOnks6NMHq+fJ4klKXnL:75dKqi61+fJ4k
TLSH
T18FC5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e7b53c096597a6bf877b4b51614f9611fce390f25107add585a047ed9954d311
MD5 8bbe4a4116c612de10a8bdc7327c1bc8
SHA1 e3cd4cef458fc8f5ba8620e713904906d12e5c5a
SHA512 dfff2f802977bf92dc84797e8664997ba1a35736ee106e6699dbf2dfd18324743d6130e10bc66e5f72a9225d643c3ec8e19a5c76fa853cc8fa841094d5ea36b6
SSDEEP 49152:2htSn8EApI0figjgiDn0AP5wZfJ4klKXnj:XX2iWphsfJ4k
TLSH
T14E95BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e2b7b2a7a656b0c1e2b4eed126c6d5bb069e8d2fcadd77699e236d7fc39d9c90
MD5 8961d5904bc6d218a989cd2d181d3aff
SHA1 b228ab4b3dd13c059cc4017a5bf2a3ff4b83a594
SHA512 6ea9364b0237dc234aa0b2f4c108ca3634a621bbb336b5a97e30d23aeaa53e62a2de5ba03d2c7202646611fa0fe2c30afdaa44dbd0a0ab4bbad8da84ca0e7c05
SSDEEP 12288:cyfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Si:cyfJ4yL/tNCJPXUQrPh
TLSH
T1FE4523AB20D5948ADE5587F81A88F001C7047EC6672F62F7EF82B4417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 95bad3031b4b279b62384add782c03d90fc94a6973331df50adeabd5ed37d1c5
MD5 893693078eeba2afb2e590e8c171075a
SHA1 f2f4852cae9b30d468af6c4b0bb8d688069d453c
SHA512 95d68c0478d21a5bb342d8316ca0b4080a3bd257232929f19802a0b184d02d54e70837939dfe8e6d034a62b60f514dd84123e8acf84b8407740a141014d8b1af
SSDEEP 12288:5/fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SC:5/fJ4yL/tNCJPXUQrPl
TLSH
T1F74523AB20D59486DE5587F81B88E001C7047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b94c2e382eaea02e2cac1d77dec6a6dc67626dc29254509d84ef5988f22d0686
MD5 e633bd1bd33cdea649962d8b6eff330f
SHA1 90425d52c27f6e9abdf81291b20b46292c2f5146
SHA512 2a95b0ad436be33d0f3b85b32042c6999b7932db6499707c95de5c455bfa6048a9fca477b41fa08af933373b6fda300b141034174bb4f1259b8d54cdcd1e45a3
SSDEEP 12288:ENfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SC:ENfJ4yL/tNCJPXUQrPl
TLSH
T1574523AB2095948ADE5587F81788E001C7047EC6672F62F7EF83B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 89615c3196f4709d907a96f51c82bc12fb539321f49e907ad4670ec5e0d32fc0
MD5 39aa9e9798301ff0260369dd391135ef
SHA1 86e56b2e9724ce9aa61625e2456cb545713d76bb
SHA512 1a075db0795cbd507a8cbd4884e4489d71baca443376a15df691818e141a8e4e2d5676ca0dcc473d7bf6eb59c2899b498dce14be205dbf4a15a075e7f6d5c9df
SSDEEP 12288:MVgfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sr:JfJ4yL/tNCJPXUQrPs
TLSH
T19B4523A721D580C6DD66C3F84A84E001D324BDC6673BA3EFDF4268863FF9659296C361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c6a23ce624b679e2d21afee04b538dc62cb144f26fe27b607a0bee5f9c847fae
MD5 5d32a48bdebc9701534dbef4fb4b1fbe
SHA1 e7d7b2add0c726b10b354f1b8253d8cafe2a9a83
SHA512 6be6919b7bd979c4b555b7fe61c943c7793ed16e06df1c7e8741b1f8606b1597e4d3c04407bdbb68128d2792cf2f6f8bfba7cf6f44ee558f0a0e0987ab611ea0
SSDEEP 12288:j4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S0:j4fJ4yL/tNCJPXUQrPX
TLSH
T1CB4523AB20D5948ADE5587F81A88E001C7047EC6672F62F7EF83B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 343c951457404f277d4d6c739e05b1dc6b37f8d8c5636804ae7a9f3078d5d9be
MD5 c0a51cf81aee7b65df47134d69b33220
SHA1 f1ad6bcb6590e06f4eb98b2928b3b2720d170cb1
SHA512 e61d292d9d8c6623d4a6ab3f1f5d83db56cfda546e0e5b6b840f6fa51b010c91df26c15718a9a62f11461f820540bb37d1aaf03195a53ef4a538844955fb4681
SSDEEP 12288:mjfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S0:mjfJ4yL/tNCJPXUQrPX
TLSH
T1DA4523AB20D5948ADE5587F81B88E001C7047EC6672F62F7EF82B4417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 894b1158222c3ec8cf7520c33a0c993a5b43a5e4bfa23c742d4961a165510903
MD5 05aced951d2c77308eab4fe18294e662
SHA1 1423bff4202aaa2eb48abf391027a39d20e23319
SHA512 3a450f34f961c338e7fead917256a93e6d71583d291a38fde6d18d62556a2a1bbe16c5dcd566e99b65515e74ef62c601d559b26eb1692dc376a444c720b70713
SSDEEP 12288:PXfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sk:PXfJ4yL/tNCJPXUQrPj
TLSH
T1B04523AB60959486DE6587F81B48E000C7047EC6672F62F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 f41cbb58488a10a7f20b4e90d38326ea2982c572776f467ad5a5d075ce68f2d8
MD5 2bb2fd3cbe49cdb03b2168709c99ae01
SHA1 19cefdb439cd4a98f6eebee786cfb31e0e8b5dd2
SHA512 01fa14d06b4d6e23bb724046f6ac2a6182268a0fae9df7780b462634abfa5e3291aa0e25dc1e03831f6c9c8c45d3cfeef0aa2469265f72bd5499842768ad25f1
SSDEEP 12288:9iZwbVzzFEoS2cPvyffJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SY:AZMRzFVSOffJ4yL/tNCJPXUQrPf
TLSH
T1CD6501A5B39018F8EC67827D8954D902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 333c59749a7972d006dc98cb376e0c97acdf74fb9234c8b15ea7b8856dd16f60
MD5 8539d2eb4fba265d571e680df857c4a0
SHA1 904f5c6f6e5c6b4d592eb2d4910993eb45065120
SHA512 82ed771021f06276e529d8f21fc49d9a43e5297d856a08054321d3237e6360cad8c7d62bd602518f821d30e9a68db60ff7e19c3410207a3f00bcf1f2fa3ae099
SSDEEP 12288:8ufJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SN:8ufJ4yL/tNCJPXUQrPS
TLSH
T11B4523AB6095948ADE5587F81788E000C7087EC6672F62F7EF83B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 81142c8b8afb9aba99b208ed95a7472285bedf18aaf8cef0f92727c816dee32a
MD5 53568a20b8250827092ca221c7cc5caa
SHA1 a8e66481d92712fa97ae892985cd1dae133c2d59
SHA512 8ec5d367f2e6a6c069b72eafa75103855f9f48a9e7489881637fe974de2dbaf9b14ee4dea5d77c19ee7f311a766e0e0906401a8d200ef97da183546694a1517e
SSDEEP 12288:G6fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Si:G6fJ4yL/tNCJPXUQrP1
TLSH
T15F4523AB60D59486DE1587F81B88E001C7087EC6672F62F7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 bc7e45e270dd1b8976d2a039219c2642b09749937d35f4660ce5f8b70e0293ab
MD5 9dc750a914eff081f7bb71c6cebed52d
SHA1 a90bbf0a664e1f84e88e74cb8e99dac94e8b0008
SHA512 4342c7d0de92630f30053f1cb625ddd045412fb2ad7311e7a1290fcbf43518d2377996f45adbf314ec54671de287dc3938d4f864cb83f592ca90ab23525826b3
SSDEEP 12288:6yPz5L8LfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sb:nzyLfJ4yL/tNCJPXUQrPw
TLSH
T16D55125732A130F9D53682788990A602F331BCB2073587EF5B9056B63FBB6915E3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f0267dd0bce1f6e2426312f6e9fca0a377f1175395803cbfd6f1979a1a4bd61e
MD5 a51b6fef77ce53924ae2f424d874470f
SHA1 bfde967fc7663c5c483c0f6509832d498204fa59
SHA512 7a798ca36bbb6dc90b3e622f419fc87f03264190e0138210719832eea427e5ddfd5a186469ac32a491054cadef2c9550e0c048e7b9e9cecd7381be564e29856a
SSDEEP 12288:dufJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sf:dufJ4yL/tNCJPXUQrPU
TLSH
T1DA4523AB20D5948ADE5587F81748E001C7087EC6672F62E7EF83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 3821ca7420a69d84b1b34d6d2c4bb681f5d204a933fe16c74c8888369dbdf8c8
MD5 6f7166e2471a75a91f131f5b75413afa
SHA1 5665b055a20088915c309690b1b030ecb30aaa51
SHA512 308bb99ed7f4363e8036b1e2e71eb4fe15685b73612a3a501cb219a4863a05887c977afe752034a103fe772aaeab73f6df390a539c4388d78853120e64b178b1
SSDEEP 12288:VufJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S0:VufJ4yL/tNCJPXUQrPv
TLSH
T17A4523AB20D5948ADE5587F81B48E001C7087EC6672F62E7EF83B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 5c9900f6e433ae2c5cbc861aced3b720c78d6c01293a29c8427c5b92c6718827
MD5 39da7d6e596b8a255205a75b463e139f
SHA1 2a444db1c1dcd0edc64282e75ff12f0f88ceb8e7
SHA512 b5522339973e7c22023476664ef14d52b38c7fd4bc8e1ba71a37b32cd335ba1b3bc39209b4c5781134001d79ac8575a89fcb7abb7a93852cc6d039d170b4b468
SSDEEP 12288:ayPz5L8LfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S8:HzyLfJ4yL/tNCJPXUQrPH
TLSH
T1B155125732A130F9D53682788990A602F331BCB2073587EF5B9056B63FBB6915E3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 0e7d7cd48529eaefbfbc88be1bad32e47999f1e36f45a10c41aece592ca69138
MD5 9d642858f1b896ec474d2e221c4387b3
SHA1 f5e9fefb9f0f0b10538bbbd52897da7156d06d39
SHA512 b956a00fc89e19b08575d7cfe2669261f27c00a99ab968bc7119685c2b5a1609297426ac65674eef913e772e93fa752d78b13fdbf6750815bc4cc6b05229a7cd
SSDEEP 12288:ICd9nWYoaLHF3z0z04PDvhdfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTJ:RT+aLl3z0zDdfJ4yL/tNCJPXUQrPV
TLSH
T13C6501A5B39018F8EC67827ECD549502D3B27C9A0770C26F07A436676F773A11C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 a8ad8f2858e5c4b51a45ac5d191b3a8806005050763c1b60b95a9170a4c6439e
MD5 6d199b9623880d00b20d9e6e6695c9c6
SHA1 ee1b170de3ac76827a2b0abe2ed5f0826e747006
SHA512 bc6dcf9d0c253aaac6b52c613cc7b79c19880decdf0251ab9b32754555f10061d865321106738c7ebe29038b92ac8f257c5e94cd191bf37828b460ae3297007a
SSDEEP 12288:ei4e7/RdTfgwCHKy7GLbbdIvcfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGs:e34d9CHKy7GZhfJ4yL/tNCJPXUQrPT
TLSH
T1AD75CF91F3E410E8F0B7CA758D659502DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 aa9c9d2e4fafb9b01c160c195be76eba83662832ee23b383be933c4681831ab5
MD5 8330e73e6b741ff9b076909ede6399a0
SHA1 ab54390280b4bb98e04b22d3ecc25ae0c32f5813
SHA512 0233ce4be2df5e187c456d0f4529c9cea3cec3972a7cfb8c681b9eb37e52ca4b29126a768181069a01951834a3c8826a8c94c5dafa14abf7071649a834551b49
SSDEEP 12288:DtfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sj:DtfJ4yL/tNCJPXUQrP4
TLSH
T1584523AB60D5948ADE5587F81A48E000C7047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 ac2e8874721103c90e01ad2bd2b935e4f6e1178c11f78bb41a00d49a16bd3b0c
MD5 9ebc4e037e25abdf0018d58447deb2cd
SHA1 e18184dc46e96dc116b7bc61dae0a357e240826b
SHA512 79fe101eb8d8f678114097edc906aa4681df55452de530d8ca5a8a3379929be72aade639ae0a8b758f74fc6ca35c9bb1259d168c3c6c0451027bde0309d59627
SSDEEP 12288:jrfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:jrfJ4yL/tNCJPXUQrPd
TLSH
T1A54523AB20D1949ADE5587F81688E001C7047EC6672F62F7EF83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a8be8d2d934d6813023221c2f429af79e752e25b8bcf2af8bca80224480c3dbd
MD5 e9fafc15cbd139c60a3ab9485825ef8f
SHA1 d98aa966be8f81287ee08b40960c0e5484c0dd43
SHA512 0f069e6fc6998c48414b5c13ac2a68b6200d996b8f37ba1bc3cfa309bc69c639cb98195e4f3e3fcc52baa8703b5e173b8204561d7355759cf748fd0d9fb9ee78
SSDEEP 12288:7cfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:7cfJ4yL/tNCJPXUQrPd
TLSH
T11A4523AB2095948ADE5587F81788E001C7047EC6672F62F7EF83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ffd9db4d0833c8432f20e369e85cfee7d13823923ece970d80d197fdbb891f13
MD5 d0dd6d699ad13a727fe5162f3e9a5159
SHA1 07407b4fcf0ac82f9be7cac2601157adaeb490b5
SHA512 3cac00161931331ae6a3c05d79eb7937ca9328049b5834f01c8671a1b2c3a1c572d98b0ca0f1f4c91876d81cb636e8de8a282a43f4b1de645483ca8070836d5d
SSDEEP 12288:IufJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:IufJ4yL/tNCJPXUQrPd
TLSH
T1724523AB20D5948ADE5587F81748E001C7087EC6672F62E7EF83B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 823762c61e1024e0c3c7b3d4fa3ff13c3b5589177817334949ab2e6df6bddf88
MD5 3726822f8ef82eb94e8bab71cb2c5ec2
SHA1 91abe53b1d893437b5e0037546c33a7869820e5b
SHA512 4bcd856f7973ee41ce314328202f6ad33b5683caae11391768e6e0195da71641919f1fb7f70641ca8639c6f941e39ff97977a5bf0e41722181debf9b71cc5b49
SSDEEP 12288:ytfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SZ:ytfJ4yL/tNCJPXUQrPO
TLSH
T1C04523AB20D5948ADE5587F81A48E001C7047EC6672F62F7EF83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 e0f01c22ae13c1447470025b1abe30b38761865e07ba75843449993c78521321
MD5 2bf186eaa0502fb72ccafd72e03a6d04
SHA1 e35ff2759339cabb7ecea2c6c4f72cf375d2ac35
SHA512 aea9b9dc3002bbba5334eb6e8c4e0573d6d0ef4e59e0d66b3fb742bedfcb95295efaa272db1fec56f1f8af87c0b7328da05eb61157f542c3c5110bb93ddd06d9
SSDEEP 12288:pmfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sd:pmfJ4yL/tNCJPXUQrPK
TLSH
T16B4523AB20D5948ADE5587F81B88E001C7087EC6662F62F7EF43B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 3e8162335740c8b506e1b88a95ba42d1555cee79621ea6f48056e2ed926ee805
MD5 43e39a7efed936bfd6ac4bdd85ed10a8
SHA1 476378979c64b33c5a9c65e84cbea1de61d1dc80
SHA512 0df1086c36df2ef6a343a566f86de50faacfa764ae00ea015fc902635716e3e41c504560269062028931ab4254c5d6454ca75f79a6c5b584974f00b13a0ad28b
SSDEEP 12288:d4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S0:d4fJ4yL/tNCJPXUQrPX
TLSH
T19A4523AB20D5948ADE5587F81A88E001C7047EC6672F62F7EF83B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 1490214c49e59aed04540af7a0c49fe869526134e2f1a3d3038899902ac002ff
MD5 74b2f98d05d2ed701af0df2bfb0144dc
SHA1 5a2e321c93ed4df2f6781e59e7a3e6bc8215161e
SHA512 9845cb6668805fa1d37645ee318d36b9a930180d28192028136bf7b711c4331aea58e05b2fcd5f889bdeced0f23a32a85551e8112c146666742f7c79f4b84247
SSDEEP 24576:Yfwvtk9RX6wkyAIqfJ4yL/tNCJPXUQrPI:lMnYIqfJ4klKXnA
TLSH
T14E75D02AEBDC44E5E1B7923C89A7860AF3B178591B31C2CF029653AD1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 97ca20a64e54bc513d7055af49f8af959f657a2c61dfc0832222fe362a47f307
MD5 bab6c39f9668d046b02055853603b59d
SHA1 d0eadeea45c3eeb3f7ed7c8aee4fc917d5f7b9a2
SHA512 d4ff83280569974b5511329f0d24bbe47d3ce144e7407079ab72745aa39f12267639e02d0cab7677a18e3de659cc974e8b3af598b07556db274e6721bf7b31a2
SSDEEP 49152:XYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK05fJ4klKXnx:6ySzPhfJ4k
TLSH
T10B066C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 86819b934b8bc3de770294ed4940417dfdefcbf738cb212ffed6393a2012669a
MD5 45797e9643b10081cb35246e020b85cc
SHA1 c8bd4685b05b8254bd752bcba3fef8f1412f8f14
SHA512 2efd4fa80fe05acc5af33768b077e00db20080fa2bad513ed4675ffcf85f7ef78881181d31635bf2952af9182a5c38d82fe3cd7d2786aba591c413c276f5e863
SSDEEP 24576:O47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYPfJ4yL/tNCJPXUQrP7:O47JUQjqirIhCnDHUPfF/pfJ4klKXnD
TLSH
T13765AE1EA3EC01E5E1BA82788515861AEA71782E1F32C6CF1270837D6F67ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 f62155c8584086688d51b69f1e9c54d18b08ee61ab8bf49431d5d16e283eb66d
MD5 a4a0cc72845dfdd5d29ae57b5e7de01d
SHA1 fd2f1d0fff12109bffd010f0cda2eb55b0e1b927
SHA512 eb0928b51cc9797e30690da2e834b857c66b2cfd39a421b5dbe0cae77a43bc5d3d4cebaa92436d0ad7cce1a2234e0d5967d7225af7d44278e8cd4d6b11616e64
SSDEEP 12288:bXsf+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:a+fJ4yL/tNCJPXUQrPV
TLSH
T17655015AD29841D8C46E92B8CB449201F3237CA593E2D3CB97C0F47E2FBA6955DE9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 8064c0e6ec9d35a231cbadcc5ee7280783a8d111f5b2013c7fadb6e88bdc2b68
MD5 57cca626b9367d6a85a48894c630649f
SHA1 7a658cdb1675b1c99a1a017243f6b48a18716509
SHA512 e560c06f9727d1ae97eb5c73fa2737459ffca17f04d5c1f108f9af0b20bc75bcea869b75d54f948dda2306f51ed7c05f7431870671397f249a6c111132ef532a
SSDEEP 12288:kEez+U3fmbPYcFTkr5NMGJlrN86djmfQf3I2zVaiad9d1cNeI:kEeCUPmfdkfJVN8Yf3tzVai69PcL
TLSH
T174351850766BC75FC6A940321E32C2CCA7707D51EE05AB0372C8873FD576669BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 5061adecbb6389f77dc3391b2757f7684cab7d7ea3b34eb08421e096fed813cb
MD5 e5874eaceed0a6b155daac9137a78d34
SHA1 0e8e6b70ef27e1da53a9e9f23a12c6d4d4717255
SHA512 a049d045ef06bfa4fb09856b036d8bdecdaf5fcb9f5982c7e4fccac89e9dab9d08c0017d4b681b974c1f09f9c99395ed06cfd0656c707e3425324fd375bee4ea
SSDEEP 24576:vusAXTPkSXjdm0E85Z+ssQY2BF7JT23uB2K86XW4d:qkSXjdmUBl
TLSH
T12A55D6815137E3CFD1FB6032076A5B4CAB64EC17B3096F6763C4453AD86AB21A4B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setting.ini

Path C:\Users\Admin\AppData\Local\Temp\setting.ini
Size 652B
SHA256 7dcf9508ce65c31607f1ad282bdfeb640ee4b4519ab2014c1ad31e8b787f843a
MD5 923d1830f97cc9c5367cfdea115d2b0d
SHA1 a13584dab18d0b1d56ca241395d6b93071f6c785
SHA512 73d326ae30c801e2f12a2ca61e079d675613289cc815a82ff4bbc958a6193b08791e941738208f0013a1835580c0446d1795999078959f5888338cebb8fb03f2
TLSH
T1E2F028334D48C91D112273B41DF2886561EBF481A870485CBF6AB8836F9895717767DF
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 926e5b7c0cf8f331a3000de283e221d12dac038789e960243f82d7edf8f81a10
MD5 93439586ef3df301fbb1ca3db75999d6
SHA1 d680ca17025e1d4cb5e6c6162c2461af39666776
SHA512 50ef18edfd2c46d4e3c3867e9e1de68c56d167e388cfed6136bb00b6f058a0c310f04cfd28f8182e8ed51ab7e938c4d2d5f24c6dcf69e0451ee41da12c7395db
SSDEEP 12288:Sb72fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SM:c2fJ4yL/tNCJPXUQrPH
TLSH
T1FE4523A751D49846ED7687F8164CE000D309BED51B2BA2E7EE42B4853FFC98A1DBC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6cf8a4bc90a2974d20d4816bc7f816b24d6a2eebc52605f34d7f7fd73f0ed2c7
MD5 8136eae018bc93895006e2796e67cd9e
SHA1 ffee9d0e7462a88813679551e4d5b6bc5359984b
SHA512 36cb331617da7ad3c7893a684d42e504800ab5911f273ad54e199daf5603148cde4bb283b5ef82ffe3d60c60c2f8f252440eb6841e2a0be97435b051397bf469
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYEfJ4yL/tNCJPXUQrPF:/gb4mBIBhGFPfJ4klKXnd
TLSH
T1DB65AF1E22EC02F5E0F5D2B89DAA4417D6B278160732D2DF1251427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 613ae31dd67b6a30252a01622a09bcf5b32987c7490b2de92750151a9d58f30a
MD5 84c06d71b077087a9b86ede8f56fbc2f
SHA1 473cf0c29e072a0743f0e38617dd75161cd27dcc
SHA512 2b883958914b0028893b4b09cf1ffc2f799412791d6186b9b0634aa96f7b2774b1f0806ccf155ef342cd5a20d6d8abe21ea37c9f6a7aba1f0a7026787c636c44
SSDEEP 24576:zG88u8FpJqH1Bzria7/mffJ4yL/tNCJPXUQrPo:C7ZFPqVIa7/8fJ4klKXnQ
TLSH
T18785026672E101F1D47BD1388A868663F771B8150375FBDF0BA88A512F23AD50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4a49bec4685cfce906a1afa993463c5eaa83a3ea3986758bcf427cb38460d65b
MD5 add3384bbd2abbd3de12b3c3e25618c5
SHA1 373a6025c4c55379ae3f991e86e8213686143710
SHA512 960a00d61dce988a7ef0743eaaa7271c2ee3063b8c960c48fa70a184715e62be892687c6afde3ad2c4b1a23c4fc566ba6ac34dcf041d2947808fe8242f3f7d2f
SSDEEP 49152:UBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjjfJ4klKXnS:3G05lO43bifJ4k
TLSH
T1ABD5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 17d55d6e17ff28f25aaa2bdf34709d755206194371324e5a350cad7e61d22ae1
MD5 9653429fbb9eedf9c10f0aa2b47d5b2d
SHA1 766d5d1a40fcd7a81699e18ad050cee5ffb63075
SHA512 de7990071c3db39b7661059808ed9dffaa343f7402b1fdce8355a8ee87bef002585e57177c5a2ef8f7d0e0ba66888833606ca5747e5a43b30f6a84685100d91b
SSDEEP 24576:tfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn5fJ4yL/tNCJPXUQrPL:da5POZ3lJt2pasx2+mrfJ4klKXnj
TLSH
T1DB65BF5EA6FC01D5D579D17CC583861AF5B1346253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d92fbfcece064175aace1f0ed49ff7da98ec4bb99fa2eaae9a6098f414520a00
MD5 68fe6f22e965a13fb04111b375ad2e2c
SHA1 542ff4fd2bb426c3943a2e0aebab99162f029774
SHA512 a5de9239d8697f9747ae0dbd24607c23c93271131a8c7b1994b66c537c5f7d3831aff13fd9de5b5e24d29b3699121d61b38d223713cab694d08d71fb8de47194
SSDEEP 24576:ONcwHdjbyQ4nLC18lb/EOjowL7FknfJ4yL/tNCJPXUQrPU:ONc/zEOVHFcfJ4klKXnc
TLSH
T1B0858B2623E901E4F5BBE1BE896B9546FA717865133486CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 48e8d1b3912c4084e521dc31ace29a862aab544731c33af028d32bed3e35017a
MD5 8f5bef3acb641012e38e6a0f2f383547
SHA1 f3e6d4178073e7fe02887d4ce01c792dd188b762
SHA512 7647dde91cd44b763ffbb0536d68d62e1b620739704aa61ae83d8d7643fc8a4e1061f44e84ba4e1ec5486bea7de3f2f292f568c409af4b2edbb1382ab76d3c71
SSDEEP 24576:ezkNvNnaFeYhJNtmZBmVfJ4yL/tNCJPXUQrPI:ezMwBtOmVfJ4klKXnA
TLSH
T10555AF6EB6F846E4D1FEC6B48D238112E6727861073293CB9390C13E1E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 102b6175c0b152d804a33651cb00aa033562132a7d5165b032175d9604930b80
MD5 c0589f269a26734fce30efba2f21c265
SHA1 d1392034432682da1fea20cfc94bb6fc7a14db79
SHA512 db241fb6a25d4e02fc1b6d1cca6805506adbfb889f9552e0b59dccff654af23562a7147fb909b816b5e2225c0d8f498202d0ec743e671dbe0d1c4aeb1728a61e
SSDEEP 12288:rHvUrBFrEjwaQTfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SB:rPUr+NQTfJ4yL/tNCJPXUQrPC
TLSH
T1D165F16F22E818E5E676E17C89858209E771B8A21312D2DF02D1817E5F77EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 601153db5787c9ede4e16f7ccd4b2f45e52b05a08968427092c9f088c8fd54da
MD5 1bf4750fb093aed1f269ad845fecdf2e
SHA1 6fe9a8bec8124bc74d4ba91b8baaa3cead00ec76
SHA512 f0c219ea252caa7bf8f7860bf7c6d54a3585ae22177d1bf4ed18e375038087d833d73628d72464c43ada293a25b20e778058cf9aa15e253b503823a884b121da
SSDEEP 12288:zQcMxWDXN1Dp/fshBItT1IQgASfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GG:jD3FHshBIYQgASfJ4yL/tNCJPXUQrPe
TLSH
T1AD75E17EE69C04E4D57BC2BC9A538506E77138E9032266DB06D0D1B62F6BEE42D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-322-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/264-117-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/264-123-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/264-116-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1060-0-0x0000000140000000-0x0000000140173000-memory.dmp

Download

memory/1060-161-0x0000000140000000-0x0000000140173000-memory.dmp

Download

memory/1060-7-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/1060-2-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/1060-8-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/1148-199-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1148-187-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1148-201-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1148-194-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1972-210-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1972-204-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1972-203-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1972-377-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1996-185-0x0000000140000000-0x00000001401D8000-memory.dmp

Download

memory/1996-176-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1996-182-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2496-174-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2496-86-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2496-83-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2496-77-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3936-96-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3936-97-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3936-91-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3936-227-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4056-108-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/4056-102-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/4056-112-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/4056-114-0x0000000140000000-0x000000014016F000-memory.dmp

Download

memory/4056-101-0x0000000140000000-0x000000014016F000-memory.dmp

Download

memory/4712-356-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4712-127-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4712-135-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4712-129-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5184-150-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5184-390-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5184-372-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5184-388-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5184-156-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5184-149-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5264-374-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5264-163-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5264-169-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5264-162-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5264-373-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5264-376-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6132-140-0x0000000000980000-0x00000000009E7000-memory.dmp

Download

memory/6132-145-0x0000000000980000-0x00000000009E7000-memory.dmp

Download

memory/6132-139-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/6132-371-0x0000000000400000-0x0000000000530000-memory.dmp

Download