acc687560790a1254a63683b325120092c68c64de7062d13165020da7ea52430

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 20:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Size 1.7MB
Sample260804-yzrgvsdn6y
SHA256 acc687560790a1254a63683b325120092c68c64de7062d13165020da7ea52430
MD5 54aa66be6c5e329d2cee518a143b1b70
SHA1 c2c61ff7d00f231f2ebdf869521c897ac5478349
SHA512 98617eaf20dd94e0e76d612df04b3a97365ce617554b9c6c221f4c9cd7b5c9fc1c133b61de7de6f3cdefe2d04509015df379b40f670b3c3b1db9f4159f9d3461
SSDEEP 24576:ziBE0zqwXeAVmYpsqjnhMgeiCl7G0nehbGZpbD:3e5Xe6XtDmg27RnWGj
TLSH
T14E85DF58A75841E0D1B2C27888539946E6727C018B71DBDF1298E73E6F77AE08D3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 11 IoCs

pid	Process
4868	elevation_service.exe
4500	elevation_service.exe
1180	maintenanceservice.exe
3284	OSE.EXE
5864	PerceptionSimulationService.exe
3232	perfhost.exe
2032	ReFsDedupSvc.exe
936	SensorDataService.exe
5020	ssh-agent.exe
3160	AgentService.exe
5640	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5cbdca53e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e1c4d0c4e24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007afb59d04d24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000024c5fbcd4d24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000097f8a4ce4d24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000827b7d0c4e24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a7d5dcf4d24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6bb9cce4d24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe\""	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4868	elevation_service.exe
4868	elevation_service.exe
4868	elevation_service.exe
4868	elevation_service.exe
4868	elevation_service.exe
4868	elevation_service.exe
4868	elevation_service.exe
4500	elevation_service.exe
4500	elevation_service.exe
4500	elevation_service.exe
4500	elevation_service.exe
4500	elevation_service.exe
4500	elevation_service.exe
4500	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	752	2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
Token: SeTakeOwnershipPrivilege	4868	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3160	AgentService.exe
Token: SeBackupPrivilege	2032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2032	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2032	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2032	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2032	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2032	ReFsDedupSvc.exe
Token: 33	5640	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5640	SearchIndexer.exe
Token: SeDebugPrivilege	4868	elevation_service.exe
Token: SeDebugPrivilege	4500	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5640 wrote to memory of 2684	5640	SearchIndexer.exe	100
PID 5640 wrote to memory of 3268	5640	SearchIndexer.exe	101
PID 5640 wrote to memory of 5736	5640	SearchIndexer.exe	102
PID 5640 wrote to memory of 1020	5640	SearchIndexer.exe	103
PID 5640 wrote to memory of 3664	5640	SearchIndexer.exe	105
PID 5640 wrote to memory of 3164	5640	SearchIndexer.exe	106
PID 5640 wrote to memory of 4608	5640	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_54aa66be6c5e329d2cee518a143b1b70_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:752

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1180

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3284

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5864

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3232

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:936

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5020

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3160

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5640
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2684
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3268
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5736
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2932 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1020
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3664
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2932 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3164
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 73f9b97f8cd4d72da43bd3051b6fe6d335561df6f096e7dbe0937dd646772063
MD5 2f3a5d8b69da4097d245098c93e8b239
SHA1 f350cdff99800e8bf58757755c71c1c71598288d
SHA512 6abda3f7809cfa3466a0aa8bffc05f842b924d419b669ba0eb10f03990efc03c16b6e5692a91e232c5cb3f44adee71c04467b0036480542d098fc18b017f4653
SSDEEP 49152:Rb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnMDmg27RnWGj:X3q6sjB/D527BWG
TLSH
T162D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 3054c3702a9f4e2234f5bed4201275e12b6a2ab484504de4635af3bb04d819e0
MD5 e997ac7ee8f2215d677f1d41cb743763
SHA1 258de0ed5953b5422c5b0896805c4973abbbff91
SHA512 a3c7261d98a724b87175381ad54c268f65e4034adf711340a35624295efcb674decb853640cb171a1e8dd6b21fecaad3405e7cfa453fa44e3ca8be89a49a9bdd
SSDEEP 24576:1XYfDtczAXsqjnhMgeiCl7G0nehbGZpbD:gtcKDmg27RnWGj
TLSH
T198650129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 f634055aa693fcdaec457c6afd0cfc9a5701a7eb712f7e4efd6071b4d4a7e680
MD5 4f633ff378d1f00e875cb9438cff0b76
SHA1 7fc335c9cf9687f3c51105922b0f0e652c1cc3d9
SHA512 4e9f70fccb007b0a60e5e7b08e3710edaa2492f9fdb8264e45f8371fdea4a1ddb4f575acf6ee4ecfecc9a24b610310eb2102df74479ea0e1df07c004817e5dfe
SSDEEP 24576:x0Le5ji0hmxxrMosqjnhMgeiCl7G0nehbGZpbD:xPji0AjtDmg27RnWGj
TLSH
T111859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 000e5f9ffa357a72e495f73ad7035074f0b2a803eee2d57a8e939afb59441279
MD5 1fe936c646eef0551da368533e82961a
SHA1 12ea1891eda82cd82e17fd6ce1d7c9ffcc0cdbd1
SHA512 b86cfd1744c42c517e233d9138f93345f019065ee73321c92b8683280f8fdade8c42ed15e71b307e07b310cb2c9b4afde733580ec2bbade8363f5de5245ba703
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWn6q8wyuWsqjnhMgeiCl7G0nehbGZpbD://ezSC6vUzPveHjy5Dmg27RnWGj
TLSH
T195755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a226996957ee35ee8758fcc64d414c70a020a6f66114c38bdc3a1d50aa233a50
MD5 18306fb438fc8b1876a310739c96c9c8
SHA1 1d4e5ce65acfb856b455832deb486a76ce6ed58a
SHA512 105d5176464e67998a19b8b72d1ea11b46d91f6b3837bdeb95e3226122737b71da6191db30d9650bbb2700110b2a48bd23d4f943198d84c621ca74ccd581b0e4
SSDEEP 24576:JVbqPb88hv/l+YbsqjnhMgeiCl7G0nehbGZpbD:JVO88hXl+yDmg27RnWGj
TLSH
T1EC559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 3fc0fcce2561d559d83ef8a8df79c797201d00f8537cf61e086c8306977bcadf
MD5 8f5863f0f1b63b5de706c52dae38f172
SHA1 b8344de1dce3f89634f2c27cc3150452ad938e64
SHA512 0c196b7583837b3a737a2ef44fa0b88d08be85db71aefb671f8c1a0a4e47d4d4c174591d15e59e23a87f66b21398f3c054aef4736c39ec37aabcf07ac19b0103
SSDEEP 12288:cLcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cLcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10C4523BF864C50CAEB7609B5C3E9F51EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 341662097b1c8bd50d49f3a4a39fc186cfb39fd0239b8f0c439e4649b355579f
MD5 1bf9009d96c8aa9ffdc5b9a1c74f90d8
SHA1 f843ae5a22b378127494134bb26e56ffc1447033
SHA512 7c70c484e6bd1d377b4b94339443b949826c0d943c29bcb7874b01dcc43e3f86f3198e12d54b8437b4f36472bf99ea6abef4c361d1fe27e0564f035462958a33
SSDEEP 12288:LeBNUbTVO86UzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:LJIUzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11765CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 337ebe9e375ee0f87042f434b72d575766077bf21777d94270e358d68a1b7bae
MD5 b7c0a0c574fd5da2fd68897e64ffba04
SHA1 350b59cd1e18e582fa4ab6cc1c3dfa59e81038a9
SHA512 9f7cfa4d5ef849a71a79761f82febb76dd662e3d6dbb472dc10fba2a9841c56c360dd8be4d1ac1ad43d8df76d325def5bef8ee89e9b1c1153506651712ddf8dc
SSDEEP 49152:uQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THO:uQvGAdlCEL8c/DRNw5CqD527BWG
TLSH
T1AC266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 11f938d4935f823580e0280868ceafce12ec7bdda2beae081d2d83536d4d7976
MD5 fde6ba7914ec6285c40e2de38ed4354c
SHA1 5661e648abbecf518e0d42abf604881000883201
SHA512 793d1728c554787e03212ce278bcf06ce463f4976d8e769e52f8e23a01324260f808da01490b5b81845a9a8745bf295e5abb3c664e1571ab011fa58340e83987
SSDEEP 12288:RAwSfxL/2Dc3RDLLmt0LDQewsAj5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:y0ewsAj5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C875E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 65e08f2e74df4a2ad64bf477806e6e033cb211f0612bab46b8c3fccf28084158
MD5 75ba0e765af3c6e52201d70dc5e34e76
SHA1 abb9ee168f803f0e8cff9f33cafb25f49d90eb79
SHA512 1e51deb71e89c3a9ef2c058e1616618ee67cdb5837b7c9459b1006000d0f063eb759d72dffe4842a8a0b41214ef3308087b72798091b7a56c232aa89cdea7b37
SSDEEP 196608:aUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH1VQBWG:aUEtQevvqc2W1cpV2tI32AB
TLSH
T187474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a5f732ff30f3f789e2baa3b7fc88969235a5571db59ea72b31783e0e60322e79
MD5 428f2b1e7dd5e84971ac783f676ab762
SHA1 767572073d01731f37be5d4f148880ce4ed4c694
SHA512 96256b2f17fb147f67b5bacb4e85f0e43c17b3a0f08e4350389b33f2a80e2d608115c537d192cc10b1c0099831dcd0b4fdc2d25eccd2cdc060bfb828ca718448
SSDEEP 49152:XCbRquA/m2yL5zTfFiV+XenmE3/zdDmg27RnWGj:AoquVjnm2D527BWG
TLSH
T18BD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ed180c94490e00621ccf9f12e2eaa4a27347877bc159d97b6a07b3f46b3b4b1c
MD5 6f9d0bfdbbfa11edf013034d22416292
SHA1 9920b6b9ba77dde67c098903aa5219d389a72990
SHA512 c9bb11c0796a2e52d0496f8a37d6b4d8e6b158a6fe648224f517ff16b19fc9dde1f2802adac03887bd48bc4eace6afcb3e52b0ff9611223ce0c545d013c35fb9
SSDEEP 24576:MAhGL3IFoiwtA5l7S53SsqjnhMgeiCl7G0nehbGZpbD:MAMUFoiq5GDmg27RnWGj
TLSH
T191359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 1ab9c0ca41572c29644a03da45a97836a9dc4c361f51d52e7234a1e41321c59a
MD5 7e8cfa5190413d6d678347c0efe52260
SHA1 b715ae6bef4e37b37bffc1f3e1bf74de18259875
SHA512 d184d5b1a9587e712894cdc267e42709e4196fc22def315523142cd128e7c7abcd65ce3e0e170b8a9db45d729c1281b114d42870d909ce747f809fc806536f99
SSDEEP 12288:pmw5HEjsChNVBFgl0WDm+C2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:kwu4OWlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F665F15A72A80CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 c258ddec556070b41be4084fecf740b0d018c3136f689a60a684fe4a9dfa5dda
MD5 80ea1cae8500c2d942cea7abefd16f30
SHA1 080c400310355eb93261a95b898ae1f8f6555586
SHA512 330a37f2e0695a352d2a1973de572873f4f98d7a514c3b34ff7bce54182dea4f04a15d280f220a8a7f84db69440f9e10074ebf5a209abd5daa70586689966f77
SSDEEP 12288:ceZ1IyJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FZugsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F75512AA239820FAE163417CC5E5D609E7337C62673003CF166659AA6F73AD44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cd74ccf6c8f32f9b8a53eac19b8a44779ae7d3e09fb6ea350523d54f7639a047
MD5 23787d69f647c24ca3d09111501600c5
SHA1 d4109e8e1ece43862b52734a18acc3fce74e22bb
SHA512 e453fa9d3be595d8abfba24b3639c9e019bc747d3494aef492a8e6364e5a21b780c766c0aea5955907c806e7e492444e23bd6f0a1ca0faef5fe7bfdb4ad288e9
SSDEEP 98304:GQRQyi36YOcPbLvw2gAf+PN3zD527BWG:tQyiKa/X+PNjVQBWG
TLSH
T15F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 24eda46498445ea979b35e455e09a370276565aa406bb2175a9dd604449c3ae8
MD5 c174ef0f80e8acc8003b33c8f78d3348
SHA1 ae918e295e3d99ca94f9e392067dec66da777c3c
SHA512 4c3d5e9188c369d61aa79ab54aa34d8bd8f66e875ddea5f4d7683f8cc27cbbe5848863b0655448885e87245ad179dfb13b9fa69d099cd903bf1f22fbe31dcaa8
SSDEEP 98304:yQRQyi36YOcPbLvw2gAf+PN3zD527BWG:pQyiKa/X+PNjVQBWG
TLSH
T15F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f4d9c141a4de5d5ef8edcd32cf86c72e2bdf0aeb09ddea47b5f3f7bf1dc71c16
MD5 736cd973067332ef336eaad8e58a2ca4
SHA1 53cb30b35d7be62e122a47a698d8497879310561
SHA512 05fe2566bb41954249813f923d5938f99bb320e1f6fa8c6bd2cd42020131e9603ef016877e2091365a91d4a3f1155f540a3eb0be3dd3aceb337106acaee0c582
SSDEEP 24576:jwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0QsqjnhMgeiCl7Ge:b68Qg55nhceWu7PNU3/tDmg27RnWGj
TLSH
T1A9B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 47f24b2bbda046984634afa7ef48f6dbf5a279acf30a603092c743ae47a3eb5f
MD5 6530ccaf6f06037259f3c2a787ef8073
SHA1 0b2c54d3ca7aecd62eb036bad71218cda99fd13f
SHA512 166a34a359b0472b38312f2656f4730f0afab31fea3859de9f7be479c6a2809da1610e0e7d76ba52509a79c377e672d72c7c825c6928b39268f8781db5721cdf
SSDEEP 98304:ky5112gYy5azzVvt69nLKnhZID527BWG:lLIHEWhuVQBWG
TLSH
T12E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 15f32fa23cab5e62e9dc66588ecca1954baa3b4a2eb6e5781e951bb8c1f53f24
MD5 b30028484a1840caf8f5dab158301ace
SHA1 483adbe73746fc50d5ac0eb2d2e9baf78afd5d3b
SHA512 5d512a8b3620dcb237433fa4eb49b71b9080da6bcb026ae33a7bef4a825c73b5dda0dd6ba09571d74dd0061e831aa4b3a603913b6ffb39deae6db05adaba0252
SSDEEP 49152:vB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gltDmg27RnWGj:Ru6Jmdxd2dtD527BWG
TLSH
T16DD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fb626506bdbb9c83b9541407bb5310d0ad004f5feb3c685d0a2b5ab57ca02bc7
MD5 59b002b4ce01f639457c6797d552505a
SHA1 296ef1f643a9aecf94b0d585398ad3d1b2c03d5b
SHA512 b4016a48dd4b356e2c44bb11de2e12cc211456f90eb51cb444888e9b27c3058a04a348f76a61455373896c0c3f47425f82d2f9ea0f812df6dcf76f9a2c147e92
SSDEEP 49152:H1hpsNoJpF1A63U44CwH7R4xXDmg27RnWGj:HmifPWR2D527BWG
TLSH
T100B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 aa2841aff26845b6234d733258222f49e1ae68df0c2c9665750b8b108cf5a769
MD5 e7d32d8ffc26ebf2c98b61a2a214cc9e
SHA1 91f5060adf60844fdca079fd5811aab43fc0916c
SHA512 ac6921554925ccb14303785eab225c584cd022b5f1adaa1a1b52082c4d9d1243e07b6a75c68fdac3314ec120f59732022105eb420f5c511857b08eb94e4d7641
SSDEEP 49152:QSuZQIY0Be2KcRVtOnks6NMHqcDmg27RnWGj:K5dKii61cD527BWG
TLSH
T19CC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 538c21d79fb4e98971e4ae39d90f368e5304477b9d90e87e9f14b096ad487d1e
MD5 dc4512c994b7a6a71c61b15885d3bded
SHA1 068bd055932658c0411f9ec3f9934634a334b397
SHA512 5514dd06cd97ff66834f73869beae0c564aebf9d5bb1f5e34a5408413389109a4bcfdbcaebc7d7817425064fe794cc7c1300940d7ef2557876588192f84f4aa7
SSDEEP 49152:NhtSn8EApI0fig3giDn0AP5wrDmg27RnWGj:cX2imphCD527BWG
TLSH
T11E95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 85920f54b3b3185f619ec90395e21e6ae068b7ae3fae2705918fe50f6332b481
MD5 d105aad626b0cb49623ff86eb8440d27
SHA1 3de597429831375095da05bd75575412e38dde30
SHA512 2273f6c453eaa635eff78fbf24a47ac5cd4a1f7dd31e8c747788fcd589f5fad17a86c8bae42363d2a04cac8d117963d75bc555f2b46a6eefc860809e4743d96f
SSDEEP 12288:90Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:90sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E04523BF965C41CBE52649B5C3E5F10DAC073E5BE92004837A577CB9FBB24984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 fbc59a83c531957ef121bb945a82f427ca829e418e2b376e64e58463c0685612
MD5 e268d0b6a83c606433da090eb913176b
SHA1 1eb3c32ea1dfe73a516829ad656e9eaef8183dbb
SHA512 ca8877f70cce17d61e5ca1310d62a3c7df00c6754e3903bfdd6bcbb4ecf284f309b04375d6bdf5da8c9503021f753a5f0a71d65d1b7b10f78741a03d46234332
SSDEEP 12288:xNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA4523BE965C41CAE52648B5C3E5F10DAC073E5BE92004937A5B7CBAFBB14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6986be6ea765274f6f710ca83596ce2051677c592c0402863bd5322a9a8d5642
MD5 3cb67fc03519c000ab2009d3ea31f9e8
SHA1 6655997ea9ae2c847f96f11a2c7b458ad68e9f01
SHA512 481265f5f12c9dab072b79c271a0ab7ce0be6ce50685ff6a90a48020774cff4c137d60dcc8793200baf025840de2ceb69b0c98607075168a724166f8f97e0ae9
SSDEEP 12288:cLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1434523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837A977CBDFBB14984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 0a6bfb0ff2c7a17ba6e165bc32141d69a4386a54f713923a7c3ca71b89d41fcf
MD5 efac924c7396cb3721cb7a1c14731540
SHA1 9ee777bb2be74c2c38929de2d7c7a11868c71bb9
SHA512 dd72ee8886fa868ce195b5cc1b0bea94bec457bf50c089fe6400b9465413316aa797949af5cc41b8f21f8270558c6c859e7034d72ee312be98497d1c586828ed
SSDEEP 12288:6VyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D045237B675C00C6D83285B4C2E5E11DE8277D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 53baf8a4af869fbe873458fd78b1660f7b9d080e2727916412382cbcdbb2cecf
MD5 f0c40412ad1360c4c2e2c7e6a6dceea2
SHA1 df3ad5289e0052d469eed1d029d222aad2e4d9d7
SHA512 4e93702f05480d579b16fcd401b7e711e86bb8a0900753f5c37afb3c8e7e149d155150c1de0f8854cefbd37a83cf798101e14adb2b724df988948904d53f73cc
SSDEEP 12288:16Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:16sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1534523BF965C41CBE52608B5C3E5F15DAC073E5BE92004837A9B7CB9FBB14984B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a56447c0b0303971378635e15b656429087eebb65f0cceb2e3c3052c68c50b9f
MD5 3ca986bc5d3ef36d29c520d34f7ce0a8
SHA1 55caed2bf62514734aae17a30214722ce5ce0670
SHA512 78dba52adb31b7382be1914c116f2181b65c905a90580cc0972b6e05a7291d1292881071b25a514bab7e6d7fd1da8171176755ceaa551964f48fe26c1685a0cf
SSDEEP 12288:QxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1154523BE965C41CBE52648B5C3E5F10DAC073E5BE92004837A577CBAFBB14A84B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2465b5d1a8d1973534845a077c99799ae93820a15642d3b0a07b408055cb9eb1
MD5 47a734b9ed62772c38d93daa44eee572
SHA1 91308c2660104453d0eb91e7362f960596a06975
SHA512 39d9a0f203878b96b564f47c251e737e8e1d31f69674b522e6414aebbda0900880aa9ddaf300ad900d1ee35634397de44642b39dd7457425e3446c783965eff5
SSDEEP 12288:qVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BD4523BE965C41CBE62644B5C3E5F11DAC073E5BE92004837A5BBCBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 4dc00a6971e34edd615cbb8fa19c51b37e2e89ad1f33e73ae4cd6584143d1b71
MD5 41c2ac62bb29a6cfd9c858ad5b976106
SHA1 344922a4f907b3fc92e5242a6e52e096c455c45b
SHA512 8100d6da44150286c7570c7a00544561d0b9e8d0162adab4aaff59124f5ece4dc33bd625f82904b17b259c9b9090a9d2c544ffb680d56cf4ac50677e597b5c47
SSDEEP 24576:KZMRzFVSOtsqjnhMgeiCl7G0nehbGZpbD:KZMRzfVDmg27RnWGj
TLSH
T1D76501A9B39018F8EC63813EC965D90AD5B37C5A0B70C61F13A5366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 471801bdb6a2a504e032ceb56cf537d278fd7f9aae0d0411d0d87a8d623ac492
MD5 1dc5acead1bfd9c74b1f252628683e89
SHA1 1e5178fd97e45b9ddfac5f4046a85198856cf4b7
SHA512 48bfdb3d5f081ac6b38662673d0592b1e0468d287f65869ff88cec4911c1673de2fefa117a888e23b75195176cf7c5aebb003e309eb721a0dab326a95c7a8b48
SSDEEP 12288:awXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:awsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1774523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA5B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 711e0ee4ec4128310f3aac87cb5243187b1d22e8fdd7766e0303cde3fefa87cd
MD5 1fee1019e6f9b259d22b769e817d1d38
SHA1 7ca0a4c05fafe5fb7adbb866fcc7ab7f68f0cb23
SHA512 5d1431436855377c68a97434a397709c9b297cd232a1269fef259a5cdb878bb2069418c070451a577206f778bf3c085898db82e2f68bb680b2e585f9326db526
SSDEEP 12288:csXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E44523BF965C41CAE52644B5C3E5F11DAC073E5BE92004837A5B7CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 9c9afc98ff350f3bc74b418c556f11a1baa51e2cae6368df222f22e15dd3b327
MD5 0ec8b66610048d231f0fedd750cb86ac
SHA1 3dc1c7ef6b219213ab07c10a36beabfc0c3919ba
SHA512 b180ccab96afa637a3100ba7137ef7eaaf6599bd66c021a7690945cb0cf4a764549d1610afb298234c6a0ef130bb049cebb07b4268904fbec715712d5fd8d49d
SSDEEP 12288:IyPz5L8JXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JzyJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16755125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 df8c7515ce7a76478138a19b61a40d84737566204f7d59552469516bb159d62a
MD5 96e312f22e245ff35652038988ec994e
SHA1 c166de12163abbe8ed006776a050c1a38596d87a
SHA512 358425baa86345d8417fb28a4fb0a5bde6d852d533110dc42efe9ce49fdf764c8b66c232e2573d7e9d50261c8470b6edc07ccdaf146b0772517901a1f37de12f
SSDEEP 12288:awXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:awsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1414523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b9cea40ab4c9d2475a7a62b4f7bbb6493fd2f5f7b816aff4e18a92855913c1bf
MD5 8b289a010461512a759f883220ab3302
SHA1 7cb709b9a9bf9a3495b0a513bc73be99eada94cc
SHA512 31d2fc27319d1fa57c28a2642359b187b196600a21b8f0d1c8a68e8a8a6d0dc725d7ae9e4abf83ce992d7ffd8bebee2c283f8133b59e9158bad4726131c5f4ac
SSDEEP 12288:5wXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5wsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F44523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 5de3b2d235b9621100b70785c8f6d715eda8cb451367e5db6c9e2a12c04882b7
MD5 844c9466c5c3d33675ab69d7432e6599
SHA1 8594e188485f617efb11d6ad0ce49db361e03384
SHA512 36e4af7f752bc9a8916b68314edfc27d34b516d80c17c740329b82845758c428f826f4fe88fee91ba84d096850c74b5c5bb0814d7384faed3024220b05109ba5
SSDEEP 12288:6yPz5L8JXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nzyJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10D55125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 36ce2cfbe929c8913d0a859e786b556f59fe0c45acd5d5cfa60653a61d762e37
MD5 9857ae5f5c86160baf963df0876245a5
SHA1 08223e045b92744defacf49219f650b1945cc925
SHA512 fc313dec31b479255dc25635c3e678e7029160ee751e48050b6a75dbd9784e1f286a66673b8c6ae98e2aa70998780c09f45fc961b0482841548873551df85906
SSDEEP 24576:aTDaLl3z0zD7sqjnhMgeiCl7G0nehbGZpbD:aTuLljaDmg27RnWGj
TLSH
T1C96501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 e0b353cf1be265467a9fe2ac1e98f1a9744a48eadbc1b15db47c5669d3e70694
MD5 4e415e49b1ac683ef1dd1e2b718744b0
SHA1 c770c6aab7d6b17fd8d9c9508edc5567d641e498
SHA512 e1218c0cef1e9adc7bd2fad03cb8bc3a96e0883193e3357400f4b668fad6a102dd62c2c5f98c42e0eaa97ac5ce19e958021dae1efd834847eedb397bb076d787
SSDEEP 24576:p3vd9CHKy7GZvsqjnhMgeiCl7G0nehbGZpbD:5vd9CHKyaVDmg27RnWGj
TLSH
T1D475CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 48a872a8dafb91afbcd80c314ceb82f1d8b8bb440e3671aabc40988153ff235e
MD5 b6512e7963deb6869b6b29e11a85fb9a
SHA1 904c2aa38cb2b426ca096a0c37b4946e9d0e486c
SHA512 d399cf7e084417aba87fc8a516b194323bceee8d035ac2e2fe62cf4b3d3829de63b770da84ea86ab836e476090fec533197a45ccb8bf001906627e5613d20d3f
SSDEEP 12288:YrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1564523BE965C41CBE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB14984B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 196fc347e8980a390e0f1d8a87e1f3a3da47e1ad81b1c9195b8b76b681f6b6c3
MD5 68249f0cf41dad10aedc76a11a9ab2e5
SHA1 ac53224b70d72fbafa42c450a079098f60bfc6ee
SHA512 100b49e94e25e4ad0681dc6e7688b9e62fc67631514ed9a9565f9ecb578221342effd36d6923c62595fd0e2fe63b342cae3d05de4e6a4ad62653c2d34cb0fad5
SSDEEP 12288:HpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B4523BE965C41CBE52644F5C3E5E10DAC073E5BE92004937B977CBAEBB64584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 19a6a308388fd76b9d00b5ad4dc8a6548727895db69614faec6357d0750b92fe
MD5 44d56bb10b8f762054f0f4c0a87625d3
SHA1 1f6530cda9180f307f8a6838ff4ee5f9959066a8
SHA512 0e2a42c56e2f452589088c5d2104a25219835861c2b887879db89de798942aa012859ed9087aa565bb5e7cefa301496f8e771b180191523232345fbefeee7239
SSDEEP 12288:H+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:H+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1574523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA977CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 0b39e6be9c720347a0bc14c9d0f493808e03aa3741656441ef68d7ba5e1855a3
MD5 469b6334899a8024a09bf7638ee6fec1
SHA1 976f112d7b525b8ca97f8dbdcdc83aea21557bcf
SHA512 f7fa2b9af5addc5fbfd4928d062a4e29bc0ff15daca3c9b38ac5cb258f6540118c3ee7cac745150134655b1fec3c253998362b1370f0c2cf73a9005914bd6751
SSDEEP 12288:4wXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4wsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f110523e72e709df45d20d559e6236e4f4539fde4accf4aa4d56cea0522715d6
MD5 4ebda6e87011069fb29a490168197bc4
SHA1 90acc29ec4aee4520c6c33bcdc0126057bc02d83
SHA512 db7908dbbdb6ac206652220cee2f4465b6317f0a28030aea075d8d6bcb0eb293fb5b70778c59fda8ddaf723a936828e0bff2b80b44cfaf1d6c77722d574d0d6b
SSDEEP 12288:YrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A74523BF965C41CBE52608B5C3E5F14DAC073E5BE92004837A9B7CB9FBB14984B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 65a2198d289c9f1e98581cb6e3d452a4f2d3011efcbe7c3d803ed0d8c1d1d260
MD5 d99f51eee561507f2b6801085a5de9b2
SHA1 ad0bcc43549f9bb893bdbe60daeed694aa76f00f
SHA512 549ce3106be5c9df028d78256d625154789442c9029281e54f98bc6097997d07290be1288b61db2469f3cca2439487646e4ac6ef366a4c38d090467d14be866b
SSDEEP 12288:SYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1444523BE965C41CAE62648F5C3E5F11DAC073E5BE9200483BA577CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a21ed26686cc2fdee7da22a88a6c762dd950f8795084f82aa54144f0efc75df8
MD5 5938cdd0a161485b875a393a78c51d5f
SHA1 14429244aa51ec3ff67c3b5c941700ec5bbe1efc
SHA512 65c12e5d4da7a8f30680290bc7f98dae220426c0adea31f48382cd149e4eaa9156e3d3744f3bbf94b2c33da2158f48c56286511d55b7be6e558d829eca40b522
SSDEEP 12288:K6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEN:K6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1344523BE955C41CBE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14984B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 41031625bf421c09795a9d874b7fd8f0e9cb844c6b675530775508e556139187
MD5 3bd2609756a1708c84e86bf6df7be6d3
SHA1 b1965ed8b7bb955e2c76f42a42e51bb418158a9d
SHA512 5174a92845e0f401e88eff01db026632b48b277d89ce708cad5c648a2a4268e5ab7368ca10090083e68a5106e59c7017691ed11ef1bc5af6fe0b97632c357be8
SSDEEP 24576:IfwvUk9RX6wkyAI8sqjnhMgeiCl7G0nehbGZpbD:cMnYIoDmg27RnWGj
TLSH
T1B685D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 72648e89b67e272d8ae1ae02acb114dda2d46ab9f6ec870ac0ae71116446d49f
MD5 ba2a03515a417bda94e1e4837fd5f1d7
SHA1 351e39d317e9fd2c18ad926896ce87c29f5aa1c7
SHA512 93eacd6b27486b44a49e3a81bbd9cabdde9253df18bd6c785fa6b6c96852170d20d2132aacfebb55ca1d8c07886de566cfb248730821b94e1ce7127a0a520ab9
SSDEEP 49152:QYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0LDmg27RnWGj:3ySzPTD527BWG
TLSH
T130066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3e1512acb25a5916ec464a05491c275e6b220d7594bc1a64cc8df1741d34ac02
MD5 1d5fdbd8c35638a15479ce8db3882572
SHA1 ff1667782ebd7954fd3e4b14e4938ea3fedc5d54
SHA512 5df50e1eeb378dd5869b5137353b5e223db3bc758efc4d79ba02073775d362a5ea7d6f56cec1b926b53fff038774f3ccb9b2862fccb29be3aecf08d069f58bb5
SSDEEP 24576:q47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY9sqjnhMgeiCl7G0nehbGZpbD:q47JUQjTirIhCnDHUPfF/bDmg27RnWGj
TLSH
T17A65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6c8a1776b8f5a2193f54b6eda0b8360245e49cb318a7a10848f8330d3e5fadfc
MD5 4bb73f9b563618aff42b0b76019f4d44
SHA1 53fe9df518d9a5f0eecb231a055abeb99812637a
SHA512 a1f304c93fe54db6004e0534ffe3a35e458d2a84cdfccfa264ed6f25ef96177dd34335d1e98b80f31edc803a3f532b55fe99af00eb6b0ebe6e4d61a3fd655a31
SSDEEP 12288:pbsfgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10E55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1000KB
SHA256 15c4ab36dcdc436dc811454ec2dfb956a395566879d950070ed57a6feb3f700c
MD5 12d12c57b8372ec882e061ee97a0925a
SHA1 fb137f82a4e5b33469d1e3dd0a9733569f520aa9
SHA512 05437a5af6ac35b0e738f3f9a416130d8d7190afdc3b7a0e8eb602f8077778d687fce4741bc8a94227453b777d4d8109cfc435ee67f85d17a4117f81a2c545dd
SSDEEP 6144:WsBC2nab8Ywa9D8RUAELQ2CotMxwYexU3ftkrKghW+TZsPIr6XOzpTBEMMtM+jfi:TAw+PU3fyBhTub+TBEfu+jfWOlW0n9
TLSH
T1FF253810766AD75FC6AD40321E33D2CCAB707D41EE059B0372C8872FD576668BAF6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 615767ca6361792d6e4b9813553b09be15c68bc422859fdf56588738e8730010
MD5 0175d51c4e6eeadbfa1d517e30ed90a8
SHA1 a21410f78452a80b073644ed714c80ea8a4d54c3
SHA512 7c79c47169614f26146c82f5f292ce1653e4910a20a8c360890874109a92f77b2fe5b836422ee2dbb5eae54788e79a2cf4ecd6e6e591c03f1a979cb5824938ab
SSDEEP 6144:C9DaU1ERQ7OA7Bnqc8GOv2M26tMxAjDJrM4lC26tMxH/zEgzKlAI6k:CTgzKl53
TLSH
T1F655D6815437A3CFC1FB6072072A6B4CAB64DC13B3495F26A388553ED82A765A0FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4a7210c328264a5d39aef51d26fb8ccda024585730abe5a9a0f28f96c499fca2
MD5 be6efc3172f7f666964c5f9e474cc014
SHA1 37a2db6571f87ef96753f946edbf08174febeb45
SHA512 01604285dfbee4b0c7f80ab89d7258ffbf823740b4222698c42580d258bc0f9385b501a5a6b53a034191d6f47496340a1736394500d83405a061fc0fb16958de
SSDEEP 12288:z07IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4IsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14145237B934C518AE93609B482EAE12D781B7E669F1044C3BA0778FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f53537a51cba74ff2937598ba68e65fef281a8d4541932a0e9ac5d5e44b11e24
MD5 e7c0aaaad86c8bd82954b950a61b8f33
SHA1 81abf154617802bdcdb38f7c6599feb214a484c3
SHA512 6317770f03c74d6d54dbfb74b929661dbb0a9962a77002b3ec0dd24045a948673095a3f7ef99614ac668620f5780e38d95d76f41dc954b841a484c0c2f27285b
SSDEEP 24576:qgb6bmBIi49WNNFpg1rSvFv7bYWsqjnhMgeiCl7G0nehbGZpbD:qgb4mBIBhGFhDmg27RnWGj
TLSH
T16A659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 aff56c0ae08e723abd11ef983544da46e2d08c6ed2a989a65e1982a7b1d88d25
MD5 e48cb3dfa402c5abd8d4badc390db8cc
SHA1 c259d1ae981cc634d51724e17865996525a930cc
SHA512 d1daa5a3f6cef8768dcd4b2ea96c8f1bc3f311e36cbef52ee36ac8cbe9ec6a6ff62340ab749cd707e84d7635baf18fd3fa0ecf71410c0673e9a3fdaf011fcfad
SSDEEP 24576:cG88u8FpJqH1bzria7/mtsqjnhMgeiCl7G0nehbGZpbD:f7ZFPqVea7/yDmg27RnWGj
TLSH
T14085016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 ccc2fd6235b1c98681800b80c1126a60c6610e94689c393a0e4b017f5769456e
MD5 3e4e9595faed9a7b887fac387dc88a3a
SHA1 017df9ff85d8cfbcc0bd9f811bca7b5e2945444f
SHA512 c3c161b41529d5cd99e22bccd7d48bdd56b59ee09815ac1230ff9e193b85ee10603b286c56b82e5e8749002769217e1667e69bbc50ee5c3dcb05a16ccf3c786d
SSDEEP 12288:hHvUrBFrEjwaQBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:hPUr+NQBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15465F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 40194171dfbae1a33673aa246357bbaf675e76f396d646d681cbb5f8939395fc
MD5 03012bc4c54feafbbee7ae6e6607cd5f
SHA1 5b9a01db20294144a0cfb6dda6a0374644dba337
SHA512 1ea9bc0862e9cf42b4775cc9adef42879d487364fab976987a39a5044fd672b59fbe456812062cfe70c3d8f78eac3a92d3a4eae5a294798d661714d175ab677d
SSDEEP 49152:qBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjFDmg27RnWGj:VG05lO43bgD527BWG
TLSH
T1C1D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3fae46f989bb7b33df0cb5b03d41df4e747c00a0bd251db06b7723b2df77ecba
MD5 edbecf849295c9ce828d88377ae2e7c6
SHA1 42ded7713651ad2b9fbd55dd7d364c617df8e750
SHA512 81acc3e29d3e25737be37af6fb5db66b5ecbac4707ce6c3dc7a50e97489df9dd7883c74afefc8db150a36436bb069497a83b95e1975bb4b418d7992264e78765
SSDEEP 24576:sfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn3sqjnhMgeiCl7G0nehbGZpbD:0a5POZ3BJt2pasx2+mtDmg27RnWGj
TLSH
T10D65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 686ad42825e452b9e7531a5b67700272e35e9aa1df1f612339643984bb9ea51c
MD5 e0ec2386058818f330db5a9f64c4b376
SHA1 48ca8a6ad895b2c508f8cead677a1c90eab2b527
SHA512 4d969db1375ef3255a315dc2894ac96bff91601051424a96e4f1e374794cb2eb167d706375e4b8803010ee8121912ba4d2b691d266ddc165ee141e9836a4337e
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7FkFsqjnhMgeiCl7G0nehbGZpbD:pNc/zEOVHFSDmg27RnWGj
TLSH
T17D857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3bbc0c3c0d2f411729d555e799c3516612eaa337502d7911cc62fb8909fd329c
MD5 1bb1f444e9282034eb5310bcda8b9287
SHA1 e94ff3b4c0e60fcf8b69a2b1e34d07544d50516f
SHA512 07fea34ed36e00725aaf31426edac75a55373ac009e2bd83629835af8ee013c9414c39b97211ef992d59d32f63c31997634d6e95352f9a480de9383f89146028
SSDEEP 24576:aTkNvNnaFeYhJNtmZBmFsqjnhMgeiCl7G0nehbGZpbD:aTMwBtOm5Dmg27RnWGj
TLSH
T10E55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 c07a9b761dcb959435e7266d375ab9489b2f4a29e119b7cc4e6dd9abf820723e
MD5 f4317095938a582326c9d703fe992730
SHA1 8035caadf43add177999295a06db373d558f809c
SHA512 2c284b8adbf3560a75d447fc37283df3a3a1ca3b07ab673ab53f048edef943b705bc0ff0e3fc126c46b32385ab70c3e1388b52d51a20eb1553eb4016bb9a387c
SSDEEP 24576:HD3FHshBIYQgAUsqjnhMgeiCl7G0nehbGZpbD:HDVHeBIAAwDmg27RnWGj
TLSH
T1DB75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/752-15-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/752-0-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/752-1-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/752-7-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/752-8-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/752-13-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/936-99-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/936-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/936-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/936-310-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/936-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/936-105-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1180-67-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1180-43-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1180-44-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/1180-63-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/1180-52-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2032-92-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2032-325-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2032-86-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2032-307-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2032-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2032-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3160-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3160-133-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3160-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3160-131-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3160-125-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3232-82-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3232-306-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3284-57-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3284-65-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3284-56-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3284-276-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4500-110-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4500-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4500-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4500-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4500-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4868-18-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4868-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4868-97-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4868-24-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4868-25-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5020-113-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5020-309-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5020-119-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5020-111-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5640-313-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5640-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5640-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5640-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5864-70-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5864-72-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5864-78-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5864-291-0x0000000140000000-0x000000014020A000-memory.dmp

Download