99bea3dd7ff4342d03a18faaf90bf30970262c5028c5951a42d06f269c7b0c87

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Size 1.0MB
Sample260812-thrn3sytay
SHA256 99bea3dd7ff4342d03a18faaf90bf30970262c5028c5951a42d06f269c7b0c87
MD5 2bf365cbcdfb584a7b6cd36546f029bb
SHA1 e8e0e9fe8347ae6c67666632e6e49471d38652ac
SHA512 f91e721fbc16af638c0a426fce5437bf847e52cc05b92222f26cb6ae2003fa8d660441c2129c2900c3ec1e9965f3cf8d67be4a2780f81158b242fac1b5e72f4a
SSDEEP 24576:siBEkWqwXeAVmYsNC7ftrx1MBs0B25gqDCB:8z5Xe6XsM7lnMxsDC
TLSH
T17135DF59A75441E0D1B6C278C8539946E67178018BB1DBCF13A8E73E2F77BE09D3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 11 IoCs

pid	Process
3116	elevation_service.exe
3560	elevation_service.exe
944	maintenanceservice.exe
120	OSE.EXE
6048	PerceptionSimulationService.exe
5664	perfhost.exe
4492	ReFsDedupSvc.exe
2304	SensorDataService.exe
2648	ssh-agent.exe
3776	AgentService.exe
3652	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\35899b718f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081b4fb76742add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9548976742add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000043dd135742add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000019f7c335742add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a053db35742add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f1c6de35742add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000069b1d937742add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010565336742add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe\""	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3116	elevation_service.exe
3116	elevation_service.exe
3116	elevation_service.exe
3116	elevation_service.exe
3116	elevation_service.exe
3116	elevation_service.exe
3116	elevation_service.exe
3560	elevation_service.exe
3560	elevation_service.exe
3560	elevation_service.exe
3560	elevation_service.exe
3560	elevation_service.exe
3560	elevation_service.exe
3560	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3856	2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
Token: SeTakeOwnershipPrivilege	3116	elevation_service.exe
Token: SeBackupPrivilege	4492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4492	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4492	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4492	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4492	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4492	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3776	AgentService.exe
Token: 33	3652	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeDebugPrivilege	3116	elevation_service.exe
Token: SeDebugPrivilege	3560	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 2352	3652	SearchIndexer.exe	100
PID 3652 wrote to memory of 2988	3652	SearchIndexer.exe	101
PID 3652 wrote to memory of 6128	3652	SearchIndexer.exe	103
PID 3652 wrote to memory of 4680	3652	SearchIndexer.exe	104
PID 3652 wrote to memory of 832	3652	SearchIndexer.exe	108
PID 3652 wrote to memory of 4748	3652	SearchIndexer.exe	109
PID 3652 wrote to memory of 1648	3652	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_2bf365cbcdfb584a7b6cd36546f029bb_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3560

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:944

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:120

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6048

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5664

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4492

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2304

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2648

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3776

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2352
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2988
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4680
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:832
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4748
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 43deeb114c9825924010bbe2f0c59ca6c040689bd71d852770b0362d99d15981
MD5 49eb986dc8ca02fb6db03cb92efe9d7f
SHA1 0cbf3e8184308d299f57fb6f4e1ecf7f425a6cac
SHA512 c86c7decfee8f2437a48c499757c97b22ec8787ceeb3657fa3ea81b3bdf7b59eefe25fba8f3097c24db03410a29a27a9ca8ad238a943dd7f5e1b026a8a3ae2d5
SSDEEP 49152:Sb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnFM7lnMxsDC:03q6mjBoM5XD
TLSH
T1DDD59D03F2D900E8E06AD178D7469533EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 16095de54286afe5e6793b9d1852a8a56ed6526972b422716c4f5222eba0cb0d
MD5 3da9302ec49ee879d54f9db71caa40dd
SHA1 3fd79a119bb3398a79278dd7851c1462ba923e97
SHA512 1569c4451ebfb6b28461bf30221a0b577b05da0043ec3d3ab3cd0a0120578e6e66ec5dbaa321a6d5ff0dd4e054d698551545ac5aaabc5696693bea3f5c0ef21a
SSDEEP 12288:B1XLsswWkxy2lRq2czAnENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VW:vXYfDtczAENC7ftrx1MBs0B25gqDCB
TLSH
T19705F12977E409FCEC67927CC962C515EA72784247A0E7CF03A499290E737D86E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 d29243881875efb8cc3b86d412815504ee0f8349615f1b4596dc72ed9f880179
MD5 6fe8a0aff1d556e1f50b8f949036152b
SHA1 16f9e14ac7dec75c277d942072034759b21a0873
SHA512 4c85b6ffc3f0054c58da93ec0f749c21fa5a77468dd3006df39875aff1dc633bb50e6cfa51ca175ce2bfc7d4f7f969b86c1464259226457c4bb87c82f2ad2c59
SSDEEP 24576:F0Le5ji0hmxhrMdNC7ftrx1MBs0B25gqDCB:FPji0AzqM7lnMxsDC
TLSH
T1E5359E66F5748335D073D0B9C5D2A68EED7130825B308ACB4286D77C2E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2e33f90c387424e6eec0610ef236db2b5d3df9cf864e7fb48aeb32c29af35384
MD5 04f7b0ff9305118c3bd45246e2825dd1
SHA1 057d4276946e818ff1243faf42adb0470c06ec80
SHA512 b2f0741067728c4c1bffe4e954dc534953a6b98eb6b29b3a4e52e121551bfeacbeb65aca3656d35194ef3bc965ffb4dd45509f14beb4167533c1c823508e0c1d
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWj6q8wyufNC7ftrx1MBs0B25gqDCB:o/ezSC6vUzPv+HjyWM7lnMxsDC
TLSH
T1E9755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c684bb54d49d00e7a6c5cd02ff32456d0059ae43d1727b0bf47b32f0b854d037
MD5 21fc213aca4bdaa7d700756c6e207eaa
SHA1 d3d4da1df57292dcebcdaa9a0526df75d8563887
SHA512 59ec523f6359bf786902580ace1fc52e97afe1bdbb999b5ccba2404678bd502451a4a7cd7cb4203d2ee85042e2d156cc61d0a3ca1bcbe3acd130719d10ee5ca6
SSDEEP 24576:TVbqPb88hv/l+BYNC7ftrx1MBs0B25gqDCB:TVO88hXl+KM7lnMxsDC
TLSH
T156559E66F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E67BD5D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 582b248fdaef7582c732cdc39a5ab35caf29004f84b6df86be6eca56670896cf
MD5 dc32c92cc07d10c656a34ccdaebd5dd7
SHA1 9d7f13a2e0bd7693f1206bd328bb25da688a798c
SHA512 c91f403722011aaa7151729ba0c988fe3dab85ff428ab553ee22c6202b905899c9cab5c06e726fe095b820daa9db8fd0a7d5d3c20b0be1d5433c238505b74f7c
SSDEEP 12288:JGKENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:JGBNC7ftrx1MBs0B25gqDCB
TLSH
T14EC423A3A8B5535CDA273379F202AE1C8D987D43ABF4D9CF9665BE4C08FD6C4B805054
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 979bb3432d9d95fdb24d5e1fdb0b0a310442d708d9b3e7c09f08a41623b478bd
MD5 ac1adcd87a4e02a75be3a67dbbe802f4
SHA1 1e528deffa6651678604aef929b4b866965ff617
SHA512 14db0c6db5d197575638f717cf372faac20f9133f165b75cc46777bbb1545cfb0a556faec7216fd8dc4782f65de0de54543f10cfd751af865890308180e0ec9a
SSDEEP 12288:CeBNUbTVO86UbENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:CJIUQNC7ftrx1MBs0B25gqDCB
TLSH
T1C105CF7BEE28FCD1C27A9DB85B91C600D7B278314B61A3CBD165820E9E235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fcc2c85e4207b2da8c10de9a1cd53cad74b4084e64e42e6b91b3a832d6f34dfc
MD5 6b1fd2db0655a35faa7431dd8464f97c
SHA1 13ca6bd11f83145b30883d9a6dc47fb91972873d
SHA512 604ae5d4b8c2aee9a041a7d99efb92d1be4fda36047ddab68070de007ce5b7f599823c90b38df46b0ad2500bdd60de24fdda8fc23059d50f53efa23e2125a452
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THS:TQvGAdlCEL8c/WRNw5CPM5XD
TLSH
T10D267C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 e888721483e4beb10795deb17805078a36a71ddd3850e631912912bb74673113
MD5 d74d9d49ba9ad7f0be05681efcd36242
SHA1 213f94c18b7541f28b593b01e098ada6c2ade1e8
SHA512 6aab0d16af6e1a23e97f7e8233fb722ab43ef920747f6af5c9fb25bb66f950f43693c8d9dad4f8889bf7d8cb32c60ffeb56ca4cc612ce6a6c68d39c3c9671d55
SSDEEP 12288:gAwSfxL/2Dc3mDLLmt0LDQewsAj5ENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRQ:1fewsAjaNC7ftrx1MBs0B25gqDCB
TLSH
T17015E031FE74E036C77F0DB61B26C71A586CB9204FA11AC3E3E89E9D49742D12736A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4c9742fa7b19140f93a4be675245e7251274758d79425d2625925f6a70fbfe76
MD5 5fa11d1f3540dc9407b5865e93d02007
SHA1 513af12029482b7ec6b354f67b2f337f55bc8260
SHA512 0e8fdcf99cd97099f94c3eb4f4559db35a06b7adeebb06f58aaffe0ce0670d8da4475fe9d1386758fbb5b21f4e0f9a2bf67d774650b00477310b7e0d41ac5b7b
SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHiM5X:tUEtQevvqc2W1cpV20I32P5X
TLSH
T1E1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 90b641eafef203af388e87584833643a198b012bc67b4ef567f7f4fdd361a27a
MD5 f9091089b7ea7403ae4273336a9f530d
SHA1 c45c973bb1cc305ee2d72fd81481d5ece44b1a03
SHA512 e607f3813fa095b742a12ef1d669be3b22bad1491c2b0ffb6345d32ddf9948898500c8f92271519227125168d151ac08dbd6984fbdd02d005ea637a6cfc43685
SSDEEP 49152:7CbRquA/m2yL5zQfFiV+XenmE3/z6M7lnMxsDC:koqtVjnmbM5XD
TLSH
T1DED58D1976B8C2E4D1F6C37886A2C647F37178154B34A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9b58bb36fabd699218895b1e27cd5f47cd6ef304712b50173e95c54a8ca23668
MD5 aea166a6562029f69f7b90dbc5dd8bfb
SHA1 faca996b1ce1d5a498cc965dcbae36d84e6f5e2f
SHA512 744b93867dac21e9a1fb7154e85912d1e0f5bf29c065a840744e2e83ab3a6eb953e217bebf6487a22ac348462bb1866569f37cccde26852a852e2a024765d320
SSDEEP 24576:JAhGL6IFoiwtA5l7S537NC7ftrx1MBs0B25gqDCB:JAM5Foiq5LM7lnMxsDC
TLSH
T141359D81E7F955D4F5B3AAB899B69570EA76BCA65E30C20F2160D11F0E33E809D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 52d54710f0f63146795dacdcc14964c5a8ac7447acae278c1c6823d48027647c
MD5 300dd8db96140ce461b8716577287496
SHA1 701f02898f8bfea9573170baf4379b7ab62ab9fe
SHA512 f5f92347b53ff696a3f114e578fa2efc2fac68fcf0cf1f21e6436fdae862adceec2eb1d4bbe3b82c4a256bb476b2c0caf64c769f457af5fe8261ad6a85e540b5
SSDEEP 12288:Amw5HEjsChNEBFgl0WDm+C0ENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGds:dwuROW2NC7ftrx1MBs0B25gqDCB
TLSH
T1AA05F08676A41CF8E9679239C647C536EBF2B8022A34DB1F1760C65B5F37360BD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 56ab174499f096bb656c2b968b9fefa82da69a0f076abb3a5802abe1330ddd84
MD5 8fc7419b4d9480add25106d23f269249
SHA1 66a19b4d84aeb63350555fb8449ebd3a73170266
SHA512 6646f5ea4c4954c9039655f625b826c08b58ece98008c1bdde42829ed3f718468a98841a4330db0558ceb8fa5fb801eaf57173612401a3af4ab651e8ec986e2a
SSDEEP 12288:MyZ1IypENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:xZu1NC7ftrx1MBs0B25gqDCB
TLSH
T1FDE4129736F421FCD5A3637CD9A29A08DBB1784367B483CF1624966D1EB7AC06D39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ae032445c9e5dd5ef0c3cb2a9c3569da1001323a6bf5ad8c0ec67051204536bd
MD5 77d41a37794b339feea47517ce63aab7
SHA1 b966cdf1c905381ca3565311a2dbe474e86860cc
SHA512 d783d1bbdb25df8c0287cbc141738dd11c340fd60e8d39f4a45100d2ad9905b64bce8fda8f19ed0864c9ffd4334706341c138447491125c6b060d39e2fb66423
SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UG:7QRQyi36YOcPDLvw2gAf+PN38M5XD
TLSH
T1AA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 22b84f5f13ee0c132de3cf2c1171c19f64b336e2a61f765a15e04649f459fb51
MD5 a81f43f7b00535ed67015c84569c3a8d
SHA1 1e04cf952c1117550f4b23c5ad440ab4a70dfdfd
SHA512 2d86c53252466e82453f3d167367fb05568936118fc679301c15820e953ba11a81832ebc4a192d5adc880e85b0267f36a721af2aa5f6d75d66f40d1fd6d10430
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UG:vQRQyi36YOcPDLvw2gAf+PN38M5XD
TLSH
T183667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7e0a37930b7651955ad497b39d4f354c3db560b1bb746a9f66957d317fda5732
MD5 9da98bedce8ab56fbc9a96800a03fc6a
SHA1 355950e3a44fe38d48cb7475a01b8a48e21a4d8c
SHA512 3820f9b7bc83de4fb06c31d8cada227d5dc2964ec6eba51f187e1920e7a36c995bdfea378e3afbd0d44ff8fc33eadf0820fc44cafe30be7a327399ec8f4fb866
SSDEEP 24576:swvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0FNC7ftrx1MBs0BP:S68Qg55nhkeWu7PNU3/qM7lnMxsDC
TLSH
T11CB54933B2F600A9C44DE1769F4A972196D17C718FE0E3DB8515720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a91706ec8fd7e791128e3d6c9dfd68e2a37d2c5f927ab065096731d921fd1d95
MD5 82b4dd76a42499c726f98453dd879946
SHA1 4b64fe5046fb52be60a1ffb441752169db01b929
SHA512 649e132568803dfc75d009b9b352d5c2f173ea5aa76096b734d9c3dca35766f5e804c7c1ca52fb9c77f2102057310368630245b7d6432929b059d905597e057a
SSDEEP 49152:43aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99o:1y5112gYy5azzVvU69nLKnhZBM5XD
TLSH
T123167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a49e39ba3886b20f0dcebec4d338517d6524b12ce70bacbad1f3464389cd7f77
MD5 a8f717f8f1fb9699ddaa0d93f64578a7
SHA1 ea4d6341d7e55f0d5d80306ce4389fc5176b5d83
SHA512 d16dde47b81fc66f28ef6e44f0d814c77b35e8d21858e831a8e2fe851bc604ad1fd6a9ee333ccf62bb0d0b80b0a15b20f14c0685dba9dacf647b49a251aa34bf
SSDEEP 49152:CB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glUM7lnMxsDC:wu6JmIxd2dUM5XD
TLSH
T18FD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c16e56eb4f610b0e0dfb21ef9c7c6734cf4573d18fc0b61732331df99c975cd9
MD5 56415d4d1d8f9db365ad0f4dfca0f839
SHA1 54cf16cbc729659c52584d2283a6836c253558cf
SHA512 7da3eed105dc7f4b6f0859c0e16d6b7df636779f0ec2c38f0b731bb7efb6ef5d9123989e592c45ca3ca5ce672a831fa72c223a33104d8ad2f46611331c747a08
SSDEEP 49152:51hpsNoJpF1A67U44CwH7R4xwM7lnMxsDC:5mifPqRbM5XD
TLSH
T1DCB5BE13F2D901E8D06ED17887569232EA61BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f184d86944c6027ebec5b7084b0add78664591cd92a467488e1d9ad85fa13d5d
MD5 2a898c84e4716d2a0f47a2646bbbe72e
SHA1 f49b8d14bf4d1fdd64a37cdd04ce2bd2658da92f
SHA512 392843f563a03230ea35f10fda024c623ef4f0a44b7fead20b9b6d69dd43532373e4b5f39d7f0efb78a77862db05228cb799497356acb2cd55e9e228e7a9e0ed
SSDEEP 49152:vSuZQIY0Be2KkRVtOnks6NMHq1M7lnMxsDC:V5dKqi611M5XD
TLSH
T149C5BF03F2E941E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 938f440d15c7d94f93865e3bec575f7255a7c48bc10c55bc9f00fb852b6225e4
MD5 eb019cc01b5e364dbc83a3ba494554e7
SHA1 0ba2090da616fc92accfcb5087ffd18b03f4bb56
SHA512 913f89c0d0899508194e65acf79129092813b12f888a004311bdeab91cd8b48aca8f5cbab6adf5ebd672bee9e7b830244c386a157802cf2c7c98845953d701bd
SSDEEP 49152:GhtSn8EApI0figjgiDn0AP5wEM7lnMxsDC:HX2iWphXM5XD
TLSH
T1BC95BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 78f5d2629c95201e4ab1c437b962a9694f0ce97572211ecc457dee8be0016451
MD5 99e89cb87e89112dfc4eafc7e3beb628
SHA1 44b549fc28c3604ca48e311e43db58e7d03b893e
SHA512 332d49d552d979b3b5dddd78706cf04e91392447b3a157b3229f8f20dc122b3f34ff566d0b1e65244f88e4fdf8256ce83c475c5b8c585f014ef0d0a2fbf60df7
SSDEEP 12288:GiENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:G5NC7ftrx1MBs0B25gqDCB
TLSH
T114C42393B8B6575CC91773B9E202AA0CC99C7943FBF495CF6769B91D0CFAAC43805098
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 96ce3c8d58034743db0d888c0fd6e8fe59934c4f7331420cfcbda2d6f935c7d2
MD5 7d9fd062ecd21ec371c757f773d012fe
SHA1 682861eebddac04068c0889424d184b6ab94a5bc
SHA512 17198c76ea3a33f91186531b2a02d4d5e9b1abca8158e1db60495c681bb632e2cf33726c49360865e4426096c21927905a5887b39a1f3a55e6c57266565747e5
SSDEEP 12288:XlENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:X+NC7ftrx1MBs0B25gqDCB
TLSH
T1FAC42393B8B6575CC91773B9E302AA0CCD8C7943BBF495CF6B69B91D08F9AC43805098
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 dfe46452a1564a627dee55a986964911af33f7d814531fad397d6edf412f7216
MD5 b91b8da64da914a32d8282ed7c5e53e4
SHA1 30069f6ca46e1fa9bd957cd90dd2144a13e0a4ed
SHA512 778191bb3a21deee5a98f4a5b1289a958faef399b3a528d9c24e22b477564ffb090cd24a22505f69eaeaa57f6078f57487bdac63fc2c4affc4641510976efff0
SSDEEP 12288:4TENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:4oNC7ftrx1MBs0B25gqDCB
TLSH
T17AC42393B8B6575CC91773B9E2039A0CCD9C7943BBF495CFAB59B91D08FAAC43805098
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 d35c6b473820815161fa87eb22b9aa48c6b5392c69aabc5f3e0cef03b14e27cb
MD5 88cfceae5cc1906c1c782f87509c0045
SHA1 88d12b960d1d5f369e0cad83058326d49de54f65
SHA512 1b31c26c1a31c0a042974832d869c4cbf74cb2d4a631989290ff6641eb4ef5be3354d2682ba49de64e950c502ff79537e4137ed983d17fd3f4066bd99ff19c3d
SSDEEP 12288:tVYENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:jNC7ftrx1MBs0B25gqDCB
TLSH
T12DD4239379BA12DCC827B3B9D6129A18DAE87C83F7B496CF9B14690D0CF67C47C24254
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 2d236d7041c3e98d26cea68c32fae894091c23368b23efab015bb2544665a348
MD5 1939333f728ab8ff2855dc6acfb06e51
SHA1 fd2bb06b8a0230c55c72b8ec352e11d94a131afd
SHA512 d90e15ec42b0bf21f15047e724ae7873b91ec22a555f386d22067d43366e7269fc56e9b5bd9ad6df3be18c612747c46e0a49e5e2dd1f4d12399e32f6f8648438
SSDEEP 12288:NAENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:NDNC7ftrx1MBs0B25gqDCB
TLSH
T1BAC42393B8B6575CC91773B9E2029A0CCD9C7943BBF495CF6B59B91C0CFAAD43805098
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 cb120ae80ff344bdfcd9d46e52356b71ca3e7aeaa4d9ea03bb1e85a9b61bf13a
MD5 1aed312589b573a7e9440d64cfc7258d
SHA1 61313694e580750b6399db06d98c9578e9a3ae53
SHA512 dc8354be26d5cab4151ec4a6091912e5f8c35705a281bb59f49c0b7d92f2234309f3a49e67b24b7fe6fce92cd3a1e823fe6f2a0283942007722a26383575538f
SSDEEP 12288:oxENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:oSNC7ftrx1MBs0B25gqDCB
TLSH
T1F5C42393B8B6575CC91773B9E202AA0CCD8C7943FBF495CF6B69B91D08F9AD43805098
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 22af97491ffd8fc771b869be114be6b123c8693ada3ebb9665774e905e0ee173
MD5 137cb7eebbe0fde78017e94e09435d38
SHA1 22378a786ee438f84a4794de12bbbdeec07b612e
SHA512 2440f06f531c106ccb51f0096f3aacdcea781695760ad83d3e60ff6e19029c045b6985a8c1b9a95552f0ada18295a234841ba87612502df91d1524a22c94593b
SSDEEP 12288:HtENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:HGNC7ftrx1MBs0B25gqDCB
TLSH
T119C42393B8B6575CC91773B9E302AA1CC98C7943FBF495CF6B69B90D08F9AD43805098
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 7a409960de4fcb24a77231c0517a13b9403495db434939204a02093a4386ee0e
MD5 ec06874497ed6728d8b3a36ac0f13045
SHA1 88fe5a37efd71fbc82c5c3d45a72c03e7702ef81
SHA512 60f3f462ce4f644d0fdc5bd101a65029a9ce303f72fd7ca5f35b646f7cc7e957a28d9882c277bae97e6f417a58b742596c0a8faa0bc7752a62026bc35a84b982
SSDEEP 12288:diZwbDzzFEoS2cPvyFENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCV:gZM3zFVSOeNC7ftrx1MBs0B25gqDCB
TLSH
T181050295B3A018F8DC67923EC9129D05D6B27C565BB0C65F13B4362A1F733E01C2EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 1b0e723bdf140c9d962b8ff289bec61552a8e6d9a63fd39e57082cc89d073e3e
MD5 98dcd3df898e72e018178409e1eeb6d7
SHA1 29bb12bf2208c30476599891df4acaed7d101560
SHA512 ff1a451715aab6209bad3df0a8ba63bf5a39b2fcb3f55aa057d852d2d7b8bc2d6757199dfd2cd38413293d52d8166027ba4d146104392eeabd171d916b1c91fe
SSDEEP 12288:MGENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:MlNC7ftrx1MBs0B25gqDCB
TLSH
T161C423D3B8B6575CC91733B9E2029A0CCD9C7943BBF495CFAB69B91D08F9AC43805098
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 c0b2d4652f384da5f3e18c7e2cf8a986e0842ed1ead26cf843f654df810af0e0
MD5 b51c4c99d1e0879280495e788d943029
SHA1 5c47955d8585cf37f388d8fe64c03965334d5bb7
SHA512 9ab8e4a946d204bd45e2facf78e6dc3dc2313ec7d1db3ab763b22235e557403625b469a54e5fbe6ad8ef68e803422eb1120ed6e6e792a6d4d9c2f592e8e69239
SSDEEP 12288:y6ENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:yxNC7ftrx1MBs0B25gqDCB
TLSH
T162C42393B8B6575CC91733B9E3029A0CCD9C7943BBF495CF6B69BA1D08F9AD43805098
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 412dc268b2b29fe31ba1d91df1c82d98b923cd77ab0e1679213fadac205d6bce
MD5 90e8dd666a04860012bdfb76d313e73a
SHA1 02191a14bc7b936fbfdb5aef18d097dc61e72a78
SHA512 c090efb4639fb14cf98e4c054a40d5e3255e070f25d48824f068a6b58cff68c48c689d954654792e583fb47934044b7d0d6d2ce2fe45f6767230a11dac848b00
SSDEEP 12288:nyPz5L8pENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:KzyKNC7ftrx1MBs0B25gqDCB
TLSH
T19CF4125372A131FCC037A238C9521A05E7B5B8335B708AEF17A45B7A1E776D0AD3A760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 116cb0d0a3b995df0146ce72954a716bd74204c8e20232432e3294a1d655230b
MD5 90b40f389fcb972a12d1a63accbf21a8
SHA1 e43205c187e55e4da9d6d9314f38cddeaa12fcce
SHA512 7c800f1d303493cb8317aeca9d1ab783aeacfca131f9429c1c2019d0b818c72291d7fb7697c4b299dec582f274cfacaa155bdc13247da15901222829ec8d4e80
SSDEEP 12288:JGENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:JlNC7ftrx1MBs0B25gqDCB
TLSH
T18FC423D3B8B6575CC91733B9E2029A1CCD9C7943BBF495CFAA69B91D0CF9AC43805098
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 cef5d383118933972cfb03d277c4c241bc2b6ba8553893008c77419277a945eb
MD5 a87256429d5d631e2f1241dac63ef533
SHA1 a57806b3e555dd139f7cc314a5fafce18bace867
SHA512 374f0a1350e858a9a506de9caf7942dc19062679fc3bcdcbbc1cd30479ec0da5f88a18d6de67884e50c114fbdb5d4b21355831a75503ffa6d603d2778568702c
SSDEEP 12288:xGENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:xlNC7ftrx1MBs0B25gqDCB
TLSH
T197C423D3B8B6575CC91733B9E2029A1CCD9C7943BBF495CFAA69B91C0CF9AD43805098
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 f0a8437bb89b086e8ae6a8eed88f63728f87e690985d55cb16b5fd02a5348c43
MD5 487f03ecb56ed415201ecd7a0f0bd0e8
SHA1 d2e3a6130282187e76d47b301b57dca54d76c7d0
SHA512 533d27d2428e1b18b7efb198511b5c52c72afd6015ce0de31cfbab318536cc6c259072cf72a6fc7cab9980a417aa87943a2585017017405b1a7b2072222727a3
SSDEEP 12288:uyPz5L8pENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:zzyKNC7ftrx1MBs0B25gqDCB
TLSH
T1A8F4124376A131FCC037A238C9521A05E7B5B8335B708AEF17A45B7A1E776D0AD3A760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 b514fa957e75166e14c99c1fca5ed9bb49547f785b30ae251b9b471846eedebd
MD5 835da82e31ba2b85ff1e27d23b1e927b
SHA1 52d741014350e19a6a5cbf8f08221362bad9bd0b
SHA512 bb6ef1c742cfbee4f92d34922408fd1c9bb3b4045cfeb70a1fd8f60044e69a76d13bf3516ec98f124d2aac772ad183fdbbae1cffb4c822976efcfbcded639a36
SSDEEP 24576:PT8aLl3z0zD4NC7ftrx1MBs0B25gqDCB:PT7LljfM7lnMxsDC
TLSH
T1500502A5B3A018F8DC67927EC9128905D6F27C574BB0C65F13B8366A1F733A01C2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 94f1593abdedadcbdde954870299abf40d779f67d7d2daa8498d5e8f81c0f5af
MD5 eacddf4c9730e9fa84ef05f230fcccad
SHA1 e275bc6a99ddfb54c1e15badfc670396a53b700e
SHA512 c11b5f0c2e01cbd62c97f6f8ac7d9a3f5951f2f0699ba2ad34fbd6dadf34fcfb0c6cf6f175f2cf268522428d3b8f263a7ff5dfb81ad8d50ae2baf3e0b132e4bb
SSDEEP 24576:I3rd9CHKy7GZcNC7ftrx1MBs0B25gqDCB:Srd9CHKyaCM7lnMxsDC
TLSH
T1A525CF91F3E410E8F0B79A35C9725511DAB67C5A1B70DA8F03A4261A1F33BD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 df969e0c4e50100f6b5a85b8fa3803201552762cf2e47330c7591f9f9026d15b
MD5 8f091fcd572e9ad50769839436e2ad98
SHA1 f4b0e41c5f940e267e6642fdd6b3d154ce1c48d6
SHA512 596ad41f42730e7a5b614b5ae230ce877a48db2320d52f7ffd7bc9cd7e9c0421a40ea69b4999e68ab8a0cafcb4d107ca8736395ac09a134e71ad852cd82803fa
SSDEEP 12288:4zENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:4INC7ftrx1MBs0B25gqDCB
TLSH
T1D1C42393B8B6575CC91773B9E2029A0CCD9C7943BBF495CFAB59B91C0CFAAC43805098
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 7fbb259523e2e861f7a9e31a8554c206aac30497ce590b5464f2c68d7bca5c32
MD5 5a847d3049f6be0d52ff3b6271230ebd
SHA1 2125b69c0a4967128106ab638102c2138deba3c5
SHA512 ccc59ccae8adf6ac7f6c1a37e1b414d0d02c2fe33710a80c90ef239e09a4879861cb241ed9b9a49147f3e78ccb83699115a55670c46b5bb72a0e0039838ae268
SSDEEP 12288:cJENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:cqNC7ftrx1MBs0B25gqDCB
TLSH
T18BC423A3B8B6575CC91773B9E2029A0CCD8C7943BBF495CF6B69B91D08FDAC47805098
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 ee3b622b14a6d9af86e447e43bb66dfd3c055a9ae056aade59cc6300953007a0
MD5 b2c0139244ba15a9cd0806938ac363f5
SHA1 474845bc44709a77ec0044b1d4029f61391f16ec
SHA512 b0fee16c80c9d027d7c26bcfc3697be2e8ddb0a7375a75a7048a7853b56db67b4713876827c564e70d57acbc624187a4bf985889e1051548f9d83a0b4882e37c
SSDEEP 12288:M8ENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:MHNC7ftrx1MBs0B25gqDCB
TLSH
T1D9C42393B8B6575CC91773B9E3029A1CCD9C7943BBF495CFAA69B91C0CF9AC43805098
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 f6476aa3e6cb4217f8b9c39fbd5473ebe64b4de54f9f153ea54acd3f520a9e69
MD5 4afae37af4da5af65faedaa69bc80921
SHA1 4a0f1629d56b1cb74a9ce0bb042ce07e052d0ecf
SHA512 8d74c9e683fa70bb23db47af0516e0086e16706bf05d944b9ffd14ae433deb748c1d22de9cae7818ea9f5972a5d100cf4535eae00eaffae4c6aa1aec114a9aa0
SSDEEP 12288:hGENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:hlNC7ftrx1MBs0B25gqDCB
TLSH
T1C1C42393B8B6575CC91773B9E2029E1CCD9C7943BBF495CFAA69B91C0CF9AC43805098
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 f37efcedb502cb80ac6cafc1856f79919e54bdd022fc1c6e04e2e0ee4657871d
MD5 b0f87f4ae249dc6dad258d9c7698312e
SHA1 665bb58b31f70b643c014074e8d10dea6741c679
SHA512 ff9140628be0ca2f5ec5abf4256ad92741c70b1683a02d39cf4a8e73897e0372f826b9d8c3f6ad5bbafa8fb5d78a911d7308ee77a2dad0d94d079840a1188584
SSDEEP 12288:ozENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:oINC7ftrx1MBs0B25gqDCB
TLSH
T1D1C42393B8B6575CC91773B9E2029A0CCD9C7943BBF495CF6B69B91C0CF9AD43805098
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 14447a85cf38002c1be6a82a148f9f45218cb09b519e533e98f89da400b31704
MD5 1616732447c843ac61478bace2ce38bb
SHA1 d6d649503facdbbc6e00bcbee0a33d583f9cba68
SHA512 2324ff34555c5e8112c769810cf1e5f4349087409b34d76ada56ffb2d51edf5cdeb34dedecadaec6c2c64e43ebe564b9b3fd27c43a306bb299cf3415ddd45f80
SSDEEP 12288:WOENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:WtNC7ftrx1MBs0B25gqDCB
TLSH
T1C7C42393B8B6575CC91773B9E2029A1CCD9C7943BBF495CFAB69BA0D0CF9AC43805058
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 a519d4051ca21930fdfdb68c722374f640ccceb01baa2b79f96d76c6dcf93179
MD5 eaa90ee2187a8ab74f242760852fc5a3
SHA1 9c2ee2276e0d7512e0987356479a56530e57e67b
SHA512 5d1fca64e95c71968eb1c65a1b79b74419829723d20d0a6d4dc7091adbf4e8a577d7ed738398cbbf412e74eb37bcd26757193dd3c0623ed6920c992313456638
SSDEEP 12288:FAENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:FDNC7ftrx1MBs0B25gqDCB
TLSH
T1A4C42393B8B6575CC91773B9E2039A1CCD9C7943BBF495CF6A69B91C0CFAAC43805098
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 5565d94ccf906b8725888ae11592e1d64c1200db5459569f01af92429712299d
MD5 27b565b5506e6f34edb0fca02ddca14c
SHA1 7927f48aa99fd730ce8bb620b107c7df59e8630e
SHA512 7ae78911438e5bc6880234cf8ce147ea367ffc7f5bf2a04ef8a7fd49eee84bb561e382d20bb854261d91785516e031a09c91c7cf2c87dbb2fbe6a587034a05ca
SSDEEP 24576:Bfwvzk9RX6wkyAIhNC7ftrx1MBs0B25gqDCB:gMnYIhM7lnMxsDC
TLSH
T11A35DF2AEBDC44E5E177923C99B3460AF6B178591B31C2CF029A53AD0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 27a220117a82f7611bf4542149c0878fa539d08c599c7f818a4f88cbcfa2396f
MD5 14bfa4be857b28ec7c008ad0c97a10b5
SHA1 c137d885f59526bdfd55cccf77902fff7272936b
SHA512 5a247415cb36b1d5318fda5874fac218c99d55504035faa33bcd7aa38e7d60f6602df2f800ea21b3eafbc6a70dd10aa5db758c686aad9edfcba79f58a55e8de4
SSDEEP 49152:YYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0kM7lnMxsDC:XySzPcM5XD
TLSH
T114066C97A16801D5C1B9C1B98B1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a44ef48f8f3b16fa4cd8f78cbfd40745f0e532d4658722c246c6a753e378eb28
MD5 c14bedba98ec162ed285f11585c70e83
SHA1 1d21cae57f42cb06e1462a288a5933b3c9af37a5
SHA512 f335481d794e4241c58cc939e4cbcc26669807303ce468ccc3d5ce815a8aa09fcea0250d8fb5f4ec7e32240af9d2278d13fed172e163287b4d80e8d553cee5a9
SSDEEP 24576:b47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYONC7ftrx1MBs0B25gqDCB:b47JUQjqirIhCnDHUPfF/UM7lnMxsDC
TLSH
T1E865AE1EA3EC02E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 82b2ffb6414e9308cb15abdf245d173049b8e04ec35bf48a22c310c0b045e01c
MD5 23b76085927581c32a5a255396cec091
SHA1 3dade0864731a7ef51a18fb18fcd19f887c4b7b7
SHA512 5dc465c698796fd8755213b7f89c9c1c8f9ba3043f4ae864d53df01494869e9f6b3013868a07ccc412085bb1ea2a3b7a03e45ab014b6b77f36e6b02297520356
SSDEEP 12288:CpsfWENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:r1NC7ftrx1MBs0B25gqDCB
TLSH
T151E4F15AD2A802E8C06E6279C7029A04F7677C5297F0D3CB56D0F93E0F7A6D06DE9643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1024KB
SHA256 17e2e13a608dbaeb5613c8a4c883fc4c976e12aa9d3e360f143c04c535cbdf39
MD5 8a691bc79a2d4bb70e996255be0f4d01
SHA1 c26ee420af4762a81b213ef4aebce73399bbbdc0
SHA512 1d759bf792e8cc17991391ddd9f49aaeb4800e55e3245bc3ccdeab9a2887073568488088418a99bdd153b6759e7b57e00cd9c7143e9e1da5c9e00d0d17ac2532
SSDEEP 12288:Ma0KU3fdwb4wuCdaf0ABkgvtol4mIVpb96x:MaLUPgmC8T1ol4mIVx9O
TLSH
T1E92518107666C74FC6AD40361E36D2CCA7B07D01EE45AB0773C8873F9576A58BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 4a4977d5b08a6b49bc982751de96e2c06481d7c2679b85be4df5c6165abc11c0
MD5 da2eb06a6f220e0f71b3976850023323
SHA1 63f212925473be225fb3768046be617de9a9535a
SHA512 c355d5c85645e713b86c0cea6274dbf028bcbfe67f432fde70265b1db9996f0eb3621776c588bfcaf44a7cbef283d7c59bdfe58451ad4033a2156b86f5f4e7c6
SSDEEP 6144:jWKB7huSh3GZxj94I1lgDwSqtMxBSqtMxb/01Yf7k5MyXflzi8paaXNRB:NdV+j7gukl5iQTXXB
TLSH
T15565D7405437A38FD5BA6032072A5B8CB7A4EC16B7056F27B388453AD86BB15B4F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 c20d45795bbafdc94077dbdcd0e5766dd302ea75adb8b407bc364b9fb00ef045
MD5 30ed4739b5ba52b47868729a40b23429
SHA1 6c8ed41d057c56bb49757cbb23a3812262ff8bb8
SHA512 97a93501cd8bb162a09743fa6904bc646d76439c7e02a634e6594ae1f067112a61beb6fb59bbc104943d22f39300d17fb3bfe2759655def3201391dc84ebe5ca
SSDEEP 12288:UM7eENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:V9NC7ftrx1MBs0B25gqDCB
TLSH
T1EFD423A3A9B9574CD83733B8E203DA28994C7943AFB4D5CFB6157A4D08F9AC47C34158
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7fffe1d53ea3099e3af5f99cc2d967ca59640b7d2a9c9a2cadb0bae886ac3a10
MD5 732092ec7e4777cffa0de5632749eb86
SHA1 96ca358009a624c28d5b8dd6c1b2f2b1d472602c
SHA512 90f0f9993d55a4ea7c7065e5df739c9bf882c7b5d86bbcdc63aa083d725361cc93897b45c1cdaeede88e05b43d79b2d2de2468af192b53483849491b7d945365
SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bYfNC7ftrx1MBs0B25gqDCB:Ygb4mBIBhGFOM7lnMxsDC
TLSH
T18065AE1E22EC02F5E0FAE2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 c3682981b6e148401283cc260253b7a797ceb40f3e2051f85e1432219acb6a31
MD5 2b4759c1be376810c71a2cc16a1ccbd1
SHA1 a9f1f340ab63e5a6aa7cda911da3dc8ae95ec530
SHA512 88ac6f920b429fc1b5a69c45966cce8d2449cb9aceed2bd9d5e88cbda4780bdc5ac33b4a8f51232411ad7c44251d914c112e30d5850043abb4c77110853d469c
SSDEEP 24576:bG88u8FpJqH1vzria7/meNC7ftrx1MBs0B25gqDCB:67ZFPqVya7/nM7lnMxsDC
TLSH
T15D35F16676E102F4D47BE138CA424667F6B1B8121374EBDF07A88B551F23AD45B3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 58d21a455a48c14c89bc29e0a46bf35a9cc6085e1b894d650f6d77b964ab1997
MD5 9a52f197e748d7515db6aea59e1a37dc
SHA1 03848feb836381f92ebe4d5a48e4ae1359448866
SHA512 8c2311a1aaa1a05c4647f7514defab54c0ec6c9cded88bb42d73b8f2439472f5936e4641433255c13e0d427df980e8bfdf84e596724147dbb4495d0d7c055615
SSDEEP 49152:2BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjSM7lnMxsDC:ZG05lO43bpM5XD
TLSH
T151D5C06A62EC11F8D1BBD17CDAC64A0BEBB23415033556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 80130d7bed312d6db14896646dc8cc5b8be28bb377d9d2506f6b299e3355b8f8
MD5 b04d5ea3be76fea64b3fc6d1aa118a83
SHA1 bbdc2b9ee93e9cc64b2558d1772e8efae8b9787f
SHA512 8359390802a0796cdeabd49a9b7f03f14bf1c3c39019f583ea31078e392f84418a7bdea2f7361a8054d4acf5ab5548aed39241019be806421155c79a67c554b9
SSDEEP 24576:pfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnkNC7ftrx1MBs0B25gqDCB:5a5POZ3lJt2pasx2+mqM7lnMxsDC
TLSH
T10065BF5EA6FC01D5D579D17DC5838A1AE5B1342253319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1df8b7be85cbcbc8ca8d4d03626129053fc9f62769f070ca9e320a0c0e82c6be
MD5 a4aca8d2a17e41056efd2a2c3bf2ec1f
SHA1 5d83b61d8f1969c0f9fbe4e8ac7629c70ca9e3ce
SHA512 eac184352eeeb5b86057c8bb9f09b8fae9e3abf80157638457bdd9f950e9adc39b768013b8ac7d3f929eea198362502e6906b3a4782bde532e95470ce009c558
SSDEEP 24576:ANcwHdjbyQ4nLC18lb/EOjowL7FkWNC7ftrx1MBs0B25gqDCB:ANc/zEOVHFHM7lnMxsDC
TLSH
T1A8858C1622E901E4F5BBE1BE89779546FAB1786513308ACF0291851F1E73BF46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f6b156bb398c2ab78908604a1a2c345a5e6477d3d1493f8b84704ba08005550e
MD5 a19428465cc1a4a028c6c996aff35dd4
SHA1 b05d41355b9db0b7bdc5bbe304c17be67af95a50
SHA512 cb5ca7b5322a0b618a6d4127bd6e2a45416e26a030a3684c1f9182503a67235bab0951b9937b1782438df2f30de514c0f896aa4d7eee66eed8826b7066f05077
SSDEEP 24576:rzkNvNnaFeYhJNtmZBmYNC7ftrx1MBs0B25gqDCB:rzMwBtOmYM7lnMxsDC
TLSH
T1B155AF6EBAF846E4D1FAC6B4CD238512EA727461173293CF5290C13E0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 b43e9db89c09dabbe5d07fed87011671a1afcb9ae4017868a481cf80e9dae114
MD5 6862f60634f07b7ab88ba92095542fc9
SHA1 103c3d4b731ae8aa31e3e47ed554d54fe9d3b6f0
SHA512 041ca7298850d7ceef3148c19cb2f1badfb969efe5adfac04e1e829af4d36e2bcb430f6994927ed89057572a0787ab79ffe65659e6e63021dd2a7496749d7173
SSDEEP 12288:9HvUrBFrEjwaQhENCxaxefPMKro1LaySyKHMmAlEbJ00+e2GRWigGdb3VdCBb:9PUr+NQCNC7ftrx1MBs0B25gqDCB
TLSH
T16F05E16F66E918E8E676B17D8642870DE771B8521751D2CF02E0817E0E77EE8BC39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 44af7e2ad8103f81ffa4ba2b18132d8c6b50021123e5744187733c19e7e3f020
MD5 a4ba69639c688c0107c41519b7f1b362
SHA1 8290db03537878563fbdd6fdecac26999ccb35e2
SHA512 f7d79ae01fba3016b80fbea4d7fa0c2b4d974138fdc04c9828de27c9cdec21f8e35c0e08e376de7fcb87aa9083d94739ccb6ad490f97ae6cb120550f23858a8a
SSDEEP 24576:rD3FHshBIYQgAZNC7ftrx1MBs0B25gqDCB:rDVHeBIAAZM7lnMxsDC
TLSH
T12625E17EEAAC04E4D47BD2BCD6538A06E77138A9033156CB0294D1B91F6BEE47D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-62-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/120-55-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/120-296-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/120-56-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/944-52-0x0000000001870000-0x00000000018D0000-memory.dmp

Download

memory/944-44-0x0000000001870000-0x00000000018D0000-memory.dmp

Download

memory/944-43-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/944-65-0x0000000001870000-0x00000000018D0000-memory.dmp

Download

memory/944-67-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2304-104-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2304-113-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2304-110-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2304-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2304-317-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2304-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2648-118-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2648-119-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/2648-125-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/2648-315-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3116-25-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3116-24-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3116-19-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3116-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3116-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3560-133-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3560-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3560-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3560-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3560-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3652-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3652-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3652-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3652-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3776-130-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3776-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3776-140-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3776-137-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3776-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3856-0-0x0000000140000000-0x000000014010C000-memory.dmp

Download

memory/3856-14-0x0000000140000000-0x000000014010C000-memory.dmp

Download

memory/3856-7-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/3856-1-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/3856-15-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/4492-92-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4492-99-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4492-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4492-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4492-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4492-331-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5664-82-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5664-83-0x00000000008E0000-0x0000000000946000-memory.dmp

Download

memory/5664-312-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5664-88-0x00000000008E0000-0x0000000000946000-memory.dmp

Download

memory/6048-72-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/6048-310-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6048-70-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6048-78-0x00000000006B0000-0x0000000000710000-memory.dmp

Download