29cd00a583a36a6c4a8ac2d99bad807de05dae109809607420eb7bd535daa3b5

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Size 1.0MB
Sample260905-r2rr3sed95
SHA256 29cd00a583a36a6c4a8ac2d99bad807de05dae109809607420eb7bd535daa3b5
MD5 336dcc427f0ae9cab6628eb1299e4e08
SHA1 21b294461a039d366e5e7041d7d213d6f92b3bf8
SHA512 38d4471a70bb76cadb244a4f0be025b33872c91402eb83cb64d27c607f53627a9509c124a83855849f19483d9fdf370d31908defce0ef762330cdf52996993c2
SSDEEP 24576:viBE0zqwXeAVmYWjoF3UbrrdPulGHIo8Hr9qq6:Le5Xe6XJNArrNGGHI/L9qt
TLSH
T18635DF48A65444E0E1B6C23888539946E7717C018BB0DBDF5298E73E6F37AE19D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 11 IoCs

pid	Process
4636	elevation_service.exe
3124	elevation_service.exe
4936	maintenanceservice.exe
5748	OSE.EXE
4600	PerceptionSimulationService.exe
1400	perfhost.exe
1644	ReFsDedupSvc.exe
5896	SensorDataService.exe
6076	ssh-agent.exe
5116	AgentService.exe
472	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b61c00528f8562d1.bin	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\GrantUnpublish.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c2437b7443ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe\""	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4636	elevation_service.exe
4636	elevation_service.exe
4636	elevation_service.exe
4636	elevation_service.exe
4636	elevation_service.exe
4636	elevation_service.exe
4636	elevation_service.exe
3124	elevation_service.exe
3124	elevation_service.exe
3124	elevation_service.exe
3124	elevation_service.exe
3124	elevation_service.exe
3124	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3328	2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
Token: SeTakeOwnershipPrivilege	4636	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5116	AgentService.exe
Token: SeBackupPrivilege	1644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1644	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1644	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1644	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1644	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1644	ReFsDedupSvc.exe
Token: 33	472	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	472	SearchIndexer.exe
Token: SeDebugPrivilege	4636	elevation_service.exe
Token: SeDebugPrivilege	3124	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 552	472	SearchIndexer.exe	100
PID 472 wrote to memory of 2244	472	SearchIndexer.exe	101
PID 472 wrote to memory of 4844	472	SearchIndexer.exe	102
PID 472 wrote to memory of 2496	472	SearchIndexer.exe	103
PID 472 wrote to memory of 5832	472	SearchIndexer.exe	105
PID 472 wrote to memory of 2852	472	SearchIndexer.exe	106
PID 472 wrote to memory of 952	472	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_336dcc427f0ae9cab6628eb1299e4e08_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3328

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3124

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4936

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5748

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4600

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1400

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1644

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5896

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6076

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5116

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:552
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2244
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1524 2516 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4844
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1776 1768 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2496
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5832
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1776 1768 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2852
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1524 2516 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1dfd534685848e1953a2224257185cada4da68f2078cc71acccfe6b46f057f75
MD5 ba52d7b0b3ac40c92e384b852f6b11f5
SHA1 71417137e5c80e2c9aaec2ab9163bbd3fe6c186a
SHA512 514e9c57df9e5c43ae8dbe75f133327e44f6b171f9ef71fdee8f60bedf6317f3b139998e1d740ff3517c4425c1f2e1096a72dcdca069f0c075435d5a929b12b7
SSDEEP 49152:wb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnFNArrNGGHI/L9qt:a3q6sjBlnNPHA9E
TLSH
T115D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 ba065c33cc26c9645e5aaa14b517a698be4f78d4583c2b5701c47ca2b1befd39
MD5 a75bb3d9163fa240af86a02e70ffc076
SHA1 590e8d7ea8b2896d3e5a998d6990e5918e5a5ce8
SHA512 fa9897ca243c3d3b075ccf5e8f6b13cf707fa6135457f42b4ddbaf6c1f1822a864195471be5836c4aebb51d54d80656fb2999f544adff3e67015c59131dba774
SSDEEP 24576:xXYfDtczAbjoF3UbrrdPulGHIo8Hr9qq6:Utc/NArrNGGHI/L9qt
TLSH
T11105F12863A408F9ED6B813CC8A18515E733BC5587A4E7DB03E49A395F332D45E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 d6a10564abcd1c4ab8a81e4df50523e1d5343e9f3eab6c30a20891cbffd29bc2
MD5 f3823f66e8e09e5c089cce9ea23dd7b7
SHA1 96e517d89016e31b89291a1a55d11c99316c50ff
SHA512 d1dd1b24a97e5ae5a64e5c999360716d6ab78fdb9d0bb5f89579bb7020cee23a6de1eb366bec434f4b6d65b3b38428dfa69f3b980705e12e5285ead8b2dccf05
SSDEEP 24576:k0Le5ji0hmxxrMajoF3UbrrdPulGHIo8Hr9qq6:kPji0AjmNArrNGGHI/L9qt
TLSH
T1BB35AE16F5748335D073C0B9C5D2A69EEA7234825B308ACB4286D77C7E276E6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4e2f259baa676b69bc2a6065ffc42c9a25d1cf3ae14249ed5115a4994800957a
MD5 32d37d82547afedfed99797d818ace8f
SHA1 b45d1dd769273f1deb33b1b27a7c27eb900ed428
SHA512 755102db314b5cd2b2fa67c79a63ef16544a147509bd9366b3ad79f0634327f96a79f72a20b342da0d7f1884ffec21940237867995b7a3d8443ac5930f4c5ae8
SSDEEP 24576:Ea7/ezSC6vUyD/aqgrvWn6q8wyuAjoF3UbrrdPulGHIo8Hr9qq6:z/ezSC6vUzPveHjy6NArrNGGHI/L9qt
TLSH
T1F5755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 349f8711dba5d93c9bc0a76857954af4d0848b5087e46921f661baea6e0320e4
MD5 d545bdf02137308d82366091469c82b0
SHA1 5fc6844d59ce3f41e96ad10f4ce21d213de7a0bb
SHA512 06b6c603ff430d63811b4adb2dc65986eb93d5eca24a77af2f48cc28e48b94f8c1a2ba3268aba7d0a4bdb62e55f87a06e593d47baad504e925470689b075391c
SSDEEP 24576:KVbqPb88hv/l+YHjoF3UbrrdPulGHIo8Hr9qq6:KVO88hXl+HNArrNGGHI/L9qt
TLSH
T1C5559E66F5748331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C2E777E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 0a37e10abb0a20c1edddc56e80eeb7af7c8f51a60e9ad02ea525f306ec439b80
MD5 99e1c927d8230bb942d695137eab4fdd
SHA1 0891d92896d7849c73a5711287e0da33769d8177
SHA512 b626f7e95c62bac0d85b8a92ca1d82ee04e577ab867cd0425d7ded0231ad00a39239c8b0034e83b02bcd8ad592244a79dc9b5d67a5c0a54c90ca2d0c6cb3a6bf
SSDEEP 12288:GL2txD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7pi:GL2joF3UbrrdPulGHIo8Hr9qq6
TLSH
T119C4234145287CF9EF6F0134656C182917329F94DDF889DADA867E7EC8390B2DCAB027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 47d7f899cff6b09d8b6bfd0fff89bf456df0fb2c7b5397019cce28256b37801f
MD5 7a261a80b6328b71f82faf1b7c761d11
SHA1 168b90f779148cc02f8c65442c0b69b89d369e1d
SHA512 af44f41cee4d9bc95950c49d9e59b8b5f735bbce4c26e4abe7e4a468d3a9dfb967a51560561ace2928a2a1cd135d13ece60535150e0f333fd90261ffb88b5379
SSDEEP 12288:3eBNUbTVO86UvtxD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7pom:3JIUvjoF3UbrrdPulGHIo8Hr9qq6
TLSH
T1B805CF3BEE28FCE2C67E4DB856918600977278708F6193CBD165830EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a0b5ebc2265f771a8e1596cbdde8a595f990656ba2fc14b5bdce4fd02137d8e1
MD5 9e7cfdea088978f36e12906bf930dc25
SHA1 705f101c217c50190c59dfb202b0d25a3ab4e5fd
SHA512 4a57399928a2ffdceeb82f94d267dbf19f14bfca7829fadda16ffb020042d89be8cd2990a61a641c8bf35e7f3958c5c27863b7d55abad1ee39e3761be1d892c0
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THP:wQvGAdlCEL8c/DRNw5CunNPHA9E
TLSH
T14C267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 9f4b46026168fe72b016d0497c71268a48f5848e9528debde1fe32ca65cd88c2
MD5 9d48034f0e342cb059cf481a4abfcd7b
SHA1 d89e2f4d2236a37e2b8d2ee2bdbacef57e26a01d
SHA512 136aa4aab2ffc3159ff40ecfaf6cb386d0db961439923feda3500482d52de78061b8563adda5723e4afe30604221e55a2e1de87bb966f044595230c559e28def
SSDEEP 12288:UAwSfxL/2Dc3RDLLmt0LDQewsAj9txD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6d:p0ewsAj9joF3UbrrdPulGHIo8Hr9qq6
TLSH
T1FD15E031FA74E436C77F0DB61B25C716143DBE204BA01AC3E3A89E9E89341D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2e02ecf83176a0059dbe49f8162c026947ed3e15cfc7e5052ec081b872d68fff
MD5 9363297b74684c003e24735b417986dc
SHA1 f0511c2013fefcfe5643fe8025c64e16c8518bae
SHA512 2b9a5b351a3ebc5d83f252da83545d9df8399b65f390fe9a78667509d1074d157923d343357b46fdaeb2963deb13c61937f1f2e7b72b651799b2ada04c0f8886
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHhHA9E:EUEtQevvqc2W1cpV2tI329q
TLSH
T13F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 684566a30c4d688aa17cdce77579055434f19bb76f14585f26874bfc76ed5b0e
MD5 614b1e481617aeb76371885c8d9b9db7
SHA1 fc072080f2970f4236bf7df037e8f7cba03fa1ca
SHA512 14e59ffd86eb4e4549b75eaad96073dcc2acc8bba9c67de92154325990cd99c3566c0dc742101a013b3dcda895ef71c7c01b9000aebf5f8e0d8885253f37c19a
SSDEEP 49152:vCbRquA/m2yL5zLfFiV+XenmE3/z2NArrNGGHI/L9qt:ooq2VjnmqnNPHA9E
TLSH
T125D58D0976B8C1E4D1F6C77886A2C647F37178154B349BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2e4b9d7352662176b6e827eca4329f7d01fc96b7e9928d6129ab867ff6c7427f
MD5 842c22864e262b0f1b7ab77ae16d32f9
SHA1 876aeef45b3f5a9d004a6ac44154d4e51a6a11ea
SHA512 c59ce6b295e9e2561148911e35e8cd7dc40fd6e8be75791e5cb399c5e7308761efa9ea547a1cace278c991e1e755c35a5604995b5e4f866f04280c71276a2b8b
SSDEEP 24576:6AhGL3IFoiwtA5l7S53kjoF3UbrrdPulGHIo8Hr9qq6:6AMUFoiq5zNArrNGGHI/L9qt
TLSH
T19035AD81E7F955D4F5B3AA7899B69570EA72BCAA5E30C20F2150D21F0E33A50DD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 54e792f37c727bba6ae0501a220f67972c2e8b7f9670d7d0e24f85d679279811
MD5 79dd54ef5473d615543c17d6b3109ea3
SHA1 f8f052bf9882e70708a20b3ff4cf71753baa42bb
SHA512 56fae04bb27b327a4ba754d88596e7e564d7102c8a8cb0fb756474057d7e7a325dc5098de50a4e66691e49e7e1f6867ed86e62a9c786b8c8041adf8a74fbb029
SSDEEP 12288:1mw5HEjsChNVBFgl0WDm+CgtxD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7T:wwu4OWhjoF3UbrrdPulGHIo8Hr9qq6
TLSH
T11205F14672A81CF9EA674238C557C536F7B2BC112A34CB1F1760C66B9F37261AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 c8c0f474956860bc1bcbf7424f6eb5b68fa2101b0101d02a06b900b3747febf2
MD5 3484ed09ff2063158203808edc73b9e3
SHA1 12448f325d87afde57c9a144dcc10a025466ce72
SHA512 f9324e78c789b7117c12e09dcf208721d95521ce3ce04a161defcff6ffae8c8f0a2980acdf2d0e6100dbb1bbe0d461fca6c4c8f07827628756cbcd1824adbf81
SSDEEP 12288:peZ1IyNtxD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7pMS:MZuijoF3UbrrdPulGHIo8Hr9qq6
TLSH
T17BE4124622A434F9EAA7023CD8E409099332BCA5A77443CF5655667E9F336D29D3B333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c0e9faa4dbf5a3e48f806ac73ce2f7156421104da7bb84c3c4c5614e9b0bb128
MD5 efbe3d26ddcc0fcf620236158e7a4106
SHA1 c791749fc978c6253dcf90bc470f3dfcfffc411e
SHA512 7be9a18f0adcbb67fc30236b52b849f80c40a495d5218ee58bff56e2648e0361406638c44e51e7a0926f22ce36f2cf39cf1c432ea932fe5700c4854bc2beee05
SSDEEP 98304:8QRQyi36YOcPbLvw2gAf+PN3ZnNPHA9E:jQyiKa/X+PNHHA9E
TLSH
T153667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 33fa0c1c59099b8ff4e280796a23249078d093b040b720b22d528a4cf95076f5
MD5 afc692c45935d24e05926a7685fe48f9
SHA1 c0f665f5bd8b97a268e4ec99ee3c36a8ece5bdff
SHA512 15d74791905d6813443ab39476b768abf183fa01a2a9e6b96b260621159e64ffbd7a28d7620ef43c51c0bfdbe964fb76ec19e996e33a9de3ecc3531cb0964a81
SSDEEP 98304:yQRQyi36YOcPbLvw2gAf+PN3ZnNPHA9E:pQyiKa/X+PNHHA9E
TLSH
T1E7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c9a135310738bcbea2d787424690e9cbf0766fd4be884ab243f2c3ed2bf56cee
MD5 fe9c491b717088ca495f869630ae5ba7
SHA1 762117a72bf8bd524a0e13e211693269c16a4d16
SHA512 d9063265babec289416df18717f48adc824e154d0f21117a0682134ec1de3fb1818e2c1f40bb646ff7a5dc80bac36fc5293f6c9cb4453d9dc02bdc8f217b776d
SSDEEP 49152:x68Qg55nhceWu7PNU3/mNArrNGGHI/L9qt:vthLRc/znNPHA9E
TLSH
T11AB54933B2F600A9C44DE1769F4A873196D27C758FE0D3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 44ad3573d5510797b9d2d32e8f18e4cd8734cc4ea8112b7e4d0b424cbad286d7
MD5 503fb88e6504cf1d23a0b8fd4797344c
SHA1 96657139848895c72397f6c386bd7a74127a060a
SHA512 6e2ae16c6c6249324c6ea4cb4618e9e35aeac6fed7f7ba3d2d3c1b94eace70179e28d7b7530552b69c606f3dbf38409025c81715abad4ab0396375b365b92617
SSDEEP 98304:ry5112gYy5azzVvt69nLKnhZMnNPHA9E:GLIHEWhEHA9E
TLSH
T17E168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ce420f760e232aa290547a72d32bd73a189ffb1f97782d0414f2bb13985fd5aa
MD5 1fe5d436f8a07dbee72a58b25a5774f1
SHA1 b788f9e20f714044bb954f21ac0041412936311c
SHA512 9ca78f849291309ec1b89f064b9772b993cda2dac62a1d642d23dfb912ac41c26fcb56686032a4928b772b6dfd165504a30e2138ee182cf9588474e517fa3ee8
SSDEEP 49152:qB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glcNArrNGGHI/L9qt:4u6Jmdxd2d1nNPHA9E
TLSH
T1FFD59D13F1D901E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE4AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b2ed9b304649372b1d06e3babd58e8cdb5ae655be4fa1a539e534214aa1e63e5
MD5 0fe5cd30977cf91d5577120219e69b91
SHA1 ef845771ca6d54a5c1940641cbb636b65e09db7c
SHA512 0435abe618722c00ea0acb70b69acfa2d9412f1c2a79dd9b54de9ac35996b6c209dd83bd1bd4c27a12f8d96293981e509ed7579e5b93ffdbc2d5557a7e929d83
SSDEEP 49152:Q1hpsNoJpF1A63U44CwH7R4xkNArrNGGHI/L9qt:QmifPWRqnNPHA9E
TLSH
T1FBB5BE13F29800E8D06ED17887569632EA72BC450B34B6DF0A90B7961F7BAE45F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8296b811aec5b6486307be7b8a524ac3dc181bed067ca3afc7a78f85ace43167
MD5 f9474e0f7fedc8f6921593c9015a6245
SHA1 48bc1bfc8e465eccaea0e1b9af7ecbeb8c3163e3
SHA512 e542cec4a6cc1ca3981a9e14c4089d33f560957ec530f6039b41e67251f4597e9a66605d3eeb47e78e95a388bc96ea0ff32e32a324b2cf2fb3edac71fc670a3b
SSDEEP 49152:GSuZQIY0Be2KcRVtOnks6NMHq1NArrNGGHI/L9qt:I5dKii61gnNPHA9E
TLSH
T11DC5BE03F2E940E8E0BED67487659236EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2a09510a7f2f18596f8b6cdb43427ede726e4952dfdb96d53f639d6d2c3423a3
MD5 304c683bc548210b0aba6c55625b1fce
SHA1 7eff029a7caa4da1990444d861b5ee4b0c1a40d3
SHA512 e1710999528d3d4878e9def8c56e6a5c3ef7e750bb965bebfa81235b5663e1d50b436be2526fde7291e5c7d25c050e0d77bf9f8070ec37b855d89afadb59a4fa
SSDEEP 49152:phtSn8EApI0fig3giDn0AP5wgNArrNGGHI/L9qt:YX2imphGnNPHA9E
TLSH
T1B095BE13F2D900E8D05ED178C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 658e666859ed2d36f7f5db82d79900c23100d3dd5235674bcedadc44e09e6023
MD5 b7c5c5c83faf086e0b6e4feca574a261
SHA1 519d292ee7f82f91ac3c42322d7edb7d75c76435
SHA512 81ffa38fc60d76251acde3c08b8ecd7ef6c0d08b9eb57d81b38790cfab5f148861297153f4fdc82fcc3d5045e22bae99053d79857151a3bce6aea7ec5aecc087
SSDEEP 12288:cetxD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7pc+:cejoF3UbrrdPulGHIo8Hr9qq6
TLSH
T161C4230154286CFEEF1A0174A168142917319F99EEF445DFFB4A7A3EC93A0F2DC9B026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 5e71fcf75bb1d47b695f0d519b4ef10f263bb9f6f761b77c4ef670d46fa43d0c
MD5 56bbc48c1c770798300f53b47fb42419
SHA1 2e9257dbbf0341ee2f95617b0f1fe1135348604d
SHA512 91e78d131908c3fd4efe3558d755c7f1ba49f02aa9ee57eb7b0266e091ac4460504d9aa8822598432c6c57b222bc48e89decee17248b8187749b146591ebd949
SSDEEP 12288:G5txD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7pc+:G5joF3UbrrdPulGHIo8Hr9qq6
TLSH
T105C4230154286CFEEE1A0174A168142917319F99EEF445DFFB8A793EC93A0F2DD9F026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 094e3f8b327e164ca94fff4960d41d9320953f8d554ff507b1946a879ca7c946
MD5 f4d5c47e4848ea9cc34ab0ec53e64ed3
SHA1 57fb12d4490c87fcc600a253bec486ce50e33834
SHA512 1eee3e3d31e1af03dd5e17683d188aa947262161bbf89a7bf8851a2d8e86ed22fea76116b01faccb32b08e4ae687731b495aca334bdab4a44c9f137922acf987
SSDEEP 12288:g3txD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7pc+:g3joF3UbrrdPulGHIo8Hr9qq6
TLSH
T168C4230154286CEEEE1A0174A128142917319F99EEF445DFFB8A793DC93A0F2DDAF026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 034d26ff4437a20396b88f50e240a977613c352cd5d8d8ddc07d0bf5f01df6cc
MD5 a240314e6a1479aef00f1738f28f5df7
SHA1 4551b335318afde22ec85f866af197cce1824102
SHA512 23ca14091e0bd24d6e9be56c5e90f2e9a7706cd0f16f7abc6087f0966f9b64741c989effb829a00af5aa0dc63ba8612392ac222f8aefc2ae3bd4dfa9510bc5d0
SSDEEP 12288:oVEtxD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7pg+:3joF3UbrrdPulGHIo8Hr9qq6
TLSH
T11CD42301153868E9ED6B4274D56814295332BFD4EB7486DFEB413A2ECD362E1EC7B422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 99415fb8b82a218491acda029a2a4d5c86b8d11d250cda8d9ff0f7654df7e6b9
MD5 2427e5f819238722c4ab05deb33aeaf0
SHA1 1011d4590b0aebb972127930526d01ca80bd7312
SHA512 242911bf5dc031423fdd291aad3da23ac67d98ded6314c96141b4f3b7e2097937618d2e03ad362a6a41f8fcdc64b2e335736b538ba52937861a5040ddc1cf984
SSDEEP 12288:08txD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7pR+:08joF3UbrrdPulGHIo8Hr9qq6
TLSH
T199C4230154286CFDEE1E0174A128142916319F99EEF445DFFB8A7A3DC93A0F2DDAF066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 844e41f1641f98db844f715b2357860bb1371091e491f20a2c6efd27b67e1277
MD5 a3fbd10c1016be21ce71d758f3499037
SHA1 a54b4f56671f87dcad6eb9065d8f642f90ec7665
SHA512 65b09f977e9b792c9f54a2a42db2e42f0cce33b9ea080c4ae6d39d49ce86b086e449658c3e9030a38326cd688562e670e270c7b11fbb954eb72dd7f18669a0b1
SSDEEP 12288:sltxD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7p0+:sljoF3UbrrdPulGHIo8Hr9qq6
TLSH
T126C4234154286CFEEE1E0174A128142917319F99EEF445DFBB4A7A3EC93A0F2DD9F026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 413cb80af19e2b41d4f6b0183031de56bb08627a0a876ba4504738c301c8d253
MD5 ee484fe1376523fefd6aeff1843312ce
SHA1 832ae78f08fd9ceae5d147826a2f99cf6b497c7d
SHA512 143fa65a56f6b8bb863028dc0d3cc3e42574a55bf4c3e8853ce8f62349aa8cf2203e97b1bd582f1c13680e29b71354dc34bcee355a941242320641d6f78b6147
SSDEEP 12288:vRtxD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7p8+:vRjoF3UbrrdPulGHIo8Hr9qq6
TLSH
T163C4234154286CFDEF1E0174A128182817319F99EEF445DFFB4A7A3DD93A0B2DC9B026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 c73a1e19221a5c48aa201a35eb06525713200d41c667f95e789c3703c51be482
MD5 ee63e41468785a6a45f114e35a964d56
SHA1 5b4c016c6cd4e1155d910cae650606ff36927ff4
SHA512 0e21b0bee1706a6d46d20edd8f36ecb2506da26e5751ba3313c2038e68807b89cd1f629d5c5904784d832377f67a5281b4459b2403de1790a931039563cbe255
SSDEEP 24576:HZMRzFVSOZjoF3UbrrdPulGHIo8Hr9qq6:HZMRzfONArrNGGHI/L9qt
TLSH
T10E050195B3601CF8EC67423DC9258916D2B2BC594BB0C65F13A4362B9F333A15C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 1d03d2682139047719937262e4974a190e7a0cc2518c597c36fcb1782c97dd42
MD5 e4c38cc5ad1ce15a7730f039cd3c0be9
SHA1 526775474b0c51c1287136e785e743326c77f112
SHA512 258628193bc27728bc1e9d455e1c610fc1214b2bafd45997eb767ef35b806ad83c76391b9c2e2f4de9c1e6ddbd3e84020be846c7967a4f6d60b5757765d44d30
SSDEEP 12288:FytxD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7pH+:FyjoF3UbrrdPulGHIo8Hr9qq6
TLSH
T1F1C4234154286CFDEF1A0174A128182917319F99EEF445DFEB8A7A3DC93A0F2DD9F026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 94311ecf219f824991ed24799060a982bfad923a187e60a5eb6e7465d1a7b6fd
MD5 1e42bf482f6a9d5d50dfb72d4bce692a
SHA1 43e066e88a6890265ee5ff7c6f1d7833e5fec639
SHA512 fd11d27401db5e5057841e67922e23f1b22f5ae97c00578edcbbd12cba05575d222e2d636010a336a88a11047a8fb0525aa9a712d90c886ac8a25de384b220b9
SSDEEP 12288:vGtxD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7pH+:vGjoF3UbrrdPulGHIo8Hr9qq6
TLSH
T127C4230154286CFDEF1A0174A168182917319F99EEF445DFFB4A7A3EC93A0B2DD9F026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 ccb9e52faf4145dbf032d45bbf044a0710026ed4c0ed17c2054a85490e781c90
MD5 d8745a70a0e46d9837e4110b737ecfd9
SHA1 8e0557e068ccf62cebb0f14e5ece12c75d9c6a21
SHA512 658c06226c8dfa2b461433481584e4fcbef6f416b63e43ae7d0a9c2485f21d40376324bb17cd6e5efbf1c872a826332e4fb9a1db28d5f6d825c2d1a833f18822
SSDEEP 12288:4yPz5L8NtxD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7pF8:ZzyNjoF3UbrrdPulGHIo8Hr9qq6
TLSH
T15FF4010372A430F9D52B4238C8651A16B372BC765B708AEF5794173A5E372E19E3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 9d83c974edb9c9f53607c231353128ba3879ccec930e5e1f4e2bfe067a122262
MD5 23839aedd29ad97b5f68f1fb730e890e
SHA1 7e8a3e97f3e2df77db03a3d5cac36da5b99d8782
SHA512 fa9ae11724b731ee120482997415b82db070b20f219ad3589d197092370d4f3726c08500da3858c873e87ea880da83105a590900e6b64b24c4bc902ec0f02fd1
SSDEEP 12288:HytxD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7pz+:HyjoF3UbrrdPulGHIo8Hr9qq6
TLSH
T19EC4234154286CFDEE1A0174A128182917319F99EEF445DFFB8A7A3DC93A0F2DD9F026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 3d9726f2daf672f9a2da734e474aec1d58ccd9274b9530b3a9aeff8895add1d8
MD5 3342e882c15a8e86bd3e1c2c7d2245bb
SHA1 51ec9c79a3bd7edb9928d73016797c0d9f923e59
SHA512 a5c9da93e3a42a07df658e53a0062281a402b50ca7d37d707acac6b2fb0c63c7b70abe5c5b7a40e06a548726ba8524226d962c2a948b7156055f33fb3758c0af
SSDEEP 12288:aytxD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7p++:ayjoF3UbrrdPulGHIo8Hr9qq6
TLSH
T1E6C4234154286CFDEF1A0174A128182916319F99EEF445DFEB4A7A3DC93A0F2DD9F026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 642be427efc7098ef6dc5a4a272f4de7c598509763c941c9426ce0ec53fbffc5
MD5 f40b825c3cab3a3a1e42294aed791e29
SHA1 475605f14359d8c23648a31b71fa24bf9544f624
SHA512 8fd59e07cb266cae7e2cef270de49d90966a508ffdb1cbaaf7520227fc867e68f000bb90635dd7661761f1ba416fe7f519869c73f5c188a2c8a8e4f735d1a8ca
SSDEEP 12288:0yPz5L8NtxD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7pE8:tzyNjoF3UbrrdPulGHIo8Hr9qq6
TLSH
T1D6F4010372A430F9D52B4238C8651A16B372BC765B708AEF5794173A5E372E19E3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 79e87b0deeca569cb1fdd37fbbcce9efa96f5cf5f8ce93026378fad558a57c1d
MD5 66c0c18029542687317c4221ad045350
SHA1 00a8f7833390e3d9a768d3889d720cdddb9b7953
SHA512 de7ab62dc2ad629f5ababbd858e679ff67ff6bd720ff36be5c58a8dc656761dacc7c3e7e64c5c6a8c2b0859a47b00d959c94c3147fe87e75fd18aaf5e963dd5a
SSDEEP 24576:uTDaLl3z0zDnjoF3UbrrdPulGHIo8Hr9qq6:uTuLljvNArrNGGHI/L9qt
TLSH
T1F6050194B3601CF8ED67413DC8254916D2B2BC5A4BB0C65F17A8362B9F333A15C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 2fe0fac2cf45ab39ef0ef7c5535863488351c2cb3ed8293ee078f224921b771f
MD5 da505b934a643f442625308c99303a3a
SHA1 e71a1d07f007b086458abaa808c37d4e9eb6d169
SHA512 90753325b3ad9219e343c32ef0c696af2c56ca4698885d185cb32df057a3a19e9d6313bc34a8642d203e66e481d77cd9905461a033f7e73d3f532587f271c761
SSDEEP 24576:J3vd9CHKy7GZDjoF3UbrrdPulGHIo8Hr9qq6:Zvd9CHKyaONArrNGGHI/L9qt
TLSH
T15E25CF90F3E414E8F1B79A35C9764511DA767C9A5B70CE8F03A8262A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 35b7342f328287d9d79cb58e567bd117376fb151914196ed6945e696ab39f290
MD5 9c0226c930c4999e19677ef17f219bf4
SHA1 944283408e84ea99d099a85fcf89cab7fad15636
SHA512 bded4c4472c04051c89bad1b1324f1ea4333639af4614abc5d0284e27a48ebce7c17b795e72c1207f24868293c838ec97a8f8b7b18014575736acb02c3e0296d
SSDEEP 12288:MXtxD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7p8+:MXjoF3UbrrdPulGHIo8Hr9qq6
TLSH
T15AC4230154286CEDEE1E0174A128142917319F99EEF445DFFB8A7A3DC93A0F2DDAF066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 41f080c6d1b919f3e4dffbb85b9e06bec542ac175d25535888826c36d26dbe5f
MD5 63d7d5f5bb85e0130270a8ac2feff56b
SHA1 b514bb6a0589d49e6e25ec4afc81060362eb073f
SHA512 33c8e86af4c5158c741e1b6e4bc7cb03d81f36c3be3e04c965c24d88087e16e2f6a2da957ecf44b3d20857446fc906e17bad921879e0a84cd563c3e6c8f3e203
SSDEEP 12288:UttxD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7pc+:UtjoF3UbrrdPulGHIo8Hr9qq6
TLSH
T123C4230154386CFEEE1E0174A168192917319F99EDF445DFFB8A793EC93A0B2DC9B026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 6a7f6f0c3a5ab4a27df62f992f45d75411fd70e635ab013dd387ce56e0d23901
MD5 f01ff6a65fc64583f1cd99bec3096370
SHA1 3c0fb03b4a0a717978953ebb53eeb0d1656d4d25
SHA512 3b93fac986bc8ba4660ad2fbd85c2eebb9844adabec7b20e474b72b47f9d6cdc56a61ac9ddce09bd0ebddd7706ebcddab3af406dac2c2ac52b7e7a90c698bfdc
SSDEEP 12288:D4txD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7pY+:D4joF3UbrrdPulGHIo8Hr9qq6
TLSH
T1D9C4234154286CFDEE1A0174A12818291731AF99EEF445DFFB4A7A3DC93A0F2DD9F026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 2d6cba04ae4cbb1ab93aba450f59dc7a233ffd6c2c66638aaae743f095a80e99
MD5 79f9c24277e3d0fbd196bb1bc5ae6e8c
SHA1 741bf65b9f14045d5e5d2e394dd56649f45163ee
SHA512 e0b9b719c27a061c3d9a0035d47d0586feb8e3de3eb6a35145a79d34fa0231d120b7fcbc7621fb65c50a6a4a93cf7c54f0ae4ef815b1536cb3030d5aac2ff308
SSDEEP 12288:cytxD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7pY+:cyjoF3UbrrdPulGHIo8Hr9qq6
TLSH
T1DBC4234154286CFDEE1A0174A128182917319F99EEF445DFEB8A7A3DC93A0F2DD9F026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 013650e9b740aa16a36e26a996851b20461474adba9263680a3dd6bbfcdccefc
MD5 5b63f8c921614e99841c69c5a68b8166
SHA1 048a7248bb1f2d1f5bbfb642ba20905f3b050240
SHA512 b01e1f132849640dea0a64e798e5a34b01c168a3c278dd3e75f24f74fe32622e7ae1695c66041f95b91007a5b019fdb5c3eba536121d51c861766c5badadcf7e
SSDEEP 12288:LXtxD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7pQ+:LXjoF3UbrrdPulGHIo8Hr9qq6
TLSH
T1F2C4234154286CFEEE1A0174A128142917319F99EEF445DFFB8A793DC93A0F2DDAF026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 d0680376b8b84e7c5182e48cd3513afc23f8bac534578d0a8293fe1c722a4861
MD5 694d7813f4e4c66d74c371cd1c925848
SHA1 1f286ab609e3b530a1bdb8db3cde9f0545c11367
SHA512 067fa5ae81db1552b9272ce346136cdfa827ce41d1a83d959e3dcd913113cf898c763cd1af44edaaaf08d2bc33ca30353acb4a3c59493d43f08f4861d7799b00
SSDEEP 12288:CKtxD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7p++:CKjoF3UbrrdPulGHIo8Hr9qq6
TLSH
T116C4234154286CFDEE1A0174A168182917319F99EEF445DFFB4A7A3EC93A0B2DC9F026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 ed0236c537c0096d800e68f82ca8a3757f70b8a50e3377ad9fbe36195fbe9885
MD5 b76895dd4115492c9a6e04d394a96b16
SHA1 bb256d4097c322e0b495433cc89e426bc9a8b925
SHA512 648d48a1897dc030609e190c1facb915edc6b15a4ea821e47e1920354343b08ac8a878575b90f9ff3989d7bbaf38c8f1e2523afe27faae98de577d7b8173dc68
SSDEEP 12288:F8txD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7pK+:F8joF3UbrrdPulGHIo8Hr9qq6
TLSH
T180C4230154286CFDEE1A0174A128142917319F99EEF445DFFB8A7A3DC93A0F2DDAF026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 80536ac0bb6d44cfc50805bbf766184ba132a67dac9534babe0c8ad35e2d22f1
MD5 794a8868f2d361ffe3b928afbcc33c4e
SHA1 e7951c8cac345a56fd33eb57df5ff99371f562cb
SHA512 5dd461a1b72a881e0752a6a4e61a622686f7ced62024343b2c483dd0a15fc22af271d8fd92abac28edd8f309eee2c227b725c89d69985630b468cc4d895b8032
SSDEEP 24576:MfwvUk9RX6wkyAIWjoF3UbrrdPulGHIo8Hr9qq6:oMnYIJNArrNGGHI/L9qt
TLSH
T12035DF29EBDC44E5E177923C99B7460AF2B178691B31C2CF129A536D0E37ED09D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 703bf868fda1b6d1c3504979d39fda45094cb86831956101064baad8910036a4
MD5 f4a465bd4c0cc326dd05d87f76b66670
SHA1 213c1ae852c36168e2323c55fa666603c20b041f
SHA512 ba11b7681275e90717a96ea7386fda3dd77d6ed72404bdd08e377209273f1fc4f9175e0c408e36dc48214dfbaaa1e396df7b137d93d9bbe8375b9f73d1936dce
SSDEEP 49152:oYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ANArrNGGHI/Lm:/ySzP5nNPHA9E
TLSH
T125066C96A16801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 13c8fb36dfa7ee7f2f9b65570f07bc31a5865907180bba3a782c2dac18de955e
MD5 49d0d0f5118739504ae4d135c670839d
SHA1 670d1d8b50044799feb6f4122481481258da256a
SHA512 15e91e25e490e730afe4528c775e783a64e1bf629c750fc160a17bbb90c38b872f45ed5cb2a30b9f0ce1ae72c39a74edeb67069cd1dcc4801f16f3b9b202cf04
SSDEEP 24576:W47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYpjoF3UbrrdPulGHIo8Hr9qq6:W47JUQjTirIhCnDHUPfF/wNArrNGGHIC
TLSH
T11065AE1EA3EC01E5E1BA927885154A1AEA71782D5F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 7d2ca9864608a7186ba1b27c05e979c47d80e4ebff56ede5b2f2c61caa6f30af
MD5 dd246186065f28502739a2180b263fe9
SHA1 f954f2a744551136e68bb6a2b69afa98ee807c93
SHA512 e5162648550ef0e39e66b8e3ecf5119ae9d9f3a1a5c1379cb0f3cf5eda68d3a8cc4f88415427cf3cd72c8d455a61cf7a2a0e18b31350b477ff7eaa5a86e5526d
SSDEEP 12288:dbsfitxD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7pGI:4ijoF3UbrrdPulGHIo8Hr9qq6
TLSH
T1AAE4F00AD26811E8D56E6278C7554A15B3337D6597F0C3CBA7C0F93E0F3A2A09DEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 f8125655a77287ea136ebce451343e3f398bb78e0dfb7bc5e7914e03b78f6509
MD5 db22ab4b23c30cc0e9d10452483110c6
SHA1 5e693e5a2c9c9d6eb95e836723d21b29b85d73d6
SHA512 2a3c31ea7ea918dbc8288155ea3463d3a07d3711dcb008792be789dce3294f61d68a7a7f8e3aa6c2e25c8d21b72f4b3e41b2278b9e45430dfc5387c21e3aa469
SSDEEP 12288:5e0uU3fKqNtM83F+8EAiLdNbbWJIT10QaUw1LYEOguDGulYsJRMXfMyN/:5eXUP+GFteT1eaEOZDGuisJRMXfMyx
TLSH
T1B13528407626C74FC6AD40325E36D2CCAB707D42EE456B0373C88B3FD576658BAE6682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 3e5cf4064089c07fa8189757f39afffa36e8c1d437838343233d59e70916d035
MD5 997021448d5fdcaf1db236d6e07c9983
SHA1 bf751aa4c27f2d9b85ec4bf065793ce8a4ad4e86
SHA512 480426461ff451ac9c394290b19db00a72942027170f6e40385e539d26db5ba696b13d1d94a0290e1810554d0978298a599704e996d97b1d03ef8b021463c6a3
SSDEEP 12288:REAiwdNbGbEAdIdNbPBEAdIdNbEFeEAdIdNb+wrS6lrwEXwb7QsQ2E+gDvrMG:0oxFi6lrHjz4G
TLSH
T14475E8419137E38FC1BA60324B2A5B4C7BA4EC16B7056F27B7C8453AD86AA1171F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 83cd829a1455eceaa1cbccacca4834131a3374b06078bd3c8b8447623c26ad32
MD5 15aa0e72bbf830cb022447f1e11b956c
SHA1 39e8d85afd9dcf522104e393794d2a034080c0fa
SHA512 08f63b8e78a9d1d20ab3b36e4e3b551e6b0a531c2501a7d94ff0e8575d2f8d6a07909496fd75955f6a464dba4b4d636e55512424e3172fe8de15d83da1082b62
SSDEEP 12288:7F76txD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7p1:R6joF3UbrrdPulGHIo8Hr9qq6
TLSH
T147D42311452C6CA9EE7E0174606C54382322BFA8DFB485CBFA46767ED93A0E1DDBB017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1dd2bf654b6174a133b401cb42623b0c5a139f90d46260c71d717ed5d09569fc
MD5 819481914d4d9f2479861c33b14dcedb
SHA1 c53a8c99e211b8acf014a260ec81517f275200df
SHA512 0073ca655bca14fb6329e4ac247d227ddb603465b6a9015995da1a9fd5745b8b89cf4f68498321f5a05c5eb1bb4c6db8baa12130e0e4d36f8c091a1a051daf46
SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bYAjoF3UbrrdPulGHIo8Hr9qq6:hgb4mBIBhGFiNArrNGGHI/L9qt
TLSH
T16F65AE1E22EC01F5E0FAD2B89DAA4417D6B278164731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 af6808369f85a0b9315aa594afa2a14c7366de14f38bdcc8a755b8ef9fc37c4f
MD5 f63f59d3852fda70775bd635ac3cf552
SHA1 a89bf4dc33e3c68d38feb78f373c4b727948b80d
SHA512 ace66ae95a5604184cacdf50e91d68a3f9378ac148aef370320d4d729c4af352c2b6bf5e93a6602fc8e948b52dec6314067271a549cdb2dd68b03f64d1af8640
SSDEEP 24576:BG88u8FpJqH1bzria7/mZjoF3UbrrdPulGHIo8Hr9qq6:E7ZFPqVea7/HNArrNGGHI/L9qt
TLSH
T12B35F16566E001F4D47BD13889864663F6B2B8250374EBDF0BA88B551F33AE14B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 cf495a28e2b837596683f7e8bb7386a1c2e3dfaaafccf1ff15028cbb2cdbf64b
MD5 e3ac3a2de0a24c3e35a13b504357be2d
SHA1 faf1108df5fbe0ba8dabbe29c5c14bcfd1181479
SHA512 ccfcbd2c4a64e720b6f28ea2a7beb4f618edfec9916f366487a4bee483b2a82c983ffba0caec91cef074f0b8b45a4007eb6ec663876dbd3eb513c1b108038928
SSDEEP 49152:mBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjeNArrNGGHI/L9qt:JG05lO43bknNPHA9E
TLSH
T192D5C06A62EC11F9D1BBD17CD9C6460BEBB23815033456CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d3fac05db650de8898705589fb5fdafe2e643159c6c358bac0354d0f07b2241c
MD5 2f3c931e8ccbfe1487f478b74f8207dd
SHA1 c5e03bdecaf4144c8fb542e78cc0b3b147c182ff
SHA512 2195d8efcfa908a789c02e37f6e748569089b49a5319d85dd7281bb695344afd4dbefe25906b4801bd714dfee914182b64a2e271755f666f11675b59cbdb5a11
SSDEEP 24576:Kfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn7joF3UbrrdPulGHIo8Hr9qq6:Ca5POZ3BJt2pasx2+mmNArrNGGHI/L9E
TLSH
T19D65AF5EA6FC00D5D5B9D17CC5834A1AE5B1382553319BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a7fc98e4a3a90461e80c36535869bb397a47e32321f07b9d774f04c9bb2bffba
MD5 d392da1167947da3d1e509bb9fcaa553
SHA1 444c944c9f746c30c3c2458c5bc2e211c7411d32
SHA512 f53d4c0bc49d6d69530d48f13880ad8077a8addc2efdc00246fe31efd6c322b58111c382ef1550d0230f28a21b0319c3ee3eb512f06e9d60828ddba09afa4437
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7FkBjoF3UbrrdPulGHIo8Hr9qq6:SNc/zEOVHFnNArrNGGHI/L9qt
TLSH
T12E858B1622E901E4F5BBE1BE89779546FA71786953308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9a467edf015697dc0a8d591e7f61d02ef5db616e6134424a9f0a79485f229c6c
MD5 5a16fc0ff674d0b0e645fbfda19d9ff6
SHA1 513435b227d921d5b2d27e16709825616bc9bd85
SHA512 d61ef61b0528b6d4e5d8b1d04028ae652c738092b718e4ce75e8e8d593eaab1fc20c34a91185a0b037440970bbbcc40b28d4b3c4b70991d0aa100cbf4d37db05
SSDEEP 24576:lTkNvNnaFeYhJNtmZBmTjoF3UbrrdPulGHIo8Hr9qq6:lTMwBtOmYNArrNGGHI/L9qt
TLSH
T1F055AF2EB6B845E4D1FEC6B4CD238512E6727861173293CB9290C13F4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 13471edd587f631452c73f44503a089dfad16f61eda03168d53777247849cbcd
MD5 dfecb27c56f7ca9977bf09fbda8de6f9
SHA1 aa9a138d9d7129e996f10aade27000635f25749b
SHA512 8d93475ee60f8f2899d44f2719e2dd6b70bbd4b86956effadfb80e3760770ed70cec6b8fd5e7864085831cc4a097b24664b0dc93213949dedea512d4918cc30d
SSDEEP 12288:/HvUrBFrEjwaQ1txD+YWF3Ub14QrJ/PulGHhWToWJHFt79qq6Ltfn7p4U:/PUr+NQ1joF3UbrrdPulGHIo8Hr9qq6
TLSH
T1DB05E11F22AC1CE5E67AA17C85864619F772BC621711D2CF02D1917E4F379E8BC3EA21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 38b83333f4548996a1336ae8eb4fe779c28bdfc80b8bbd101e2993cf2254cec7
MD5 f6c342252f476bbd46764baaacb8ac9f
SHA1 7e2a9103085f4e87cdf76c9fe751a72315a98add
SHA512 cafab1c85868415d248a3ccabfa08dcde944346dd757c2af512e25a433b2f917d4353c971ed7fc1e426a701a3f047afc8e663caf4344872ccf888affe942ecdd
SSDEEP 24576:XD3FHshBIYQgA+joF3UbrrdPulGHIo8Hr9qq6:XDVHeBIAARNArrNGGHI/L9qt
TLSH
T16B25E13DE66C04E4E57BC1BCD6638A06E7713CA9033156CB06D491BA5F2BEE46D3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/472-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/472-149-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/472-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/472-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1400-82-0x00000000006D0000-0x0000000000736000-memory.dmp

Download

memory/1400-87-0x00000000006D0000-0x0000000000736000-memory.dmp

Download

memory/1400-81-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1400-311-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1644-92-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1644-331-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1644-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1644-98-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1644-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1644-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3124-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3124-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3124-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3124-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3124-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3328-8-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/3328-7-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/3328-1-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/3328-0-0x0000000140000000-0x000000014010C000-memory.dmp

Download

memory/3328-13-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/3328-15-0x0000000140000000-0x000000014010C000-memory.dmp

Download

memory/4600-71-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4600-296-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4600-69-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4600-77-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4636-25-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4636-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4636-18-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4636-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4636-24-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4936-56-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4936-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4936-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4936-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4936-43-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5116-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5116-136-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5116-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5116-138-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5116-130-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5748-58-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5748-59-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5748-279-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5748-65-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5896-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5896-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5896-111-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/5896-315-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/5896-105-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/5896-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6076-314-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6076-124-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6076-118-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6076-116-0x0000000140000000-0x000000014013E000-memory.dmp

Download