Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 01:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe
- Size 1.8MB
- Sample260910-b5wbnsv1ct
- SHA256 b4b6b2bc7d9f87f488b58b508048830a0805294f83d89a8e08553b5fffe44a30
- MD5 f1bd6f481c9bc9e36a26134591271e2b
- SHA1 7c4c86dba481a760beb81a7271660034745bca93
- SHA512 7b27852482932661642367b8df22d2decb746d828b40ecb9bbc2049c6bf66f5f09c223f81013175389c6422f6ebb3f5f30b68bca29ad702729094580cab57e93
- SSDEEP 24576:0iBE0zqwXeAVmYA22C9+bmOmbTk3reZCIT59z7m:0e5Xe6XA2LlOpbeZB7m
- TLSH T1CD85D048A75445E0D1B6C23888539946E6717C018BB1EBDF4298E73E2F77BE09D3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 22 IoCs
pid Process 2504 alg.exe 4344 elevation_service.exe 1040 elevation_service.exe 4804 maintenanceservice.exe 1056 OSE.EXE 2844 DiagnosticsHub.StandardCollector.Service.exe 4296 fxssvc.exe 2280 msdtc.exe 3156 PerceptionSimulationService.exe 1656 perfhost.exe 4852 locator.exe 2812 SensorDataService.exe 1736 snmptrap.exe 4980 spectrum.exe 4652 ssh-agent.exe 4284 TieringEngineService.exe 4124 AgentService.exe 2244 vds.exe 5016 vssvc.exe 2392 wbengine.exe 2240 WmiApSrv.exe 4508 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 24 IoCs
description ioc Process File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\a42dfdb02d44b5a9.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe elevation_service.exe File opened for modification C:\Windows\system32\fxssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\spectrum.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103203\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103203\javaws.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103203\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ac97417c640dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036cc3617c640dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000019905a17c640dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053414c17c640dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe - Modifies registry class 52 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40} 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577} 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577} 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe\"" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1} 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A} 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib" 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe - Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 4344 elevation_service.exe 4344 elevation_service.exe 4344 elevation_service.exe 4344 elevation_service.exe 4344 elevation_service.exe 4344 elevation_service.exe 4344 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 916 2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe Token: SeDebugPrivilege 2504 alg.exe Token: SeDebugPrivilege 2504 alg.exe Token: SeDebugPrivilege 2504 alg.exe Token: SeTakeOwnershipPrivilege 4344 elevation_service.exe Token: SeAuditPrivilege 4296 fxssvc.exe Token: SeRestorePrivilege 4284 TieringEngineService.exe Token: SeManageVolumePrivilege 4284 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 4124 AgentService.exe Token: SeBackupPrivilege 5016 vssvc.exe Token: SeRestorePrivilege 5016 vssvc.exe Token: SeAuditPrivilege 5016 vssvc.exe Token: SeBackupPrivilege 2392 wbengine.exe Token: SeRestorePrivilege 2392 wbengine.exe Token: SeSecurityPrivilege 2392 wbengine.exe Token: 33 4508 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4508 SearchIndexer.exe Token: SeDebugPrivilege 4344 elevation_service.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4508 wrote to memory of 3952 4508 SearchIndexer.exe 120 PID 4508 wrote to memory of 2144 4508 SearchIndexer.exe 121 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-08_f1bd6f481c9bc9e36a26134591271e2b_icedid_mespinoza_njrat_ryuk.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:916
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2504
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4344
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1040
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4804
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1056
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:2844
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:752
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4296
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2280
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3156
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:1656
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:4852
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2812
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:1736
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4980
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4652
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4284
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:3928
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4124
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:2244
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5016
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2392
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:2240
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3952
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:2144
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 8132d18a42e86e58f2ed565916750bdf8601c499c657c192c99ede156b6f82bc
- MD5 14a2c7dec5d8df74d687560098defdfe
- SHA1 29936bc2b264145813c9f69eada4c6318313c10c
- SHA512 39f04affa4b74136e09253af643681a600e579c63f70eff98cb2a0a27ea19a81c352007664e8645e766a9e3bee7dddb77a44b0251e50e2a1400b0a1ea3c0f146
- SSDEEP 49152:fb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnh2LlOpbeZB7m:d3q6sjB0ycv
- TLSH T108D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.6MB
- SHA256 66f5e5a8ac4a44e6336d41c3dc5034aeee8f7ca74ca8ff3b85a7c34777dd32e0
- MD5 cceedb26558d97a58f482b0c03892fc6
- SHA1 9478f9c41bf39d20f5f11f82d11d19719bfb00ce
- SHA512 1321905b21672106f4e469524f21eef7656c9bb7e633a76217d18fb574621cce0b66cc4de30cb62b60475c6bc4d336e7c9218cedcc93ee8f2d6084bfb058671b
- SSDEEP 24576:dXYfDtczAA22C9+bmOmbTk3reZCIT59z7m:ItcL2LlOpbeZB7m
- TLSH T15175016467D448F9DC6B823CC9A28411E633BC9587A0E7CB03E489661F737D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 d1600a8f4dc82286bc72565dbf53565bb2a0af393239eaebfeb7d348db1ccaef
- MD5 877070ba3a60ce35aa885c7e9e19f5bc
- SHA1 9f825645f1e8fcd01d641c028d5d083f77366e37
- SHA512 70eee19561c600ea77d6fe187bba0bb83d0bf031e59acfe03cd7cbd186b53a016570007481c658167f24bb2de0a6a86d008c3faa40d0b2d38e4bd9df9cc29dcb
- SSDEEP 24576:i0Le5ji0hmxxrMp22C9+bmOmbTk3reZCIT59z7m:iPji0Aje2LlOpbeZB7m
- TLSH T10295AE56F6748371D073C0B9C5D2A69EE97130865B308ACB4286C77C3E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 1c030137dbfae78f5f8f84ce69c4bf4ef5fc22d8686172f75726952ece6e57b5
- MD5 51ab4082ef9e47cade6e10122e72b34e
- SHA1 cf456c1dbade594ae09f8a43235e21fee59d577a
- SHA512 54c04a4c755d2e3d383a89bd4c9609a8377f8787491eab6344d8ef909fc3dad8bc479eff696d18f54a9b7ee1c405e6eb18a63362d31166f0724a06bc24c6b84b
- SSDEEP 24576:ga7/ezSC6vUyD/aqgrvWn6q8wyub22C9+bmOmbTk3reZCIT59z7m:X/ezSC6vUzPveHjy62LlOpbeZB7m
- TLSH T1D0755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 1f7f00badfa63c624d622c63f90006ed276d156fe834cc09b9b6df180223a39a
- MD5 c2ac0dacd2bb031135a434362d93817c
- SHA1 1befdaef1ae95c90f7154f9f40c5b4af7a6a8863
- SHA512 69be9c3d2488e25ab56f11378b3480c796fd8dd07d46fd61acc1bae59b3b9e9923af9b851107bed3d0bbc3d266a7cb157c1c6b6d581dbcdd1af7068c1492e902
- SSDEEP 24576:UVbqPb88hv/l+YE22C9+bmOmbTk3reZCIT59z7m:UVO88hXl+z2LlOpbeZB7m
- TLSH T187559E66F6B48331D073C0B9C5D2AA9AEE3234415B318ACB0246D76C3E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.3MB
- SHA256 b420d5d89aa7fcd0ec268a431a4ab765d2d2fa57d954af8bac820115c1839f00
- MD5 0be4fc383193be9f22ae762e9c77af47
- SHA1 a818ccfc983b5a015eb97f208ffb0017bc7701b1
- SHA512 f362033c3e7cdf853c2496de78afd330a235064dfc13baf19a7f265aafa1bb86d83c65b818259cdfe3125e28324a921d47b2b4584c2a90eb3b7e539fcd5336f9
- SSDEEP 12288:hLN22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:hLN22C9+bmOmbTk3reZCIT59z7m
- TLSH T1625523C18FD8C8FAC6BF1230569164F52539EED8DDC6B55B81891ECF18F4AB8D44A20B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.6MB
- SHA256 062abd1008078d555205fe934a4a59319901dbb44f6f6bd9e51d95269fdc0523
- MD5 c056061443c48c2f1159194406939af9
- SHA1 eacab5604043691ef1ddf59f83b621c7161ff124
- SHA512 86c8f78f5c93ef4ef1ba015e1d5ff65f9416630164ba4484581a3b5bc98f8c4e2276e0f7081150875cb125efe0d1274112941b06889aaa30ddd7bcabedd2f313
- SSDEEP 12288:FeBNUbTVO86Us22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:FJIUs22C9+bmOmbTk3reZCIT59z7m
- TLSH T12875CF7BEE28FCE2C27E4D7857918640E77278708F52A3CBD165820E9E235E05D7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 2b6f35e7e6489874e2f141940d8537f0b4106ed1895bb7bc06e9ca9d8b7552dd
- MD5 7f87bc2553b17b8a27da6562c885ae77
- SHA1 c29946e55e748023bfd0564c646669b41fd0e60c
- SHA512 7533da9722c333c050a5e81265cb7e6f52ab8c8b0aed395b0b2f75bd1e98d201129af541b1af4f65ef3e1216bd66e767e0a4af90417acc9d7e84d9c2484eb470
- SSDEEP 49152:fQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THS:fQvGAdlCEL8c/DRNw5Crycv
- TLSH T140266C656BF880F5E0B7E134897A85B2F7B678421D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 ba9e4cd7c49d90c2e38a1cf798688588db82b6ed50114219cd2fc2e51c64c2c0
- MD5 0185b8a6f6e8d8c83ddc8edbc3b422fc
- SHA1 a1b207f83def16793796e51bc1678e7e3f99becc
- SHA512 10bf6b7dfcb4101cefb35e6ee41c62276597728150e98d3160aa962d79e6f465dc0624d20142ed839e3de3253bc02cd3d8370c33253ac3f6295506fa224dbebd
- SSDEEP 24576:Z0ewsAju22C9+bmOmbTk3reZCIT59z7m:Clju2LlOpbeZB7m
- TLSH T14D85E071FE74D436C2BF0DB11B26C716142DBA604F922AC3E3A84E9E59702D26376A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 54b62c89afb080f2634ef62c4ece8e26dd2761fd8eb02115c020b2fe08a3d385
- MD5 13cb1e0d9dc27b20e7e3b067f16ddd98
- SHA1 58d7d443a6d2db98c0eceb556daf49990cefbf1c
- SHA512 343e547009a8b268ea6b35f941e468038940f04c678b83430d06b0b8c2e3b986cc14b8b08d36ed9e06d4d862192deeedfb40b92a7a7b176200e2af9648157879
- SSDEEP 196608:pUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHSv:pUEtQevvqc2W1cpV2tI32S
- TLSH T146474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 f0151c9c6aacfc6bba12fb81718bc94be3dbce49bea3c198f209f34276aa644b
- MD5 cde9567b14f301f7cc7199915ef5895a
- SHA1 7462e0c605da3df1efaf70dd8ace8ea605c4f862
- SHA512 8fb7800c0e5e5b29a6b970d57fa93583512fbc8cf4f81f6b3bb53a9bf7f7b47def7b935b769ee352fa674bf49f411a6af2520f7d69b194a2cb942961c506c55d
- SSDEEP 49152:4CbRquA/m2yL5zTfFiV+XenmE3/zO2LlOpbeZB7m:xoquVjnmXycv
- TLSH T1E4D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 5dbbf765e0b19408657eb1a00b11ff7171f0f5e351fe6110a4495e09b3d29f69
- MD5 8e601ffb4f50cd0368f653e04aad37ae
- SHA1 036ddcec5a5e50e1a70793c4416cbd55e49d4ed5
- SHA512 f3931e32dc5f48e723d98714262d9853028076f6cb0dababf94a34651fdc8352e91d091e0d6e722bd2e0201b59f7d4ea5d5a25ed93d129ec3bdd86f690e1bf8c
- SSDEEP 24576:hAhGL3IFoiwtA5l7S53322C9+bmOmbTk3reZCIT59z7m:hAMUFoiq5n2LlOpbeZB7m
- TLSH T1EB35AD81EBF945D4F5B7AA7899B69171EA76BCAA5E31C20F2150C10F0E33E509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 ff6e8c3258a7dcc5dc2a24a2030816d123cd88632a60c8a31d7af2ee309ade6a
- MD5 867a4c01813f60937eb3406e572244c5
- SHA1 314c6d42f284ab61420e5469028e5ab4ccc74e45
- SHA512 2bad9667337e97166ce0231a2c9d9d1b1aca5a18a066de005c943d806d5025be2d8eebf420b8be1bb02d09b629c6cd194025e91c6cf20fb31022f15815e3cba5
- SSDEEP 12288:Qmw5HEjsChNVBFgl0WDm+C722qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+114:Nwu4OWa22C9+bmOmbTk3reZCIT59z7m
- TLSH T1E475F18677E80CF9E96B823885578136F7B2BC152A65D71F0360CA5B2F73361AD2D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.4MB
- SHA256 074f769f25e3d35a06f22d9a55fcecdcf7531361389d812fd1a53f7bd7762add
- MD5 232003452f56cfbf7faf190401c07434
- SHA1 a0c2cbaf689185e1ce67b17abe39d2439e38c0ec
- SHA512 87980aad21e2b96236718a181f3b1531bcb72eb6ca93a98b6b66f807e4ba0d9e6df5f6539c3574baae5c5c2c3be99dccc29144744f4c976aca02e6960d124769
- SSDEEP 12288:veZ1Iy+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:2Zux22C9+bmOmbTk3reZCIT59z7m
- TLSH T19F6512C627E860F9C1BB4238C9E15545E372B8A5ABB253CF02540A9A1F73FD59D39323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 b39a654237442cd2aa31aceaf8a9155ead675250dbcd0d41ba28a306d2d9edf4
- MD5 60a8c2165642363d55cd03c543c4301f
- SHA1 07194bd86e7179a7ddda76d952922231bf9cf9a6
- SHA512 9c446139b0645b0e0cacfb797f1fc10126aec3f2f3b763b0aa757788789fe869158a12e60497ea97bb72496ddf8237c2c08bd9ee3bbfaf2494229f1f4a2e6dca
- SSDEEP 49152:ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U2:BQRQyi36YOcPbLvw2gAf+PN3oycv
- TLSH T1E1667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 4b9b48a5543d70a4aa73ee8d3417cc53e5f7272bca8abc9b0a8ee2862778886f
- MD5 dcdd5c7848851b4b16a33abf2cc4e75e
- SHA1 a63e1da2cb9e1c982eadfd2010dcb7f56792d6fc
- SHA512 37bfb1fe21f130e87d51098663d6728a50c9cd808297efcb5bf21ef25c74c0cda7e7c4418cc38622d3b16551416cb97319315acabc8ea54bf1cd201ec4a01174
- SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U2:nQRQyi36YOcPbLvw2gAf+PN3oycv
- TLSH T10A667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 f7219eef5fc710d52b49dbcd5fe53b14f428eed801cc2c2422466b8b74969591
- MD5 a07cc5ad5c06ede3397e79d77d912b75
- SHA1 796ec01fe4b19bf99ed9f19ae3e26fe9d9e32474
- SHA512 737d0e0deb32519729ebce0fe8d046d47de34b51fdde30575f63bb439b0658c7bf4131eb15205490541391c4a501cf63a2d1dea360c8440d53f058538b5815cd
- SSDEEP 24576:9wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0h22C9+bmOmbTk3p:568Qg55nhceWu7PNU3/e2LlOpbeZB7m
- TLSH T155B54933B2F600A9C44DE1769F46873196D27C758FE1E3DB8505720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 2a618b423e9029b21eabaf03796fdde5c319ffe85696028ae16a8a5511d231c6
- MD5 335c80c30c54e7d2977cb1192e84518d
- SHA1 e28be2e8c0ee64fff580d9126f39f54a419ccb56
- SHA512 a739dbb783e84c9d0b820e795c26bf214e17b97e89211965e10490518bd2a4a8cda6e19dfaa70d7c2460a71b78049b0685a6fd7221e5b5dcd75c7a01b8cbe55b
- SSDEEP 49152:D3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk998:Wy5112gYy5azzVvt69nLKnhZNycv
- TLSH T1EC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 da40b093fed0939f54ed642f12a403c3949b6af51ae0ad0e339c79394ecbf8a8
- MD5 caf26ffbcb7fbec44db8c50831f05600
- SHA1 7f914feea19e29a2a78a981b9bd32f4ec7f48418
- SHA512 d6fc1ab8e81807def8f3362c83418d46872788923c73768d6e0e8caf05452ec4af38f2da9173361292272c2bef990d72fe6358dd54ea230b12a59cff6e97a7c6
- SSDEEP 49152:dB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glw2LlOpbeZB7m:Du6Jmdxd2dwycv
- TLSH T13AD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 467b1b5ffd2f491d6c8a0a27ce6a4d8ed6338107893b6e53a627bf1545d39a37
- MD5 b7a5af0db2ca31d34e29ec4819b6fe95
- SHA1 0296fe8c92e4a81d4bfb90f90285d4127263d1d4
- SHA512 5aadb26220b0af1b0a7c178f46ec4e5442b0d8beb657bcbb01670899a12396cb4b00671f5f9f868a4c0e8a8719d73438d1283732de8a2deaecc299fb4e887eed
- SSDEEP 49152:R1hpsNoJpF1A63U44CwH7R4xM2LlOpbeZB7m:RmifPWRXycv
- TLSH T10AB5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 99d67bcb49d971452d0f284acf7dddc8841f21eff992a9bc14f5e60b0d8b12ac
- MD5 66c3d09707012a1140955107b119f590
- SHA1 e2db47fa335ed013bdb51530ffa7d608466bdef9
- SHA512 33ef65f7ebcc03751f7c29cf6c1949f2be85ebd6249e198acddc990b58a42b3ab4a83333ea34cf881f626dadf5f5d18a029a2167945cc19b54bff1b2586cf4ea
- SSDEEP 49152:cSuZQIY0Be2KcRVtOnks6NMHqx2LlOpbeZB7m:e5dKii61xycv
- TLSH T1B7C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 3224eef6ae1cabd4cf8835774daa4ab756072cdedde024cc27158f35b785de69
- MD5 823da8abce9aa778acb8a6c054e89c3e
- SHA1 b1e9f43cb3fad153bbbef3befe108fd2c9b56310
- SHA512 fdf2a08749f6c58c6ed0cc1629ce6b7f423c47c9487ab0cdf97a05fae1d7acca5e2130b93b9a91fecca192181cf90bbefb033b16db46ebd3342839537c6ce7f8
- SSDEEP 49152:OhtSn8EApI0fig3giDn0AP5wA2LlOpbeZB7m:PX2imphDycv
- TLSH T16C95BE13F2D900E8D06ED178C7568632EA62BC150B35B6EF0A90B7561E7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.3MB
- SHA256 a0c4b852ad0d1a2c49f1b845c663ea88c3cc8b1c620af551078d4b9026896e54
- MD5 5eee569d5380ffbe1587cd20df4e5dd9
- SHA1 28f840271adf8b9ae87b5ad6d1c141c295bd6e30
- SHA512 526307262c73f9f6f4a123be3c4e2bfc14d71f91727ae597eeff5777248e46d8cb332c3f4e511e5e1db639bc5fc8e9cb3d5a2970466e3d537414a7a34b50861d
- SSDEEP 12288:+V22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzGF:+V22C9+bmOmbTk3reZCIT59z7m
- TLSH T1155523C18FDEC9FAC17E5230865120E56529EEDDEEC7619B428D0D4B2AF1FF8940A14E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.3MB
- SHA256 fa148dbfad1e93dcf7116e0fd84a99a162d70a6ad270d0f05792df9c57653fec
- MD5 c2fcd7dbd1691f1f7d48377514ef09c7
- SHA1 af0ffdf3352439e661a33421701a15ccd5cef0c7
- SHA512 e5deb3252efbeb8a18c52e7d12a50a5a7c427369361168f1a09692a69993d0d65cf5c9cb20b2ad24eab7903a84bccf4810659eef78a83a148af79d99c171bbab
- SSDEEP 12288:GS22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzGF:GS22C9+bmOmbTk3reZCIT59z7m
- TLSH T1BF5523C18FDEC9FAC13E5230465120E56529EEDDEED7619B428D0C4B2AF1FF8A40A54E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.3MB
- SHA256 81300f0dcb329dc21a9fd2b397d2e6544f4e3cb911d0b061e7ed65e0651814ae
- MD5 070dc087044bd4d79e5fe90c6e85f35d
- SHA1 64c578bc2aa2a9e25c38fd71432b616eb3d0151b
- SHA512 9e4246e69affee5feffd0d911447fbf6711a7b4545fa0a17df8d8d3d2ac917238a888148c116cefc968d93c56977d64413c6edd8c1596b9460269c260fab4581
- SSDEEP 12288:O022qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzGF:O022C9+bmOmbTk3reZCIT59z7m
- TLSH T1F95523C18FDEC9FAC17E5230465120E56529EEDDEEC7619B828D0C4B2AF1FB8940A54E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 8ddf1e5601e371fe5da40416f4392f2f0c0949bcacc6e1e504300cf8a4048d6e
- MD5 133fbce97153ad99f014f7bcbb7e69cc
- SHA1 809743719a6c4f218effc2ee728637b881ff97aa
- SHA512 dbde4a8a6f027f332d1fd7b86c7694c583958910a47a1121b172b8b948c61defbfdf413e8a19b494e5b6327659f6e02aa7255a70737fee66390b5e3ca59e110f
- SSDEEP 12288:AVX22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzGF:822C9+bmOmbTk3reZCIT59z7m
- TLSH T14B5523C11FD984FAC47F9234C56150A1A275FDD8EFE3629F82440D4B1EF1BE4A82974A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.3MB
- SHA256 31f72a11ccd7b2ff396fc484e608de85ab5f2c6a8014b35e6e7d9e3db7d5a9bd
- MD5 44bca2628efb06a3b1158a4a454c6017
- SHA1 2ac64482c171cb394d37f11ae37f0e18488178c8
- SHA512 2ee41efea82c08172d386b78daeaee721ee8a16efcd05008a6369a17e67644cc7e4c35320e83420c282628750f5d3cac955dfb9411f1c7e53fde6b686f4d8572
- SSDEEP 12288:pP22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:pP22C9+bmOmbTk3reZCIT59z7m
- TLSH T14E5523C18FDEC9FAC17E5230465120E56529EEDDEEC7719B828D0C4B2AF1BF8940A54E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.3MB
- SHA256 69745d9550133b1eb52a855fd6a9e3f04666e88109d8d4a1febba14b7aacf85d
- MD5 838872196236cbc3275e59284ca2418b
- SHA1 6edf9f4cc439fd6d21ee19f879851b921f885419
- SHA512 0d9dcbd8fb305e33ee277f3d7906e340a0d72d1fe0ecb2030fe44936f1f84abe125d9c0a7b8ea3a91664caf67fa2fb6adcb4278ce6219c906fb5f9909f39490f
- SSDEEP 12288:EW22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:EW22C9+bmOmbTk3reZCIT59z7m
- TLSH T1F75523C18FDEC9FAC13E5230465120E56529EEDDEEC7719B428D0D4B2AF1FB8A40A54E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.3MB
- SHA256 046610a5d56b99f284857a17026f1e689c74d96f518410da2253706a4c71533d
- MD5 3551dc68441205de40ff52a37a59db28
- SHA1 e7c390514cc9bea5a3d16515ea77ba9c14334faa
- SHA512 317a96aee4332904457aa5ee8af3e6bf2c6e97ce2b7496aa783adcf880f05fffcbc02331b36840132d808c4ed637d4b852da3299dbb49d4ea078d6daa52b3df1
- SSDEEP 12288:7K22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:7K22C9+bmOmbTk3reZCIT59z7m
- TLSH T1595523C18FDAC9FAC13F4230465120E56529EEDDEED7619B828D0D4B26F1BB8A40A54E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.6MB
- SHA256 b46dbf57708352aec24dc31261931006e5e07aca2a881e512aedafd41f7ca788
- MD5 495adaea90b00a8cf4fd124ab860301d
- SHA1 029f53723c7a4ea8705798185776a785b311ce53
- SHA512 a8145fce338dabcbf2ee4c606854f53e8960c2d9b0d01c0e83f7dbbe57844f2bb1da272badf958b16452db4bd95f531b5aced40944baccd38a18d6db52de4fd5
- SSDEEP 24576:nZMRzFVSOy22C9+bmOmbTk3reZCIT59z7m:nZMRzfm2LlOpbeZB7m
- TLSH T1617502D5B79008F8DC7B813DC9518856D2B2BC594BA0C65F03E83A6B1F733A15C2EB5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.3MB
- SHA256 638ed362d4114b2756c4d4342b13897f5d952aa65ce107758e591bd12c83016b
- MD5 e55d348119ae44c2494b64b564faf083
- SHA1 639adf333547efc37580ba06500b60427b0ce460
- SHA512 74b09340fa57f45a4e52cc6fcf25428d0e951e8152a4f32e92cd32a4b9a85a5b8780e5418cb3da000c3c1d733888f077cd6bdf0992243af5f7e7111d1283d99f
- SSDEEP 12288:hB22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:hB22C9+bmOmbTk3reZCIT59z7m
- TLSH T1735523C14FDAC9FAC17E1234465120E56529EEDDFEC7719B828E0D4B2AF1FB8940A14E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.3MB
- SHA256 d6773aa25d2ce7628f18954d536bdbed65b1bb6dac88eed308b5e4d35dbe3e85
- MD5 2a862793be3b7a55192042f2ce723283
- SHA1 057c3a9ec4fdca09e9736f0802d930cf2386f626
- SHA512 5550679bc433fff6c45e6c6eb59e67d6fc3ff6add5ab54fdfecf65fc4a93a69b5c25ce22362a961974da6648c08df64c2a06b6c5bb9fc1d575dd254fe677c9c8
- SSDEEP 12288:8d22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:8d22C9+bmOmbTk3reZCIT59z7m
- TLSH T1965523C18FDAC9FAC13E5230465120E56529EEDDFEC7719B828D0D4B2AF1FB8940A54E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.5MB
- SHA256 3a17135bf4c5966f5e45277891adabd0701e11c91f2fc4ef188a80cb285a42ee
- MD5 95bfb35cb0df544e5418f6fa22e40b96
- SHA1 94d68b12ccfb5b08596da1f973c3d273f9ee2f86
- SHA512 73b57c78ba6ef7f651fd2e554511cec53b20b55037c64f9a0b4cdf0f55ab27d1c317c588fac71da9ce4b04b054c959165656b5ea6a3c26116df7eb7a2a246baa
- SSDEEP 12288:0yPz5L8+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:tzy+22C9+bmOmbTk3reZCIT59z7m
- TLSH T1DD65128367E520F9C17B8238C9511951F376B8758B619AAF03940A7B2F737E09D3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.3MB
- SHA256 ab287163dae14f96cd00ee0121766dc439950e35cfcc2eb960904e5439ac1f34
- MD5 e711687c2a9fa17fb7155566c4adb3b2
- SHA1 cc2300a1b809a218faa74c92cb55e56ea0f907cc
- SHA512 2cae36d01b2482f1ee59ccae50bcf8efe468c0c94f9343e157d0a3264e015a90bc6f0dd2ae65b295e7aa468b8c3ca6152b402588e31bf819f0521baaefd2e7da
- SSDEEP 12288:BB22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:BB22C9+bmOmbTk3reZCIT59z7m
- TLSH T1EF5523C14FDAC8FAC17E5234465120E56529EEDDFEC7719B828D0D4B2AF1FB8940A14E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.3MB
- SHA256 4835f298bb8a47d47584c86fb3da9ad72acf94fbef895686375f0bfc9d40facb
- MD5 b3b84c9597e18f7f63033aeda5e7284d
- SHA1 9664bfb54882d97183cd85e846cb2705cf0b20bb
- SHA512 daaf20e371288a5cb3aba2459edba425c435aaf0abf41fe30b78675d2e163c397ff48741373a43cac1bafc2ca85c5324077ff9f9d61e24360b94d50e3be09622
- SSDEEP 12288:uB22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:uB22C9+bmOmbTk3reZCIT59z7m
- TLSH T1075523C14FDAC8FAC17E5234465120E56529EEDDEEC7719B828E0D4B2AF1FB8940A14E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.5MB
- SHA256 3c9e55749e691a113e20db7d847c569ca3a0da329b56b205415bab2733204482
- MD5 1ec56dadd11e2d471cccdbb2f9a1016d
- SHA1 9d5e57a65fb8977ca7e474c5f69c537c298a651d
- SHA512 65010919e347da1da863c8c6fcb096600614a8a97f90002043f69d7a0bde0ede2f65434c8f8b9b526c3277173b6a9c3d780602e77d338774c80219aade34877d
- SSDEEP 12288:0yPz5L8+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:tzy+22C9+bmOmbTk3reZCIT59z7m
- TLSH T11165128367E520F9C17B8238C9511951F376B8758B619AAF03940A7B2F737E09D3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.6MB
- SHA256 b1b786f51cbdbe930087015af2e57826d991b913a6e4fa900eca46221fec8428
- MD5 9168c0f038d44f12c3a97ff31687cac5
- SHA1 1b29e1824304216314c1b726032cb1bd5f5f2a5f
- SHA512 24293504cc1368a83c51b7a1b6aea06d71fd7da3b121d4ba76fcd9ac6286f7bbc8e8325315214c26bf1de708e2e4f82702f3c93de3fe8e76fe9455a84aed3d79
- SSDEEP 24576:JTDaLl3z0zDk22C9+bmOmbTk3reZCIT59z7m:JTuLljb2LlOpbeZB7m
- TLSH T1A87502D5B39048F8DC7B813DC9514956D2B2BC5A4BA0C65F03E83A6B1F733A05C2EB5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.8MB
- SHA256 063e4731865bec844addb9c787cf1598017027f7b84032ccc891e6a91fb15402
- MD5 612e3eb108be9c85fa54a8a742ffe3b7
- SHA1 3a30abf8c3953f678e79d8ebfb66196b9c9f54cc
- SHA512 a4e71e3419cdec1127d2d2be85440f0c8febd2d4bad9abf5f693e41f8780fe5210f9e25a21b6b73900393debc4ad9082b7a9d48033ffb1ee5b6b6919cc3dd7dd
- SSDEEP 24576:x3vd9CHKy7GZI22C9+bmOmbTk3reZCIT59z7m:hvd9CHKyam2LlOpbeZB7m
- TLSH T18E85DF90F3E414E8F0B79A34C9725511DA76BC995B71DA8F03A8261A1F33BD18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.3MB
- SHA256 2f9e591e89ba98bc795e7033034a7c6a98c1cbb0751989879f3448ad25c8ee37
- MD5 e42c6e9807b200a30a97e5f3d96c5887
- SHA1 dc7437f79c93cd2dd7d109f08b1d5cc634a4cad7
- SHA512 1e2bdab755e6841098e2f0119fffa7d0bc2b82d37ac1944b219427410e19454e88d8e0b04c13c6abc8992b7e218c122fa56ad8c8b6761d042d4c97107a5a62e6
- SSDEEP 12288:9U22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:9U22C9+bmOmbTk3reZCIT59z7m
- TLSH T1A65523C18FDEC9FAC17E5230465120E56529EEDDEEC7619B828D0C4B2AF1FF8940A54E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.3MB
- SHA256 e6ba6cec3490721c8e0cc3b0f4b0924e911038678d78b9572760e13c3a159310
- MD5 66595e147bf2bfec192dcd91ba3fcd2f
- SHA1 02125e161c912c34240cdb8a7eadc110daaa55a7
- SHA512 02bfd88aeeeab9245448771441c771dbf134037ec533e2e6e39ddf8c5c568a091fa1bf5b8cfe69c29b01e11d4c8074325236ef7f3f8e4d47ad83aa55f774bd3a
- SSDEEP 12288:te22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:te22C9+bmOmbTk3reZCIT59z7m
- TLSH T1F05523C14FDAC8FAC17E5230469160E56529EEDDEED7619B828E0C4B1AF1FB8D40A14F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.3MB
- SHA256 7cc2bb93b518187e7b826cd4e70a191f827cba8b1dffee940fe6635cbaabcce7
- MD5 2fd1cd3aeba2562e1fc6ae355513c3f9
- SHA1 f21eb25e6eff75bf752ba9f038cca4029ade462f
- SHA512 6b8d0a3590acbc9c992f661164115eb999302c53eca157eb788fed52f70296e02351a9afb9b7a64f19e208639020f9452bea3e5dffc28369eb40b19f0543d63e
- SSDEEP 12288:MT22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:MT22C9+bmOmbTk3reZCIT59z7m
- TLSH T1E45523C14FDEC8FAC17E5234465120E56529EEDDEEC7719B828E0D4B2AF1FB8940A14E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.3MB
- SHA256 640a9a3f8075f017c72d23bd40fd965e670d4d940ba424624d2da97fab1f5ad1
- MD5 aafe576b1b87204ed9b8f0acf9d09479
- SHA1 a74b2e6928925bba43a595aa2cafc1ec60350b23
- SHA512 ea5c0c9367d8f2553e60bc9e224b2a7b116950d5cb2568a6ab51811f690c797a485fe1860fc335d59d974dd623031f457abb91c3821c15ca166b461fda1e77dc
- SSDEEP 12288:jB22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:jB22C9+bmOmbTk3reZCIT59z7m
- TLSH T1375523C14FDAC8FAC17E4234465120E56529EEDDFEC7719B828E0D4B2AF1FB8940A14E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.3MB
- SHA256 a8385e5cd5d7350a7a0e0c528373807b8bcfe60e9e098d9c323a9f68ed0fdd05
- MD5 2061cd49acd6916c519f5b458e5c7543
- SHA1 79a45b5e97b124a85b132e36cae008082215de54
- SHA512 3f15bd77069f96afd95db0608db0e5a47ed0f2720f743eccb19455f544ca982bacdb77b6684887aa07920a3173fecec2175ac3e9cd679035c4fbf9697c05c281
- SSDEEP 12288:BU22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:BU22C9+bmOmbTk3reZCIT59z7m
- TLSH T1E25523C18FDEC8FAC17E5230465120E56569EEDDEEC7719B828D0C4B2AF1BB8940A54E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 7a6e35eb62a9b4f8b1b96f96a0e29d895414675d15f530cc6726e94016fd3030
- MD5 dd9d12b6bcde7d74a642eb0520acd2b5
- SHA1 864e022142cad2659afda86bc53f806791e5edc4
- SHA512 0fc4e9d6e50f0eb4da7397a9f8a48986eb1d6555425a62b13669bbf6d535764f0510c4dfa902112d21c469532b6deac82c4db48d8ab51e32d1a24a63f94756b4
- SSDEEP 12288:/bsfx22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Sx22C9+bmOmbTk3reZCIT59z7m
- TLSH T12B65F185D79842E8C06E6234C7515681B333BC659BE2E3CB52C0F97E1F766A09DEA703
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.3MB
- SHA256 5e8b58a15fba9ed1a2086da7d91ee9f80b6b233688bff9a2023a7ba9c6c025a5
- MD5 3d52e7042410ed079b0488acafb4a835
- SHA1 2966d1ce88eaf90365f3950a0e197c4de78ada1e
- SHA512 9dd894c15eb9e0d85a3a13bebbb8ea8bc45f8e764dc4fd700025162b37b9bbbaa2e5a9eb4098d406a8a7472838f19bb5227b6ce56797a289272c9a3605130822
- SSDEEP 12288:Bs22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Bs22C9+bmOmbTk3reZCIT59z7m
- TLSH T1075523C28FDDC9FAC07E5230455190B4262EFEA8DFD6A19B91490D8B25F1EF4D82960F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 eb53b1e993fb3ea88632608e4c4af4d5e83c81506edc60d90ac6b5ba69c79c9a
- MD5 e7bb6fbd461d12bba343de9127a277f1
- SHA1 e8101d3fd4c32def97fcf2d29ebb22e962b5869a
- SHA512 b3a6c9268bc93d4076fff2ceaa6c37df799c41ed87805a1edb34d3a89c9e6a0aff0bc98ce46c23b7bd23b61301147a1c9822ca05821e03a91181b0b8ad8a1a9c
- SSDEEP 49152:Ca0h2GEkuAe73q3pp46zwwQi2LlOpbeZB7m:Ca0hNYG4JwDycv
- TLSH T11385AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE44D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.4MB
- SHA256 f6a2b3e2297cf8b1af5c5df8bbd43bbf47ed804d3c49da67214b8a672ef12c66
- MD5 1883a12ef08fc532d2b0bf9e88dbf064
- SHA1 225c066e44f77ce4e6805c34cbb6a15e8b3c3a06
- SHA512 2a14b32164f0da08a955a16c4e7abb6da29f7e56e66ace86317aa7deed29bec85b0860eb39ea74b7a651e37f5c29fbd7c9714af97f0f969b2a0ca07d32c4ec56
- SSDEEP 12288:ThbHjfXn22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:ThbHjPn22C9+bmOmbTk3reZCIT59z7m
- TLSH T1C76512AE1BEC10E9E17AA23C85914146D331FC695B52A3EF12C5827E0F77EE45C39B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 5e6b1dd707235bc17cdc0eefa8b14a2fd89d3685345e31790a6c645c05120ae0
- MD5 4aa86940ca785538219d08e03fadd06c
- SHA1 92bb47f4427f3e1ee1a5fd297d6931e764d2227e
- SHA512 2ca5626b72edd1bcf6c95a3bebaa84a260813e7369dd39f12eed6536190d11ea0f2dfa84de12f630342d4dc70c36230c2c1670608be787f6063414d83af74dfb
- SSDEEP 24576:P3YgnJcRTk4yti+R5dpR/P22C9+bmOmbTk3reZCIT59z7m:PIgnaTk46ppR/P2LlOpbeZB7m
- TLSH T17D45BF2DF3B910F9C8AAD136450147B5BB71782D1F209ACB0174C538AF16EE89E39F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.3MB
- SHA256 2d4e5a29b8825f48b5a294ffc998f8a2c47c02b9b270fec818eda3175d6e148f
- MD5 0d9a8c09b3f3f67c1330b301464653c4
- SHA1 f0bc2be232c2afc3f59d34343d80888956eda49a
- SHA512 09e052418a2f9bf5aeebd0162d03b63abece21aced1fda616ed2f3bdd08078101ace58e7cf62c9a475386c861e83e59b14ad0c9f1be541673cf2931eecb523ed
- SSDEEP 12288:NQ22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:NQ22C9+bmOmbTk3reZCIT59z7m
- TLSH T1685523C18FDDC8FAC07E5234465160A52129EF98EFD761DB418E0D8B26F1EF9A43924B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.7MB
- SHA256 22dd4d1fc020b9f12f55b6c5b861971948736099464ee757696f27213c0c12a3
- MD5 a6e1e96fbf35674249e2d06ed2af52f7
- SHA1 b7fa72a586728377e63d9213d5ef0368db80e562
- SHA512 d4d9d6b640c33b4b130c93ce643c68080f087d8e848aa87972ef95172354690297a23b87ff0a7bd8b465634db9deba93251806d4cac488f42bbf73b0001cfa41
- SSDEEP 12288:UObfA4LWOsvAYFTN22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxp7:5bL3UTN22C9+bmOmbTk3reZCIT59z7m
- TLSH T1C7850155EBE400F9D87B813CC9A28516E272B89D07A4E7DF03A84E561F637E18E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.4MB
- SHA256 51f8c90acdb9f6a7e44df83f18e5962fd8f53bd65c969caa6bbb1461cebedebb
- MD5 d5a219010c84e6e24c6d338cc60f0956
- SHA1 4421d31d67ad34e9666d689d97d8a8f3c9f154f2
- SHA512 e72280ae4bf6d1a8abcca1d90e091ef57920af453ebd2db773256adcd833b20b479e046686c1c8ae245330e2b4eb16e81fb72e60ec8c07e29af2f3bc12b64b51
- SSDEEP 12288:KpFtIOB22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:BOB22C9+bmOmbTk3reZCIT59z7m
- TLSH T1906502552BED10F5D07AA13C8A925249D371F8654B5263DF02C085AE1FB3FF8AC3AB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 fdf87431e7bca37e4558f9f63e5d50515ead6e12dc17544f9fa495bcec58adcc
- MD5 3832e283aa3fdfccd398a93865adaa1d
- SHA1 cf0347429ef3510f3fd7dbcf1f0f2103404814f9
- SHA512 143ef8e36a534fbfc6598cb4278dd714fbedd1dcb9903be9da48b4f3d3d94757046b424000315204d86c83695936b8631015e78e543ca6fe11b8889285324da6
- SSDEEP 24576:p7NM9YmZqmWMUkPjZM48Mv6bEhs822C9+bmOmbTk3reZCIT59z7m:p7cBWMpPjN8DbEhH2LlOpbeZB7m
- TLSH T12A659E6E6BEC81E5D477D13DC9A28205F6B2B4611B318ACF1152833E6F37AE44E36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 519524413a77b284d7f4496a3812a9762b71c2706e802fd3233fae7e4a5a5dbd
- MD5 9cb92c9a66ba3488c4c9eb1a3671ac87
- SHA1 e3ad95610c609d67ede4c4bcaeccd64034df6369
- SHA512 394105e580ee626a05cd470c30d14487eaef59e18fba23589633783b4b155ca41466d438ffa38aca9d43fdcb70cfec77f4eb1974a1daf30767b755cfa97df416
- SSDEEP 24576:CW6BApg2YuyuNDYTabvcRvNYf8km1u22C9+bmOmbTk3reZCIT59z7m:CF2YuHNETovcvNYf8kmc2LlOpbeZB7m
- TLSH T1FD858E6927ED80E4E0BBD27D45B6D186FAB2B8511B3056CF0255862E1F33AF44D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 990502a043ad04567281a8939bd6cc3060d04ecb9771aab4895ada25650a71e0
- MD5 3669ef5e7ff330a11715cd5003936df2
- SHA1 eda3f78fce69d925761a03981d90e56913d7814f
- SHA512 941085510025515cb2f1856244b7e3c05c905590770b36a35be66a89217b54c1b5031007740f11832e637f4a4dd4c5a57ae8f9075e03d36352b272fe14d70236
- SSDEEP 24576:1AFs06+OmlfkNXEbToF22C9+bmOmbTk3reZCIT59z7m:6Fs060lwXuC2LlOpbeZB7m
- TLSH T1BA65AF2F66EC00D5D07ED17D8A97C91AF6B1746307255ACB0260863E3F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.6MB
- SHA256 0e9fe84cd2916e823e60b7bd73d8236e3986ce9a66c8952aac211136faa0998b
- MD5 e10289bce7b33216051e1a1ae6fccbb1
- SHA1 076ccd2b4b80f6a7f10961c3ffcf7294492f07d2
- SHA512 6a5c741406fe32c6cc32fe4a6515a51a534f65c83d423e95c80a027bf38da4ea48f091618ec6fc69b53ec44dc06b44ce5c09b1d518dc4bfdcc2c6e1e19c8ed3c
- SSDEEP 24576:/JnJ5D3WtC22C9+bmOmbTk3reZCIT59z7m:/JnJ5DGtC2LlOpbeZB7m
- TLSH T15475D06DD2A810F8D4BBC274815A1696FE72387D2F2269CB14B4D5353F22FE09979F08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 b4571f6d14145f485d50b90ef4c825eb0df35d95a20d757eec1e5adce9311102
- MD5 fc468115c26f97808ac61dc95402610e
- SHA1 2291a8b09a4c3af44f9468c12c3209b4ce22262d
- SHA512 02934a76d12af55b0ce6bbaa6733225c43a3791d208f2542876fa7a68d32921c610e99f49cd2b4c6d0e2ac830cc7942a858772df4d10ca805c5dd81d7b118923
- SSDEEP 49152:Po06DIKdwc+eQnSt65aVI2LlOpbeZB7m:wOycv
- TLSH T179956D15BBEA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.4MB
- SHA256 666a5ae1c27d510b91c2bd9a7629f4b85c64a8e873f76672cc6f8f115bc152fd
- MD5 afaf39614687cccea58c4af07726e444
- SHA1 a4964c9268d578a5e2df3dba41858e0a167c5e88
- SHA512 75867d74b16bcb5e2f5d9eb1dbecbb27f4d9f50ad728a1b94879760c0e36c00b9f7d7b8b473236c31d884fa59ac3c151e6f03a7de6903d18d21eb326f545c8d1
- SSDEEP 12288:cEP3Rrc22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Xrc22C9+bmOmbTk3reZCIT59z7m
- TLSH T1E365029D2B9DA0F9C03E913C85918145D372F474AB9223EF42D5867E0EB3AF96D39B01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.4MB
- SHA256 6d96b7f9c0c22ddff088c63493c8750f126e1677df0a9c2e2612ab0b670b0138
- MD5 79873c790eda485ec460e2008d0f9705
- SHA1 cf641341555fd35874d3b33b1f02f4945fb4cf48
- SHA512 4fc801b253bfd4e90deb2ccbe2aa792d9cf7829e57bc54ba322f614b56b40c4e51c81b45bae2f7af29a59a1d4cd7f97bb5144cee331435e91809d3b9c935c0df
- SSDEEP 12288:FjkyX22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:FIyX22C9+bmOmbTk3reZCIT59z7m
- TLSH T18565128057D894E5C57E42388A6341E49A35FC709F5262DF51C0AA3F2F72BE4AC35B16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.3MB
- SHA256 7e0754b96f780f9ab811ffa3ac1b2514cea54e37c0f20a7f8333c4f3003f60ab
- MD5 3599fcf96eea7d44e96c699f3b23e7c6
- SHA1 365dd1a4a852b8f76a7e6f0a451dc0046a3aad38
- SHA512 a269e79e2020b1189382b618a3cf913cf1346db0a4f805a7aa81e357ebc9b7ee264c611c10a0ef2e4778f6ca9dd6134b9c16041ee37a3e06efdf0e42e4aabf00
- SSDEEP 12288:JFx22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:/x22C9+bmOmbTk3reZCIT59z7m
- TLSH T1C65523C44FE994FAC43E4234465154E56135F9B8EFD630EF40C94DBB1AF1AF4A03AA4A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 06c35ee29730fd768a3823b2ff6ef4a938e3e86b576d3ec1b8b17ca4966548db
- MD5 0b894745467b4ccf38c364147dc05970
- SHA1 8c194e5cca0aeeb760ca845bae8c95b55d374c26
- SHA512 0fb9e77d56ea93c8c998f5d13d1fc2b59641b96aafda0ee0ab948cc314365e8eec36a8cdf965dd9dbe96d6910d3f56b3b3a1abfcbf844e3cac7456c802d577ca
- SSDEEP 24576:8Q9MxZKdcz97w3022C9+bmOmbTk3reZCIT59z7m:8VKX02LlOpbeZB7m
- TLSH T1BC557C2DABE905DAE177D23595A250C3A633B4311B31D6CF2448D03D4DBAEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.5MB
- SHA256 01b7b865e6db93939524be4c1ac518721200e57079e307918e19eaddd83ceedf
- MD5 b486df27a204b1b94c6c7260aae3cf81
- SHA1 986417365a2d16872f3d53f9d96345cc1cc91017
- SHA512 9b65b9378c231c922aa93907aaa84a50f629b2aad2f60e52637e9f90321a1ac30dd5a9dd87a0bb41d942e771c99589165aec6e706430245033ec282770fcd663
- SSDEEP 24576:myocxApb22C9+bmOmbTk3reZCIT59z7m:7ocxApb2LlOpbeZB7m
- TLSH T10875E05FBBAD40E2D17A813C89818245E773B0745B6263CB5191C73E4E73AE9BD38B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 4e3beb90a4a98a63995f081f818c0fb0ad4e910277198c83a61980a26abeb5e3
- MD5 434dbd4824b2fa5e0d12bb97f0ad3704
- SHA1 5f063264aebbb28afe64bfad30ac7e27f9fc2f03
- SHA512 74b9f0d1075162cb28fb2f95149a8aa9e9be5553447deb19aa10820d999dbe7dab5ff586c4220f5a6eb9925a01181e4c309652853321bbc593e39a328df6beff
- SSDEEP 49152:gWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKb2LlOpbeZB7m:S0zuNI/ycv
- TLSH T164A57B3DA2EC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH