7e27679d77227f17ca37667ab224f399302286e4a64712f0dda2bad20c55d9b9

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 17:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Size 2.3MB
Sample261009-vraycs1vgw
SHA256 7e27679d77227f17ca37667ab224f399302286e4a64712f0dda2bad20c55d9b9
MD5 37b3b91fad221f8de5030c8db3dc3de0
SHA1 82f12f87a13113d386834fa1ccb9a66438ff45ab
SHA512 2b6e8fac8c5f7d478dd554962e227e0cd5601f1cb6d3c95b2cade4d436d8a4e7dc71c7051a1aaa18d2c8fe43869dfe921a7241101f12c0c70869359477db6a78
SSDEEP 49152:mr5Xe6XnqOLnPhd6dM6uZkzDr9UJUUXEei3C2nhmYqOLnPhd6dM6uZkzDr9UJ:fKnpdDfZyDeUjeiySnpdDfZyDe
TLSH
T132B50248AB5441E4E2B2C23C84839546F2717C0147B0DBDF53A8E73E6E77AE19D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 11 IoCs

pid	Process
3272	elevation_service.exe
4328	elevation_service.exe
3324	maintenanceservice.exe
5668	OSE.EXE
1444	PerceptionSimulationService.exe
3400	perfhost.exe
248	ReFsDedupSvc.exe
3116	SensorDataService.exe
3292	ssh-agent.exe
3764	AgentService.exe
3824	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8d259226c17a6531.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1360-0-0x0000000140000000-0x0000000140257000-memory.dmp	upx
behavioral2/memory/1360-76-0x0000000140000000-0x0000000140257000-memory.dmp	upx
behavioral2/files/0x00010000000093ab-135.dat	upx
behavioral2/files/0x000100000000932b-134.dat	upx
behavioral2/files/0x0001000000009952-136.dat	upx
behavioral2/files/0x0001000000009cd6-138.dat	upx
behavioral2/memory/1360-139-0x0000000140000000-0x0000000140257000-memory.dmp	upx
behavioral2/files/0x000100000001b96e-137.dat	upx
behavioral2/files/0x000100000001b96e-375.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104140\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000063ee207b1158dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d737dab91158dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c498edb91158dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083a7ffb91158dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036e2897a1158dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000001c19287b1158dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe\""	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3272	elevation_service.exe
3272	elevation_service.exe
3272	elevation_service.exe
3272	elevation_service.exe
3272	elevation_service.exe
3272	elevation_service.exe
3272	elevation_service.exe
4328	elevation_service.exe
4328	elevation_service.exe
4328	elevation_service.exe
4328	elevation_service.exe
4328	elevation_service.exe
4328	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1360	2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
Token: SeTakeOwnershipPrivilege	3272	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3764	AgentService.exe
Token: 33	3824	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3824	SearchIndexer.exe
Token: SeBackupPrivilege	248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	248	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3272	elevation_service.exe
Token: SeDebugPrivilege	4328	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 2976	3824	SearchIndexer.exe	100
PID 3824 wrote to memory of 4864	3824	SearchIndexer.exe	101
PID 3824 wrote to memory of 4428	3824	SearchIndexer.exe	102
PID 3824 wrote to memory of 5336	3824	SearchIndexer.exe	103
PID 3824 wrote to memory of 2796	3824	SearchIndexer.exe	105
PID 3824 wrote to memory of 2060	3824	SearchIndexer.exe	106
PID 3824 wrote to memory of 2324	3824	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-08_37b3b91fad221f8de5030c8db3dc3de0_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1360

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4328

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3324

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5668

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1444

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3400

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:248

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3116

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3292

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3764

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2976
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4864
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5336
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2796
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1150f7328d42fac4b7cf8b1256e2963ca5b47304f1cb3ccbc528a0edc25cb26e
MD5 b5dd396f5f7d74fc4d7c5bdcd8d2c76b
SHA1 12c2e7d79b7a2b63d093c27058cb6e51bb792856
SHA512 3429c74270fd97bc4416dab04473bf40558a877c8ba0d738a0621b7a10d10849e6bfbc71f1c6d7595d0eb50d4dea315593e9289f0fe92292598d2145d8d2c713
SSDEEP 49152:Cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnYqOLnPhd6dM6uZkzDr9UJ:k3q6HjBZnpdDfZyDe
TLSH
T113D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 32425cd89e4ba684a5493fc968f4ca5ea748d0eabe63e816e3f6441d70fb3876
MD5 e2d5f7db2186641b527cc0e2b4a3efb1
SHA1 c68c89c7646aeca1e98b782a6b543d8e18fa1132
SHA512 67dff57e542ce6973d40e6cbc97ef89ea715e2001b6d56d6d173ebd0c3e4829283b7c1faff7bbf933927bcaa4bf03054031a999d52b2f97d3f28b543301bc260
SSDEEP 49152:nzcKqOLnPhd6dM6uZkzDr9UJPUXEei3C2nhmd:nznpdDfZyDePjeiyx
TLSH
T14C75122977E404FCEE67423CC8E28119E6727C9143A0E78B03B4DA655F33AD85D7AB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 c0b26249162bca3036958141c8d8d5bf8a7c249aeb1c1679483eb845d14bb98f
MD5 8a37d4c849289d2a0ac0d9019b299d62
SHA1 753a84a428268f047373c5f6de282e087a4f85fd
SHA512 39654fd94e67663ce5c1bd737175792e58128ec3b0f82d88d6d8cace18d0e73aef6b08f82a4791e6f5a5d61369729a9407503e291215b699a6101d7b1d888ccf
SSDEEP 49152:fzcKqOLnPhd6dM6uZkzDr9UJPUXEei3C2nhmd:fznpdDfZyDePjeiyx
TLSH
T17C75122977E404FCEE67423CC8E28119E6727C9143A0E78B03B4DA655F33AD85D7AB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.1MB
SHA256 f8e39632306652759293483d0950058a915f60194762ec4a84bf096a3fd4ab99
MD5 4c59d2e9a5f17b6a29fc9cba36f210c4
SHA1 858288d6479855b3e82341ecb7054d7decf284fc
SHA512 63f6cb86ca6478e0f36174859d750eacfa9c3eaf1ee65e425942b8d3a1821538bedb11a2476361153c591d5971beab0d94f6e236fa9b5a93e1bd883b4e969534
SSDEEP 49152:tzcKqOLnPhd6dM6uZkzDr9UJPUXEei3C2nhmTO0ANm2VT:tznpdDfZyDePjeiy/O052x
TLSH
T1B1A52328B7E805FCEE57423CC8A18119FA727C8503A0E75B43F4DA655E33AD44D7AB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 a031200ccc75467e0fc09c9293757f91f77f0e52c34f97dc49d2a53685fa5d0c
MD5 f41c13b6db90fec357948d70a84ed82e
SHA1 499cd113c5ae080e9db1a9d37b0b2034b1e78e77
SHA512 9a30d9dd3d90c05b2eb4695d786401a7510b925c708c4ee7d702cf92098c78ce702aeedf8fae3831e48170dc0802edb058067b16cbed961b08007d38f3622950
SSDEEP 24576:EXYfDtczAOCqOLnyFrGhd/M3UoKSdvU6uZD4BWMDr1zgHbJWe:jtcKqOLnPhd6dM6uZkzDr9UJ
TLSH
T15B05012877E508F9ED67823CC8A28111E6737C9143A4E7DB03A4E96A4F336D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 f7b59f587a217f5c80ba00cac5241b281927956943b5572249850a9353d875a5
MD5 9ed90415c40028ed2b39c5590fb389ec
SHA1 b255c393a0af2d28b034052232942de660b60946
SHA512 5cce7582ea53a18a5fabe750ae2369d02b279d82fd57847556a756c72057a637222a7fb7d561e9875c251526495c7ae7ac45157d8ff08fef9fb4ead72493319d
SSDEEP 24576:i0Le5ji0hmxirMsCqOLnyFrGhd/M3UoKSdvU6uZD4BWMDr1zgHbJWe:iPji0AcYqOLnPhd6dM6uZkzDr9UJ
TLSH
T1FD35AE16F6B48335D073C0B9C5D2A69EE97130825B308ACB4286D77C7E67AE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 af1990d3bdb9fed6380f85bb9d333ec7ac3515bc36af6332a44cbc87ed89d0da
MD5 52896cbf8f507c043fb0cbb34a4cb048
SHA1 5e5e8af8a2a87a32688b29fb643fb3e8b7ed3cbd
SHA512 183ab8b15456317554cd743aeebd6deb1ae17e2cb81b71f134e1ac102e6f8349bf3eaa2115a826ce0fcfb86c4f966c37d543d93720f6dbfe1262f5fc8b3dab06
SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWE6q8wyuSCqOLnyFrGhd/M3UoKSdvU6uZD4BWMDr1zgHB:h/ezSC6vUzPvxHjycqOLnPhd6dM6uZk2
TLSH
T1D4755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c83325bdfbb256409597f0ee81cd858fb4ee534b1155aa0de27ca4e65f5c8240
MD5 2b3ed6ea44808eb18c1a26d208b1db2b
SHA1 0aa10c4a092619dc062333ddd9f45a1fe308d807
SHA512 bf930a893219e6f73f239d4bdf96f5c444ba1f2931c2e978556effb4d252ac096071e51a1527b88366c491a5a1d1558a7b66f6fe0db34a38dec708696bdf20e7
SSDEEP 24576:BVbqPb88hv/l+6HCqOLnyFrGhd/M3UoKSdvU6uZD4BWMDr1zgHbJWe:BVO88hXl+RqOLnPhd6dM6uZkzDr9UJ
TLSH
T12E559E66F5B48331D073C0BAC5D2A69AEE3234415B318ACB1246D76C2E77BE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 ead450a9d53394cdab06a5ad14a705ae8b8111879cbc2c1fc2d0f9d56183c241
MD5 84420141e72e6017a5d9f19002968cd0
SHA1 7eb6e2f9e13bfd5ad906c4110a2defa9fba2df8f
SHA512 b39fad31d715dada8cb1cd5d754f4b3e159c9fec8ca2937e6d01fed92fdc56459c29109d4b63c571cbee7fcafd2f8b5f9a4b9503b64b3d59580325450940f8ec
SSDEEP 12288:JRoCqOLnyOmrGhdgTsMyEdp4oqFSLMgOYtTzSj6uouXNDg5BWMDr1zgHbJWe:JRoCqOLnyFrGhd/M3UoKSdvU6uZD4BWp
TLSH
T100C4231B5BDA02B9FBB4093A55D192E971AC6CE4B56CA968E224FDCECC30C73D0E1435
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 77957b34d79977abc4ee4fc4b7582b80d22ad418f584eb33b8113cb4c4f6bbde
MD5 b79064ced4e9cc0d683253a1e074db3f
SHA1 028a9e95ddb1d196ca0fb200adb6ca71ccfaaf43
SHA512 d8d32c69fa96591f08da61ba1c2fee77de68f979767e192a1b27e054c6e9ed9df50ec756ac377f64645767b3758e7190f4c4653c993a7ddffe0edbfa6fa6a9e9
SSDEEP 24576:UJIUfCqOLnyFrGhd/M3UoKSdvU6uZD4BWMDr1zgHbJWe:UJIUKqOLnPhd6dM6uZkzDr9UJ
TLSH
T12005CF3BAE28FCE2C27A8D795A918340E7B278704B61A3CBD175C20EDE235E15D75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1a8745683016d47c6c4d886ee981d36ead1ec887d2ef7bc641fa56ae135998b3
MD5 1604342a5222a6e52d074093de50d896
SHA1 04b626fbdfd17c67817befc86e11ee14dfd7108c
SHA512 c10cc65667a3d0776813fd7d3808dc9ec573dc3477df9f32f77e27d7cf85910f8bfcba0f405a0e459ff1afe8264055e77d40d4fa4767e74d32d70611a1fd3b42
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH+:CQvGAdlCEL8c/yRNw5CBnpdDfZyDe
TLSH
T16C266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 842ccbe4de32bf9222c5a446f91f41c3ef2846d0e453aebf88ba044082df6878
MD5 146e1d7f3961e0a5a95c069f0304a506
SHA1 499ba5b4de606d7c67e2b098d4ce5a3fcd5f9fa6
SHA512 788755e409a86cf58a4dffbcb28e126a7a8d33bea8487f77991fb7a5f8959fc0dc2d5fa1167ea4e6d12926578168e23f1f813fae28ac25fbc0cf6fdd0adc96ec
SSDEEP 24576:sdewsAjlCqOLnyFrGhd/M3UoKSdvU6uZD4BWMDr1zgHbJWe:0ljoqOLnPhd6dM6uZkzDr9UJ
TLSH
T17E15E031FEB5D036C7BB0DB61B66C316247C7D604B611AC3E3A89D9E99301D22376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 10f3a1306febdfcdbd052c312b39c56787642a93b51e6266746601f75177537f
MD5 f0b07171b3f746d114f0372ab3317177
SHA1 cb3a1adf5c258cadde4971cbbd19de2441f6c3e8
SHA512 96e846d848c05006fc7e465b4495595e0b0370383d62aea8f2c51dc4a087fcd8e8612020ad89bf3d7011e7d1a5fa77d68005c74497318f815ee4e258f0a414d7
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHupdjU:vUEtQevvqc2W1cpV2EI320V
TLSH
T1C8474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a731842693e2d235422350d40ff962758ae8ca628071b0ac488c7ade4219114f
MD5 82cf7398ae9c659dd20a55998d4b23b6
SHA1 71c322f2c161d8b5521630e3cbf1cbcaed5a11cd
SHA512 e4e3af1aefd2577eb3e3c1799b6f922edf90c472f486b6e73a66e114b43ec5c14fdac86d74e37d3dee6cca942e9a6d1d9506c12109e8b01000848a7380b56b1f
SSDEEP 49152:+CbRquA/m2yL5zLfFiV+XenmE3/zIqOLnPhd6dM6uZkzDr9UJ:zoq2VjnmNnpdDfZyDe
TLSH
T195D58D0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0c7972b3dbf0f39e3d44a21661fb749ae29da1d317d3a0885b1f63088d215ff3
MD5 5ebedd7adc2cd9bca3853fb92636b10e
SHA1 e5131fc2cd12035992c2cb926709e0a19b53fff7
SHA512 92d84d8c2fafcb84e43f20fc028c742c89b68b297cd5e0f39370665771a96daafafaba692956cbaa5b38d780ce3b6c20863c5dce1bf6cc485d6107d6786d9545
SSDEEP 24576:sAhGLJIFoiwtA5l7S53WCqOLnyFrGhd/M3UoKSdvU6uZD4BWMDr1zgHbJWe:sAMyFoiq5/qOLnPhd6dM6uZkzDr9UJ
TLSH
T1D035AD81EBF955D4F5B3AA7899B68171EA76BCA95E30C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 430e024469fe25d69874d110aeca9fd359d475cdc79defccdac7fc43fddc707e
MD5 2a61c1e9f9d4e806b5a4cb798e6099fe
SHA1 90ce41cf0d424ab4ed54acb5c233cb432745e932
SHA512 73ad097b2a6c44c2187c0142a8596283e1fcc9ce80d1207f95ebcd519afd518c4ab1fc4f1ce87459f8adac582f78320b6342000d82085ce07e88db3499290ae9
SSDEEP 24576:uwuoOWICqOLnyFrGhd/M3UoKSdvU6uZD4BWMDr1zgHbJWe:uwDOiqOLnPhd6dM6uZkzDr9UJ
TLSH
T10D05F14A37E50CF9EAA641398597C136F7F2BC113A24DB1F5360C65B9F33261AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 cbe6c8d6035e4b3380a5fc247274f3d3b05e9a5cedf4e86c0799312ea35985ba
MD5 6bd91590b8cd92320a05c8ef6b66f271
SHA1 42b3d7e385c5f61a443052b6f469866a64efceb1
SHA512 032221d3565d6f692dbc7311b88d69658a36117dbf3439c590f0ac40b146ac1b90ed09c92151a6b3032ffc11b50f60ba83e6583ec7cf4ab93a9b482d338e54cb
SSDEEP 12288:OBZ1IyVCqOLnyOmrGhdgTsMyEdp4oqFSLMgOYtTzSj6uouXNDg5BWMDr1zgHbJWe:IZukCqOLnyFrGhd/M3UoKSdvU6uZD4BM
TLSH
T1FDE4125A37E821F9E2A2413DC9E14289E3B57CA1637883CF5224969A9F33DE35C35731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fd5e64884364c39c072e39cd4ab97b48bc0e1df003e38ddd36fcb245f0950c23
MD5 093a6d86c40e44d46d046e3b53e53fb3
SHA1 d91c086afc585055ead0ac05d15bea968f60861a
SHA512 a09c99d4b41807a6e64bdde345536a0c3adddb9b54de4e06c9925ffdd0af1d140e8bf3d63b85cb8d5cc1bdd5d461c1f7a351f80c3f46fddd84e057847ee03f47
SSDEEP 98304:mQRQyi36YOcPQLvw2gAf+PN3MnpdDfZyDe:NQyiKayX+PNcpdjU
TLSH
T1CF667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 90fa395af2f4cabe14a27b6406cab8d788ec61d3ed2d12702e71c4294dccdfeb
MD5 f6513b228b767f8acf8f25170274c7bd
SHA1 227d00b80cc7f26517d2ac25c358dd17219874c1
SHA512 8c69252d6e5b4190568292cff44c93bc58911437cd09ca653eda9be54c4bda1c78fdb2a56372d536cfd16dfd50407fbc61b93fd8f5745c3c7da64b9b7b7d92de
SSDEEP 98304:VQRQyi36YOcPQLvw2gAf+PN3MnpdDfZyDe:sQyiKayX+PNcpdjU
TLSH
T1F7667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 afecd6cf0c80c8c74f384c3e15a41fc328a2732bae4cd6f71e3708ff35a77057
MD5 055c6db300ce4c1682c370af99253731
SHA1 694f291c2ae8858ee4916c044cb3898ee857a46c
SHA512 2da6656a0a5658831878d5b6c5ae227ac0cb0ed3223576fcc8553e649e7c11cc3bfbe8b0e0843b12d730e57c4d38f5580fed7b8cb5cf99f9f2abe742cb436ae0
SSDEEP 49152:768Qg55nhheWu7PNU3/YqOLnPhd6dM6uZkzDr9UJ:FthWRc/2npdDfZyDe
TLSH
T13EB54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 defd160287372d16f0d6d0f6cc9fdd0cd4d0ff865120d5cd439ce057236e0249
MD5 70cf68424015e5f214d8bf6b3ba3c9b5
SHA1 b8c264c84cc2524d0c4bdae884e2ca76bef98db6
SHA512 1a5a8a32eebad40df0d40d813e1ec37026754e10c19a984476fa90da3ee1ee423557bb83ce1ce9e50eee6119bbae3cf44b69dec616f45615d5ede29b0130e38b
SSDEEP 98304:7y5112gYy5azzVvL69nLKnhZ/npdDfZyDe:WLIHmWhVpdjU
TLSH
T197167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 35e8e908ab555363132ba32df6a565900b1c7bff203bff93aa135f0e678f48b3
MD5 ad3d52b90e553db52d616653447ad84c
SHA1 6e854bcccd9b9fdbfbd0ae7451efb9997ffb65dc
SHA512 cc5cc69a607dfcf6f9754dc6e7f9bb920c27441100119e8a26ebfd2ac3f4ff8fe5a454b41311f4b71473df9deb6c722c34aedff48fa42ec84b2222684ce9be94
SSDEEP 49152:ZB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glnqOLnPhd6dM6uZkzDr9UJ:Pu6JmVxd2d1npdDfZyDe
TLSH
T10CD59D13F1DA01E8D06AD578974A9233FA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d0fba5a1a925e4282ce0029e6dab3951faa44d1543133e6ab38a860fd084cb4c
MD5 00a358d91766a6b3ea9c9294e63e0e12
SHA1 2dd0d35b51933af9e6d5319731199efa02337398
SHA512 3b7d29dbde94c0b6b1718bf0349a2e661fcd94c231abe5a021a3f146ad0becd9d635953a5aa3f5c04e872c9e599645710275a3820ba538413af3d1144803a2f1
SSDEEP 49152:e1hpsNoJpF1A6UU44CwH7R4xqqOLnPhd6dM6uZkzDr9UJ:emifPbRNnpdDfZyDe
TLSH
T19CB5AE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b8006cbf95aecfb6b7a38e28e445ebd10655a72398e586c97a11d9cd31b79d85
MD5 5c6fed9cd60a33d63f00bb3fb09dd8cf
SHA1 4be867860cdc0f4e68ba55c91c9ae3daad36fbe5
SHA512 919f497d10292c56102c8e1bc88310184c90faa82ab995c8928d6fbca28837676c0d6e3f4d98e13dd7d89c7e3224f99c7bd7da200befd40afda38a3f054b8830
SSDEEP 49152:lSuZQIY0Be2KRRVtOnks6NMHqlqOLnPhd6dM6uZkzDr9UJ:r5dKTi61jnpdDfZyDe
TLSH
T1B0C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 209cfc5d767b0bfb87b5ff95ad01fff4c5c1df0800c84f11b2acb9109f8c0e00
MD5 8261ba6559db87fffde1e37245341229
SHA1 aa3f85bdf39d4f40cbba95c26ae358fab8f000e5
SHA512 4b92e0b4b8b28bf4ff1f8b628d8063ebe9b2cf4d3e4cb5e5d4c4049bbdb7780f494c2e4017c57fc4ac97a97118c75fffb190a08c105952c042f6c5df625beddb
SSDEEP 49152:ahtSn8EApI0figngiDn0AP5w2qOLnPhd6dM6uZkzDr9UJ:bX2iyphpnpdDfZyDe
TLSH
T1D595BE13F2D901E8D05DD178C7468632EA62BC150B38BAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 78591ba8b6e9f962bcd02ac61c891a8bc7ce2bd5806920237a1b9c4bd015a0bd
MD5 9451af2ef39fed21a03df399adca35e9
SHA1 08985930fcf9221311aca4ad2a930f00bb844c4f
SHA512 cb154b4c238adbfcb4006c32964a327410ac0982401da71373e5ae592bf9d5797d6dffb7405b6d5155416bce2f1cf95d322ea422ccb3a19aa3475f736fd0ee11
SSDEEP 12288:SACqOLnyOmrGhdgTsMyEdp4oqFSLMgOYtTzSj6uouXNDg5BWMDr1zgHbJWe:SACqOLnyFrGhd/M3UoKSdvU6uZD4BWMi
TLSH
T176C4231E2AEB02B9F760453A81C153ED71AC6CE9F66CA568F218F88EDD71C7390E1474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 88021c090cc284272cbcc7f0c0886967095c02560376740ea9fa66e62b1c1798
MD5 f3b34a770abd05abb2eee0f00fdc1b30
SHA1 edc4ef53b715f38e6583f14d39efb2bc62290013
SHA512 b084f04941be6a07cbb6837301463fa52bbfb87407572d97410f1808f2bf824ae0f21cd04835eeecdd2d24a7938b8c0c940d62b54309ab15623822d07018edd2
SSDEEP 12288:9RCqOLnyOmrGhdgTsMyEdp4oqFSLMgOYtTzSj6uouXNDg5BWMDr1zgHbJWe:9RCqOLnyFrGhd/M3UoKSdvU6uZD4BWMi
TLSH
T150C4231E29EB02B9F760453A81C153ED71AC6CE9F66CA568F218F88EDD31C7390E1474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 a3ddeb3103fa0fffb208d8ba39b575dfa53b2698e51ef8dda6a2b91ae89cf74d
MD5 0552189f75366eac7defe359ea893ddc
SHA1 46940325b434a436011485f1546c503ecd5b4123
SHA512 0663f4ff1e472890137c3fb4a8c79720e7389eae7a8c2d84f313f203ff99c4d7be869784868e81d2c658ef1ebea05add2b0820c01b94783b1ae248eed8885c68
SSDEEP 12288:PXCqOLnyOmrGhdgTsMyEdp4oqFSLMgOYtTzSj6uouXNDg5BWMDr1zgHbJWe:PXCqOLnyFrGhd/M3UoKSdvU6uZD4BWMi
TLSH
T15EC4231E6AEB02B9F760493A81C153ED71AC6CE9F66CA568F218F88DDD31C7390E1474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 15657163dfb36f7c3ad0508d4b0a335f3c62bb6abcb984391e113c706d7c9f6d
MD5 1c50aab2810280db825230faad9131ce
SHA1 c51c3638077bf18cbdd6f5214338f654ccdb627e
SHA512 64838d8234f7ca89d87b53d5620b090bd500e8cc8d54bd9f0afa17b63026bc8dba317c0e2005dc800a5858e8e4929a05b90e17609176825c554fa8e1e9b9fe3c
SSDEEP 12288:/V2CqOLnyOmrGhdgTsMyEdp4oqFSLMgOYtTzSj6uouXNDg5BWMDr1zgHbJWe:ICqOLnyFrGhd/M3UoKSdvU6uZD4BWMDu
TLSH
T161D4231A2BEB01E5F6608539C5D15299F2FC7CE4B73896AFE710B88DCD719B294B0930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 d71045bcf1de786b927b3f802ba3b0b89ad271ac2e6d21d4db61a7f419e55b70
MD5 93f5c244e8cec2542cd8eb1b60d8080a
SHA1 66c270ec201b05a78a7f3bcde40ca1d8af718e19
SHA512 62e0246c286be3d5121a3ad92ff9bb5c24467c60f01e287b871c0de546075960271a979d73a384290e2f262bf0ec00ee38663f9b85d541af55bf5246f3867569
SSDEEP 12288:E+CqOLnyOmrGhdgTsMyEdp4oqFSLMgOYtTzSj6uouXNDg5BWMDr1zgHbJWe:E+CqOLnyFrGhd/M3UoKSdvU6uZD4BWMi
TLSH
T177C4231E2AEB02B9F760453A82C153ED71AC6CE9F66CA568F218F88DDD31C7390E1474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 1060d8a9e099048662149c31998fee6d6208c3e22d780e67cbd802d7ef64fc07
MD5 0d47416390e8c40f62b724cdd4e82885
SHA1 fd6e1a3beb8703afe18485c95b63c27102079a0d
SHA512 da593fbb3493cd72ff8ca82627fb2ae5c76fd66dd959f27bbe21c1f0564f3d493f7dc3d7b9d1cb27862a3f4608da9e85e186bc7343ea27f22cdab001425428c8
SSDEEP 12288:cdCqOLnyOmrGhdgTsMyEdp4oqFSLMgOYtTzSj6uouXNDg5BWMDr1zgHbJWe:cdCqOLnyFrGhd/M3UoKSdvU6uZD4BWMi
TLSH
T19AC4231E2AEB02B9F760453A85C153ED71AC6CE9F66CA568F218F88EDD70C7390E1474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 0c1cdefe302f8b8ab135d74a8c6c31cec00a45406d4d2f5bca82e3553c426781
MD5 87abaf20ab18eab30d2886f31eb5865b
SHA1 fb02826bbf177cd898715d7574a1740be7e09319
SHA512 8924abae4d3c534c7a39b8998bf3676daf7d0447828550bad57d60edd8e5a6e1b54a1ae114aa2de3806f189e87f05a2c9733ae856b8a23596094835476d8db9c
SSDEEP 12288:HZCqOLnyOmrGhdgTsMyEdp4oqFSLMgOYtTzSj6uouXNDg5BWMDr1zgHbJWe:HZCqOLnyFrGhd/M3UoKSdvU6uZD4BWMi
TLSH
T124C4231E6AEB0279F760453A82C153ED71AC6CE9F66CA568F218F88DDD70C7390E1474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 ecd6df5e970d5c82b4d0af48dc1f315500326d4ff42fb02a42d1413bd2eeff54
MD5 3b761ac116f81ab4731efbfee832dff2
SHA1 98fb2aaa065b15d792a2d64cf74a7f5c084fb0be
SHA512 1bad1970d78bbcc7be4838057ee741d685514abb1d05c2e14b9ee89bcac3e2f0288de1ac4641c4bf7a6543b6daef41755ffcabead1990cca6af6de99da8e62fd
SSDEEP 24576:JZMSzFVSOxCqOLnyFrGhd/M3UoKSdvU6uZD4BWMDr1zgHbJWe:JZMSzfAqOLnPhd6dM6uZkzDr9UJ
TLSH
T17A050199739008F8ED63813EC9518546E2B27C691B70C61F53B4366B9F337A21C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 73e0dfa7dbf42b6195aa2466ea707fac1b762d209dad4cfb4b47fafa30028502
MD5 7bcc9bc61f574e0a8fe83d23b4e65d83
SHA1 3fbf00af93e9cb63c2185fca54a5e46e24a1417b
SHA512 0d6b7a95fc259ed000bc1e15f88bc312e96fa069715f571c8f6f4c20bfc017b5a3a22292b0e0abdfbeabd24b00f2606c503349e7d99d8ec2977eabd15e9f570f
SSDEEP 12288:fUCqOLnyOmrGhdgTsMyEdp4oqFSLMgOYtTzSj6uouXNDg5BWMDr1zgHbJWe:fUCqOLnyFrGhd/M3UoKSdvU6uZD4BWMi
TLSH
T180C4231E2AEB02B9F760053E82C153ED71AC6CE9B66CA568F618F88DDD31C7390E1474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 606e1d1fa7afe386c948359df0a62ccbe74b6dbcba6fed447c745e52758faf66
MD5 a8a23f173f3a9252c25a1b2339a9f68a
SHA1 d1c9cc3aec191e69a9b70d7a48b707e09c434e5b
SHA512 7b4fe18c79a26c361eb40da9817a559b9454368778273bc086f22c77120b0b1e3cf7f271dee072c2bb0a5b6df60fb7ae42f2b52c7b230854eb99a777ebc48c98
SSDEEP 12288:2YCqOLnyOmrGhdgTsMyEdp4oqFSLMgOYtTzSj6uouXNDg5BWMDr1zgHbJWe:2YCqOLnyFrGhd/M3UoKSdvU6uZD4BWMi
TLSH
T180C4231E6AEB02B9F760453A82C153ED71AC6CE9F66CA568F618F88DDD30C7390E1474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 6279ca942101c40b1c447e5d31f42af8a29734c0644ef111c61d24ee8ef495d2
MD5 f451ad6b4070cbb4584e76ac1eb1d663
SHA1 df37dcf64103161e894183cac5ab12e30171b730
SHA512 606c02e103707b7bb6ae367a627c43623c388b2ef774e1fa5f61068d3ac360d0d6928ae3e9c516a6fdd47eb7668cf2f7b23a59d8dd9c4e4b541dc9e336cb93c2
SSDEEP 12288:QyPz5L8VCqOLnyOmrGhdgTsMyEdp4oqFSLMgOYtTzSj6uouXNDg5BWMDr1zgHbJL:hzyVCqOLnyFrGhd/M3UoKSdvU6uZD4BM
TLSH
T1ACF4120B33E630F8E2728239C8921646F3B57C7157348AAF5364567A5E336E19D7AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 f200b7904a2db6c3414ce62d8c8048ceef49ea4e8422f95b38f91467ce5b057a
MD5 79b61c06da1a4ca56f966c499fa6b87e
SHA1 ce809b5ad8f1fe36fc28a2276ded919adc972f35
SHA512 cf4e556b4c190fbd4813c88733e1a2c573a939d83e26975a3ad3ef7b1361c22e1a5fc9175e2863c0349131e0b38b41b36ab94ea2c218aeaf5ef9902f8d903389
SSDEEP 12288:3UCqOLnyOmrGhdgTsMyEdp4oqFSLMgOYtTzSj6uouXNDg5BWMDr1zgHbJWe:3UCqOLnyFrGhd/M3UoKSdvU6uZD4BWMi
TLSH
T119C4231E6AEB02B9F760453E81C153ED71AC6CE9B66CA5A8F218F88DDD31C7390E1474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 bade91ee8e9ada05402178a9e738074cb3624a2b55b8dee53e7c268d862ee6eb
MD5 11f52c63bd00a29bb1f5190f3e57603f
SHA1 0e2701fee741f4f5bb9f7554ab7b99e594bfa2f8
SHA512 540c3bd2d39587b8031b33839dc439d8d5ff7cfccbaa6176451fbfaf1974c8d5ed3aaca5186450162b85574b654066c8ae730b304f8ae2e8edbb33f4c4178b05
SSDEEP 12288:9UCqOLnyOmrGhdgTsMyEdp4oqFSLMgOYtTzSj6uouXNDg5BWMDr1zgHbJWe:9UCqOLnyFrGhd/M3UoKSdvU6uZD4BWMi
TLSH
T1E9C4231E6AEB02B9F760453E82C153ED71AC6CE9B66CA568F218F88DDD31C7390E1474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 0e0fd9ac707d1b21f45da88bf120ca3dad2fc3f115a664c92ac6a0bd3713698a
MD5 4c3d5fe224eaa1cebf4483c0e84caceb
SHA1 32245ae20e0fe12644ccf816d18cac465d670773
SHA512 e6355320419b3dc1ef951152f936cca7fb284010e158f77eed226f33d21cf88b9b61075a23e9c2a602d963aeb032fd7d8cd17da3f67e81a24ee25dd476401a65
SSDEEP 12288:EyPz5L8VCqOLnyOmrGhdgTsMyEdp4oqFSLMgOYtTzSj6uouXNDg5BWMDr1zgHbJL:dzyVCqOLnyFrGhd/M3UoKSdvU6uZD4BM
TLSH
T1AEF4120B33E630F8E2728239C8921646F3B57C7157348AAF5364567A5E336E19D7AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 af15bd0078b9d49abd27cda746c23be6b8b5dd5895ca330eef174ac3708e8fe1
MD5 29da2f2083c1b40a1b45189353176588
SHA1 15e30bbdcd275b9340c205ae76d5f8daeb1e20d6
SHA512 fa788539664488cc177794a5682e2bb69e875aabad628c425938f374463c8abc8fc3604d999d9767b9f36bf29bb668214f6e22f39a36dc6dedf7504d0cea804b
SSDEEP 24576:LTHaLl3z0zDnCqOLnyFrGhd/M3UoKSdvU6uZD4BWMDr1zgHbJWe:LT6Llj7qOLnPhd6dM6uZkzDr9UJ
TLSH
T1DD0502A9B39008F8ED67813EC9518556D2F27C6A0770C61F53A8366B9F333A11C3EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 7c812f801182b22b6ac64a7e9be353512be245636b53e9e4c3ec37e60dee88dc
MD5 a65aa7dc50c0f7b97d15d65101b5ac4c
SHA1 4a5b3467216e03d43fbc650e6e92976c30bf356f
SHA512 e79cd6a7cdd83191b3183830e04e0f0a86038c00c9aee155c55babd375c20ad3fbf2c32de789f026737d029a3cfe65552034ba976b315a711db6b8d64d9cd4bc
SSDEEP 24576:C37d9CHKy7GZjCqOLnyFrGhd/M3UoKSdvU6uZD4BWMDr1zgHbJWe:k7d9CHKyaAqOLnPhd6dM6uZkzDr9UJ
TLSH
T18225CF90F3E410E8F1B78A3589725511DAB67C995B30DE8F03A8655A1F33AE18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 52804cd750ed0ed23e313f8d0583447209886cf6ebd10b988bc5d3bc1141b2da
MD5 a5352c1213b890996cb5a023554564e1
SHA1 95bb5669a26e7ee63e709f987a482ef916a80fb1
SHA512 851fa0ac3437198155dae4a2305d28ccaad756c9420567368f356aeb6304059625c60a84d8fffdd79ce0b97f42b749afc5d931572a212738407281cdea06a9ad
SSDEEP 12288:t3CqOLnyOmrGhdgTsMyEdp4oqFSLMgOYtTzSj6uouXNDg5BWMDr1zgHbJWe:t3CqOLnyFrGhd/M3UoKSdvU6uZD4BWMi
TLSH
T15AC4231E6AEB02B9F760493A81C153ED71AC6CE9F66CA568F218F88DDD31C7390E1474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 85e562a19c97470f5aff2755782937bdccbf6d3fb79f248de2be2d14a42c928c
MD5 50e2eb6d6bfd7c8d12c6b42de0f7c182
SHA1 442913adc2d74ee723c842d34590cba36c5dcc6b
SHA512 9590bdfbec3513b5b65c34f06daf595e8dfa77122bf29a9e882fc478771f6da19a422976b0196e9b6dca0733c5d0dc569e5356c65e95cf9fd5210816cfed9005
SSDEEP 12288:c1CqOLnyOmrGhdgTsMyEdp4oqFSLMgOYtTzSj6uouXNDg5BWMDr1zgHbJWe:c1CqOLnyFrGhd/M3UoKSdvU6uZD4BWMi
TLSH
T158C4231E2AEB02B9F764453E81C153E971AC6CE9F67CA568F218F88ADD71C7390E1434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 c49bed782c3fdbd0733eebe8c5fcb27f9541689462fe6e2725d345eebde2d56b
MD5 e6f7fbd59c370f149dcda899dc66959f
SHA1 5152476975735429fa1e5dd6922d0fe659894079
SHA512 bf2506abdb3538180423b5a64b70f996e2fc0c1f12859e350f7478326ea9d90ea805cb0856fdde528fabd21a770c7bea57d8a41fa57a616441471dfb12c939a6
SSDEEP 12288:76CqOLnyOmrGhdgTsMyEdp4oqFSLMgOYtTzSj6uouXNDg5BWMDr1zgHbJWe:76CqOLnyFrGhd/M3UoKSdvU6uZD4BWMi
TLSH
T122C4231E2AEB02B9F760453E82C153ED71AC6CE9B66CA568F219F88DDD31C7390E1474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 bf8a2335074f4977d76ccb1c64c7e8f670823155003db3dea32be54386f23d97
MD5 dc15577de25d4f2377d5d198fd0d6d0e
SHA1 e5a7bb146acc57217ea30b849a2198cbf5d72f7e
SHA512 4aa9f3c227a7311ffb399b1bbf90f6b21a4f0a220b9bbd880bc1224bb105f4eb44ea6c37217ca9eb7c558e6e6029c545d6e4b2b27a68c2ae6942e582620b7443
SSDEEP 24576:Mfwvok9RX6wkyAIICqOLnyFrGhd/M3UoKSdvU6uZD4BWMDr1zgHbJWe:sMnYIJqOLnPhd6dM6uZkzDr9UJ
TLSH
T1A635CF29EBDC44E5E1B7923C89E3464AF2B178691B31C6CF125A53AD0E33EE45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a0f5f203eadf9f84a170a7ae839893bbdff4dc2c80b9703745eb4fd31065d0a9
MD5 3be94f7f5b41193deea327d1fcb19056
SHA1 bf9c082b864948dae2b720632dbc1d0275a85914
SHA512 fe776e39270ae88e33a28d01a9b3c904218f6dbe9d8c947ce86f802320b4f7bfd9ea3674d4256445e0d937409e9c6a3492796483133e7f5f6da08cb841928b15
SSDEEP 49152:7YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0WqOLnPhd6dM6m:fySzPsnpdDfZyDe
TLSH
T13D066C56A1A801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 09447a94cfe6e865b2747764a9118fcb0647c3a2fb6efdfde29e7d49313b4d4d
MD5 36c57d051e2a86408ec5cdae9b515f46
SHA1 964f0fe46ce35cee838677f82d8e3b7b5740769e
SHA512 dd45f3a9ff03aaca9c80e1ffda6bf31bffa96e873e8abecfc8ef0ad7fd44b3f7c25b1e8e36135b6428d25540c6d89c1be467b706be0d2a110a244b89142a274a
SSDEEP 24576:447Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYhCqOLnyFrGhd/M3UoKSdvU6uZD4BWp:447JUQj1irIhCnDHUPfF/mqOLnPhd6d2
TLSH
T19965AE1EA3EC01E5E1BA82788555465AEA71782D1F31CACF2270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 317ce4f89a3ed582678562f5547f73cd8c5b0afaa894afd952173c6f2ca598da
MD5 5792d17d5f3d141effde7e9df31aac91
SHA1 00494f5d3ec4f8559608ba438eda1482cbed35cd
SHA512 afa08f5906cdedbdfbac310f435f048f58f86a3d87c01f0d2bfed8c5d49bcd9535e165aa37f3d70bb19672b4daf4039e25d0745905e372a2bc264ee2611eab23
SSDEEP 12288:pNsfkCqOLnyOmrGhdgTsMyEdp4oqFSLMgOYtTzSj6uouXNDg5BWMDr1zgHbJWe:ukCqOLnyFrGhd/M3UoKSdvU6uZD4BWMi
TLSH
T1D7E4011AD29802E8D16E5139C7824285B3777C6597F0D3CBA3D0F57E0F369A19CEAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 52d23839c80f3eee3efe5dc6e90adda16cfa4bf34b5cc570bd8fc23dc3bf4040
MD5 ef9dd341a9b3c731c38e896852704de6
SHA1 13c2182e506cd2f64f7b01b1cb940a4f2e575199
SHA512 46840989a25f47541a1593e7f5a3eb07375caddc0af30e859d821411198421946d1a3ba23a59e4f91eadc12f1017edb321625579e90c891549ac8a2161ab1747
SSDEEP 12288:BZCJU3fnBwlBMkdFH9J/BrkRl1XxWrlY7YL:BZGUPALBQRl1XOln
TLSH
T1D73528007666DB4FC66940321E37D2CCAB707D51EE04AF0373C98B3F9576659BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.1MB
SHA256 cb014c5ee71ed2c33d5a4f30275bdec045ec2a75a45d21d66e69b47d0d1026a2
MD5 ecc921a7537c8d0e84368b5838c396f7
SHA1 c0da51e73c3f7b6e404df6089437082349d40bc3
SHA512 c64de8d2a7704da14fba07cf1e18fd2192fde5ff60e4e219c78e134f339041cbb9f1a1caa5f09bba89d531be1b3e2a7bed2e69dfb67df35f859039618374ad73
SSDEEP 6144:oj4TRxo3nHG2mqC4hy+YavI1WeAr1cmcjmVaildvcjmVaIy+tMxHy+tMxU+8cepK:cnO+YaFeAr1cmcjmVaildvcjmVaU/
TLSH
T19B45C7406437E78FD1B62032076B9B8C6B64DC17B7096F26B3C9453AD82BB15A0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 5f7e40d308063b24c1eb945609d14ee4d56ca015acb8e81f2e1bb2bd669fe1a6
MD5 c67f73c907e0c3106a81a02c402f232f
SHA1 144811ed357e9bfde9f6e88f9bb3da4f42a7c006
SHA512 e3545710ac7b93f520618c3f49b0dbfe5e20749bda676094e5e91324b349d9814fd148dc516c75cbbd93c5c53ac94e8eb998d18e0b1ec9696867f24bc4a1dbbf
SSDEEP 12288:fF7NCqOLnyOmrGhdgTsMyEdp4oqFSLMgOYtTzSj6uouXNDg5BWMDr1zgHbJWe:VNCqOLnyFrGhd/M3UoKSdvU6uZD4BWMi
TLSH
T190D4231A5BDE0269FAB4053941C592B8716D7CB8AB68D4EBF108F9CDD830CF398F1925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9e8efa6391194a25ff43c7bb65c84fabd555da7fe81ec80100f89529c29f32bc
MD5 83dc2a47509e2e0298549bad057c3b1e
SHA1 b813baebd35b611123a0b363304a454839995146
SHA512 28e92c261bf84174194c93b03aff50b245015809bbf98bdf0e85e646aade9e8df4df991dbfe3c20baa3c478d65ea50289cd8bde578166fffa05c5ff5c6d865ce
SSDEEP 24576:sgb6bmBIi49WNNFpg1rSvFv7bYSCqOLnyFrGhd/M3UoKSdvU6uZD4BWMDr1zgHbl:sgb4mBIBhGFEqOLnPhd6dM6uZkzDr9UJ
TLSH
T15365AE1E22EC02F5E0F9D2B8CDAA4417D6B278161731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 2.0MB
SHA256 6c2c2f90bc0f04bd4f3ca2ef1cdebfc45a45f59606a4272dbb112f85996d5fac
MD5 a3fc5a16764d60d646a5692eb22ca222
SHA1 3b9c742554685774c2853dd548d8b39301325655
SHA512 f577a2b78a5b0611cc2866d532aed04b024282137483d11e4c44d41615a2e19da4c4c107b28527654f5809e7698c7d5d88cf365fd9f4965c31ba989ba6c4efc4
SSDEEP 49152:s8MwBtOmbqOLnPhd6dM6uZkzDr9UJjUXEei3C2nhmd:tFJnpdDfZyDejjeiyx
TLSH
T137A5E12EBAF845E4E1FAC6748D238116F6727861073293CB9390C13E4E679D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 ecabe1f8f3ea1699e6c635b7229ae97aab8f914853ae1d0a29a7338b57dabf6c
MD5 8297b3a420270273ff90a9248638f108
SHA1 15640ed2441c99c01d1fde80a6af5cf4a0571f97
SHA512 af0b9f64ae8d13a5f5bb9f07eff210cdab28bd577fbb2ba8b233cd578fead2d1a908ace06bbbb89b61c7ed871157fd782465c5bf20a8daf1ba5815cb09ebdeea
SSDEEP 24576:KGjSboX6jEO6D0niU3S3mamnFMYb/VPmzd:KGjSUXEei3C2nhmd
TLSH
T18C05235AB8F960DCD33693BC4096262E78B034A3076093EF5AB0C7305F59ED0A676D5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 60a87b79f2013c3febc8077edca97a491ac81533c76974dd756bee3e2bfae133
MD5 5b5f2ab253a79bedd316242169af2a70
SHA1 8bd7d79dd8b51d86fdc487593e1ffc62a51108f1
SHA512 d5f5ec5743019a3c02d1e6943882f7953f6f94132670000b9614bbee3c958b7b47bde48017fe4b630afd573b41751de64deb7ffa2e53bc4c8df670f3077af4c4
SSDEEP 24576:LG88u8FpJqH1bzria7/mxCqOLnyFrGhd/M3UoKSdvU6uZD4BWMDr1zgHbJWe:K7ZFPqVea7/TqOLnPhd6dM6uZkzDr9UJ
TLSH
T1C835F16577E101F0D477D1388A8242A7F6B2B8251364EFDF07A88A551F33AE14B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b8fc15422b9228663418f89fb2932ca3562848a00f264cf02ce8d4ca70024dca
MD5 6d18069761543ebb553a2ff66d432066
SHA1 a482fedb2e53643a29489134f7ede0b1e4aee0ad
SHA512 4146875687fbee8c432e7d7f0693d07dd0ea930ba843f89a0842275026fed471f5337c70def92a58318d3987d28e01ebfb8b6eab3ced17fbca9f97bb7edd1267
SSDEEP 49152:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj9qOLnPhd6dM6uZkza:hG05lO43bqnpdDfZyDe
TLSH
T116D5BF6E62EC11F9D1BBC17CDAC6460BEBB23825033556CB02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0c659e677689391b9bf0da17cee3a9c692d92de3cf2423624276f77b1d211130
MD5 c286dcb75007be4c7a83ac8994c97498
SHA1 b40ddcabe4fd81bfe85867aa1dc163b775007123
SHA512 7f78a7d790fa13800172bf01ef22465ec642e2ece8a250be3ec62e5f0a6455704fa5a80cc837bd46cf5863082f066e81a18f6116587bec83b8483440ec236baf
SSDEEP 24576:lfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnLCqOLnyFrGhd/M3UoKSdvU6uZD42:la5POZ3+Jt2pasx2+mYqOLnPhd6dM6u9
TLSH
T10065AE5EA6FC01D5E5B9D17DC583861AF5B1382153319ACB022182BE3F37EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e42d84765f7f266b064e87c8940e3b4d48e1314f1dda02a51a1d045620e80520
MD5 27d62bb5f3de64ad656d7d79c440161a
SHA1 f5e58a3df4963b89e5521e91521ac6755cdad909
SHA512 70ae41e00ec3b116053b31f47ca9c6735f483abf54344ac6333bd40205c37ca64d2013efa93129ff832b568089e61538528c902d827a7064c3201dbd7a326858
SSDEEP 24576:zNcwHdjbyQ4nLC18lb/EOjowL7FkpCqOLnyFrGhd/M3UoKSdvU6uZD4BWMDr1zgh:zNc/zEOVHFzqOLnPhd6dM6uZkzDr9UJ
TLSH
T139858B1623E901E4F1BBE1BE89679546FAB1786513348ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 0a010beb03454c906bbb53eed33f064f12f5116c558abe36901fa2b191fdd818
MD5 e5583b01aa7d0e4824ace44d32b47f7e
SHA1 ade551e606a8f4e50f51849c51f9168a80d1e853
SHA512 7aac9860877102fb753ae2dd0386c99e4754867e3b09290956747529cefc5cc600c6c6aa0299f95e236fb2005df4d8ab1b5d8e0f15e796f1fc766b728a25c06e
SSDEEP 24576:igDIxuboX6jEO6D0niU3S3mamnFMYb/VPmzd:igDIxuUXEei3C2nhmd
TLSH
T1A625124D737A10F9E227E03D81830615E6B2B472836256CF57A4C6795FA3ECCB939E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 2db64db02b82fe07a50add9f2679c06f410da30bfe5d5b295c9746daa484a759
MD5 987f737f7a2bbdc0a0d60073604b61ad
SHA1 0fc65334f3cf7e354410b358a84d06c609574470
SHA512 ade038b6eedfe419a12f242859ec824eb98c5c392b61f3a266e73508b8b1d611c7dbb0b97f733f90f4e647a3d432924ed82d864ce326e035804cf2548a91f30f
SSDEEP 24576:dtyOboX6jEO6D0niU3S3mamnFMYb/VPmzd:dtnUXEei3C2nhmd
TLSH
T15E152301A7B850DCF726127C95A712689E747C220B6183CF66B0D73E2E36FD4A971B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 debb1205cb580a11ed82a11e5704972eaa8d27fcce260aad33da3d70a234de9d
MD5 c9f528f14a33f813160a48352fa03d38
SHA1 6f414b68f1319d1359c125ceccb29a802d29ae4a
SHA512 53fddbddf3e675e543fe0f75d14e6fddb630290ca32b2b539f04c8a410517c45f5be6a6ae63af5430cdaa80c5e1cf46ab782b3312cae2cc664f5825707ca25d3
SSDEEP 49152:MDMwBtOmbqOLnPhd6dM6uZkzDr9UJjUXEei3C2nhmd:GFJnpdDfZyDejjeiyx
TLSH
T16CA5E12EBAF845E4E1FAC6748D238116F6727861073293CB9390C13E4E679D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 24ce053e07f0370b4ffb36c47909a52f098133cc9ba603076077d80e45815fff
MD5 1fb61c6108f5c4f5387f01314fa0cab5
SHA1 f92dcf5e6ff6d02cec2a44fb132fabdbeb4ff01c
SHA512 8a464841f8012e4e8e60d300da601d36fff68a7c868bed3b4ec82c77dff3f79a3c6274befec4a34d795a13b548be0e8159c00c93c16e40ed6a43d0e282664a02
SSDEEP 24576:+PUr+NQcCqOLnyFrGhd/M3UoKSdvU6uZD4BWMDr1zgHbJWe:+JQtqOLnPhd6dM6uZkzDr9UJ
TLSH
T13305E12F26ED18E5E676A13D8582831DF771B8621711D2DF02A0917E4E73DE9BC39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 05faad1aa37b591cfd48c6b0ff71b24ba69b196da4c7058781290e39dd57c482
MD5 2c64af98f953248b5e6e5a1657218489
SHA1 0496cd61f5b6e5e5f6766b03b5e39e8c70da2d67
SHA512 1fdf873f5cf60c848a62e0793bb908c7179c2f8ad888e315debc0ca0dcb702518c8894cdc6e927e754ca35d19f05779fb90305b0a9f6ec9924968056842896be
SSDEEP 24576:oD3FHshBIYQgAgCqOLnyFrGhd/M3UoKSdvU6uZD4BWMDr1zgHbJWe:oDVHeBIAAxqOLnPhd6dM6uZkzDr9UJ
TLSH
T1C425E13EEA9D00E4E57AC17CC6938606E37138A9033166DB1294D1BA5F7BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-105-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/248-111-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/248-104-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/248-338-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/248-372-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/248-371-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1360-127-0x0000000002930000-0x00000000029B3000-memory.dmp

Download

memory/1360-0-0x0000000140000000-0x0000000140257000-memory.dmp

Download

memory/1360-76-0x0000000140000000-0x0000000140257000-memory.dmp

Download

memory/1360-119-0x00000000036D0000-0x0000000003730000-memory.dmp

Download

memory/1360-139-0x0000000140000000-0x0000000140257000-memory.dmp

Download

memory/1360-128-0x00000000036D0000-0x0000000003730000-memory.dmp

Download

memory/1360-16-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/1360-17-0x0000000002930000-0x00000000029B3000-memory.dmp

Download

memory/1360-125-0x00000000036D0000-0x0000000003730000-memory.dmp

Download

memory/1360-9-0x0000000002930000-0x00000000029B3000-memory.dmp

Download

memory/1360-1-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/1360-132-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/1444-89-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1444-79-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1444-77-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1444-269-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3116-356-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3116-144-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3116-357-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3116-353-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3116-143-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3116-150-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3272-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3272-30-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3272-29-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3272-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3272-31-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3292-158-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3292-164-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3292-156-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3292-354-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3324-48-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3324-49-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/3324-56-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/3324-55-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/3324-63-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/3324-62-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3400-94-0x00000000008F0000-0x0000000000956000-memory.dmp

Download

memory/3400-99-0x00000000008F0000-0x0000000000956000-memory.dmp

Download

memory/3400-323-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3400-93-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3764-180-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3764-169-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3764-176-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3764-178-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3764-170-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3824-185-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3824-186-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3824-192-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3824-358-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4328-155-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4328-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4328-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4328-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4328-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5668-212-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5668-65-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5668-72-0x00000000007B0000-0x0000000000810000-memory.dmp

Download