1bf0b5c1bfbc13bde59c50e9e3677e5b3da0c3f86012ba371f8d14c9b48912ab

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 22:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
Size 1.3MB
Sample261024-112qbsxtev
SHA256 1bf0b5c1bfbc13bde59c50e9e3677e5b3da0c3f86012ba371f8d14c9b48912ab
MD5 0b910d8c3e593ec9c71928bb57a0f5a9
SHA1 5cae2f810dcec909fa45a4cf86dbc4fe384327a8
SHA512 cf8f923ca586cfb509cf1dfda5c5a6311445ccc112fa732969c549d1b7098708fd33e5339e1771dbd244f37c15aa5d3ee2a445c1bb4d858b43b36bc2b6580444
SSDEEP 24576:+uKxZ8VxWKAaNUF3P+iMod87mLWNNrIQsqjnhMgeiCl7G0nehbGZpbD:+uC8VxnUF3P+97ma3Dmg27RnWGj
TLSH
T1E355CF19B7A941E5E073923A89628251EBB2BC111B31D7DF5254B32F1F33AD44F3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4724	elevation_service.exe
928	elevation_service.exe
5768	maintenanceservice.exe
1176	OSE.EXE
792	PerceptionSimulationService.exe
1784	perfhost.exe
2560	ReFsDedupSvc.exe
6076	SensorDataService.exe
3300	ssh-agent.exe
1300	AgentService.exe
3600	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fcab98273a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\java.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b76f6680464dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008148f3250464dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fc678270464dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000168337260464dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000005b6914270464dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
4724	elevation_service.exe
4724	elevation_service.exe
4724	elevation_service.exe
4724	elevation_service.exe
4724	elevation_service.exe
4724	elevation_service.exe
4724	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
Token: SeBackupPrivilege	2560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2560	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1300	AgentService.exe
Token: 33	3600	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3600	SearchIndexer.exe
Token: SeDebugPrivilege	5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	4724	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5784 wrote to memory of 4260	5784	2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe	89
PID 3600 wrote to memory of 4316	3600	SearchIndexer.exe	101
PID 3600 wrote to memory of 2252	3600	SearchIndexer.exe	102
PID 3600 wrote to memory of 988	3600	SearchIndexer.exe	103
PID 3600 wrote to memory of 4924	3600	SearchIndexer.exe	104
PID 3600 wrote to memory of 1332	3600	SearchIndexer.exe	106
PID 3600 wrote to memory of 2584	3600	SearchIndexer.exe	107
PID 3600 wrote to memory of 4484	3600	SearchIndexer.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5784
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Delete /TN "EVKey - Vietnamese Keyboard" /F
  2⤵
  PID:4260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4724

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:928

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5768

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1176

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:792

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1784

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2560

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6076

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3300

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1300

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4316
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2252
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2960 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:988
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2948 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4924
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1332
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2948 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2584
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2960 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 44bbbec47205c176be82518422ca292b97ed7f0cc4d5638e49444b1d7c2d9a82
MD5 222b8295b33942b270e399833fed839a
SHA1 e4c54cd4354ecd99b9b09769d20f97d93c0c4fc8
SHA512 89319b31e03e8aded833368a68fe9b00e50395f1b4d538d26f6b299ba311615cff5d983df7b40a224e0998aa7675de86ffc784e13d0b4fe3c8bd448f02325315
SSDEEP 49152:6b+632BuPkFKRrdE6ohvstBhuXjfS4LWxn8Dmg27RnWGj:s3q6sjBnD527BWG
TLSH
T16CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 74f6b1c829c66c2a6e5d08e3449f9d7aa29d6f5521f2940c66f506eb3a026f32
MD5 1a4550bcd42b81640bdbf0b50643de3b
SHA1 913d11f5971167ad43252a25e1fb3ec615fe6125
SHA512 8f7e5740c4f4e0c74d96f7f01d0c81d3fe362855a2bf8b68f60ed9c8ca0ce1256d7bf71accc02b2e71a1e3295ea7f0ca7741a8720a66fb13c9afe33694e7780d
SSDEEP 24576:4XYfDtczAnsqjnhMgeiCl7G0nehbGZpbD:vtc6Dmg27RnWGj
TLSH
T152650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 497f22a99503672a75ff0ae4ad4f5208f3b372c0a64856e8ec35775450ea9879
MD5 4fd0aee4c41ac8bc2d670b80650e5d76
SHA1 6922697539b7af314eff74d356d934c948913564
SHA512 0523a22a892f1ffbf9aafd4cc2e00724f69e4ab51ff3ece178c60e005efb737f9a33d968a3be1da0976b056a44b011323349fe59583e7178387e6b72dc8141e1
SSDEEP 24576:n0Le5ji0hmxxrMIsqjnhMgeiCl7G0nehbGZpbD:nPji0AjlDmg27RnWGj
TLSH
T1B2859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5880ec58004576244fcafe2cf7408550933ce4c281a9d8b744105a0a8fa2d41a
MD5 a32c8425cd59cad369584f3a9ec347b9
SHA1 741c8856eab7186e8f1abcbff1f8c97d73dcbd6b
SHA512 0f37004a8c59219ffe4a62c948e0ae740c4044609b4d0d1d90659b02e7744373a0d0479480e53cc20e3943e3a210a9dc12e4be0df1957c48d3ea128dbd8ec18f
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWn6q8wyumsqjnhMgeiCl7G0nehbGZpbD:x/ezSC6vUzPveHjy5Dmg27RnWGj
TLSH
T19A755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9cf2a86b35ac600cf7d495aeb2e8c68ecae2cf6f7d97c7bee6314267731fca8c
MD5 53a70f6297695867d3ca3d112fe88f66
SHA1 e306fc95ff921433b8088ab397cd305b0016a64f
SHA512 a5efd20711ff2a6e380e6266f8d5dca0c56a996c0bc8ab59b5f1c61dff01145820375a9cecefc91ab2c35ff391b8b43f24c0e55122d0b9b620671db0df23ba86
SSDEEP 24576:TVbqPb88hv/l+YTsqjnhMgeiCl7G0nehbGZpbD:TVO88hXl+SDmg27RnWGj
TLSH
T105559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2e4898ab2d86c004ecdb4bacacdfb70a1664ec780eede45078ea3fdb6767c8e1
MD5 1be270306d6b1cecf32a2e9c0dc974c6
SHA1 92410579be7ff29bf4bafb964136c17931a383a6
SHA512 0781fe582202660b75b0ac9d77695694f3b31cad9c23f9205b61b3291f475a742ebb70d3ffa6be9d2d436457094f2cfaf14896d16c39e256ccffa973a1779f8d
SSDEEP 12288:yLkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yLksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E14523BE824C10DAEA7708B5C3E9F51EAC137E56982018536A637DFDE6F5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 2347d549f4eaa277e2e22a974a83cbfcb80e888b5195ed151c72b5a4fc58c123
MD5 2023339376d0b37a66a87912d240467a
SHA1 fbb328f00e704e326b2613e7abf4b17796d44533
SHA512 7f4039cabef11cbf31279482db2c6ac980e79e480e03247f46638f9875b381c094ae882315d4a741e0f13e98867ffc8754995e99cb3344432842c8cf3cbcdb6b
SSDEEP 12288:JeBNUbTVO86UbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:JJIUbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B65CF7BEE28FCD2C27A8DB95791C600E77278314B21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7fdf780e59620507017ccb8ec3141554b586a14c661cf9295debae252eaef470
MD5 3883cec576b9566a537ccc00a336ccb5
SHA1 a267504218dc82e6fde386ee8e4c7a0cdc38ff78
SHA512 e80ff0da02affbc19991377fed9d3e6cd0c37a42b32d3bebb4f63152a7eab3d4459ec7a61fd9fd84a306ae540237a7208d92fd7935cde749f2a9978ec4081137
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THW:+QvGAdlCEL8c/DRNw5CaD527BWG
TLSH
T143266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 23943973c95ac2691b3e5caa18f9ab5ae845b82906f748b0f307efb20e1dd246
MD5 02a71aa41eafbf75ec5799b3d82ecd05
SHA1 5233a72f919aefdb4c1d1a3f6bf61c4e81cba09e
SHA512 c7b9ea849833e35b455b79a866c91aee75c6a96ff8006b81695904aa376b770d1874f129bfad8dd23ed476c2d37abd3e8c09a9b2257adedcb95fcc33fe9d1938
SSDEEP 12288:xAwSfxL/2Dc3RDLLmt0LDQewsAjBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:S0ewsAjBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10375E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a5ac7eb1616b9cdcf987563b9759b7a68c6604618a4e38d151d139216dbcd30a
MD5 a198f16c7a8ba032f834abc9a77e81ca
SHA1 6497467f05548748b6b88851fd7ce29bbdbaa804
SHA512 7a3b0bdb396964172bc6051603dee27071055c79200633e9484bdb6fb254cdb1b93cc3af18191afa636ac3a8c6d9abbee7c5d30458701e76958280229d2667e3
SSDEEP 196608:8UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHdVQBWG:8UEtQevvqc2W1cpV2tI32oB
TLSH
T17B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 26307b6c796f76606424b626d300a8953d85e9e3f1712ead509ddc7b4ae76e02
MD5 c389b2b9eedf735d1d0dc727d0b2fdc2
SHA1 d64a5b6f65e83303a757145112d303d5332ee227
SHA512 85bf4f1961449a0e6a108cacdec63947769f8e187decad86e8f0e11b4befba8678fe71f67d0740d4b483fcc4a11d03c0c44105636c63c81cef33ae237d8aaaae
SSDEEP 49152:VCbRquA/m2yL5zTfFiV+XenmE3/z1Dmg27RnWGj:CoquVjnm+D527BWG
TLSH
T127D58E1976B8C1E4D1F6C77886A2C647F37178154B3097EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fc88bd039e7c12f6e70df938bc243da8238140fc800bc10727fe45649d9db2a6
MD5 a565f2ad9dc3171c4385cac97904eef7
SHA1 50cc6d2d151a0b05de97dae50d331d1ad644a64f
SHA512 7c3d4a77454c8d2d9db0a337b1ae7f734d56291721107b80b3d2b3c691edcf4bd70c708b6df346c61e1759894469887ca0b93b254659cfbaab46787eac6a26b5
SSDEEP 24576:IAhGL3IFoiwtA5l7S53KsqjnhMgeiCl7G0nehbGZpbD:IAMUFoiq5uDmg27RnWGj
TLSH
T189359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 88c0e951d54b90dfc4a4baf4202070cac3e7d1a92bb79ad6349aa04944ef86d0
MD5 c59651253d0fbf08a4be4940e87afbdd
SHA1 81376edd169f6a29fc7042161e9fc901c3a7db5c
SHA512 262b26718fded1857c039e85049a297b48ac7fbd4279250a8ab49ac45159ab542ff79d640dacf01a1f7b78f6cab0e0cb5663f9b64dd20ea4642f927c36b939ab
SSDEEP 12288:umw5HEjsChNVBFgl0WDm+CGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:nwu4OWlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14E65F15A72A80CF9E9674539C697D136F7B3BC122A20DB1F1760C65B6F33260AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 40c0d04306cef36a8d4f10c0bb54596096f874d07ab3bafd2e38a0d09c90400f
MD5 7539530711e174acf2cd77d0f9406c9f
SHA1 f0ff9d12118811cb835015a65ebf634b669730ef
SHA512 98811e77970c5529f6d79504476abb702d88077830c87d1c7ffffcd826521a4794d9c6f5b5e5740ec3ce0adcc14c9900dc5dab0d4b18a1e054b12a4364a3612c
SSDEEP 12288:MeZ1IyxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VZuwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1675512AE239820FAE5634178C6E5D609E7333C62673003CF166656BA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a72d93978d68cc560dc0eadf0e641fd03b079281237febbb23761685c8128d72
MD5 e5d14dec6940269080d1bb11c60524e2
SHA1 b43bac9b53d837f51e88b6f3ff1c3dfb87a724e2
SHA512 b80687a0c6a24bc474b726785ae462d1c2e8c09426d7c476b5472f26296190610cd14c19b84c3546832111ce7a341e19ba662c0b873dd9faa997897a76ed9924
SSDEEP 98304:uQRQyi36YOcPbLvw2gAf+PN3zD527BWG:1QyiKa/X+PNDVQBWG
TLSH
T199667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4668fe0d3b88d09a9e152d9b1fab43e69c3311b3ce34e2dd5f11dc454420e9d6
MD5 5dd856e3609373efb9192bc3dd3c75bd
SHA1 31b2987a37d52567fdd383c3ec3ef15059f9c8da
SHA512 6df73651ea05a2d395fbf64bec6288a6235367eab78294c6c343a4289a76b378a74a74e6c4531c7141f97a10823cd0b73f4a98987ba8711c332b059a66b40044
SSDEEP 98304:aQRQyi36YOcPbLvw2gAf+PN3zD527BWG:RQyiKa/X+PNDVQBWG
TLSH
T1E0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7a4d022b7edd08a0506df7545a82d77160920b224fd5e8885bd7d8b7c5e97347
MD5 7f9e424db57932a19f9495f72323ff7e
SHA1 a3e4f10b8014063b8d5737d44e0cfebc2dd73035
SHA512 ee7f15936a74155b815f7d2a3ddc6bcbdee1d2ee266dcd73e9b9f4b7708c3c82459550a833e68d817e629f16ef2f5ad5ce69e675effd51c3a8168966bd9163af
SSDEEP 24576:DwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0AsqjnhMgeiCl7Ge:768Qg55nhceWu7PNU3/lDmg27RnWGj
TLSH
T134B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 15590d9ba06ee6f70aed9433514a147bc8160516d938b397205b62857ba14e3d
MD5 885a2e4ac859f6979db7cfd645c6e8df
SHA1 e5e23da7e585679506ac8e26680241dc813c2940
SHA512 230c4478e0be3ebf87b37a7eaab1c2f749c6e6e1b1e77d9d88d630b2e7939361898d0e39675062f830a90dad9a61b604288fad4ec31a0c7e7ea0452a527a88e5
SSDEEP 98304:By5112gYy5azzVvt69nLKnhZAD527BWG:cLIHEWhmVQBWG
TLSH
T1C7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 815be6cee06ed433e66fb033a336eda9503577d14d8fb260d61844b34a90a30a
MD5 8e2424c76751cddca67f7f714a89e2e4
SHA1 56256c7f2c5fc139cdaefb15f7f76a26c0f39598
SHA512 fd786616f421ae02bab97510b666e3d88bb91a88756c8b0dc295de004fbbe675bd24312f6b85ebd0c7424993c575277928d22ec7fa745ec3ad744d1fbcfcabd7
SSDEEP 49152:jB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glLDmg27RnWGj:Vu6Jmdxd2dLD527BWG
TLSH
T1CBD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ca655dd0786f995257cd43578b89d37b560379943e40a227b1f1abbcd2a41312
MD5 cefb23b02468946a92167f26c54f46fc
SHA1 0c03f6b91369448c10cff7f5921d127033b40dbf
SHA512 7d9390004d806429865119ccffe9d2cd660a693f51641554668eebfa682367f10f23012a60bee1b89a06f271683fad777c91ce61707c6901a992de9d9a298e9d
SSDEEP 49152:i1hpsNoJpF1A63U44CwH7R4xvDmg27RnWGj:imifPWR+D527BWG
TLSH
T194B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f26b44e7791ce1017b9692955a02810da2d496142e231ddbdc18c8e6fc61aba8
MD5 63237d2bc6e3469e87872a7148097ae6
SHA1 9713de474dfc0e992add4e5bfda436937f95946b
SHA512 71b5976224b9b5bf2340e3775b0971c483fc1c415977bf3cf678a4e747cd3f80a7da521b7b359cc582c748e39ac4d9a4bb2c0388b7c68c41f0076ba1c2707cde
SSDEEP 49152:XSuZQIY0Be2KcRVtOnks6NMHqsDmg27RnWGj:N5dKii61sD527BWG
TLSH
T1F2C5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d5dcd9de62fcb0b91d3eec66f8b6451a37089dcfa1308f9a08a88d7af08b14d6
MD5 d62b7776ce32142a94002e4d661d0007
SHA1 5cfb4c1e3a657114f69b80b3c4381d45f1bc2789
SHA512 ddcb5a5c7399f3fd23f235bb0cee89116a7a0339ab6065b3581dc5246e9417c2badb6141fdafbfb56c614d907074d015db55576f91f8b9bf0e4646b1a46d4951
SSDEEP 49152:chtSn8EApI0fig3giDn0AP5w7Dmg27RnWGj:dX2imphCD527BWG
TLSH
T11995BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 fea593208f9dd9d88e66d8130ed15d0e0df566b5f89ab29e9329949ae9ea4664
MD5 dc835062f671d9fa3aecfd288bbb6849
SHA1 a9b5eccb80a6b1a40307b50993c8c64f419e19fe
SHA512 c391c1395b716827e7f83f258472210c7345ceb07748c4ef3776a7f72d3e83b30b73deff4afcd687b2137f5a899f8b769b2c8c6e210a66505f4cfe79d1305e66
SSDEEP 12288:DMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1224523BE915C01CBE92244B5C3E5F11DAC073E57E92004837BA778B9FBF24A84B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4e0ef8ffd38f8387ab89342715af285c4deea304c7c7fcc7cc6c796d57a60600
MD5 b1ecf74a0731fbfde97704332c4cda04
SHA1 26846806997d1ef3cff2919b15286b807b3adb29
SHA512 16b1bfe94a4ab36347e19c1568a426d1c896e2b98f13d9c29d5ae752eda0caddd9de478d812b2d51dc5ba8e1595a8946eceeaa789602e0c8138583fb92223a6b
SSDEEP 12288:I9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:I9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A4523BE915C01CBE92244B5C3E5F15DAC173E67E92004837AA778B9FBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ab1aa3b9c365aa28aad0bcdb6d057af79df93d5b6b44b78a2d405c1b9dd9413b
MD5 2f7e5423e90f31da1e954d69ec3ee924
SHA1 a42010b7207c6d28fc3cb258c6c1c4d13624fb35
SHA512 c00a7178425075477d3a0e10201376de0647a4ba153ab58c385646c3aa993793b5d018e839bdcdb604597f0614720bb39f9f2854408d3e705445892314dae666
SSDEEP 12288:KjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1434523BE915C01CBE92604B5C3E5F15DAC173E57E9200483BA9778BDFBF24A84B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 cca25810d327dae513b5845da94e74e45949e5d827270c68dc4aef5aeae36661
MD5 d6ec7af53bdde53725fe024c9f679a2c
SHA1 2efe4a640e05dad45a6ada50b0e2186c4e132627
SHA512 17dd0dc0569debdd5a1f4c85d094a430296edbebaf2434b5c80300980b21a3477b109623b04b3ca73d787c4c184204fa13c9ad25cfc2a866268014bfc2a88849
SSDEEP 12288:VVqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:asqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E645236E535C01C6D83285B5C3E5E11DE8237D96EB3005DB6B532CBE9FB26944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0631fabe63293ee0402a5b81e0c77cac3fdc01cdf4ad378366d8d46b3715b4e1
MD5 aa1d9df961fd65257f9d690cff1080db
SHA1 e3543e63b15dbcd5c3ff97713980bddad0ed532b
SHA512 98ea94ef67561d9136bafd25fffeeb53e5f6e8268af77e914ad392ec8521c2c11686d3d637c92c3a61e11a468b82af21305e57284bedbec09143b9081fb75678
SSDEEP 12288:dCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F4523BE915C01CBE92604B5C3E5F15DAC173E57E9200483BA9B78BDFBF24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c2eaeee20b8cc1ffdc048ede493832952f64312b99e361b234853d03eff871bb
MD5 9878182e89dcd095fb3e966a71f4cb3e
SHA1 0bd1e99023e769c1a18d3a485ac5db2aea00aee4
SHA512 5578b8029b6d5e1792087b5067164c7fddc0ff1a094e7c9c25d6a83ad3b2244d9243c8435344e12692548973318b24db9798595faf24bdeff93827ae44e66358
SSDEEP 12288:+JXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+JsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1114523BE915C01CBE92644B5C3E5F15DAC073E67E92004837A97B8BAF7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 9e667bcfc0eca25ecda52df8cf7936dc6677eb14d4ec146e2a82255efde10297
MD5 6f3bc48c201daaa9bf3dfad453574891
SHA1 689b1605e691d54d1405999d26241d02b741e796
SHA512 6d41f46583a20446e6d6064ae4ebbb5f252b76b2de3fb2066fd50bf181d6765847d14dc4a75d55bc86155f8a65b677286b2b181504941c09b3280c714a35a094
SSDEEP 12288:t1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:t1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1224523BE915C01CBE92644B5C3E5F15DAC073E67E9200483BA67B8B9F7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 16d8999c984523edec1fc3445fae0cd5afb72ebf52075c4875cb3b7e8249b668
MD5 563bc328b4b4ba995935433ce48d8701
SHA1 9134005aa21bd547042589689b981e3ee6e6cfd7
SHA512 c2d12ccfafa70880688732aacf15c4e3016ab5eb85e837c1a41bde781e004e21e72c444ab1d745f4ca92e357a3537b995938f85ea1b9d72314a44d1e4caf7553
SSDEEP 24576:BZMRzFVSOdsqjnhMgeiCl7G0nehbGZpbD:BZMRzf9Dmg27RnWGj
TLSH
T1836501A9B35018F8EC63813EC965D90AD5B37C5A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 9b6ded43a620702876df9d429b71a7ee6dc90498086dca5631da313badc4e57d
MD5 8a7b0a9e19f9a5421d424eaa3d7e5ad4
SHA1 d9c9c246d4c4ee8c6aff6f20093ef9a61fbce6aa
SHA512 53b0a0e23d5c0d3b0a89f98e9cdd8986bd8e80b6fde93a98d80333f8ade6952a1bc1342ac063785c44dea39e71ae8567667193cdf3fc16a0772ec8afa629f134
SSDEEP 12288:9gXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9gsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1164523BE915C01CAE92604B5C3E5F15DAC173E5BF9200483BA5B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 380f4e172ce0c372d971af490b47eb4eb30236810925dbd2eecd5fb391996d03
MD5 8aa1307079717f9537a22e21c1184c77
SHA1 2fd164e842b13d06dc213f93366dda80061f83a5
SHA512 ec85b9750e191a3a8db99e564b95205dc92157a4b140df50c332a8a7e69eb99f07c29dadf65a2590116e99415c08e53120fbcb2d149443fdc820ecb2fb05407b
SSDEEP 12288:iUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16A4523BE915C01CBE92604B5C3E5F15DAC173E5BE9200483BA5BB8B9F7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 5dd8e8b32b99751ba9e227efa11d415c91f87a064e864e2cbe05825c43c10df1
MD5 68711ba5c42babca9873a53dd0097fe1
SHA1 24364275643db1aaa9b6ae8266628c3a5c8243b2
SHA512 018fe83536d040249ceac598e6d1f9925d15960fcac29277c23bc4aad4cc00048a996cf88222a72dd9696be4d527a1f611fb2d121981278e27013c64d8f3268c
SSDEEP 12288:OyPz5L8xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TzyxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18855025B73A530F9D1378178C5A29A06F7327C3247204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f652f91ec41105b815ca35b1fbcb9c0aeea6154ac584f7c4df6c46bf12f8818e
MD5 13a496f17c64676a7c7b0367998e79a8
SHA1 3c7aab582d796dbd01b6bca74634aa8bee6c66c3
SHA512 6269adbd20530f2fcd2af3f018cdd1f043ec7f673d80bbfab5c3a7c696c7743516cfd622fcc1d49dcad7a8451364d0605123fb968cd5a672a0947bf3a77e7c38
SSDEEP 12288:ngXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ngsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1494523BE915C01CBE92604B5C3E5F15DAC173E57E9200483BA9B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 91d401f9dbe63f2508d9f7ebaebf583b0641fb511c390636ec35bd8eec36e589
MD5 910554bb87052d40b7a51c226100653f
SHA1 3b6694bee0c42c4cce4b60128738c8ecce2b3bb8
SHA512 cabcde5cdb8f6a1db03ed221ac2b9a1a309f6d816253f107a33b1b0570b2bb912d83ce7902e0652aeca0cedd26196de8628a57c8917c257baa399413ed93456d
SSDEEP 12288:9gXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9gsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D04523BE915C01CBE92604B5C3E5F15DAC173E57E9200483BA9778BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 088c47bfc27d7f3c81597f73eb33c8c26e9d7382a8a416889c1f0d1e44ca8f02
MD5 127ee711679e08695498ed923d52fe6c
SHA1 3f38cc7210eb46c448ca9ef1ebffb49eed33830e
SHA512 828e50187ac88bfdaedaeb3fd5cd3b1ebdb6c04789f3aa841afd84a61d043eaa67397862d2a3747cd65d54da29e16b1a4bf553767d6c661ef1a1693a32c811d4
SSDEEP 12288:QyPz5L8xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hzyxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A555025B73A530F9D1378178C5A29A06F7327C3247204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 43a0c2de5a1cbaf23bb80470b2381c4fad839d5eba555e478d8fcb7142365b1f
MD5 a344941cb3a52bfdef6ad807b027efac
SHA1 ebeed9f34cbdb7b8422d695e2275ff5f49c3aebe
SHA512 b5df5ab5e84d2fed7b443aaf4ed98a2159938bf679f12224b4930fbc0095cc73f05c41a12b0f11a0cd75fc52ce9a765b433cdf2f7b60a0935fbd9bc1516f7cf3
SSDEEP 24576:ITDaLl3z0zDzsqjnhMgeiCl7G0nehbGZpbD:ITuLljqDmg27RnWGj
TLSH
T1AF6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 16204d13f68a4d0d258106426fe5a4cae7be42c0d82045660c910e86b2ac19e0
MD5 bea9a404cf251d2267d4f5e2f7e9730f
SHA1 a53ba9a1523934b1b999bd96a370f902a95b56da
SHA512 8f58b4750d045489befff15f015ab71f5b63b9fdc33d8a8d20ae25be5edb665c762a6e32298f327575f81fa173651188fe5106bb4347a25a658baedc8b513e9b
SSDEEP 24576:93vd9CHKy7GZvsqjnhMgeiCl7G0nehbGZpbD:dvd9CHKya9Dmg27RnWGj
TLSH
T1B075CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 8e99d930f769696716709fab940eb095523e2cce84772b971b0b2a3971bc5174
MD5 0510f934c299fe3bfe4c15a16c2248de
SHA1 cce3e708011649c2696adaef7a885157ecba8eed
SHA512 7e2b33ef278a2c5df5d7e2549fdd34983ecfc80905ca5038d52d6e1570c3c3960694ff5f7afdc3b914dd6c4a3f34c9d45769fdbc0c8341a904148deb1160e92e
SSDEEP 12288:IDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1124523BE915C01CBE92604B5C3E5F15DAC173E67E9200483BA9778BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9c5bc04d87ef2337d083781c8fd2b087f630f85987dc6d6abd5424b14fe0c370
MD5 c6d06a04187e1915e737ccc4d8f652cb
SHA1 80be938c8731b96cbff66d4b9d8f23e753e7552c
SHA512 bb42cb0382e4b35ec1e497b163be509a90d0871301264ba7e27b16a0d1f6a1781108799923d45a678a5bdb0da8af183c9a08fe19f1007be906eb6d849348cab0
SSDEEP 12288:VRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F04523BE925C01CBE92644F5C3E5E11DAC173E57E92008837B9778B9EBF24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a88d01f371a3c37e6cf974f36aaec894320b052112c0de798b18deb91dc55b10
MD5 2173bc10975aaae17e3f297986b3a765
SHA1 f2c81d08863dc6d735fe54b5dd5ab5bd94cc5603
SHA512 f6279301298c91d0f82dc2ead93b8176fe91efb022c37286f96692789d0895429d1ce4afd9e5ddab05c2d9ece0e22ba856ba7feddd5bbc90154fcf4640b92e8b
SSDEEP 12288:8eXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8esqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C14523BE915C01CAE92604B5C3E5F15DAC173E57E9200483BA9778BDFBF28684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 2faaf1d805ea35830a14322e17f78fd251e5e2a86f7db72c3fbdf0b8f37a3c1f
MD5 004decad791da616fbf3a31f89de73a9
SHA1 04e95f6c820025d545ada6fd41595633ba7f136f
SHA512 c9d72ad737a2b261337523392c705b5c95cb95a99a10b1a180ba607915cb511c3acc75a4b5ac10d36fae6dc88da4650cb86e2949c1ffdcea9b83d5e7f0180d93
SSDEEP 12288:fgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B64523BE915C01CAE92604B5C3E5F15DAC173E57F9200483BA9B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 921afc0e2325234058566e66ab5be7f4310531e677279811a7c416b34d3f413d
MD5 42bf77c930e2ba9bac63d6b1b16744c8
SHA1 15ac73d697cf56ea76ef1db2d398c17be3513df5
SHA512 e04d8c7f51f9031ce02e1569d3281210d477da258dbb2923b7e6954bd00e55b728c57d884b38a492807b54ea66fb98b6ae6b0382edfaa9b18b4019c124f8b41c
SSDEEP 12288:0DXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0DsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1344523BE915C01CBE92604B5C3E5F15DAC173E57E9200483BA9B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 03acb5508104597273e18f70f4c07e1b3cf9734771949e3ef51953f5a8617f3c
MD5 a5e7625d2dea60592454e2147acecdf8
SHA1 d7d4e8743db4c4124fbfbaf2805124409e3a6407
SHA512 0440807dcf7c8711cc6ce9df039937b54c291cbcab6c6f85008cf5e1adfc204f3ba1e2029ad9a6648b4eb5af59b0d2f1f827ef30d05a4fcf7aa09d442fbcfe72
SSDEEP 12288:JYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1584523BE955C01CAE92644F5C3E5E11DAC073E57E9200483BB9778BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a444df513da5eaa7efe1f2bd95a36a060cff422ef9a4cc24c016fa9309860bb2
MD5 9c07833a79cb3bd2b8a0b63b07aa1d49
SHA1 87faf7bdad1bc66b03fa87c71d52d0f3b8463a83
SHA512 df212ce80ec6495597b10af5d04585a45e7c8448a7bed85a31798c7a0915b36c9242b99cd94f856d2db2af2bf3f7512c77d730345537c25da269cd1125b86560
SSDEEP 12288:pCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F74523BE915C01CBE92604B5C3E5F15DAC173E57E9200483BA9B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 463ac400a945ec95295aa8fd39f2038a0d3073b42c3ed6654d56636faef28be8
MD5 249dff918c26b145c3377ecc47ee8055
SHA1 fca357b34497f3181f7cd21614891f21df9ba3c6
SHA512 962591ad1c4446983e2048e7cc9e13bcbbc16adbcf153fe4eb8ece3643809a3a193c4ab51be797b4883e32b07912e04291382c78089916ebd9b965c9a1739ce9
SSDEEP 24576:9fwvUk9RX6wkyAIEsqjnhMgeiCl7G0nehbGZpbD:vMnYIgDmg27RnWGj
TLSH
T1DC85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 fad4d47b547d57625ebe212fe3404ddc3068cec956b7d7d2443085b519934305
MD5 28af925c55f1aa944c2bad0b0f693646
SHA1 f17dc57a8cac03952698480801282bcd2d78f729
SHA512 a0485580384ab4dce2291553a1ff1757fe75a4fc6efb89cf18aca3f2cf93899cea05dfc39abd81d57924bce5480d3f3688ea4feb72f5c03d12b8a36710f1ac32
SSDEEP 49152:tYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0bDmg27RnWGj:gySzPTD527BWG
TLSH
T18E066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 577a8f176854d115b67e0f9517ce7b91a5aaf2c4d8cc0b8fc0a57e74a2e0bbcd
MD5 35fcb8f8823cc71171350f56950f83e3
SHA1 d575769843600bdbe0a681e25901eb36d7f66a60
SHA512 b6aeb12200757a8cc6bb5f191418f573bf0707953593e8b6a0bc07bf4cfd2f87d2a2d6576049d342e24480874615f406e21c76601efa0c66d41f21ffe8f9ba29
SSDEEP 24576:647Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYNsqjnhMgeiCl7G0nehbGZpbD:647JUQjTirIhCnDHUPfF/LDmg27RnWGj
TLSH
T16165AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 01e463993d78f6ce4ccca68726ee1c3affdcfe558bcfcd85d39db634a30135fd
MD5 31e1984d0318d5a51b247b0099539982
SHA1 194da036508675ae2fa8cf29c8e3914e638895c6
SHA512 a17edbc7f2ee51efea6cbb284ccc52d067242d0820dcd22577282f6f2c5016ef38158361eb91b4fd0b87b2f8cae18f59e5a021f4d33d15662461d7f18fcbe0f1
SSDEEP 12288:7bsfwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17A55011AD29802D8C06E5179C3969605F7333C2697E093CB67D1F87E1F766908EFAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 fff5885b935837f0e00a6c252529ff6fa174dae11cbff0401b96601adf69840d
MD5 e231e83812e70a1a037bd118f4fd612d
SHA1 115726135a8406f9d29824a2e24f58f890753609
SHA512 415de50eebfca405b7aa24b1d4a65ffe04d4d9f1be993a86896b6143e3401fa6fd08c88fec97464c2a1fddc93b7bc94921b2a889a9584bd3cd4cf6c480f57fd9
SSDEEP 12288:7cwv4BqNW8weKljiUjR/ligzZZaRMRUFD122V:7R4+W8lUjlligFZaRMROD1/
TLSH
T1D25518107666CB4FC6A940325E33D1CCAB707D41EE446F0773C98B3F9576A59BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 85e03dc2e679093c59c8d7dee3621f51d34538c3022239674526310328df6dc8
MD5 56b62d435ea477e91fc04249d3fac851
SHA1 a720d78b09eb1bfd47f8c4e438094339c2bd9ff1
SHA512 78de162cd162e5c3881ed13816d4d05494cc6ed9de03ec1736619d49e77c38b911e4c5b0795140bf34d56b1e461ac017b3d3fd7f47fe8a3caf2e9423bd00cff1
SSDEEP 3:OlH/lNTq7QP0GMjWgngp3li3mCllltq3mCllltGlslslslslslsl6OeF2fX:K3AqnlUmCtSmCtEEEEEEE/ag
TLSH
T1EE8192988B820B38D1273A72412647850734C08AA5996BFF82083023CC086985E02ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 28073487184e5e00bac243630d4ee3fe2663625c092d5a1d5a30b86b25ce9353
MD5 e9bf4e717e2ff68dd9c9b792cf01bb7b
SHA1 cbf6042e69669c0fa7065a40b1a441483840793f
SHA512 877272a3553fd82b87ada901b793f3b5b1dcf97cdb0a2ab915d572d00cd294cd89972e5e64422fbd84319536b5f0bfb1a2cbebd95becb5d91a8c9d12be2aa575
SSDEEP 12288:uOmI8eN0eUH713P84Iq8uEwrilTuovIe25jDf1Js5agjFgV/7E:jHUHZbED05c5agjaVzE
TLSH
T1E67509416537A7CFD1FA603203365B8DBB64EC02B7496F267389053AD86AB45B0F97C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setting.ini

Path C:\Users\Admin\AppData\Local\Temp\setting.ini
Size 638B
SHA256 0c1f03b3a7d2790796ac63380f72a47276866c988dd24dca9bad044b1ba38707
MD5 11146409813d8c3e8b77604a6996ec59
SHA1 cec26456fbcd6d4423632f6fdf35fa932e07ba17
SHA512 3951681956286acabbfda5859ac14491364b7c37aa30ac2cdc6053bdd635c916e4fb9fc2d45a40665f753dd967e830e86d2d9c54264c7f74d61cbd41fee9a6d3
TLSH
T1ABF022334D488A1D112273B41DF2886561EAE481A870489CBFAAB8836F9895717B67DF
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 67e782e6c9df2aa6d513d04223c608153b1f0669900c6dfb107fa3132f9fc7ac
MD5 fc0dc06d22a2afc925c2cc567e47d033
SHA1 fc302ac4d881f020174ca234c4c12674bdf37a42
SHA512 7739a6b84fe16c29fd0d0fec91d00ccd1c56c25a60e9c45f2022cbb9b92a6d3f85ea5ee4c2c42f5870aadd7901bdc7aac7d721b76a21d0d09e34413f00b74a1f
SSDEEP 12288:U07oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:posqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C245237AC34C118AF93605B482EAE12D681B7E669F1004C3BA5778FDF6B18D48F39517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 62273306c02bfa6b7978535df62c6568ae5d2ea9022d8a558af7c46ccd82f171
MD5 aa7dee0576f6d1fc5da88e6491927d74
SHA1 095f3a3a8f42ef229ca567a39f967d94b38fa622
SHA512 fb7b093f69e4f70a94c9793e60fb5ed46dae9985c7c6626902dd034b42bbf871a2ed1545fcde6263f2aeb3d18f09ee635fb422d94a092c8b4ea73b6f456adeb9
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bYmsqjnhMgeiCl7G0nehbGZpbD:ngb4mBIBhGFxDmg27RnWGj
TLSH
T119659E1E22EC02E5E0FAD2B8CDAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 72ace61d8125b8175d4dcc0b955c608900213c344ff353016655b73f87c1f8ae
MD5 a5bd3d8cc33cb7e59a1484a417a9dfae
SHA1 fc6022a5578fc56c533ef7824bd56c7a1852a155
SHA512 b282e65258e0b95eb6dbf9471a64274b99ceeaf067bd1f98dff010130576e2bae6d1ea016c9a517344684cd2ea268d21e2467114e94ff2194b247da8b06d160d
SSDEEP 24576:VG88u8FpJqH1bzria7/mdsqjnhMgeiCl7G0nehbGZpbD:Y7ZFPqVea7/SDmg27RnWGj
TLSH
T1CE85F16577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d5533f5c06cba4f208edbcbd11ee83f2b29c5b090eec4ab2268745fdce264d26
MD5 edf31972e2e0fcbeb6366ba85bcd654c
SHA1 db3864d85b0e8bcf129eb49f333d7aab8e5c82b6
SHA512 6ad8bbba1c93b0bb8b97c699a2c1f5ae1dfb157f6bdf0ac40862a28291f7b50b600074db357c194e1b004b9dcb91f4ec2d502a3e1fb4b40ab0ddd3695c1f695a
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjNDmg27RnWGj:SG05lO43boD527BWG
TLSH
T1AAD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bfe7800cf39cf3011c1acb843f579b85e6620cbb03a0200e6ab05b082d92a4b0
MD5 e9b7cd43d5ba36e5c74962596bcb7fe3
SHA1 ff8e22092246ca149f7dbb376e2a265afc74aba5
SHA512 a8b84f018916e890334d7fd16ebc5071122a0351c97d18ff65a1d6ab1930bffb96dd8e69191f4e796745c53725c1dac736eb4da448febf09784bdb4391ff23d1
SSDEEP 24576:5fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnHsqjnhMgeiCl7G0nehbGZpbD:pa5POZ3BJt2pasx2+mlDmg27RnWGj
TLSH
T1D965BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ed7d2249e801f18127360e4c9ed7368a613cbd17ba896b1c3ecfec0c099a8aba
MD5 f2fd957601f5a5333af19123b0cfadd5
SHA1 8c7866d62cc772532c6e7edc6666ab405aae2a72
SHA512 31fef36530fe7a708604d12b554cdde42597faccdf8444d0031497d99e6ed4bd3908016bb3186384d5b6bcc5bd80043b65e8fdc6242dc7dc0cf921cf02bccdea
SSDEEP 24576:kNcwHdjbyQ4nLC18lb/EOjowL7FkFsqjnhMgeiCl7G0nehbGZpbD:kNc/zEOVHFyDmg27RnWGj
TLSH
T17B857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b08d0a4e90de12b7e87a7050f8e23913e9434e92882355828bafb2a77622dae5
MD5 b66b1a84f8f35c9e35ab3c236c8a883d
SHA1 8a96d9a1c0db2f7df2cc56adca6add139854515a
SHA512 ab64f16818ba1d7550327645452942093e5587b438653923ddb8b8a28d13efca6294238d2a78e50ffc6c74deb197c5c26b9a0911a8cf4515db3873097721fa06
SSDEEP 24576:BTkNvNnaFeYhJNtmZBmLsqjnhMgeiCl7G0nehbGZpbD:BTMwBtOm/Dmg27RnWGj
TLSH
T1A055AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 6751191d53caa5f31fd80ec050f7e3c4b1cd38d65b358563c780d31fa37b7c50
MD5 e012c4dce7785fdffb4436dd0ea47752
SHA1 5811e5d28dc8e3565e0167f05eb7642f6cc7232b
SHA512 5edaacc36f718922a3140c7ad49350ecc3a5e38ac7304c7093ec6eafd24972ef6b4de196a7f362ab456207f3b07fa224da2357cec91f33e95647f99a3dfd8fcd
SSDEEP 12288:3HvUrBFrEjwaQ5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:3PUr+NQ5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10965F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 41f7bddc973f8e2fc8f6235dc2d1b4dd9d573de7c99e6ebe3c9a71377f92d5a4
MD5 18593c45f190345b64311dc12b6ac843
SHA1 0e9c290bc979b30ef58b884efa1fa524f0b4bf89
SHA512 2f8fdc9f5c6c5a1675b9a6462062ce18c589594fdd9cb6f9de1fff025bdd134f491931c0aab88daf60f233ddce28077010dc8a6da4375879029e78fd8ebc83ca
SSDEEP 24576:4D3FHshBIYQgAssqjnhMgeiCl7G0nehbGZpbD:4DVHeBIAAYDmg27RnWGj
TLSH
T13875E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/792-134-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/792-128-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/792-127-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/792-363-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/928-96-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/928-95-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/928-89-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/928-202-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1176-348-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1176-115-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1176-116-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1176-122-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1300-186-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1300-188-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1300-193-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1300-180-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1300-179-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1784-138-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1784-364-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2560-147-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2560-365-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2560-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2560-148-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2560-141-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2560-381-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3300-174-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3300-167-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3300-369-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3300-169-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3600-203-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3600-196-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3600-204-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3600-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4724-178-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4724-77-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4724-85-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4724-76-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5768-113-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5768-101-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5768-100-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5768-107-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5768-111-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5784-7-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/5784-153-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/5784-0-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/5784-1-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/5784-8-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/6076-366-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/6076-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6076-160-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6076-161-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/6076-154-0x0000000000840000-0x00000000008A0000-memory.dmp

Download