8b676bc308ab1052f7ddd7ddf32aba3db5b2eafdae15f7a25117a193478490e5

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Size 1.7MB
Sample261024-e9588afx8y
SHA256 8b676bc308ab1052f7ddd7ddf32aba3db5b2eafdae15f7a25117a193478490e5
MD5 91fb0ee97b771f6a894a879be8de65c1
SHA1 e9f87c1e77c7015dcda2a7d8b425a68c7068fc2a
SHA512 e78287377cfb69e18a8fa056e378dc3d3a417c88ee2fdbbc63e008b30ba98f902129f591f8cfe6adc8c5c3dccc53601fbf749d3a6a9ad6e2f9b0c2528f9f9505
SSDEEP 24576:NMA7qy/ccqNgPgGnQ/tbw/2Mkjy6Fr7g0oh:NMALpqNotQ/lFTjN4
TLSH
T1A185CF59AB5840E1E1B6C23888539942E7727C115B71EBDF1398E23A2F377D19E3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 11 IoCs

pid	Process
1356	elevation_service.exe
5560	elevation_service.exe
2416	maintenanceservice.exe
5016	OSE.EXE
632	PerceptionSimulationService.exe
3168	perfhost.exe
2364	ReFsDedupSvc.exe
3304	SensorDataService.exe
364	ssh-agent.exe
4964	AgentService.exe
1116	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f437065f3a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b9c54af7163dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000015ce4ef17163dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a59945ae7163dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096444cb17163dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000776684af7163dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe\""	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1356	elevation_service.exe
1356	elevation_service.exe
1356	elevation_service.exe
1356	elevation_service.exe
1356	elevation_service.exe
1356	elevation_service.exe
1356	elevation_service.exe
5560	elevation_service.exe
5560	elevation_service.exe
5560	elevation_service.exe
5560	elevation_service.exe
5560	elevation_service.exe
5560	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5068	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Token: SeTakeOwnershipPrivilege	1356	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4964	AgentService.exe
Token: SeBackupPrivilege	2364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2364	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2364	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2364	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2364	ReFsDedupSvc.exe
Token: 33	1116	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1116	SearchIndexer.exe
Token: SeBackupPrivilege	2364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2364	ReFsDedupSvc.exe
Token: SeTakeOwnershipPrivilege	1116	SearchIndexer.exe
Token: SeDebugPrivilege	1356	elevation_service.exe
Token: SeDebugPrivilege	5560	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 4688	1116	SearchIndexer.exe	101
PID 1116 wrote to memory of 2108	1116	SearchIndexer.exe	102
PID 1116 wrote to memory of 5416	1116	SearchIndexer.exe	103
PID 1116 wrote to memory of 4488	1116	SearchIndexer.exe	104
PID 1116 wrote to memory of 4428	1116	SearchIndexer.exe	106
PID 1116 wrote to memory of 1848	1116	SearchIndexer.exe	107
PID 1116 wrote to memory of 3828	1116	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5068

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5560

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2416

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5016

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:632

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3168

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2364

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3304

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:364

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4964

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4688
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2832 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5416
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2892 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4488
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2892 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1848
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2832 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c433b142104e7b2b3055ed1b17b087e2792bf2ab9da77b0e835c0d322d68fd5d
MD5 17d3a9ea6d469253a6087d2ec308d8b2
SHA1 99c8bfeb8d3a3425582887f6e06aac74c7eb00fc
SHA512 5bcbf0721d20c92760d8c624ec992184aa62108bf589b96375979ede10f743ade011e88d87f661a84d93e6b94ec49fdafa81e899be2f1d5da25c0f6ba52e425e
SSDEEP 49152:eb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnmQ/lFTjN4:g3q6HjBGLm
TLSH
T137D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 d6dabcc9fc187e023685df666ae2d0a718cd8b47b0c01e04b9f3375a5e73fe93
MD5 59094c0f8d87149dd1f6665d62e5495b
SHA1 4007647afde9d41f49888920a7a07941a4675aa1
SHA512 9eab943aca85a7c690a7e48b67966dd08ca449a4a056e7d0e34d55ed7437c4edd1a675a6e2af6993cccf5e09ae37c0299486d2208818ae21f3e6fbad98856ecf
SSDEEP 12288:21XLsswWkxy2lRq2czA1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:0XYfDtczAVnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1B065F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 6c9c892d28b0f0111e96f2bb7662bdf26cb8a33ef17dd1ec6a57e198f570beb6
MD5 5fc4499e1916bdfa622f0615ac046b4f
SHA1 2343ac910722deae62be7a06ba4d4099370cec2c
SHA512 6823991eae2f3b77722e58b9a7ebeffa3b7f9f2a91fefcd94e313402fa7511d95e248c6f1900ac74b4bf9f43f002d4a9fa1e9031c055dea0eb8ef9b6ecb260c3
SSDEEP 24576:a0Le5ji0hmxLrMunQ/tbw/2Mkjy6Fr7g0og:aPji0AlvQ/lFTjN4
TLSH
T172859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 622c75fac328a13212696f4380b90582d0a72568877c433c44443c670361669d
MD5 6d3216cec19fa05a32332a51e7f02a26
SHA1 8e327b2c0421fd390b229be27842d0d155973338
SHA512 762332f198eb88b8b64d0b0e54dd047d00db24a4c1f6bd331d7fc5679ddaea27d848fcf3ae5ff36a1d9cbd2ff03f233e1a7a5c29fc5e583f7d382f06f5024ecb
SSDEEP 24576:Ha7/ezSC6vUyD/aqgrvWE6q8wyusnQ/tbw/2Mkjy6Fr7g0o4:K/ezSC6vUzPvxHjyDQ/lFTjN4
TLSH
T17B755D15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5a0acc15836ee30938c0c9070a7e20ab0807d0c8ace5e4ca470eb9d16080a467
MD5 6b54e064d952d971d22a5604885cd861
SHA1 53f705db4a17161cd88abc5d28f12d77113e4a6b
SHA512 b84db0734a8b4b8a2f7acf71e623a9207aaaadc0b34c3b8c786a2a318dd3ed42809395ba91e33f32d299eae9b3c8d7c96af7ccf514f39c78aa17343d0362b911
SSDEEP 24576:9VbqPb88hv/l+6xnQ/tbw/2Mkjy6Fr7g0ok:9VO88hXl+SQ/lFTjN4
TLSH
T1FD559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 d70a67587138bd8b17d496086b9b41c6ccc21362f95e3134c31740de92e69d26
MD5 aeff248e4014417816c25a89f18b4837
SHA1 c0a5f85679af80ab83a09ac4211b3360a347a7a6
SHA512 fc3690755e852ab37ee581761d92efa262c64eee3069141d3adf1b47198ad8d265ff8cda41f1339c4fb329dd8b92416aeeb54a7a593faa8727fa1903802d201d
SSDEEP 12288:/zqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:/zqnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T13F5523696A24F897FF2B06B15CC285826B7B0EC1BFD4E74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 0d37c2fadc96135bad58ce08b473111a1488585c5193343ffeb656f9267e51c7
MD5 7bbed80e95b1aaad6b8062248e378626
SHA1 e16a4f82ac634870f40506e048be58370dadbc6e
SHA512 8c668c91b74993efa17f009539aed38bbf9252346641b3d5d9ad570abe8585c9571e702734a2ad7d33c51c8e79cd986cdb71db458949e806933ae8b0535ee2de
SSDEEP 12288:aeBNUbTVO86UJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:aJIUZnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T10A75CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4d4205cb5f8fe2c71a20ce853ea9a99a04403de6b98215cc1c6ff7b0636fe355
MD5 6a92c0b442eafba7249ff1c841cd4470
SHA1 6cc438f80c2d930f7ecd8dcbdf45c7089eba3022
SHA512 fcc3c7010ea9f2d50cf2a11d59ca2521b08a13a07e2547592c27d4e7eada0d9b44308dea127dea9b467c731130133864c24ae03986936ece1f96a49d1744a39c
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THR:8QvGAdlCEL8c/yRNw5CfLm
TLSH
T132267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 dbb7f95a20d7031052f9faddeecbbd604e6fb34442958568ced8b9d9617978cf
MD5 47489977f06b4a6fbf8ff7c3c121e710
SHA1 c18e9cadb624e91870af81d84cf76aeb1c83b14e
SHA512 7a3c5dad21be291395e12d7f8d0509287ab5203ed94ab57ef0a07caef19b5421080fa4ceaa4ae6566e65f7df9c6ced433044fde50df8667bba55ce1b55c6012f
SSDEEP 12288:YAwSfxL/2Dc39DLLmt0LDQewsAjfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgv:9QewsAj/nQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1E175E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 cc96233eedff203a5c86e6e56d811facb082129f8a0193cf2d8b41e41cd9b112
MD5 7e9074122f75fdc56d1c600150ef00ef
SHA1 a9b5cf244415f95d540649d972d120297fc35243
SHA512 152974e51b84be770a1882e3a87300f66098d159e4bb2bf83c054d56ab48bccbc316fbdf803415fb5d46db80b9e5f9ce060a55f2053c3491af3c447e01ac98f3
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHcL:ZUEtQevvqc2W1cpV2EI32
TLSH
T17D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a48ed0ddfd597ea8d4bb62753c4108dc537c3d68db1a91fc0fb73dbd86ee283f
MD5 003cb147b1cc0a3efe31e16f7654ef93
SHA1 d685aa1a8b32313927b52e9cd67296643be2c15b
SHA512 a1944be607d972c84014aa7386d05bfb4202d1e69a2da1b72dc574b38573bd918b757e795a528cc1cc48c872d37553db232c601d4d1172e8b6c2b2d90fe3c85b
SSDEEP 49152:xCbRquA/m2yL5zQfFiV+XenmE3/zfQ/lFTjN4:+oqtVjnmzLm
TLSH
T143D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 097d5d6820fd9034575b67df793d2680c083d9a602d275c75f3bf5bff348e3c0
MD5 212a2f4017620003a09719b62ab34124
SHA1 ba5a989296901f8f60270da5f8d6e85eddcca3b0
SHA512 d4f835c82316313186e1bf98f94ef2545d64100f5ede1de544abd8a2b5d67527863d7f12a526ad62caeb72e6753cfc993f33d54b69ab17d41a2bbdbdfd0b3024
SSDEEP 24576:rAhGLJIFoiwtA5l7S53AnQ/tbw/2Mkjy6Fr7g0oy:rAMyFoiq5wQ/lFTjN4
TLSH
T13635AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 2b6064d2fe7c16378a11e37c77555bc5cf715a2abd7f4cebea5d95a69fbe6e92
MD5 1f5cc4677d414d13dd88352d78215412
SHA1 2570d6ab3ff4337e95d0e6756cc78871b1fa858a
SHA512 d745b6fd902d2cb3b2ff19395f0e0d6a386367963d838369244b3423103d4a18175f04b8462ce6b539d800c43fb351bf22be4b37d115b4ed2125c21ebf9849dc
SSDEEP 12288:smw5HEjsChN2BFgl0WDm+CMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM7:JwuHOWjnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1FD65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9bddca3ee5e4b336c7b11bf86bf211b5bee7ef52feebe13593148cdb1c06b2a3
MD5 0a2576904e62fb63c495b4bc60b34a8a
SHA1 db997844899842b59ada6a0b076bad79d07ec322
SHA512 3853b4e038cf593376ce0285f8f480c930e0a4b302cb867e54d0f51baae6d9ab4a719ef4be7458d76b5df7ce210ca5ccf97dd06ca0e6989ba9b9c921c5984ee6
SSDEEP 12288:8XZ1IyvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:cZu2nQ/tbw/2Mkjy6Fr7g0o5
TLSH
T17355126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3d0cd8ced07255d737371c8a1bc95698978c56ef524f722bf3468baa39be004a
MD5 9c4ab3e4d3f4a8c1e576b03ccd238119
SHA1 977436f895d1bed5a80fbf56dd1e0cd741876393
SHA512 91ef556cd4f701cbdc816c2ec294c2107162443a6ab676edc4f55c4c8019accbee8c08cad30974dc34400af2796b570b9f98cab8d7498bb7ff8a01a2ff24ba12
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ul:ZQRQyi36YOcPQLvw2gAf+PN3SLm
TLSH
T15B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6553cd98342bc2d1f26ac58ac25e927fc9b4f4f5f37b29e64504a6816e076d6d
MD5 83a85c198eeb991da6436802d9b96e95
SHA1 3d38aa907131c5e291d2fe668637e3acbe749799
SHA512 0a92c00c49759c4cbe0b41b8fc450facf6ef6e4fda0b079467bcc407a055b1351e96c6f510446a7b9c348795933d86796605c8b46d323cf493bfd0eb16fd7bca
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ul:RQRQyi36YOcPQLvw2gAf+PN3SLm
TLSH
T1A0667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c4d60cde808280bde2ec65dd2065dcc0166c02ef58de7d67f52d02ec4e82679d
MD5 d08a82225ba08840b81423ec136f2ded
SHA1 ef7878bf3f02047113a92fe850ead5bbbf6822c4
SHA512 4a6bf55b14836ec5bb53a41600eb531854fc6faec179bbcb9f7aa841627be7cea389591f0a3614479edbbc90228ed8d9af55154b10e7d4d1a213e186562a9ad8
SSDEEP 24576:8wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0mnQ/tbw/2Mkjy6:C68Qg55nhheWu7PNU3/vQ/lFTjN4
TLSH
T10BB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 298cb2d01e739c0316bdfd7d2845aeb4605d8e1d4fcb61d3c2c5e68aa0bdf558
MD5 eacda4726601288a4fabc5d3f18be9d1
SHA1 68e58558cb0d69653f453e139e53c1c46b6f6093
SHA512 b89eb10f9b174ce7bbba1a1f3b12918280a22c0fa4f51fa99b767b1a3db1d15873bcf3d8596a607ce8695c6ce81c3eab01c1dfb8c78a47a2e7875e662f0bac81
SSDEEP 49152:b3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99n:+y5112gYy5azzVvL69nLKnhZlLm
TLSH
T1C2167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cefa4f0239575fe9fe2c704a0706e3c0078d03cb9aee0f0cd5357ab9a3a9b7e9
MD5 6216ede8b796d2ce8ac4cce1f3e60631
SHA1 3216aefc51161ea9d0ed8b521cb6e016106983db
SHA512 c402f58f13e8b88d8612dd034e74ebf9c5a9f788a43528c756cadeeb43dd279747dabc9c9a0ed5d268daab8577f390d6384d461cf0aaa5d94f6cdaa8a1d58e5a
SSDEEP 49152:UB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glKQ/lFTjN4:Ou6JmVxd2dFLm
TLSH
T180D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 627a42052161fcdc87314c477b080772f20e2fa2437e1d18c4ae874919452f8e
MD5 3d83426e39936b8e7656c613c699b852
SHA1 eeb84a0b22c760c128da85181656f75663698a4a
SHA512 77d1698988fb3b8972ae0296d3fcbfcf5c96bd24bfbf45e079ef0ecc14417c88640e61bf00e45b3b3c95ff433bf6634ac813d724b2cf272fc00076c0aefcd736
SSDEEP 49152:a1hpsNoJpF1A6UU44CwH7R4x5Q/lFTjN4:amifPbRzLm
TLSH
T1F3B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e745b389ae8f108566b1c3b1e5dab6912ceb5aa531a5f86b5b24f9fcbe10f49e
MD5 f8819224d22605fdd097ae4d6742b111
SHA1 9a241fa74d855781f69abd5a5d1aae8326c0fd7b
SHA512 bca89df1dcc491521b8bf1e07d5b1fe56a068a621775cf9a119a35cc00cde31a162afded9e828cb9a05055de9d192ff62dfcde04731f0f8343cfef9d73f535f5
SSDEEP 49152:OSuZQIY0Be2KRRVtOnks6NMHq2Q/lFTjN4:A5dKTi61BLm
TLSH
T122C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1c664a645e1e3b0e3bea358b8bfb382e0d6dcfdc5ce860d0697ac777f73a8904
MD5 d9304dfa48df79d62e3d0cab8aa6eb3d
SHA1 d1e1bc6136b3f3665311545520f5e542aede54e3
SHA512 b96590ed751e28597b6c9c67a7149ed145b08ce13c31d95cb4b8aec974728ff6329c298a72b5c7ccd8309bf7fba985ace8b6359218569a4d5370d6fa085c23eb
SSDEEP 49152:hhtSn8EApI0figngiDn0AP5wVQ/lFTjN4:wX2iyphnLm
TLSH
T18F95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 02096fe3fa78bab4f863965351f5196a660bcf659c2deab26c279ac976e99fab
MD5 b2487b5d1ccc659509128f3b3f06a2d6
SHA1 ba1716c1b68932284ea9c1e8c22616b883bc8cff
SHA512 78905f71d534292a4c940af9fcce1f9f910567b5c8dc6a197ca58dd37874fbc5a4321653cdbcfcd6e071e9236394532363883d6dd1fa88bcd37df5b968a0c9cf
SSDEEP 12288:nSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:nSnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T11B5523697964F98BFB1706F14C828182A77F0EC6BFD1A38F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ec8efb110698746e610e681449607cd591eb0715b87291e25c5b19f3e8f676c4
MD5 f6c74d9a32a2aace8283e3d10d9b3f94
SHA1 cc49646ab54de151a58a78f7a3bb4287d8e1dcc8
SHA512 b12e62858e7a8914951a391926f751f4f1d694cb168e799c28a0fd50bbd821e2e955666a90882ba7a337077c9734c310fe6a97e7fc2f192624c9a8dca03bdc8b
SSDEEP 12288:ZLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:Z7nQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1B85523697965F98BFA1706F14C828182973B0EC6BFD1A38F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6a73da32cc1dfd3540eff73fc6106a591bc37d53d6a901fa35ec381340c3bd0c
MD5 aaed994b57a6bfe0d4dfbf12df80e579
SHA1 9da6cc7e1e72030afd22ec7d1e8af679f976351d
SHA512 2fc8eab4f9b6da48142c48ed5d40dad04120747d03bb0bcda6e316fd36853811f41b3443e9c110015b983caf3cb9b809f30622e5f83919521d9ce9dc08c9496c
SSDEEP 12288:PRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:PhnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1B25523697925F98BFA1706F14C838182977B0EC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 19fca85a2dcde3bf274da790daa6108510e540ff3c15fb9c856fa0ce71c07fc5
MD5 e13ce04041cef7d326830eefa2c7b572
SHA1 6ca0419fd5eb9e39f83a7551e03ef1828065a42c
SHA512 46b765b5ca2cca884ae84695969a958827ac0d68977a44b4c1472ff14fddc5ae0c80374d3ed477e7b925d2a9e609a35063bd4410ff8e6319ebbc84204c517077
SSDEEP 12288:FVAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:gnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T12D5523693B69F4C7F92742B4CC928142E77B3DC5BBA1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 871d095d65a4d2d6e2a5fef0dd7b7109eb7ae3919e429df14608575c39ed9514
MD5 e2d0704840638d42e38559f28c7b8129
SHA1 f1efb57273be11522a6e4f10fcea3cc45608fa35
SHA512 5e6cb7bfca425a6f07edcda08a284c9554d0c8181deeac3fc72575d1cb74a912c9bfc6f8bd53aa73a6572a987f4947282a1659d44206c587ba89fce8911256f7
SSDEEP 12288:jYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:jYnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1155523697925F98BFA1706F14C838182977F0EC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 17b93e0a5107896393a6179acf320ef3bb409d59686a4ea43bac3ca305e11c31
MD5 cdc3c4cc8b6826d3a4d27b2fb51bdbf6
SHA1 7953140eb06d2237b36925eb2d242a86e22db94e
SHA512 bcde1858a5d9ee836c68947b74398ddd4be02242a76491e0cc8eaeb48f2e33968711ad4270621d22f1286a8d7c0fa8f75b8bc57d017b91cfce2d8b60e6cde2c2
SSDEEP 12288:xnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:xHnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1265523697964F98BFB1706F14C828186973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f12aa2ef8e60396ab1b557749dbac6e71d2624ed40f2aeb762c535097ea821da
MD5 e29f541b21db82da75f33a260656b7b8
SHA1 775f2ef920f1be916a1be2b8e84baf122a5a1118
SHA512 b778bfd79e66a5b4833f49b9030e014ab30a593a93751d0b195c9b907102c273e95356035496da25fd48564001422446d64c4cfad44678711aa78dfe46e65120
SSDEEP 12288:zjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:zTnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1B75523697925F98BFB1706F14C828182973F0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 dfac7f2925093d5fc15dceb1d525c6b465308c5f9a6b1ec42221cabb0da86cff
MD5 ee217de34aab91d270684b9bdcbaf145
SHA1 7fec85b2d350c9f5607c0c16f8a97a96a59b2875
SHA512 c7c437fbfb40b67b25bcb14d5e34d06fe646ff6cb421ac5cdced9f04d66df19967477c447afec9f9c1b3ea7599be4554f43cc1f5d739c65810aae8cf852b5821
SSDEEP 12288:iiZwbDzzFEoS2cPvyrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:FZM3zFVSObnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1F17501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ea3a42cc0f5ff13869bfdfcd4c160373009ccbe00a5981902b90da919d09c52e
MD5 6797af807fda1e42a38d2d3bd3427361
SHA1 960157051fcadb800b9fb5c0e1a5b1f57366b8c3
SHA512 b641597180ea54e79969bc4af4fdf1dd3f3d61f6148d86dfe4542fe9eac9734b7ab1b8286997dc2e0bcadda396a2fc46d902f38be2701724bc3921d9d1502383
SSDEEP 12288:amGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:aGnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1B75523697924F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 995df2136ddfb78643e981cbcc2c01abac1a2c1702b67fdcf548ed9de51f9f06
MD5 db00db79ece076131726deba67094d9d
SHA1 a39556d891f7b181e7b09703f293dc1693f28563
SHA512 58f94dfbe3e1f672515f401c0b625c8ec9bc321afec2c166c80e2b16edac1f8d76637eee71651819865d8cafefde66a88b2e7c301a53924504b9ac812bbbe76d
SSDEEP 12288:b6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:b6nQ/tbw/2Mkjy6Fr7g0oK
TLSH
T18C5523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 be3939564bfa7c127eb89672ee27efcd9cd1ccbabb5ad76f41b488d5e0786c1b
MD5 97c10f8e093e7af2d3fd2d7171e9baef
SHA1 4e58681984c235b2fbc5c2790076c15f0e16bf14
SHA512 2135fdb74d103cc23799ac316541cda28b77a6479c61a74b00df750746d1c1731ba780ade27521001b789374e5fb62cd8a8edb919e2935cdc698d9acf0110d12
SSDEEP 12288:2yPz5L8vGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:LzyPnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T13E65021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f52772561cb9fa475fb0edda85f171e39bd070946647ac3dcc4b4201804e414b
MD5 7a03aaa5e4f4739275cc410279f196bb
SHA1 680abe8232c1e0b9f61449b2d1dfadc37ebda4c7
SHA512 be6b230993b5d340f32c22f42510c15295766f32ae2ed47c9ff94f012fd5d1769ae4d8392cdd788a0c046ec9c6d19c76aa0771039af9255895515c732f244a76
SSDEEP 12288:HmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:HGnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1A35523697924F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 666122c0cb5cbdd3d2ce2f34ccda2a93596b24bb9c17ca81fcbd9e05f33daa55
MD5 6b8cf4d01901609666f3d8896c055867
SHA1 8ad78b65b544958837a46cf07146d7c35408b142
SHA512 dd18086df63f9789e36f8679e3c1f94667b2368310dd03a99508c96870f9d95f0982ec63440c24da80c4560d108b689c7a8b56072837f445fe817276b53a9a32
SSDEEP 12288:vmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:vGnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1805523697924F98BFB1706F54C8281869B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 cf2fd72f409aa080f36c409c103983661ebb9d46637151dc29e39308bd4cab21
MD5 018e7bec285eb4f4b9df8588a98234c6
SHA1 f4db4ee12e9c126c1bf3ce64e622805fdfaf5e52
SHA512 19f87db543a2bf84e29d35565f9e86ce8d6fd8fdfcc6e1bd89b25cd41a8f210d427cce1399d7c59645003e34b0ac4f84eda7d556f8cc691c7c3167ff49d8e155
SSDEEP 12288:wyPz5L8vGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:BzyPnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T14D65021773A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 57db48864c59ef8e687b74e64903074354b01d71fb1f92dd369090e4802a6668
MD5 8b02abcd6c9f37d57bf9e3fcd30dc7ca
SHA1 c1f65a83361e1466c0e77dc91ddd927dee7aed87
SHA512 b903950011b69b3d7088dac689d5eb9134f16931920ef995171a2ffac68ea37cb20222545a51bf8ba4899ca9069d7e18dacbac764cc0ac19c28b37b59b51746f
SSDEEP 24576:KT0aLl3z0zDRnQ/tbw/2Mkjy6Fr7g0ox:KTDLljsQ/lFTjN4
TLSH
T1247501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 1f5f4f6b5158f288808928e5dd62626210ee30ab17f027db2366e524c6fbe0d1
MD5 caa57c2704815ae5b7a98b802fb236cb
SHA1 9ccc5c507a6f1e882cee0091f360195bd04f17db
SHA512 08f06fe97306b26be851acf76a395757435d6d04a46887bdcd7d3c12468b36de0792b44db1b3824a4f3a3f4ca69233d6f4abc85339e5c6c75297a0cf0ed447d5
SSDEEP 24576:T31d9CHKy7GZ9nQ/tbw/2Mkjy6Fr7g0o5:z1d9CHKyaXQ/lFTjN4
TLSH
T1E385CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 874a227874c8d0d6044d9c44886067a81f1ac287faa3d193af0fcbe298c1ff6d
MD5 ff2e43da6b2b568728f2b489d1393e78
SHA1 d001870cf09befbfb09a05424934989ec1797ef3
SHA512 e218b4d6cccacdef2ed63e6aab4c2bbba464a5fd69fe004e7c6d9db84cbf390f5e79c6f6f12a2342e2f9dedc21fa078f4ccd10e0d0aa43c0532b2d776baa0f26
SSDEEP 12288:5xGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:5BnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T16A5523697925F98BFB1706F14C828182977B0EC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 aa28769db110399299a82eaa394ffb315adbf46f6a0f90730d5ed11299f67c73
MD5 a72596ecfb382b28850c273afe5767e4
SHA1 3b3350eec6d431b16d330ed9f29d272ad882ccc7
SHA512 861fcef1a097e5898361271d9b812ca5dbe0d5042c674d1dd56e85517524f2afdbc8aed762517208e3ebd853c9d897b24d9200c3547165a816dff543811b57b9
SSDEEP 12288:5PGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:5vnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1645523687964F99BFA1B06F14C838182973F0EC6BFD1938F7B481129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 fdc0d67253b05886bb5bae4c04d17b1cda78f382f850c19d807f73da20b7eef9
MD5 2927312a9f6d77f8ee8715ec1b155f8e
SHA1 613d232f329fc0d0b97a5c81922e71dbb874cdee
SHA512 407a763305ce55543743cb1ee97ad1bab734cdcdd740da866fe34bd7127301ce250dff2c8c517863d50ac2bb638746a0ac1630625cb1fa8e427967da307eecdf
SSDEEP 12288:/kGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:/EnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1785523697925F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 5107fb27239958464975e2de5c8575c3f4fe3de2dc00b1847b481b15b49291b8
MD5 45bab2da40756a1a8653fbbd1b692379
SHA1 1f3a9b94556a0ccd1f08686b56e21adf891ce40f
SHA512 c4f16f1d429fe1d0def21c7dd93959f3e5cadc1472ebd1ff69e3ee3352ad2cc8a8472b4a5688da2f89659946e39307d2f0d9d8d2147eded2520f3f6f6f44f206
SSDEEP 12288:YmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:YGnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T19A5523697924F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 6457cb153893367941ffbe88d943648861a0a49ce757ade0351bd80a6241c812
MD5 89052ebe6e641b47446a33e8aa104dce
SHA1 bf95bc31cee688a0df95cc112a4a1fb445081f62
SHA512 5e980790734db8b624c9fa8b3867a51a3c6d700ecdbf0e844a181cdae17863da6d96cd9a4b36b93f67c0e15120a5be307e849ba59301f3f1bc68c7fff076bf91
SSDEEP 12288:IxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:IBnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T15D5523697925F98BFA1706F14C838182977B0EC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 da8372b5f2414da82d994ee3291ee7c6fcc33479e72c015f64114ea7aab6255b
MD5 b4db986f4c87173bdc6cb487f13bedae
SHA1 511139e1113ebe6114cbf467166c30cb86e821b8
SHA512 55a602aaaef86616fac2afbc8bedfbdbae21d7be6bbc714202967f3ab6588819e786da21b481887fb537b233819a02e5f5137e87a56db3de88c4b7f0a1cf8edf
SSDEEP 12288:JeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:JenQ/tbw/2Mkjy6Fr7g0os
TLSH
T1525523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 47490e60319a79ee3be3b5e011ea822936d56a05b0e7c67e4ea0fc2983703180
MD5 4d6ed09dccbc351a537eb64ae2306651
SHA1 7e6e5e687eb65afa037422dba7720636fc0b3bc4
SHA512 2b4a4cdb3432ac14d1e6343cb891965776e09aec99472a054fe207fd6b8d0f81e5108f8328c7056768fcea7d431d305cd0b7f0210170f624a7879b35ff65a289
SSDEEP 12288:2YGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:2YnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1385523697925F98BFA1706F14C838182977B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 d0501f7b4813189edf1e6c064e0feed09c93d44689dd9a7e1c6f61499a471eac
MD5 a603d5ba5f323a65f7233f97e2c707ca
SHA1 e4cd866846fa7838595780807944b310e4650f21
SHA512 628cfa7fcb50036adff71b9407f25f8533716c0b6cf8d875e69d3b18f4ef652eaccc44de9c665e9f5e624877549560fe1f6c72b008ba8861b6a99ab835767177
SSDEEP 24576:9fwv/k9RX6wkyAIKnQ/tbw/2Mkjy6Fr7g0oF:sMnYIKQ/lFTjN4
TLSH
T1F885DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ac9760703453805f9c1d6d075d098aa6e9e276fd4e3793d43176488a8f079ba0
MD5 b98c470a72df9f4336b236487158d1b4
SHA1 804d54f13f3e20297ed89bdfdb5d7a6ee79bf669
SHA512 49196f9f74078edefc6b3b75355286bb02b149f8604f1117d1a0ed80a540bad4b215d3f6071f18d3ddac2d5d4e3ca10f45e9e89aa34ebc7760ba38d1135fee6f
SSDEEP 49152:dYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK01Q/lFTjN4:dySzPyLm
TLSH
T1BD066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9e5261aac2c1ac58d3aa8d7d5283a15591f703d2013fba95d0af6af445dc07e1
MD5 70d029cc2af4f58a2c168ee1f9d86552
SHA1 d7721c5989432c43837de6138611d7fb45403350
SHA512 57ea7f78d1d75463c0f277323cba4d67bb53d4942a1dacd0a0a11ee06f8c52735cc26ec2f6aa87bb05dc82f7ae5e8b5940274b55a0cd53d57bc20d52970a21fa
SSDEEP 24576:k47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYrnQ/tbw/2Mkjy6Fr7g0og:k47JUQj1irIhCnDHUPfF/FQ/lFTjN4
TLSH
T1CE65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 9a5f8e98aaf8d0f1475e5ce07abc1e5ffd0fe072fa6db0435bcf9a7fbf71e955
MD5 b19414ac059349fe17e145090032a1c4
SHA1 10a6ea80d22ec3dfe8fe2d0b4e81ad30eddc0a03
SHA512 aac9d51b98a019dcf75276492e07f7f0d1e6ee34f49a6dbca760e068b9c99c50b6da8a130aa22b72ce1fc2e367a71425839a70b0409bf97642417d01c66266d5
SSDEEP 12288:WssfWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:w2nQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1CE65F119E29852E9D02E5275CB828A41B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 fa1cd7b840570d70ef3c82a2c740313c9ce071d6d94d70593fcad752c21f1139
MD5 bb5798a7bec78f19b9f09eaf165f2e10
SHA1 8a603333eed8bd951b31a07f4c4e3c7913d98e35
SHA512 2ab037628a1e33cc5cc86a2cf8ca891e886d9f0ac7c481dff7dd507ec5d24c25169d0812b531437ea305cebf204da7387b2dd0882e23fe1b0ec10fdc0008f82a
SSDEEP 12288:ucNFtBqmdoJvqh0dLOtSQavTQI9wmk6F+F1YW7CUVnvz:uAt/mJI0QI3xFAt71vz
TLSH
T1A45517117626CB4FC6A980325E32D5CCAB707D41EE056F0373C9873FD576A59BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 5158b56a9eae8329f2d5c202e7756b45f75b5be7c84ce0e50859d5ed94699c4c
MD5 e88252a9f1fab711b2fa94c037bdb161
SHA1 3fd46a30a1aa684295dde1a31dc2d1310335129c
SHA512 2137f5f4047b7b09762240cf5bde037799fbafebcbf7ade053b7635d96a249a393173976861dc7e0c2f1801c5f5f536e4515f0081137242d1786eacf5ee107da
SSDEEP 3:OlH/ldCe1WD/XLyTvsa3mCllltq3mCllltGlslslslslslsl6qp:KpELKs8mCtSmCtEEEEEEEj
TLSH
T1898192885F500635C303383220F043885330C88A690983DB432838136C586888D43A79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 45cd675769546825a783ec3e4a877c1acb37e3dc0d44c51977e3be26a7c67204
MD5 649931eb336c38666aee4665eb987db0
SHA1 0baf66e168177dfec0a93a5154c9398708dcbb95
SHA512 eebda8adce037bc8b1f4ad3e8bc4e54ff35dd8e08a692072069400a06b13c4b28f6e7b480a7f6531dc5f214b9e8a2ae1fa0b47d9e6a1afb7e1db680460dbe733
SSDEEP 12288:4ZwZaqqIvhK+yIKyVfR1c0YcvoLRDbmfV+ygK:UwZaqla6RbfgK
TLSH
T10265F8405136A78FD1FB6032033A5E8DB764EC06B7496F26B3C9053AD86AB51B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 7dd3ee92b1db5db54116bf18b4b59b203b9faaa6d1477ab67f49473bb6adc155
MD5 f2654a82b93d9179880e5d6db9e3511e
SHA1 9125664f09dbcfa68bcecf41320d04047a1a1d77
SHA512 c57d1cfbb10a52d80a5b0ad9fbe624fa8895257ebe5edbba2897d34016e1c77a46dad01d11bd2dfbf088c24ab567e58e9c89800f01c3c6e06c7aa1691dec9447
SSDEEP 12288:667OGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:dOnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1FA5523796668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a41e3af03cbd67a028a75690b5740b2f8db04dae39d4447c9a3eead83d92a2a6
MD5 c4a7f4d344f84dadb70c82b7589b7334
SHA1 690e0b6aeadfeb32c951b922e20185b84597c2bf
SHA512 d3aaae8acbdaf9a2aac81b6dc63ea973ca1abb07e3ef17976bf4ac39c1bb17409a1397bb9bd3f50673b869eda0d519019a1ec53946afc93a567cf3013d35e131
SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bYsnQ/tbw/2Mkjy6Fr7g0oJ:Ygb4mBIBhGFrQ/lFTjN4
TLSH
T19465AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 3e41bcc9526e4fd2bf225d43f621850274913f2f5aed0d8f0e418db94d96f48a
MD5 f3ed6f5abba7705de14e2524fd3c0399
SHA1 aea4c67c4f03aaaad5759ecaf60e94ed149870ca
SHA512 37404ee4da43d2223bb75d1da5c5a861df7375dc29fe5df3d2e2bd3278409d54c81ced903bbf4b707b61dc4f23415c70ab9878b47a1f2dd2b4346f82b9d2bbef
SSDEEP 24576:/G88u8FpJqH1Qzria7/mbnQ/tbw/2Mkjy6Fr7g0oV:O7ZFPqVva7/kQ/lFTjN4
TLSH
T16785F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ac50086da568865a2e0d244a6e762b861d5892daa05fe5ec4b40ac796157acf6
MD5 f7b0ba50379d7aef01fce24a0cdf1c5a
SHA1 208e1e90d5cf018fa7b4c3b346a833e0e4a8ded8
SHA512 b82bf6c6f2541082739c0e6d87e2ba02e407e4488b20242a5c682459e0c06400d0454cc0a0c4ddafc64d6d07c67fc21719e48aaa991fd203435dcdf2ee36aaa0
SSDEEP 49152:mBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjHQ/lFTjN4:JG05lO43btLm
TLSH
T144D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ba95c44dac1e1500038a10752a1f0d461071e2003e83af287032c8cdf32594db
MD5 b3724e3da507cc6a77592ce11de71dd8
SHA1 1a1b868c965653d8fea38178503bdeec310366e5
SHA512 b6540a880a3be7c75d2f70a007c3bbdb9fb184e291bd05201ead89a3792ff86fe41dba5cab4f966e982cfc171fd33328d32fd52858bc645ec73f3dc927c61347
SSDEEP 24576:qfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn1nQ/tbw/2Mkjy6Fr7g0ov:ia5POZ3+Jt2pasx2+mvQ/lFTjN4
TLSH
T10B65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5c32129c6fecd7b31ef4499c0df9fd12e9a11a9228c49e67a27b442e0d438531
MD5 c72d0b29676d4aef2ab9b62b09eaa296
SHA1 52f38330b6eef69bb70757b354deb7f1bb314c8f
SHA512 ed899adb7a098b61dd2730ff7d22d9c99c48d7051fcddf48e619408616b361ecf18556b2a48352bd66115f9fa053da5f6573d84fe8edf6c973a2b001c263863b
SSDEEP 24576:8NcwHdjbyQ4nLC18lb/EOjowL7FkDnQ/tbw/2Mkjy6Fr7g0oW:8Nc/zEOVHFEQ/lFTjN4
TLSH
T183858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f007cd6a164f833e18012e3ca6c6e5d99f9a7df190ee6af57bfa324b314f3d91
MD5 66ad4ae4d2ec4dfefec040181013e03c
SHA1 ac8255aad0e605954482c8a325473d8c9c33f1e5
SHA512 7dfc07aa97cae28f8892427eca055427256a28caea35a02223532e85f70e11cca4361187d8ee2070c823a804d6c70c391bfbf9e29b0ffc59eadfa87940d17384
SSDEEP 24576:+8kNvNnaFeYhJNtmZBmGnQ/tbw/2Mkjy6Fr7g0o/:+8MwBtOmGQ/lFTjN4
TLSH
T16955AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 1c96c6f00cbcb64615f334f7b1bd2e023ed0ff0de294a9420d1986192a738266
MD5 ed4af8eeed464fd3e689db5dece28f2e
SHA1 5675b2df527f324b75bbcfd46303cc25ef164b66
SHA512 ffd48349cbb264e899e714081b27317e17b55a1271c5e23dba033a294acdd317700363382416b116801c27e916b4770094741c69bf60edf13fecf72b45864ce3
SSDEEP 12288:UHvUrBFrEjwaQ3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:UPUr+NQXnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1B965E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 01fd38652eed0d1cb7040a5f0bb04d7d8ced08e750e840d17a6a60a715850cbe
MD5 d3b558bc989ff518392d4bae96962596
SHA1 e0dc282c8740ee3c09f1d0d1ef3575e07f725652
SHA512 9faebc07c3da9ac68e1c913baafa94394edabe29d6c9b87dbc4c9797947ae9a363182c6d5e771eb895c42b914eb9317bf15c0a800d1c586ef171a83047caf32b
SSDEEP 24576:4D3FHshBIYQgAynQ/tbw/2Mkjy6Fr7g0oP:4DVHeBIAAyQ/lFTjN4
TLSH
T1A575E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/364-120-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/364-126-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/364-317-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/364-119-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/632-72-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/632-299-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/632-78-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/632-70-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1116-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1116-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1116-147-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1116-153-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1356-26-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1356-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1356-17-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1356-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2364-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2364-99-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2364-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2364-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2364-333-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2364-93-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2416-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2416-43-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2416-68-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2416-65-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2416-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2416-44-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3168-88-0x0000000000930000-0x0000000000996000-memory.dmp

Download

memory/3168-83-0x0000000000930000-0x0000000000996000-memory.dmp

Download

memory/3168-82-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3168-314-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3304-112-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3304-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3304-106-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3304-318-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3304-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3304-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4964-137-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4964-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4964-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4964-141-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4964-131-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5016-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5016-55-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5016-282-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5016-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5068-14-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/5068-0-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/5068-7-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/5068-8-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/5068-1-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/5068-25-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/5560-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5560-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5560-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5560-37-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5560-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download