8aee4b6b7260594a4811c0f88169984a63d4a3a80e42c5cf7ad6dbb14e4637ae

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
Size 2.0MB
Sample261027-227hmsgw5t
SHA256 8aee4b6b7260594a4811c0f88169984a63d4a3a80e42c5cf7ad6dbb14e4637ae
MD5 ebe29a0fcf13f21fcb389d5acf8ae801
SHA1 c66310d1e743266e2a0dfde45286219253ea6889
SHA512 e214e4a0aecee19cfd3bab1c788e79b3be333c22ab94f4bac2542b938060dd01b23343e1c92447f1f20d67f2b0e6fa3ce0c7069babcd614fd1139a87b95a1ce9
SSDEEP 24576:zonB0LE2zKV0ICMO//35gUKSJozCh9bEO:zo07zKaICN/3Hh9A
TLSH
T152A5AE16A69C7CE6C0729238A77387C2E33EFC054761C69F12D092295E3F9927D3A791
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2880	elevation_service.exe
4304	elevation_service.exe
3316	maintenanceservice.exe
3576	OSE.EXE
5944	PerceptionSimulationService.exe
3872	perfhost.exe
3136	ReFsDedupSvc.exe
3160	SensorDataService.exe
5932	ssh-agent.exe
4344	AgentService.exe
5700	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cf7ae82c17a6531.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104140\javaws.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab3f24bf6766dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000340829bf6766dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
Token: SeAssignPrimaryTokenPrivilege	4344	AgentService.exe
Token: 33	5700	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5700	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5700	SearchIndexer.exe
Token: SeBackupPrivilege	3136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3136	ReFsDedupSvc.exe
Token: SeDebugPrivilege	268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	268	2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	2880	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5700 wrote to memory of 3508	5700	SearchIndexer.exe	100
PID 5700 wrote to memory of 1580	5700	SearchIndexer.exe	101
PID 5700 wrote to memory of 4604	5700	SearchIndexer.exe	102
PID 5700 wrote to memory of 1028	5700	SearchIndexer.exe	103
PID 5700 wrote to memory of 4192	5700	SearchIndexer.exe	105
PID 5700 wrote to memory of 4164	5700	SearchIndexer.exe	106
PID 5700 wrote to memory of 5228	5700	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4304

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3316

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3576

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5944

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3872

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3136

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3160

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5932

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4344

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5700
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3508
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1580
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 2916 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4604
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2868 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1028
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4192
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 2916 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4164
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2868 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2da7ae4bf24c4a40878f2d2d83bfce1962b6e2b9063799344dc5bbbcdf1634f6
MD5 cea9b80e5e9afe402a10d5f6e22e6a02
SHA1 bf8c8abffd49a9247481951752d796e0b55da029
SHA512 75ffa16db1493906924592b3321416c10648ac9a4b1b3a52dff492df56c1b30d52d96a19b3b627be3afb641b9a7577b10d86d401966a37b56270b413f7f836ad
SSDEEP 49152:bb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnYCN/3Hh9A:p3q6HjBhCN/38
TLSH
T19DD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 3df0240e6a0e75d340482b213b8f9b519bf87498e539648fd61cb8145e3c8f2f
MD5 bb19430ca31f0fd8e21be390cb983e70
SHA1 c9ccc30bbc2bda76244f63e698f8e7fed8c088a9
SHA512 592b58a812e3d8ebeca7970aefdbe71a3726c76b30f6d5ebffd06cf187addb709157187fe5a42b44ebd9a23391dc6d16a604389891f4df7b1166fc10cfffe39d
SSDEEP 12288:01XLsswWkxy2lRq2czA1iiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9O:SXYfDtczA1CMO//35gUKSJozCh9bEU
TLSH
T1D385022867A108F9ECA7817CCCA28415FB33789547A4E79B03B499691F336D86E3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 5bfdb458767dd65169c959137178a0863df15a2e6373c79a49ed539fbb93267b
MD5 61d10e4f21c50c1dd5174afd0c0fc5a7
SHA1 a77a66514345b21b377495f8c278b149eb17beb0
SHA512 d576f8a436708fd635a780c04a1caa2e248decd6f88238665fca96217bb51283970d128f5c2edeea1d5cbf9fa2769dcf940d09bdd1fa8bad6403b8faedc90e7a
SSDEEP 24576:C0Le5ji0hmxirMgCMO//35gUKSJozCh9bEV:CPji0AcPCN/3Hh9A
TLSH
T109A59E25F6748735D073C0B9C5D2A68EED7130825B308ACB4296D77C3E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9ee60ebb8fb4cb275ee34b62cace6a2813e15065ad922136186bbf275dc895ad
MD5 45ab4a9b1e686909ce65ace451cfbef7
SHA1 9b93b0ada92678599bd78d00721bb49e254a981b
SHA512 4ccae411cb97e638f46f17bfcc8c5a1317fabe39a9a5fc3648798fec7bf5c4540e345107e25eb3746086d8e1fbfc1331128944bd9a0b8442808e6d75f0be8d4f
SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWE6q8wyu2CMO//35gUKSJozCh9bE7:P/ezSC6vUzPvxHjyTCN/3Hh9A
TLSH
T189756C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f4ec25d887aaa0e7251b614cfae50fc643b1eeb41ad5c184c41959c5cb57bb37
MD5 659e8778b6018949c88bff9cd8aef997
SHA1 7692109844d216bd8dc73e0de44223da86e5169f
SHA512 a011f8a0f3439cd7529bded053ceac2432e562b95bde7bc855c3c5886d2a6242dba01b8e3f48ced32fe7887e0fb9773815b0c745a665d9af7ccabb8a8e344ffe
SSDEEP 24576:eVbqPb88hv/l+6RCMO//35gUKSJozCh9bEZ:eVO88hXl+kCN/3Hh9A
TLSH
T131559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C3E67AE5D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 8eaa90493bac4e99bf398b02c498c61be002de94f8689b37551281f3e603b5ae
MD5 71e0650599b7c25801245563546fc727
SHA1 6b51d93b3a674ae7c1e9b0f69e549519370cea40
SHA512 fde50f921eb5c560e897f954a66fa25eb67fd9307a727e7596b58276943e94fd74ed369e99e23372def2e662bdf17f794da1bbd72b569ebd65714c6ce509364f
SSDEEP 12288:nRciiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9Y:nRcCMO//35gUKSJozCh9bEi
TLSH
T1827523244A3118A7E5E5787519EB381A7A626FE5E9CE2E381C337ACD187BC70F13450B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 7d674dc3f19f75cc7e1eb85a0e6b51e21e202669b8fc08960baff6f1edcbbec6
MD5 844188d2230ad7f036d46f3973fc0faf
SHA1 e8c063e3c24dda4575afdc5e3b12308b6ce7b2a1
SHA512 4ddc1772ebb8ead70a375fdea70668d1a9ed7a30955b9a3e2c917bb832e0f32fbc768050aaee64dddd9e24c5ba2d83bb05870e4e961d25c5439c5ab4016624c3
SSDEEP 12288:YeBNUbTVO86U5iiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9S:YJIU5CMO//35gUKSJozCh9bEI
TLSH
T16985C03BEE28FCD2C27A9DB95A918600E77278704F52A3CBD175830E9E235E05E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 75573bcfc0be9a6851098a6ad24d9fee7194becbeb537196508255af7979a8c5
MD5 154582b820c20f1966abc940e7403768
SHA1 f46211e4b96812b06e0eab4fc1c2a058b9a13354
SHA512 35fdc430d6ba6fcb2f6a6ccad73b91440be12c2812004bc1e2b1e1b6af979235bf995c88b172668dc42d7e5b67d0b9d8080cceda4515c8022cc9727d01ffe34b
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THR:9QvGAdlCEL8c/yRNw5CmCN/38
TLSH
T1D9267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 184bfa6057edebbf664bc2458db847503d54b85572ef246f12189fc513741ed7
MD5 811a2ff78fc92bfdc855f7a945ef71a0
SHA1 bc5a3c4ff24bde2992d290d1944b9acf66cf76fa
SHA512 eaa9b24092f154f194e964fc18c5208055e0d237fb3ff8322e3c5b8610a68bbe7f542449f780bc6ac85bdf7ac8f7643b1a486017dc2047e823e799daedd1755c
SSDEEP 12288:8AwSfxL/2Dc34DLLmt0LDQewsAj/iiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev6:hdewsAj/CMO//35gUKSJozCh9bEm
TLSH
T1A695E031FE34E436C2BB0DB61B36D716243D7A604B921AC3E3B89E8D59345D26336A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 657514d0cb16174b326a573cf8247e69e12b99c021b98de30677f81a60ea27a2
MD5 e931bf90a34a1e100567effbb2ee1c07
SHA1 6a32f5f1592f7da05f464bbd4d13ad6364066f4d
SHA512 7d30ad4a17c8839fc97a349b3117aeb236893776c37ff544bb7de835dd3273ad280fdfc2a6587955fc76e735ce15c3d414a1a2d85250c6680d9feb9358984a3f
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH3U/:QUEtQevvqc2W1cpV2EI323U/
TLSH
T1E1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 263c5d377d9b5b98aa1f93dfba7498dfc409c2a8fa18ecb5e58839bfba53ff21
MD5 af8232f3a7b7752601dc7c9edb9119c0
SHA1 fb01a950370cfcbcf9aeac2d2b8fb2ebc2db9a49
SHA512 7acca05a73e026041dc763b8d0badbdc24dffa85f444d9c614f06c94adceeadb146b2872a131339c32108ffd069aec8d3bab488dbf7c2da351c64c511b216455
SSDEEP 49152:8CbRquA/m2yL5zQfFiV+XenmE3/zfCN/3Hh9A:1oqtVjnm6CN/38
TLSH
T1A2D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2da1592ff9e579582aedfbf2404b3a8c658d59fbc1594c6ac2bffb0dcceeadd6
MD5 70fa78cc3a2ac08610de731146d1e522
SHA1 60a143c2cbb9a89d05a2455b3d8bad979d094730
SHA512 be8de14478d050ffc31d553454692046d25c1a78198afe19521ed9526bf55c324ca82a506ea2bd25c232d3c95e94b7503a7caf9f8c1c24670a84b06ce36ae631
SSDEEP 24576:qAhGLJIFoiwtA5l7S53aCMO//35gUKSJozCh9bEu:qAMyFoiq5qCN/3Hh9A
TLSH
T155359D80E7F955D4F5F3AAB899B69171EA76BCA65E31C20F2160910F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 edd355e76a693524e3742da322b323212836b06be8b678aaa697043803d6ca53
MD5 cba9a5ce1001b2341769c1c390dc2e98
SHA1 a609c17d2592761c8fcf7df320f046ae98bca7d5
SHA512 ae78b83106efb5d62d7ab774e6fa6c3efdbc774781ad7a6960bfa0c393ab502b0ec7e748db53ce3e72c496f72ab89850e0d15fbf8a4b27919f7f2c3f61ea97bd
SSDEEP 12288:mmw5HEjsChNVBFgl0WDm+CWiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk99:/wuoOWzCMO//35gUKSJozCh9bEb
TLSH
T10685F14536A40CF9E9A7953885979436F7F2BC122A65DB2F0770C65B2F37220BD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 20f53cc7c74a91c7707bb4c0ab8a8639dc981769e4d14b2e6c838834ef276594
MD5 bc405a2861988549b2b9cd9115b1368c
SHA1 38be65624e4a40dbe5789943c306ec1e9f5dc7fe
SHA512 46a283dc7391472f615b9ad1ee01ce16d8f12f729c77ae0c18ceb98afad0138d9f13a838535a85ee2651fa9baa5cfca6327b4563db7748d109aa2e350a031d8d
SSDEEP 12288:CBZ1IyviiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9P:sZuICMO//35gUKSJozCh9bEp
TLSH
T12475121927A020FAE1E3617C89E26509F77278A2677643DF1932579D2F33DD0AD38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c5c66764ad9cd8cbb895ac3e9a993dee40908961310b31cacf7589a01cb96ef6
MD5 6fb94f3fadd4c82fbc27e8b2adb02fd3
SHA1 ed467e38432c8aaf25826d313c379ff4172f4502
SHA512 46de5d28ab8cbff6f5923e36eb25b101ca842f32b125fcb5664da1be4dd2dff6fda2b02e8f2ecbb468e4ef172d4c68dbaf6a0d25275ae88e82664936028fd5b5
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:2QRQyi36YOcPQLvw2gAf+PN3dCN/38
TLSH
T165667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 63fa0569f03cf0b610ee92d66876af6b35d36aabe826c50e896b470a66cce43a
MD5 ba989d4c03dc740b543b6212e260d26b
SHA1 6045dc51904ca01495337dfd74480888ef8d55dc
SHA512 3f92a1b24f9f20f82e71973b79297b513922b9a22e326d35b252674879f4b70e6abdd2591f3e25a169ab0cbf01875a166c77a5c6042f75cd9c1b9553b88871dd
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:oQRQyi36YOcPQLvw2gAf+PN3dCN/38
TLSH
T11A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c2f5219c66fca2166323cc5dbb4839149331ca6ac14230ed9d9d3541db4722e5
MD5 c785f1810a13f8e43a4e1d15348b8af2
SHA1 15dbf7a11ca167a52f3fd610edb1f1a2f026a346
SHA512 0f3950eb94991c7d061ea0511aa5ccfa575984ed9b1f4d86ef43a34ded586654c719cb76c87b9891eec9d3c0027da50b78aceeb65e2826c4d3ce45925795300b
SSDEEP 24576:NwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0YCMO//35gUKSJok:p68Qg55nhheWu7PNU3/PCN/3Hh9A
TLSH
T118B54A33B2F200A9C44DE1769F4A972196D17C75CFE1E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5d0d34d1dc7fda3f65a3abdea4e6e869516b89a3c013a19695d7d247a2f1d16d
MD5 0ffa5595392793e979f985c81e0068bf
SHA1 055755d342f624ce087c46f5bd3ff3c2c9f43909
SHA512 9171d3570394ba8c019638d7d1c5cb184a211dafad1cb422b01e9713ce0c3487f06f53a227d31356652d7414832850c9e78f914d74f52aad1e606e4692ae623b
SSDEEP 49152:73aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk993:ey5112gYy5azzVvL69nLKnhZcCN/38
TLSH
T152167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 259b3dba409edba7da53f7311d1afeaba6f0ae4d7fa85321f97eea1328f294af
MD5 fe75be28c1bd271cc07f8175aab53984
SHA1 aa763c02079d762d511980992177bf932986be3c
SHA512 e96c3564696717b9740caa6bb5702745e9134757de77425fea55f80d624af8c990037dea05fa30a98349f452623c448db0e5c1b744f8483f95c4125e9f0ea24d
SSDEEP 49152:oB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glFCN/3Hh9A:iu6JmVxd2dFCN/38
TLSH
T101D59D13F1DA01E8D06AD478974A9233FA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 43cfb5e95bff912ce1d061d4d6934a01bbb2f6e62980dee31e1e17747e8dd5a1
MD5 08265836ecfbf5f7238e23f24f0cd2ae
SHA1 8649aceabfc619eed7b53a5114753f6a1fbdbcd9
SHA512 d973cfd1f48d172af700624272f83ad3473c82972ccd141ae4d87c4683ff748a724e3489f93abd942d3c4bd168fca79c472834e6b0bfd50cfcf62325e18b0d9b
SSDEEP 49152:q1hpsNoJpF1A6UU44CwH7R4xZCN/3Hh9A:qmifPbR6CN/38
TLSH
T13DB5BE13F29900E8D06DD17887569232EA72BC460B35B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7f02ef306f70a82d9cd345275a23cfe36de25fff1be7218f5d9bceb1ca9b15d5
MD5 5a7413487129c1971e96facfd6a70666
SHA1 91f56e39c5515d1222acdeb4b7414c0ee7815192
SHA512 c03b74c6b2dc74de1a26621c421d05d5f87270f0f58ade1c61c47c62fed31cc4f779cabcce53b48a86e537fe0f785f5cc0dd91fc0bf974bb0d72b9953e44b69e
SSDEEP 49152:zSuZQIY0Be2KRRVtOnks6NMHqICN/3Hh9A:x5dKTi61ICN/38
TLSH
T1F9C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5debfd127b52d6b0a271fbdfb590b754aedef3a3e00117a91f21168733620015
MD5 29bc539bc510e20537459e16ae5961b4
SHA1 ff6fae190a3802fd92c178932eebcb3e790d1fc0
SHA512 182044e599ba03a7938da6e025b5e167f5ff43d16a8e443748b7ea4bb8cc6b7db42b67c3f05ce35aec6139f59ad6af481666661d49fe35117b635276be5c771f
SSDEEP 49152:hhtSn8EApI0figngiDn0AP5w1CN/3Hh9A:wX2iyph+CN/38
TLSH
T18095BE13F2D900E8D05ED178C7568632EA62BC160B39AAEF0A50B7561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 ee692ece398d584fa9e35de55b213d017d13a040e62baba31ec0e2aafdcd4979
MD5 58aec0f2533042896c782dea892ecde4
SHA1 2b285da0a3fb87ee18b88a867048c2d9e2c76db0
SHA512 f0b4c880f39328844657e88a7a515c57d37c8bb35009247bf34b795f3738121e312892901f4e10a0c0d973ed1acdebd118349778678102457d768ac30ffcd992
SSDEEP 12288:vkiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9d:vkCMO//35gUKSJozCh9bET
TLSH
T121752324483219A7E4D079B509D734097A617FE6F6CF2A392D3B368D296BC70F13851E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 4baa9a90c2362cf9f66512f74993de2efcba9bf590b32c121007499f4c128e98
MD5 a19e227ec84ea83119e5ba07b7545a61
SHA1 821aa7604788e80964e077d0249cf983346bbec5
SHA512 b4336cfe0981c082f75863846fcb9c5d2594ae937f3718817373ca9b52127d0bd4d757ff5cefe18d7a3f88a2703ea0e4e547ead1de14dacd8ac15d5a36401dbd
SSDEEP 12288:hriiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk99:hrCMO//35gUKSJozCh9bET
TLSH
T11A75232448321CA7E4D0B8B519D734097A616FE7F6CF2A392D3B768D296BC70F13851A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 111e528536f29f24ce87b72dac84533918362e1a2cc555da4b1a520614827ac1
MD5 d7b4c97f15f14ac0a8e109c984e276d3
SHA1 ca8dd56ef87d713ff249d02e554cb236dfcad0fd
SHA512 258d938039e586b38c14ec996a8d7a2790e0c10aad981b9213d122b645fa6fd6c6f3eecf83bc61665042287b37a8241b143df95c6563ce48768b0ef55d27d7e7
SSDEEP 12288:5hiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9T:5hCMO//35gUKSJozCh9bE5
TLSH
T1EE75232448321CA7E4D078B509D734197A616FE7FACF2A392D3B768D296BC70F13851A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 1b4dcfd81aedb3cec5a1b2ac06eeac8aa8623507eba8b05cfedb631a91a2d07b
MD5 cb4436fb62080a214ed2a45d263a4325
SHA1 2e6d5a6f2fbb84bb75f45c1c44703a5cf244cfe4
SHA512 d8a45314bda9cf4d114c9f5c38fc34a0b4fd556c0a2bd6412fc3834997360c6c4d5ae9d13fdfd32fb6480f2a7f05aee119e82ba71657061d987708cd8f4ffea5
SSDEEP 12288:UV6iiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9w:9CMO//35gUKSJozCh9bEm
TLSH
T1AE7523200A3204D7D4E1E57849E32409F7B17EE6E7AA1B7F1D22298D1D77EB0F534A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 a302810be15ce0939010179c344203996248939e0a151f275f4a5d5f0c20d6ff
MD5 9aec0efa083fc83f78d0093ac34ca066
SHA1 9748594b0a8ad07ccfa7736d9f2bc0b4577393d6
SHA512 c9054d5dbdfc02872b7ae48d2e00b6b9964a044169c58bebbea061ddeb429ca5a2625417c7fa8ea320a73b702ad9d635943e1fd8a53dc94bf377c5ee268fb0be
SSDEEP 12288:tyiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9M:tyCMO//35gUKSJozCh9bE+
TLSH
T156752324483218A7E4D078B519D734197A616FE7FACF2A392D3B768D296BC70F13841E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 85569b671584e4eec6f8061d1e8d993c8b41da01e8b8cb9a9b63db5b18b193b2
MD5 e8e525af58259fb2256d581c55c04763
SHA1 bc38dca7b5a71b2f0dd9831f3c41995da9f5c270
SHA512 0ade586f81f2cf5c079cbad9d8a29a639e90d67c852cd329d56496d11b763dcb85b82a3bfcae5925d545417caee4a0f582eeeb88839f7c943840c7a0d74ae6a3
SSDEEP 12288:rniiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9K:rnCMO//35gUKSJozCh9bE0
TLSH
T1BE752324483219A7E4D078B509D734097A616FE7FACF2A392D3B768D296BC70F13851A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 edfe0c0a082292429072f06187f23dbe862e182cd168b4ae866826b829fb6e69
MD5 fd8b04e34116234972c676c5cf665f69
SHA1 c3841725c6cedbdbe25aefde9b6747c74e924611
SHA512 e1bf17dea5719d6af7c57affcf0404788592f6130c4619d56435758f0d36d62788875e39c996f9826f04e42d0740e7391978db5c5e85190abe3a88dea53e034d
SSDEEP 12288:lDiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9i:lDCMO//35gUKSJozCh9bEs
TLSH
T1E475232448321DA7E4D068B509D734197A617FE6FACF2B392D3B768D266BC70F13841A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 31b5764280644deb5647a75cd12d2675853e9e53c14e9d78635fc2d6c5b93785
MD5 7e476b6db18310d849ec6e6c27f58d80
SHA1 793c8c4af9f885a4f95ade1e0208a2877d3ef181
SHA512 72a6c8e1d6518eb767cdbeb3a766421c8470d3382a789def98705093370f5895df81c23187653340c6c540cab6bf4e10a5d152a8746b9cf836eff7b40b3d1463
SSDEEP 12288:piZwb6zzFEoS2cPvyLiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9+:sZMSzFVSOLCMO//35gUKSJozCh9bE4
TLSH
T1CF85026473601CF9ECA3813EC9565806E6B27C6A4BA0C62F07B4365B1F337A05D3DB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 181ed382686750e88ff736c3305311411c8b97db56358428b3df7d77760371f4
MD5 1404818a4fb5c076ffd7b288b9e41554
SHA1 7b5c0fd2160d33067a9cd7803159483298729cad
SHA512 623ff2e1224337f6ceb110f71b85219d06fd684429d0ae058f317c94479f96ef834e1a7a4853af3930b31a844829075f3436a7f0a4f7650bade79b9c885f7950
SSDEEP 12288:R4iiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9u:R4CMO//35gUKSJozCh9bEg
TLSH
T1B775232448321CA7E4D069B909D7341D7A616FE7F6CF2A392D3B768D296BC70F13841A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 dcc01bb65321abcfff6a0c4c1cf985b6148c55d9a813c9c32000915607c7333a
MD5 447631c558bfae7c8e59a2ecc17fea73
SHA1 2549c0de0c890290a643d4d69a6bc4d8b6c2f5ca
SHA512 882b9652393466e287590947379896dd352ef6e4768a5fde6aa31d8b648f32a7cee4c7ceba4a99afa37048e8b9bf85f550b613466ea5285b8ddfbd3bb91e4bd6
SSDEEP 12288:TMiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9u:TMCMO//35gUKSJozCh9bEg
TLSH
T1B2752324483218A7E4D068B509D7341D7A616FE7F6CF2B392D3B768D296BC70F13851A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 c785a845490560888e4ccff2e91d46a711d51e0133a1abcca5cd653f1101066c
MD5 15ae24b10c578806e2da58d0453ca49e
SHA1 005e1c0f1ccaa22a9e3571e294e92011a77b3992
SHA512 32ad8a23fe3d4e3e251363926a780e1fa1b6fc8df615e229ef2a896a1b1dd07841f8d88fb20da391e5bb89673fa245f72de21a93605801d3e224abf19c534b31
SSDEEP 12288:iyPz5L8viiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9T:/zyvCMO//35gUKSJozCh9bEN
TLSH
T1D7851217677130F9D0B6913888A21906F772787257648F7F1760077A2F27AE0AE3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 8118fca36accbc0e3d5991e47ed610995e863b61fd6bf628194f316956892388
MD5 e42326b0132846546a9e833c09c245aa
SHA1 e804b3894e18960c3935316e6cf40975ab064945
SHA512 540cf3bb28393412096a61d3f9772b33c69cd5b824e8df4914f35fd2ca71d16f3e26cbcb41583c505cfbfc21a9e2ec8d262caca862ef3a0aeec7235838ee688b
SSDEEP 12288:t4iiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9g:t4CMO//35gUKSJozCh9bEm
TLSH
T156752324483218A7E4D068B919D7341D7A616FE7F6CF2A392D3B768D296BC70F13841E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 5d36e328c28def08db475a35b249dd9ae8382b11318074735e620ec0b713d0e0
MD5 bf4480f7e8f0cf102937d5fa5de5c050
SHA1 256ce07c20d55efd2e505a4ea335b7a439cde4f6
SHA512 273722be3f27ba9447f6a61597377b1837956d5c1bfe11c400758b41fdf0c0fa92667c8a0c6a0b6983d230a7e9433fd4f68d276cde8974d55c13c2048c9a8c24
SSDEEP 12288:O4iiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9D:O4CMO//35gUKSJozCh9bEN
TLSH
T127752324483218A7E4D068B919D7341D7A616FE7F6CF2A392D3B768D296BC70F13841A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 d6a3260854b1db3e1b6e20d2a9dc95be5ea1da1de0288311f0109738acf06f41
MD5 855d1645165d692a1b926eb26cf0b020
SHA1 38de735775540220d15fb216dcf4d7c5e2697e8b
SHA512 6bfa435059f0f4866d179bb3d04c2b5fb809e35ef9981cc9718872518b3f9cb59b97e10d78a13ccf0a923e9d7d0de1bc182c6e00876d77b6d10dc886c4781b4c
SSDEEP 12288:KyPz5L8viiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9p:XzyvCMO//35gUKSJozCh9bEf
TLSH
T117851217677130F9D0B6913888A21906F772787257658F7F1764077A2F27AE0AE3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 c4728e098759f4f328af7df3d82643f1e81d755cc891d73d21dc0bb99a2e9c76
MD5 23b81ff13a9587174f726cb1c02a050b
SHA1 862ecf3c4bd0c4fdbf5a24875f7721904fa1951e
SHA512 952d3b52a5d3a9c0ae0567567dd54d58f0393017ca535717c80fdc6b2ca9ad926118197b50d809e94165ee75cbb3ba0c399263f488de4fd7cc66bc984fbb13ae
SSDEEP 24576:CTHaLl3z0zDxCMO//35gUKSJozCh9bEE:CT6Llj2CN/3Hh9A
TLSH
T19C850264B3601CF9ECA7813ECD565806E6B27C6A4760CA2F07B4365A1F337A05C3DB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 2.0MB
SHA256 91e3ff058fa130b808469c56ee7d065ca2a5a32fb2bd3f70ce9eea8c8debc1ec
MD5 5f15fcc69c425414730e98c2acc87431
SHA1 ab2f88dc2fa8757e07e174631633e4ae65d8d213
SHA512 a94b3736ff67360c9a73a269ed1d10f20bab3e48caa338e9a1e36e01968bb6bf4d3afdf006b25c86f13bf9d9305b5b5ddff1ef4765bd353f9028523d906dc7f8
SSDEEP 24576:e37d9CHKy7GZ9CMO//35gUKSJozCh9bEu:g7d9CHKyaXCN/3Hh9A
TLSH
T1E795DF90F3E414E8F0B39A358D765511DAB67C9A5B71CE8F03A4261A1F33AD19D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 ae52be027ff47d221f5b1dde3941c18ff7531fdc571db89c95cbb54537cdf824
MD5 be719fb5e3a6162338e6fd99faf1409c
SHA1 cc39a160616f33091aca1b8382480b6fe4944624
SHA512 223e1cb5b616dfd5a7ea84f5f15b4ce86bd2d857bc512dad9ad36c2102687aaa2e60b2b09c1e53a8480ed1cd61c1148272c253d3ddefa5aa1d313dbf531fdd5e
SSDEEP 12288:8BiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9r:8BCMO//35gUKSJozCh9bEt
TLSH
T138752324483218A7E4D078B509D734197A616FE7FACF2A392D3B768D296BC70F13851A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 591d6efffa1d3a7f9a2f3c1e541674507fc0e363ff457a23b487231446d47852
MD5 31be391ba7cd4bec607062f29667efaf
SHA1 2c5737a0016c2e2d2260bf54ea673cec087d20ca
SHA512 9bc452a4a0104fc5e78d3c3d249bcf4d63efe6718fb6d6499b0b53878fdbc82624d15f0314949125743b5dec0c5ebaf956ada3bc6a5ea6914e475b1d8c8ccfe0
SSDEEP 12288:9PiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9X:9PCMO//35gUKSJozCh9bEp
TLSH
T1EA75232449321CA7E4D468B519E734097A617FE6F6CF2B392D3B398D296BC70F13441A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 568e2943912e5aa3d289f73bac39612d2dbe99a87ae7a5d77a3b493a564951a3
MD5 3ecb4ea7075c471169eb975dd6b70485
SHA1 6c09517b60042a2beddf562399be4e81e8ca4283
SHA512 700bd3871dd1e6460d5f5435cc3bbbd49bc48e2a0942f41f1e0ce6e83618850b501b3e78bc85f56f0013063ac9e894e99983d551188e406138da62da0caeae69
SSDEEP 12288:MuiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk90:MuCMO//35gUKSJozCh9bE2
TLSH
T195752324483218A7E4D069B909D734197A617FE7F6CF2A392D3B768D296BC70F13841E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 0a9527d815edbe5370f95a0cd987fd7745df31b37512d4cb4f3deb0732585478
MD5 7a7e2de8e0ef515155292687e895b0cd
SHA1 f57693ef04b787b0ebec0d2b35ba7fd9e98789e7
SHA512 4c91bb5e444fd2ac9d9b6c6be0116cdc094c7b6081671a97c71d38d8c2c911aa674973c1269a399875579a7bfb97b9a6c5dbe9e5e48c2833c65bd8ef2e83afff
SSDEEP 12288:N4iiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9/:N4CMO//35gUKSJozCh9bEF
TLSH
T1E9752324483218A7E4D068B919D734197A616FE7F6CF2A392D3B768D296BC70F13841E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 d8344f259a344a70a122cbe359880722905753806820af46e3367a55fcda54dc
MD5 34d7522acaffb8799b03e9d318795d32
SHA1 529783ca21e861f0c2d2593ee1c7dcc9a58bdb2f
SHA512 1f3568d1ceb8ca785d28a33ed21fa4000441076944f9376eca98108e6fdc599355cc1c993802c0c5b5afeb224f355e583e8146ca053ef0f773522a8e619abc6a
SSDEEP 12288:kBiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9T:kBCMO//35gUKSJozCh9bEZ
TLSH
T132752324483218A7E4D078B509D734197A616FE7FACF2A392D3B768D296BC70F13851E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 d74596dfa96a8b2ad14498e850080cdb062f9c8dee17f8adbaab51f6c9442644
MD5 6c263e57a3e549e41000fa06f3ecfd64
SHA1 5852494859ac32710ee2e6c830d3c0e653d019fa
SHA512 5af30c61caaee2deaa5da51844f6dd3d85bcd5c16317c0a41dee97ab165beb1c4ad92bc924ccd13454ea271f719a227527ac030279102e63d277204daebbaf88
SSDEEP 12288:LwiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9X:LwCMO//35gUKSJozCh9bE9
TLSH
T1BD7523244C321897E4D0A8B519D734197A616FE6F6CF2B392D37768D2A6BC70F13841E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 d74ee3a6db72e44f0e4071168cf621955e03505991f1635a07e6f65d448993bc
MD5 ec0ca8f2625e0ef73304e124a0c9776a
SHA1 728db93a4745af1869b398efc71f6663698fb7c1
SHA512 fbf82d4a49f6e5abed4a026f5d4980bd773da990298bf04d08784aa85b3e57c62b1f4a8bf2ef6046b6f14641aba161739f000f24f2dcb1652a8616da6af01c83
SSDEEP 12288:ayiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9u:ayCMO//35gUKSJozCh9bEM
TLSH
T1D1752324483218A7E4D078B509D734197A616FE7FACF2A392D3B768D296BC70F13851E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 d3a763fcfd80a55682c5e391295e9dadac1c42a0107916157e9ef0ea7c956b7b
MD5 0d20eb6b2a2803354dbc7567e484e258
SHA1 fd5a61c9099f6bc3f45ebb487cd34197aafaac4f
SHA512 c078937a9a0da541c1f15c567daec067859d549c7543474bf272965c004799cb48dad39795be1ccd5ae7aefa6a7b5c51c179a18209f501092ded84e6011c9b84
SSDEEP 24576:Gfwvok9RX6wkyAI8CMO//35gUKSJozCh9bEK:KMnYI8CN/3Hh9A
TLSH
T1B4A5D029EBD804E5E0B7913C89F7460AF6B178695B31C6CF025A53AD0E37ED4AD39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 286797885e4c516fd5fbdbb17f322ed36b1c806178d76248a3ca6610a0701a6f
MD5 6fc50a09c9781ab0341e8f05b006e74f
SHA1 5458bb493a0c3b85f55b7329c783b6839eeaf060
SHA512 94eb107d7e0078000ff6f1efb0a547fb5fe26ddd377ce176033d80fd3c6cbaf7d8f2114b8dd0a0cde8222870eb04241f97b826904680a54adeb56db7b0170a6c
SSDEEP 49152:nYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0VCN/3Hh9A:DySzP9CN/38
TLSH
T1F8066C56A16801D5C1B9C1B98F1BCC1BFBB134490335ABEB02E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 71fb203417186c2668f2068b57ce6822fc6555c517afc43905c82fdc91a451d6
MD5 838e37518da426fbd19c4a0b31d2c6a9
SHA1 560b660f4cff1d1b55e3acf8ffbd8df8fbe9e66c
SHA512 3b25eae8b54c7367824de572af46d72c88be1ac2e27f1357937908d0700247739069685588e47269eaff0afafc292da5f7b2de27b9299f42b1e5ae89050762ca
SSDEEP 24576:G47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY7CMO//35gUKSJozCh9bED:G47JUQj1irIhCnDHUPfF/FCN/3Hh9A
TLSH
T16E65AE1DA3EC01E5E1BA927885154A1AEA71742E5F32CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 d134abe19275655d12f26e5c61ce700eb43d9c79d1db155f2ca771d250fa84b4
MD5 38aedba5b6bff2f0a0ea2f186a4fcb55
SHA1 df6a5ba9c1921d7167468f01eac33e9efb914897
SHA512 376d9214ed46c2e17502036ad5960987114c458807e2ff511c94a1b9d32ff64a478b67262aeec3895dfa259e37a6ea2b4dc31be68dd9deaca9f70ec58420f391
SSDEEP 12288:QNsfIiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9j:xICMO//35gUKSJozCh9bEJ
TLSH
T153850119C26402E9C0AE6179C7965A01B3333C6593E2D3DB16D1F57E1F3A9A0ADF9B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 6e68f4615968bdf64deae3e619cb343fc27f6b829635d2d040fec5ad4f1fca6b
MD5 29392f30391c2a70a77e22858e91494b
SHA1 618f14b0e4f572f2f0c15d0e25ca1717c134580f
SHA512 fa845de22d3e5822a5e8d609d1a4dffc921f0c9d6f40f72603be27d3e17753fb72c61e4f59257c50c2f684ae7d34e09c807968bacb94f43cacf1f1fe593e85da
SSDEEP 12288:RpC6U3fnzEnRLjbhhmXX9rB2OvHrm04cjqhPnJLtpq3Q3SSdsuhA0:RpZUPziRS982KV+ghLtp+QDdphA0
TLSH
T1534518407666CB8FC66D40321E33D1CCAB707D51EE046F0773C98B3F9576A59BAA2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 b1d9cdd989d6fc7a4acc041e45d882ccfc721a63d1604806e3b070d0d6be02a4
MD5 bd578505cea784c736dc95ba7e85b139
SHA1 66b7cde15e9bfe9cf2475094d9c19f3ba38e69f9
SHA512 f05a3d30405fe527386c500445859e75d99dbbee7d888b8293a6da3fc77353e211e3e6de7f2c06804fe14af73717165ccc48b375383073fad4685275428e00bd
SSDEEP 24576:GDNfOa8khkPmq0yAwjcujc1s383s3Rjcr1rPTz:hTjcujc1s383s3RjcrlX
TLSH
T1E175F840653AE7CFC1B7603207365B8DAB64AC17B7056F2673C9457AD86BB01A4FA3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 54b4a7daf0de6ba76431e766a22be4ac6fe4a60e75441af3085a8787f8a7c0e9
MD5 a0086813b397ea85e5bea07a7679268e
SHA1 4990597f288cb49ff56275ea82b16d444de2c7c3
SHA512 7582aa7bb14a9c04bb5ec7dff99297f296a68eccd454df3cc398f7f1dcc5deab5228697eeeadcdd8544f0a509088ff5d9528180ee4e41f6d8a87efdd3853a791
SSDEEP 12288:kM7AiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9b:FACMO//35gUKSJozCh9bE9
TLSH
T1907523204A251C57F4F479B405DB642936267BB5EB895ABB2C27368D283BCE0FD3460F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 db54d9c589300a29b25e8cadf0f6ed0ffe94b046568f16190707c87e1cc04df9
MD5 7e3ece6f33456eeccb2f9149993673e3
SHA1 55fcb40bc9d3e77957c5f3dd5580fe3fba484b6f
SHA512 cae28302cf067ac4b08cc8b6a72052d6df38aafb5c8f689ef8af6906c221eb08d51febc72719df3d1665dc68feaa6328596f3d82a53988341bffb8158366142e
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bY2CMO//35gUKSJozCh9bEr:egb4mBIBhGF7CN/3Hh9A
TLSH
T1C965AE1E22EC02F5E0F5E2B8DDAA4417D6B278160732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 d86b70b453a026db83966a1f63e3499ff55cb0f0f31c68d3b940719e82d6ca4d
MD5 1894f7aef01c35785db22943b178c83c
SHA1 a39b7584dc60b5d60ad9a226c24c8667e65b712e
SHA512 e7b91671fd2fcb002e72e50fb4f7cbc061ed1877776140a42d99b4d52e9d94e84e221b78f08c23fee89cfe7be4826bb9c5b0920f323a5713481e87898ea87170
SSDEEP 24576:TG88u8FpJqH1bzria7/mLCMO//35gUKSJozCh9bEe:i7ZFPqVea7/OCN/3Hh9A
TLSH
T1FCA5012567E101F1D4B7D13889864663F6B2B4250364EFEF0BAC8B551F23AE45B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 e265dcca6c415db2cfa70c56634d0eb120a2be635dc02d7089c2ac66bdd93b31
MD5 9e0eea13ea8a4a52ff6c2862fc285f78
SHA1 d9e2c93240341b1b55b91ac445ca944a21624f3c
SHA512 056aedccb8ec35202e0313bdf7f8fa6459d73ca8c038e5f6603873d651220db29dc084bf768796a4ce6c7ec07be5778db1479842675d33c5fd4afd56b39c2d49
SSDEEP 12288:rHvUrBFrEjwaQXiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9A:rPUr+NQXCMO//35gUKSJozCh9bEG
TLSH
T14F85F22F26A91CE5E6B6E17D8982460DF7717862131292DF02E1817E0F67DE8BD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 928b561fd1e19592949512f8015cb35a2dd08210d079e7c8767936b3e6f4d891
MD5 25808d413b4fc65541ca4e0201178d0b
SHA1 0f7a5319bba72389e6be9668c84f3761300b7396
SHA512 13ae7275f21d376332db5f8274defdb741fc9da9a88ea1c2eaef62aaa8db6e5c0430cc04301ea467094d23aa4bbfb10e785674d2526cb137db44660c0ef7e821
SSDEEP 49152:TBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjnCN/3Hh9A:8G05lO43bUCN/38
TLSH
T1B4D5CF6A62EC11F9D0BBD17CD9C6460BEBB23425033556CF02A486A91F27FF4A57E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8e0b06638090325218aee3ab9228249d54316ccbe5a6615877580c6b128b973d
MD5 203b95b71ba38ab52656637367589dd4
SHA1 727377f89cc4c38014f18a7d41642c1395954e2c
SHA512 8f5974ec46ec5bb7f399c53fa5473da1f162cabb6cc186da4abbf66c374201e0b23ffdaf113f4cece7ca5fe1bdb73d6d479677597af3aabb72c91f60085ef122
SSDEEP 24576:xfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnVCMO//35gUKSJozCh9bEP:Ra5POZ3+Jt2pasx2+mPCN/3Hh9A
TLSH
T16965AF5EA6F801D5D5B9D17DC583461AF5B1342253329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5201462bdd9495374dfe2fe73f12a44ea5aa674036782d2f79ce70644d7fb2b5
MD5 e073943d0cda896c3138c72190af7f1c
SHA1 ec4a5101e9a2ed3eeced2fe966253b5484a93929
SHA512 da964ce7289cde897154c0698991546a69b6f2a63e5c804d4eb7f33a519f96e0e6a3e89b7dde72cb1ea5c8a72f8b06b6a6fa532b5390bdc09f4a044c29b53ffd
SSDEEP 24576:WNcwHdjbyQ4nLC18lb/EOjowL7FkTCMO//35gUKSJozCh9bEL:WNc/zEOVHFuCN/3Hh9A
TLSH
T188858C1622E901E4F1BBE1BE89779546FA71786553348ACF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e0fc337f5822cc5d12ca4bfb9b6c7d3717fd69738f3ca877ebcd6a582b8c9b5a
MD5 3b7117654392eb604dfc432bab310950
SHA1 e8d6e70128de9aa3e04bd2139e021f818c55e887
SHA512 1932ab70b814eba73ff2166db09492993e056d04d11a8879862b90664fbae4d8aad2aa397ce03b09cf71991786891795910b3fbd88447bff0c173df9716b9095
SSDEEP 24576:R8kNvNnaFeYhJNtmZBmpCMO//35gUKSJozCh9bEi:R8MwBtOmpCN/3Hh9A
TLSH
T17755AF2EBAB846E4D1FEC6B58D238512FA727461173293CB5290C13F0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 52c26af1dd1a540c361e4b6d10ede9d80c5ba29623ede71135da8bf499c77e75
MD5 17699b02a99b664191d24ee10b267b59
SHA1 4235e19d1c3acd81bd28605aac3ad4978fb203bb
SHA512 646799156d5bff2f4273b966dd5d4fbb4ed2cdb0ffbc631f83e7e335b477ba809fcc11d567bd8e8a216c2b4c2c70838ae65891123ccf376f1debeef534a4102f
SSDEEP 24576:OD3FHshBIYQgAECMO//35gUKSJozCh9bE7:ODVHeBIAAECN/3Hh9A
TLSH
T1C395E13DEA5C04E5E47BD1BC8AA34906F77138A9032266DB059481BA1F6BEE47D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/268-77-0x0000000140000000-0x0000000140306000-memory.dmp

Download

memory/268-9-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/268-1-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/268-0-0x0000000140000000-0x0000000140306000-memory.dmp

Download

memory/2880-15-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2880-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2880-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2880-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2880-22-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3136-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3136-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3136-96-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3136-90-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3136-327-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3136-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3160-102-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3160-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3160-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3160-313-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3160-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3160-108-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3316-52-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/3316-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3316-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3316-39-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/3316-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3576-223-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/3576-55-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3576-54-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/3576-61-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3872-78-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/3872-84-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/3872-309-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/3872-79-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/4304-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4304-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4304-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4304-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4344-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4344-135-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4344-127-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4344-133-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4344-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5700-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5700-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5700-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5700-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5932-121-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5932-115-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5932-114-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/5932-312-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/5944-73-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/5944-67-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/5944-65-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/5944-294-0x0000000140000000-0x00000001402B4000-memory.dmp

Download