054e20f28e2aff8c19fca28cca4e2e57ef6af52aa088776d90965492156e634f

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Size 2.4MB
Sample261027-c8d28saz3m
SHA256 054e20f28e2aff8c19fca28cca4e2e57ef6af52aa088776d90965492156e634f
MD5 f08e20f932b377bc205e498fc2fd2534
SHA1 9e1d822c98acb17d084b551ec94a27d73eac5e8a
SHA512 b14faebbc90a3c060c7a91bb1c6bfd4fd9bbcbb70972badaaf570c778491e18756525e4f8333e01d4ef0c0a444076d90cd06fe0253de30d92fcdf948c78afdaa
SSDEEP 49152:Tm5Xe6XoLNiXicJFFRGNzj3karSj8RoTCCW:FT7wRGpj3kJTy
TLSH
T1F2C50159A74445E0D1B6C23888539846F6B17C048B71DBCF4298A73E6F77BE19E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 11 IoCs

pid	Process
4092	elevation_service.exe
5876	elevation_service.exe
6004	maintenanceservice.exe
4896	OSE.EXE
4448	PerceptionSimulationService.exe
1436	perfhost.exe
3688	ReFsDedupSvc.exe
4592	SensorDataService.exe
4324	ssh-agent.exe
2404	AgentService.exe
4456	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\abbea5f7227843b8.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5948-6-0x0000000140000000-0x0000000140690000-memory.dmp	upx
behavioral2/files/0x000100000000932b-45.dat	upx
behavioral2/memory/5948-47-0x0000000140000000-0x0000000140690000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab16ba22bd65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000372c5224bd65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003030c523bd65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a6095a26bd65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f088f23bd65dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c00e7b24bd65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3371866bd65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008bf33824bd65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d4a5566bd65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6ad2b24bd65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000918a2a66bd65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe\""	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4092	elevation_service.exe
4092	elevation_service.exe
4092	elevation_service.exe
4092	elevation_service.exe
4092	elevation_service.exe
4092	elevation_service.exe
4092	elevation_service.exe
5876	elevation_service.exe
5876	elevation_service.exe
5876	elevation_service.exe
5876	elevation_service.exe
5876	elevation_service.exe
5876	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
832	Process not Found
832	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5948	2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
Token: SeTakeOwnershipPrivilege	4092	elevation_service.exe
Token: SeBackupPrivilege	3688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3688	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3688	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3688	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3688	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3688	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2404	AgentService.exe
Token: 33	4456	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4456	SearchIndexer.exe
Token: SeDebugPrivilege	4092	elevation_service.exe
Token: SeDebugPrivilege	5876	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 1092	4456	SearchIndexer.exe	100
PID 4456 wrote to memory of 4304	4456	SearchIndexer.exe	101
PID 4456 wrote to memory of 4412	4456	SearchIndexer.exe	102
PID 4456 wrote to memory of 2428	4456	SearchIndexer.exe	103
PID 4456 wrote to memory of 4544	4456	SearchIndexer.exe	107
PID 4456 wrote to memory of 3192	4456	SearchIndexer.exe	108
PID 4456 wrote to memory of 1172	4456	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_f08e20f932b377bc205e498fc2fd2534_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5948

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5876

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6004

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4896

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4448

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1436

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3688

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4592

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4324

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2404

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1092
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4304
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4412
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2780 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2428
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4544
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3192
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2780 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e47998ba571a00071516f3d9e3c7c2dabcf459855912280e846533265514cbc1
MD5 4dc6eb6bf316e13dc8f1d293def80d4a
SHA1 187b67648dd32ecab4c35b115c6eb0b5ab06d1eb
SHA512 09c2f7dca265b2101ee9907a6a37c60c4f29cbd5b21cde131fc1fb6943e6aad6f78af2b60583495d0c2c1a7f35050031468c6185329a7d40adaf345282e9dcc4
SSDEEP 49152:+b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnCLNiXicJFFRGNzj3:A3q6mjBh7wRGpj3
TLSH
T1C0D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 3e4f18e3293967bea3c81026415f7d296705278c146e13cbfc20baa77ba1f402
MD5 7310f5a56cb6ac5b827cc8e0f1b87021
SHA1 58399c8fd1391d8eccf02b3fd23eb6d09613f1e0
SHA512 f0b44e0a3babe12fac2656236db996e25dec4757134ead0a302e2131b3fe48d2c6a6091b24913bfabbf8ef31f9f39cdc976371f63a6d7546961c54ccfda4241c
SSDEEP 24576:TXYfDtczA1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2tc4LNiXicJFFRGNzj3
TLSH
T19375012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 c938203f030976e7c01d68c072f11f89ba116f0b69f5bba6486ab78c2ac6d637
MD5 a92ba029dce7fba7d2b4809601c5129e
SHA1 da85e95241be22d8b3c12185344d6401db078282
SHA512 f4e480b436b6a5178aac2f9dfe335af1ac20c9aad46df3128fc65f5df6cd62ed59cd2e0a6ca3db5c401948b444144a39b492f39798c5ca1358761f5e8efa93fd
SSDEEP 24576:e0Le5ji0hmxhrM6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ePji0AzvLNiXicJFFRGNzj3
TLSH
T1E6859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1bc71a553c3e23e2744362814a218cd3380bc86d6bd5a3ac636627dc612e8cf1
MD5 e9559b9dac290ef387ce32f17cbca56f
SHA1 62afef69b4648d45cdaa6925485dfe9891512518
SHA512 73d38727f5ba0fbbfbcd45062dd369107eee7bd52539ae053295eb2ec61a1c23ab36988a2ddc7a370123c8224c63a40535215f32309752e50d85155b07cefcda
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWj6q8wyuI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:R/ezSC6vUzPv+HjyDLNiXicJFFRGNzj3
TLSH
T108756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 34b944c028578eb2c28d20ee90ae1259645911e5aec5526ff7233a695c38a445
MD5 bea59d157e102e06cc35b009df5d5494
SHA1 c35e05c6fc80a182e39b64b67ae5aed8ecec325c
SHA512 7721a47c8c7ada2f8be972530586d87047cf0bb5c93a4273badae51eec7142cd785ccec7c3988d9c18fb844f28d310187f0110bdc84a7580215b5f260b82e6be
SSDEEP 24576:dVbqPb88hv/l+Bx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dVO88hXl+PLNiXicJFFRGNzj3
TLSH
T1CA559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 aa5d8a0b26fef1b6b6a3aa009285b342a68cbabc9adfa3dca58cecf3ed3ee2ae
MD5 31f42977c2b8f715c8c2ffa610a0d846
SHA1 1a45e4dd5f5ecfae96185c9cba4b9683b68187b1
SHA512 2912c1702973d81ff89080dc9b0d58ab6bee988edf1d57ba8ef0a1d2074062a089b2c7ef3491d81a037a7585679e5000c44a8a89869c6d1951c015c5c9c4bf7a
SSDEEP 24576:BGm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1LNiXicJFFRGNzj3
TLSH
T1415523D3468854B1FBFD0039867A5828B5845E2CCA695DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 0756d3627bd241b6d195269fc19cbfb513c950b988b389e05837a9e0d5fa49b3
MD5 a3a5862be3466be13ec11ed14228b823
SHA1 a6b88f257d4ea81d6be9bef742ab0c4a7b56feb7
SHA512 10ba850565f368228fba1f51fb1745de5c267bdbe74f4333281df13d91c55bc0e14322bc301019c096a6625a8d9b807204ddac08a000e5a63ecffee4b79a4820
SSDEEP 24576:FJIUp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FJIUpLNiXicJFFRGNzj3
TLSH
T1F875CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 514f14b998b0a6693b18721f674f1c5245af82bfa80fddd8f0a9eaa974b5bc79
MD5 016e41586ea47122fd81a1199b378ab7
SHA1 b07027b7300e7dc296b2ae32c5698a5a8be50658
SHA512 0ef3915d401b5c24ee577a922e2717377824dfa0ed89def8d13bd610e10ba5ff97ef9d13d2825bfcaefad50ce4e70736ad20e2d24be106e6406b83c6516f879a
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THp:xQvGAdlCEL8c/WRNw5CY7wRGpj3
TLSH
T15F266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 ceabf300908e4669791f9fd317d4e6a265a04f8cc1635b21a3c98b4ed6631209
MD5 8ad0bdd6a35573f4cdc46b942eca6d11
SHA1 d835afae2843894089d0d1cc08a9f7199365be12
SHA512 d1fe5a9983ca6a0f1ba74148f37a79d91103d5befde8238f945af5c3a04862caaf58bb7230152d89d4de8cbbaede6054b5ab625a2dd0dfb0fabb38bc851e3c68
SSDEEP 24576:DfewsAj//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Tlj/LNiXicJFFRGNzj3
TLSH
T1C075E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f91eb198d5c64c5c75beee91bacb9c97789609f9a569f0bce017ff8971e060ae
MD5 8b706066137f3cdccf350e474808bbeb
SHA1 bbcfe669be8ab7556b4b6b25897dda77dee1d5ab
SHA512 1e08f768c87daa342c67d379f2c9079ec6023c5408a6156f4fa1d353b8e4feb11abffdfd283834c51c5b445aeaa94eb6abcfd182055975e37385e37cdd89f075
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH7F9:WUEtQevvqc2W1cpV20I32p9
TLSH
T187474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 aa88fc2808d609a0dc01d37686b567eb3f6748131acc29f378a26f3ea2fe43ba
MD5 ec3a4112f917d16317690e012391dda0
SHA1 4084a4bf56634de80e3d177f1a894890a42f0d7a
SHA512 64a2901458d3dcfe589342a1f6acae33ed50922730c951bb42f65e9bb5ae1a2c1fda384536aa91a0279b9d09c4d7188ebaed4e2c26ee9e42ca259e22dbe44392
SSDEEP 49152:hCbRquA/m2yL5zLfFiV+XenmE3/zfLNiXicJFFRGNzj3:Ooq2Vjnms7wRGpj3
TLSH
T1ADD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e496a7d478370f8a0ecd7c4edc123131e2818381c80dd034334be833c85043a5
MD5 ed1c7ab47bd6b98e7a7a4b370bdd031c
SHA1 cc359a6e6ba83ee3281aabf8e9b34041bd856913
SHA512 50980a619d506b9e8b4e0b88a041cffc2b909b44d974f325dc991ba69e169ae01451f4c120f840300473b740c0599b5fb1373957ff1217d95ed282badff88db1
SSDEEP 24576:MAhGL6IFoiwtA5l7S53M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MAM5Foiq58LNiXicJFFRGNzj3
TLSH
T1FE359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 20948b7c2a2d01a474259295d9399a76789c610bc750b1e76ca3e383031e428a
MD5 115ce09c207d9b9b1681791c78d819d3
SHA1 0519d13419b6fc4b4f09124b1a12cece120a6941
SHA512 110f0750344e200e1261141c8789837b79217fe038e99d8c4bb8319638aa36ad11e4d4b908ee18b98dfe9172080234899f7c316ae555bd62cbdb1215dd8a789f
SSDEEP 24576:KwuROWj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KwSOgLNiXicJFFRGNzj3
TLSH
T1F165F18632940CF9EABA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 657a3642a4fd723703af86688413f8bea0b59ef6a3cde21d2bbc92f35a78c0a0
MD5 d80ede3113230a8537ad51f758c645c5
SHA1 9c14c01f767a416648c67e22389d2cf1da37d730
SHA512 22ba9f948f841735bbaffc25dc6ca2f169ae85db101255150433c5405fa454f745c6c6a73b3c217d22fc4d0f8707b3b683d18e63f9a0f33c6bd904344be74872
SSDEEP 24576:BZuS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pLNiXicJFFRGNzj3
TLSH
T1C755129622C820F5E2BB413DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1ce742846f9c5710eac7b0b80a42835b47eb983a089ab20fe1caf688a0fc48ad
MD5 e5a09b0650eff753f3443fdf26b986dc
SHA1 32c456e86a015b3e7db34c0717470f047d39ae2f
SHA512 33f0e8b0abd47aacc40dc18acb37592d7302855b8ce93bd1501994d3272eae1e40b1eb4c423efea6d639647da99730210c8dd5cb0e8ec4147096093096effb9b
SSDEEP 98304:NQRQyi36YOcPDLvw2gAf+PN3t7wRGpj3:kQyiKanX+PNhF9
TLSH
T1E6667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8cfcde351fd9411548b9b990378f8a5d4d1bd2134de5de6b8d21269d4c7971c7
MD5 931969779cd10e3c57c4fedede15128c
SHA1 08c1542fe134fc633941bc968cd71e84e76c8a4b
SHA512 51004215bb83c52c95da78d8d2792c83b4f292f47415ce7e74dc78afc3f47fd2374160a43e69ee898235f376785eb90d4508c7b5ea9f14f293a6b46170fdec0d
SSDEEP 98304:EQRQyi36YOcPDLvw2gAf+PN3t7wRGpj3:LQyiKanX+PNhF9
TLSH
T141667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0d3c3a7e7c78ab4b7e937e17afddc1bd950f701dbd4a5e95cc9bb5544af3cbc0
MD5 1b9ca90aab10a49efa5b349a13c42948
SHA1 00dd46faf3b553ae9dbe1d864d5b5c81bab8c1eb
SHA512 bfeccbb4717f5eb603fbd62b4299f06859193b638594e197a4dda734ad4eb56f09dab14d2b46862c0f2f6a6809402c096985024385a89d07b58814c9d84c07d1
SSDEEP 49152:168Qg55nhkeWu7PNU3/vLNiXicJFFRGNzj3:DthTRc/v7wRGpj3
TLSH
T1AEB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5b06e01902355a17fcb6fa030c0aa4170223dfafa7e306e5a66a86bddb364cb7
MD5 498aa06276dfd26f038eeb906c5e1f4f
SHA1 03e51306f68d7c50592410ecb84af3d93c33d8dc
SHA512 18ba80b075bf0fff955e3854e00aa2a864c5aeae8b60f4fd1feca2998ca5f3053c723190c54ad0c3dac13b8f692511dc9033101a271349a85c6be05e775f767f
SSDEEP 98304:9y5112gYy5azzVvU69nLKnhZm7wRGpj3:gLIHRWhAF9
TLSH
T15F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 779a90b1e536ce647e36b674c26ee5d1d27225c2d4a954dc944a8feacf88485b
MD5 dcf003a63b42609f45676187d5ae48f1
SHA1 3fdad8e534b216c7be6423726dff202855ce49d4
SHA512 a860cff2da1a17f7f2e57afb91970d3b1f245904e0caa2d0b726bd3f641528c2278dbea3d634700740a58b9f5823cee75c509e632244e1b212c95b0a590d0810
SSDEEP 49152:yB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glvLNiXicJFFRGNzj3:Au6JmIxd2dv7wRGpj3
TLSH
T1F4D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 98788e67eb2aafefa1c7916d061c51ff8d95cd7605fd6eb15e5f4dc02e395322
MD5 7de8c4f7b77019b2fa2138999ef61ca1
SHA1 a2711da6c68d6a5653212cafd0c628788f60d416
SHA512 5aa5601e549e490aa7039e852102508799d4008753b28a43d8e2bdbd425fb84c59fda8ad30f9f11839fbd38ccaffeb6ef4f264d350be40dad62b84607bdf6dff
SSDEEP 49152:W1hpsNoJpF1A67U44CwH7R4xJLNiXicJFFRGNzj3:WmifPqRs7wRGpj3
TLSH
T1E7B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0c09b2f10bec447ec76965d001f52f0d566fe98d604692aca762dc0341da2d22
MD5 a3d62c0d21ef518fc3fb82423095747c
SHA1 044dc994a77fed5aa737f1e7ca9b0b65bb97bd79
SHA512 29290a2f309bd0d86276a08d092f4db0711d183959192c0d9f7f3eace3a4289f74921dd75ed34018944cb3482964c94773b6ed84214db97cbdf3842f628ebd3b
SSDEEP 49152:7SuZQIY0Be2KkRVtOnks6NMHqSLNiXicJFFRGNzj3:p5dKqi61S7wRGpj3
TLSH
T172C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 42e73b1e29f64fee52acb430afc35ccd99134deb60cd1823623626c8f719abb1
MD5 cbab7171a9c718ab456fe723a948f40d
SHA1 f816e7e19b9df32de0a6dc33e8d4ece7841d60e3
SHA512 65af71979c1d7435bf5965847e4ec9f20040b9d91a9f97331c6e2e308b09dddd4e5c19cad27fa4854f6f055bc706cc7be8dc29124614e1f0df34ae9b6406502b
SSDEEP 49152:VhtSn8EApI0figjgiDn0AP5w1LNiXicJFFRGNzj3:kX2iWphA7wRGpj3
TLSH
T15595BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1f5842700cd148f6220cbb2754fad37bbf44e44bc85ebfb87a9dd47bd5e5b998
MD5 8fb07e084477a04caedaecb402fa7848
SHA1 d6962b7f66ee5bf484021c6808deeb0dfaa1dfe0
SHA512 8e246ebecc9838ba9ea9a50ee2df6cbd3de0ffe5bb6e492f54ca32b797e8230d9610b29c13d0503c06102175c4fc615750c40819103dfff3f845efa17045bb1f
SSDEEP 12288:yUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:y+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17C5523D3558955B1FBFC0039C6755428F5882E2DEB5618E3E2083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e1780f4b68ce456aa68fcf45e4232245fc0b437892238fa0b026e4b5d4bfb561
MD5 468a55071111512e5eb1583b1fa9846d
SHA1 d3f41d1c7ffe487044db0c09ca82d1e26a647d38
SHA512 de2526a285889c1fbb3638e6003e5ee8209c21da45ad341066d6f2fb1b60c77e9b0559fad17be003477cb6ae25bd5dcd158eae82bdad46e09c646e6be0403936
SSDEEP 12288:D/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1775523D3548955B1EABC0039C6755428F5882E2DEB5618E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 bba4a63e6cc7581b37d64cc21048792a56b701568b6204a7acc9f9a81dd9f185
MD5 08bbdd86eccabf791740afdc7feb1469
SHA1 47efc0c4c116a0665f7827f2c7a88cf23b5a2239
SHA512 311c3a314623b09c6ea6be6be2e02c3a123b88a1d599d24dc2eef4dba45eb52601f9e4a8abeb4c5463da11a83e3ac9017b3002aab1ac9ae6cb7ea56deaba066b
SSDEEP 12288:i9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ih/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1815523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 218c3492d3e4134b27387bf11248c10feb020aea89c0b968ce2637c151257418
MD5 9e32be3bfd5323a005b6aeb6c82db44e
SHA1 2a12825e53a0d38739894a2e65311cd1e0494fff
SHA512 e3406a02822a3d1e6a5b044a196b795d8a85fa8db678f4d44ffe5bf2b83aa509af0163d75b24d07a5586cb0a6f158a9c619dfc28fe6218c0af520de8f84cc0ca
SSDEEP 12288:pVqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:A/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T153552392168900F1EAFD803DC6764424F2A47D6CD7325AEBD3003D1E5A75BDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d107e4dd3aa049e271b46bd6dbecf19d8c60107dfae3487bea73b1d0d68273c3
MD5 ec1145771d127f1fae03dda290f00916
SHA1 353009a39f33f75733e72392a9bbf04dfdf80cde
SHA512 ac372f7e1a740b4a1c52441764a410edde78a3a0234e9d3ada9720a754a71938825dbe33d9cf425f4059bdf657b4edac39e4d039afad95f46ff1621d895a669d
SSDEEP 12288:QSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Q0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B25523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 208c3c2b9cc678e28871ce1844055aa95ba440eb4a83a30ab061d3600e098ea0
MD5 c4daea488278395290ddf7b0a41ef969
SHA1 5c843e9807b3bd1200c5112731f7d38d2dd5fc32
SHA512 e5027aea1127dc9f2f09257ee5a310b72435798efd0b4b3889b13f480bf163dc708dc291a4cebba61d3f3d1a093f141f100ecae4aade9c1d52ae43ec1d7818b5
SSDEEP 12288:IDiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:I3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F85523D3558955B1EBBC0039C6754428F5882E2DEB5618E3E2083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f74485d84a4769a7ea83bd0a19f8dca68e80ffd457a66517a9a7820f1761391a
MD5 694ffa12e6d1d74b485012cd0f8e1cf4
SHA1 120548f4e6dfb746ce171ad4cfef76f59120b67d
SHA512 bfe9befa1e0f89bf73826a48edc805b9a4ba1611b7347a29020e01724986059af70840b1df27cf932d7a33790e1df88edf682df545bc41158a93bb3f8fbde0e5
SSDEEP 12288:NniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:NT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B15523D3548955B1EBBC0039C6754428F5882E2DEB5658E3E2083D1EA278FEBDF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 4fccb868e906b9234ec1d634763a307158776b048d3b338143f3f4c27947e6ee
MD5 20ccfbc8fd13423bcf4bbac5b344f251
SHA1 ef314427ec69e7c2b161c12efbea673d86927d36
SHA512 ecab946c8f3c2b808798159ce939ca8adf160b4211aff9002103921cad34d44eba9dae3e182bb69af9bcf14e62eadf86750835b4bf7a07ea77f6b87bb7d3d2dd
SSDEEP 24576:gZM3zFVSOr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gZM3zfHLNiXicJFFRGNzj3
TLSH
T1B6750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 555d350a7545d42121e7fa66eea2b617bde2ee70882ee1a7c28c1c938206caed
MD5 06ec89853516dcbaaf85b100ee3eaf7b
SHA1 37cbc9746ed5f8043982f26d2ea59938921be715
SHA512 c2cacfd6d3d6fe4a46aa71221b646e5848538da21303be063611c182336f7acb25b57c4cd1e7f8849a73114ad75425c9864bc77a07d7d84bacf5100bdbfd7051
SSDEEP 12288:MwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Mi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1725523D3558955B1EBFC003D86754428F5882E2DEB5658E3E2083D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0955d4f185cc3a617804f9401a1ebcec9c38cebdfaf5b0f4bfa59a0b5bfd5bb1
MD5 984b50098ae10785a5e19aca109971a9
SHA1 3ae0ab478c2aaabb52a8b5d173e2272bfd964987
SHA512 a7ab023817328e177bb274acc01962e4ff380ef0d6d3d9c0da70a2e34f7805a903b32ec6d7111844f714fc859a4123aa3a99a2412ed61ba88a3ca6b99e3a8e2a
SSDEEP 12288:ZMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Z2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A45523D3548955B1EBBC003986754428F5882E2DEB5659E3E2083D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 ac2582c8f6ad9a8c5e835247495be5b1bd9169ba9e0a4ef3606cf18bfd511f2d
MD5 c6628fb66102aabb96f6b1aa19dadf37
SHA1 ee0adb6fa414ae07cf7da684db7b7939f31cccc5
SHA512 be2f5f7e8a5902fff444ad910284b82706ccf931bf9d63493a5ecd22dab5846d61402e5c149ee388d62aaf2279dd6834e66d94a0c8e9e1a8672e5442be01db54
SSDEEP 24576:ZzyP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZALNiXicJFFRGNzj3
TLSH
T16C650247629530F9D17A8139C9621911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 fc542dced5facd7d15287b9a854adea5b6fb8fda801e627cda2a34785d2b5d82
MD5 900e819e8fe4ca5263219a9ac71b3c0c
SHA1 7b6c8d19112d8112fadc99fa206c3c901c168355
SHA512 cdd7b39344a3a3ac2ccd5c3587721df672a069ae2e7800d079461a2968f1d88ef88efdefed14a95883027fd33fbb67b36a8c60a5dd3803441bf2549268706c07
SSDEEP 12288:twiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ti/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1685523D3548955B1EAFC0039C6754428F5882E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 415561806e211d4d2d3aaddb6a23b54adf6d928ba7a70f29b92b7f306cb1333e
MD5 71485dbc7d312d549af52b3c019405ec
SHA1 7f322025b5346f10efe47be2682f132614528fa1
SHA512 a34336f5f5bcb80563c227f1292d97f6f7065a352584e320a1c17e7983b92c92942bc557aecb5151956e9c6c0c32861a2e91de3ab4cbfa01f4e56f78c7adf161
SSDEEP 12288:rwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ri/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1135523D3548955B1EAFC0039C6754428F5882E2DEB5658E3E2083D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 7aee76413f72e9a50062a3a6cef9ab012fc26a719e4cf029946e109df49b4bd9
MD5 1e0fe68c22501652fd63fafd7c80c4de
SHA1 a9d5d7f2ea1e427ff29fe0ae16cd32873e25ef7b
SHA512 ea2850d5ab4a2d16af27bef1f41e4e5fe4b8ae4c1049f998f17acc6dbfcfa26fc6854bbd1dccc5df560ae93bc845859614d44512b811be23f0332925c7ac4cab
SSDEEP 24576:OzyP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OALNiXicJFFRGNzj3
TLSH
T1B3650247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 f9ec01dfaf0de91bd3f77736650f3948047e022ad5ae0861067b6df1192a7f62
MD5 4c737328895528cc843575e8719756a1
SHA1 8779f3c4ddd1fd6245c09aee3aa27de6acddc601
SHA512 d0b654dcf28d2b352e3d8cdcb98c86b954770ff4e285da2e37b624e87eb1752f969857559560d59be06c0cb13ace9ec6495afd4cbc2a8c4a194f1284167ea944
SSDEEP 24576:HT8aLl3z0zDR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HT7LljILNiXicJFFRGNzj3
TLSH
T1017502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 a9d87082897a134eee7e9dd54e247b39d800c4fd3561b5b3981059280d4d9b20
MD5 53de4ccf4ef4601a25cfaffcf8b639d9
SHA1 300ba640e32bf192da105d99b00177de97ced644
SHA512 ba6a124157dbf24c933e58e26b0aa2aae066aa4d2cdad92c6711c00023c1099f0c463878dcb43cf2c9f31a30815a40b6cffac312c50ed8474e4b21e5e99b99d6
SSDEEP 24576:n3rd9CHKy7GZN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3rd9CHKyaHLNiXicJFFRGNzj3
TLSH
T19985CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 8b761417517af7937e4fe46c57ba0098c5fb02c57cca090aa90e77a654fc0a60
MD5 c6a3b26573aa8596b0b920ca74e61bc1
SHA1 6b88d00f88bf5cef2bc66836d90ffcff70004b31
SHA512 5c45c6d1d49e773a7bb06f6b360522ce1cce5d9837bfe8791a7f780f1c0520a241522d2e20ce1a4930f0c9a26a995e7c5b3b6706eb4d881007d4edf99860f315
SSDEEP 12288:SdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C85523D3548955B1EBFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 ed0462dceabeb4a9b94cc7e2f077aac5e718de274f5c043e19fab82d71d80605
MD5 0892a4f533b5c80fba61623d4d1d7214
SHA1 b03023550d4f1114eeb28bde5efefde7e0d155da
SHA512 f3fb515c6595d19638dca126553ced08fd46b5e3b2dfaa4d33cb08bc9f140b797d951f34cb0f859c7ea2d4db7441cdb445899878d0192bfdbb147e261b1d38b2
SSDEEP 12288:37iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3v/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1265523D2558955B1F6BC003986764428F5882E2DDB6619E3E3443D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 8eb80dcf275b2d4152c8d3ee9d10e3b9db55cc343db4c0613db4bad0bce14989
MD5 24665c5db67a1f901cec2c162f66092a
SHA1 1a0fe68e05dd45d57af9edc45b38b33a507a376e
SHA512 ffc00d3e6e96e51d4f0b4d9db46d6bbac9cf5e897d175831a58ca308d51733eea0da82c338fa05396a98b7a8091ba94db0764740d291379c896d2cfcc492d78c
SSDEEP 12288:EmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:EQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14A5523D3548955B1EAFC003DC6754428F5882E2DEB5658E3E2483D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 e6b66f042cef911320f677bc4927c1bda411b8f6c635d51505f8bea9e5a6a54d
MD5 1fa75b785c2da3dfa78981c429464c21
SHA1 0aa596081cb148aed24a53f2ee7808383ab40a30
SHA512 a1d3e42bd7be2bbd870b36368b828538c118dda523c11aafffaa874021362e7f9b3843cdae75473bef99e5f12ebd41f8d845a608ae9949833568e9bf50eb7c35
SSDEEP 12288:owiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18C5523D3548955B1EBFC003D86754428F5882E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 d2a5941adb433a0dbe1e4d9e8aff49d11cf2ab4745438bb29fff2e38676258c0
MD5 d5707b9a260760ef35abad59a0056a55
SHA1 c296922abac76fac43c8a66a71038e6ffba2a921
SHA512 efe431ea5fc0465b12d2e7847ada7b0e6680b8eee9bcbec7812eb160eda09266dc16c02d532cdb5e52c3f3ab25ccfc9e3bb229974f0e8577ecbac1770220a6e1
SSDEEP 12288:CdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1855523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 b1cba81d4bebd19450c4de8925ce93a3e3d0a84c9083669594050b63ccd9dbef
MD5 e5d08a1e1ac0129379318bb3b068570b
SHA1 41876694a6517f59f87b75e0d584aa73e780ba1e
SHA512 70a24be751c94210d116a31dc3d146e4159b087a5e9d266a9c4cefeaa98b0081bf7319e8372829c52a3e4a904dccae798aabecaefb0e0ff098d48c55e832259c
SSDEEP 12288:yYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C75523D3548955B1EABC0039C6754428F5881E2DEB5659E3E2083E1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 7b02fe2d84ddb0197f3ca1a10a588493ea8b35f97b6e73f06a528018bacdd883
MD5 722937702edba9d157ce964ec426cf1d
SHA1 ba5e16a703b6c3a4b77e77d05abdbf498595adb4
SHA512 a21759302be6008e0981aae4101987d119d42f9fe8ac18952dad9752369e033f78d9b3a605d2a959c673d4e3fdb7aef566936dadeded0df1174f9aa7034ef780
SSDEEP 12288:5SiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:50/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1145523D3548955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 f1a212bb98920b0449cd50dac685b3e2b530074ad61e8f5abce372ebb491a760
MD5 ab46e0183bd038a7b4f559e4b21334f7
SHA1 260677122c3a30e977c0f893fb3f2123c4a84497
SHA512 836e50b2da3df36f32ac3e38d6c3acfe3fd883a1b8b8a7dd0ef06f4106630dd666171798794c081b3727da41e8f293e8373d77d0687ffb501e03501ae0e47b4e
SSDEEP 24576:5fwvzk9RX6wkyAIG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4MnYIGLNiXicJFFRGNzj3
TLSH
T15C85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a9fb8b120cb03aef6ef4f7a12c56cbd785438e5ee4622af1377505c2140c9ccd
MD5 7b2387e037ba893d40f4e05f14d4f89d
SHA1 81ac37ee7993479ad143833178a5b6b727320c35
SHA512 4270f415883015d40d7e4ba78404760b0488fe84566848cc630b9bb7fd13f1e15f60035b713c87d3ac3fb5d8e7a4f674bf3ba79f39f4f418f381fb0f534937f6
SSDEEP 49152:eYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0VLNiXicJFFRGN:BySzPN7wRGpj3
TLSH
T133066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d050e2e7a58da5e8f460b5e4070dc0deaa6ee5693057d40454a8c2b8681b90cf
MD5 2ed862f6601d0fc1fc4521ab3d45efe4
SHA1 12a5c873fa27d578ac88a9429a37f566649a75d2
SHA512 076e3b0e7feec8184f50878e85c0893e38395cea952a45ebc707b8ced57ea6daf22cc33f090fe522c2eb140788d01786c41b4e1b89c0cd3a657c541eb4626085
SSDEEP 24576:E47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:E47JUQjqirIhCnDHUPfF/lLNiXicJFFS
TLSH
T18B65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 13ca8cea7b556a03462c8737822d84f3b648173b4deb13be17a60ba12131cdf2
MD5 cecc881ce4f292fd2b0e33305ce49c93
SHA1 cd04ac380003242bd69099bd6ad1fd2e344e4345
SHA512 dd090f92e349dbf46a20a0be61e80693aa2315b70089b4088984bc6457e97cc8e3a73accbf9e0be5a0ad0aa3675ffb70a1c40d6c8cbe4dfbe7b257406450dfa2
SSDEEP 12288:NpsfAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+S/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13065F15AD28802E8D1AE5139C7664900F3673C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 32a2cacac53c3e012f7d910fbbe9b7d3d7ba4279b617468afd1a02331d0aee75
MD5 ecfa2b0b31072aa154b405239b9dafa6
SHA1 787ed18b72843b480c83dc410a50d7952c1a1690
SHA512 831dd57a017f44954d8f9ebcf48a706bf68c9e5412ecef11e7ea84d230a7052ca6ed07b76bab93ab4a83e6479df879a8aa84c767ebf0db78e84dde4aa8851c9f
SSDEEP 24576:kK908UP3sr+O2kjHD5CaRMAEl1vdS2ua:A8UPMjjYaRMAEzvdS
TLSH
T1914507407626DB4FC6A940321E36D6CCAB707D02FE046F0773C9973F9576659BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 8KB
SHA256 7f2d57a7190874f4544f56274cf747633deee0fca2835763cb2717d4d3410506
MD5 29458f96b5cfc8f8eb8778ca88d921dc
SHA1 9c06443e5d56cd3b6c56c2ae1faaab6df7d686d5
SHA512 3a1d1c3112c6e394f65236d7dbd16ca3810de21cdad4a256f9d47a026bac77a50fdfe7cf21685346e6d6fdffd1d51654768b7317ebde3841bec4e701e7fe3dae
SSDEEP 48:0U904weDll5S2nXllSUREK0kENRu+UKnVr2:FmeDll5BllR+LRTX
TLSH
T11C025961FBA0F53AD86705768CA9E7ED2335F5A09C110347764013BE9C9E1860D6AA60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.0MB
SHA256 c94e3a7bc4ee03f73b1aff89762f4ee37a26149159ae6ee31302c873c228e61a
MD5 f067bbfd9e2c8fbcc954adb2cd6bf7e5
SHA1 666ed4792a10d5adcc81579405675061a813cec0
SHA512 0a8d83ad55ec2712dcf6ad6653ef10b2a972192e0358e1b09f8a6505b04e0e8d074f92c4b41907c615cbe42382283000dcdda5381a1e5f9f819b00aecf485b43
SSDEEP 12288:aP7ruV5FPjsjV6qxKu9Mkpw44oYTYLGgGUFs+U/l+UIbsxJib:aP7QkxKu9Mkpw44DMKtp+yl+Z5
TLSH
T14D35F700A4B7EB4FC9AA9037063286CDBB645C06F7493F0573458938546BA6FF6E27D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e74ee8fc8d26753045a1ab3468f4dbe2be47239243f8700333ddfb0790ca463b
MD5 0000b20fa673a68d0ed93cb069f96cbf
SHA1 44aff36389e2de14512debf5709fd9bbae8a77ce
SHA512 5b459d7f51db93b196aceacabccf6f7ad5b61bbdc9293684a8ace132d19b71502d4655fdc7704f5f19d3cddbeddd2dc1ec285fed9f3ae8de058b7e787a118018
SSDEEP 12288:wF7oiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ua/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1915523A3568C59B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b44d244b50189b6fae927a0c52a51c529013e406f0c3a8c7806fce70a7f29c7c
MD5 376ca69603f7a09060a99088e8564097
SHA1 0447f5bdb77c7bbcae7827a0b5c02492033fbe35
SHA512 15dc9bc2b1ccd832c8336deba0f087d805c0584dc8780e73890740e11f16f7ddf2ff32a660f8a7592295171898217cfa56d4902784569979eacc436bb293c819
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:egb4mBIBhGF7LNiXicJFFRGNzj3
TLSH
T1F865AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 b3099510acaba530cd8f40fd7f39b20f4ff9d777e11a898ceb25aead2164af84
MD5 c97488826f04f85b7254b42657a07fa1
SHA1 486663b4214c9d8c1b6cf779e26795ba253c2ca8
SHA512 02c744ebd5b1856de24ae1c84b043044cead76fb5d509e4b9c4f4a2b650dae1c2b1882c598835b978b3cf9a48da1e7ba0591c4dccddf2d040662c563d459350d
SSDEEP 24576:GG88u8FpJqH1vzria7/mr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:N7ZFPqVya7/wLNiXicJFFRGNzj3
TLSH
T12585F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5fe15eeebc16acb3abe5e6111cb81dbc2772f673561d6dd0cfe89d357957a43d
MD5 5ad0238485482a45c70da11f5dd013ee
SHA1 f38ad03702811f0bc69561a0f50b02e6a46a02a3
SHA512 4639f1c47401f7bce9fdeb0dbec5a901469ac97b14a1816e17c190dcd672adbb6e493a4397d382f646029ee0c367b02e594e52d4bc27e320d93d62a97bb95631
SSDEEP 49152:ZBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj3LNiXicJFFRGNzj3:6G05lO43bO7wRGpj3
TLSH
T180D5C06E62EC11F9D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bc02d00b96f4474760f489790d755262cbd98539d23b175b91eaec32560dc48f
MD5 81808e203d61e945bb69801ba1ac3605
SHA1 d6c0c1432c106cb33c45d5ffa544c199da3984d5
SHA512 2c668b88cfbce39c146f8d39ccaec8b0ffaa972df4596233572b5a2c735dfff94ebc3315b51b0b12d5477dfe241782b5c0c0fd2f6f538d99a525b7b138d89de2
SSDEEP 24576:1fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnV/TwSfVcYG3K/cJHlnFR+IGNe8jg:Va5POZ3lJt2pasx2+mvLNiXicJFFRGNf
TLSH
T16A65BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 04a01d5756558fddcd01dfe7b87bba1e88c6c843b1a568fa1b054f2d18683ea5
MD5 e2c449995d67291506c64e22afc6941a
SHA1 41cb5b16909c782eafbcdadf0c51e06ba19c184e
SHA512 54b13d21441417c21674b46182ff7c07fe61afc1b1501a2401317a27f2c6f2c978a5275f824ee23de419ac5104212426f4535a9072670e1e592c715bd163a33a
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tNc/zEOVHFQLNiXicJFFRGNzj3
TLSH
T1EF858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 5cc10b3de6ab45cedb9efa6a58f619c45e543696216e68114a308f90cd8e1c8d
MD5 4b44f9ed4c0a7563c864872e1c2230ed
SHA1 b1b15564de288ef09e51666a10eb0a20478e8ea9
SHA512 1ed1e9ebee7efecc12ba86fa2c6dbf75e29d8cdd773da642e6cf2eeb434e7fecb1ada758454df33259b2876b7b279b2bf0e004d3cb2847099564255ad301af65
SSDEEP 24576:66DI+aKngL2jdshRTdG1YxITqvfPkbIcbjLm:66DI+arSj8RoTCCW
TLSH
T10825126D63AA01F4D06BE13D96934506E5B2B1B487074ACF4AE4C5BD4EA3FD8B93CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 59e2d589711bca5806e8e890a8057fbe2ae630b50e1ef9cd162fec3d29fa9016
MD5 7f3396eb10f93d3236167a6109028ad8
SHA1 ca0ae472515b74624510478b4e2324c3340c6385
SHA512 da5219a1e6e89b71bc89864b22524c3e0a3b3e251182379a837da15544774e0d987c59fb38afc40a411cc151eb6c48154581a4d31069772acd3b0922c50beeec
SSDEEP 24576:nPUr+NQH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nJQHLNiXicJFFRGNzj3
TLSH
T11465F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 6ec1425364e7e3bb560468de6143128043cee45b93cfd6301e6f63f8d97dfd18
MD5 9a97586ed56245256b544798e6129b9e
SHA1 c3edd14eef099776a889e9facefafd6b18a665b7
SHA512 6232c80efc66f557d44100f101fd52ee76977b86340ccb8523b002b8d4c5c70fab5c1ccf166e2f26a4e844215d3b98e5580d50a82c85def241960230a018cd9e
SSDEEP 24576:9D3FHshBIYQgAe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9DVHeBIAAeLNiXicJFFRGNzj3
TLSH
T12475E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1436-332-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1436-100-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1436-101-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/1436-106-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/2404-157-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2404-160-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2404-148-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2404-149-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2404-155-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2428-420-0x0000020153BE0000-0x0000020153E6B000-memory.dmp

Download

memory/2428-350-0x0000020153BE0000-0x0000020153E6B000-memory.dmp

Download

memory/3688-354-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3688-352-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3688-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3688-117-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3688-111-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3688-110-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4092-34-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4092-35-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4092-41-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4092-122-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4092-43-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4324-143-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/4324-135-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4324-337-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4324-137-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/4448-330-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4448-90-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4448-96-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4448-88-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4456-172-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4456-166-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4456-339-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4456-165-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4592-338-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4592-123-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4592-124-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4592-335-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4592-334-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4592-130-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4896-78-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4896-84-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4896-77-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4896-316-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5876-56-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5876-49-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5876-147-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5876-50-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5876-57-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5948-8-0x0000000001FE0000-0x0000000002063000-memory.dmp

Download

memory/5948-14-0x0000000002C40000-0x0000000002CA0000-memory.dmp

Download

memory/5948-22-0x0000000002C40000-0x0000000002CA0000-memory.dmp

Download

memory/5948-6-0x0000000140000000-0x0000000140690000-memory.dmp

Download

memory/5948-20-0x0000000002C40000-0x0000000002CA0000-memory.dmp

Download

memory/5948-30-0x0000000001FE0000-0x0000000002063000-memory.dmp

Download

memory/5948-0-0x0000000001FE0000-0x0000000002063000-memory.dmp

Download

memory/5948-47-0x0000000140000000-0x0000000140690000-memory.dmp

Download

memory/5948-28-0x0000000002C40000-0x0000000002CA0000-memory.dmp

Download

memory/6004-62-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6004-61-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/6004-69-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6004-75-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/6004-68-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6004-73-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download