5e8e664f623d674cc2b281864dc344e512e73d277d78154e06c7c1e5882f2724

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/11/2026, 19:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-31_d73cd92c0aae1989a0af9ef4c600799d_icedid_mespinoza_njrat_ryuk.exe
Size 1.6MB
Sample261101-yf4cbaxyat
SHA256 5e8e664f623d674cc2b281864dc344e512e73d277d78154e06c7c1e5882f2724
MD5 d73cd92c0aae1989a0af9ef4c600799d
SHA1 f389b4d6f5bcc77a0c3771e9a5fbce9da1a9f63a
SHA512 679ceb9b31883eb954d1005df980e33744a890adaaa752f04e765d4cf78115027cc4fbfab076023648f09238f4961b9e71d236ab83b9c811b3a9a3262508829f
SSDEEP 12288:KyVOd/QmcJAmfPNs1kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDF:Ky+pcSmf1sftd7mPuI7cpctubZR
TLSH
T12C75C00173E84498F5F7A67899F28566AA337C955B38C68F0354421E2FB3F91CD39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3296	elevation_service.exe
460	elevation_service.exe
1044	maintenanceservice.exe
988	OSE.EXE
2456	PerceptionSimulationService.exe
4736	perfhost.exe
6056	ReFsDedupSvc.exe
2320	SensorDataService.exe
1788	ssh-agent.exe
3644	AgentService.exe
4744	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-31_d73cd92c0aae1989a0af9ef4c600799d_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-31_d73cd92c0aae1989a0af9ef4c600799d_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-31_d73cd92c0aae1989a0af9ef4c600799d_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-31_d73cd92c0aae1989a0af9ef4c600799d_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b05e4034f1788cf2.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106906\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106906\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-31_d73cd92c0aae1989a0af9ef4c600799d_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f5b1aabb396add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000882850bb396add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001aa63abb396add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f413b376396add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082d21977396add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d298176396add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d31ed676396add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004af76477396add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3296	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe
460	elevation_service.exe
460	elevation_service.exe
460	elevation_service.exe
460	elevation_service.exe
460	elevation_service.exe
460	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4876	2026-10-31_d73cd92c0aae1989a0af9ef4c600799d_icedid_mespinoza_njrat_ryuk.exe
Token: SeTakeOwnershipPrivilege	3296	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3644	AgentService.exe
Token: 33	4744	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4744	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4744	SearchIndexer.exe
Token: SeBackupPrivilege	6056	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6056	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6056	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6056	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6056	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6056	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6056	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6056	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6056	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6056	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3296	elevation_service.exe
Token: SeDebugPrivilege	460	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 6028	4876	2026-10-31_d73cd92c0aae1989a0af9ef4c600799d_icedid_mespinoza_njrat_ryuk.exe	90
PID 4744 wrote to memory of 4284	4744	SearchIndexer.exe	103
PID 4744 wrote to memory of 4860	4744	SearchIndexer.exe	104
PID 4744 wrote to memory of 2804	4744	SearchIndexer.exe	105
PID 4744 wrote to memory of 276	4744	SearchIndexer.exe	106
PID 4744 wrote to memory of 5340	4744	SearchIndexer.exe	110
PID 4744 wrote to memory of 4228	4744	SearchIndexer.exe	111
PID 4744 wrote to memory of 3988	4744	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-10-31_d73cd92c0aae1989a0af9ef4c600799d_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_d73cd92c0aae1989a0af9ef4c600799d_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Users\Admin\AppData\Local\Temp\2026-10-31_d73cd92c0aae1989a0af9ef4c600799d_icedid_mespinoza_njrat_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-31_d73cd92c0aae1989a0af9ef4c600799d_icedid_mespinoza_njrat_ryuk.exe" uninstall
  2⤵
  PID:6028

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:460

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1044

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:988

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2456

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4736

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6056

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2320

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1788

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3644

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4284
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4860
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2804
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:276
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5340
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4228
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 14901615290176e507da33d61961fa1105711150b98db2772c7159b31ae7c089
MD5 131ebf1527610381c46f688a7cb260f4
SHA1 ad139337f12d1f47fd5b09abe92250dbccfcea4e
SHA512 3ff6521cd3577886989fa66bf75a223dca3b3d12bb978a275cc895e25dd7bf118b59af8ce90d9789edcc5ea01a80d819b12c5393bf339bb275020abff2df6c9f
SSDEEP 49152:lb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnUWPuIw:73q6HjBwPuIw
TLSH
T1F6D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 7b7cfce93030dc7d0e7453d288e2ec2605e6dff93135f89b854335a68b74bd58
MD5 5510350bbf37f4ce52e4d392d7dd3dd4
SHA1 f27f1ee71f694329a7714ab3a271849ed576a427
SHA512 711d3c24dcb775150684bcea1bd11f5b540904fe761748d8d9b43c4879ab77a8eccf5d62a9e9e40f57dc5735cbbbf8ed61c10b95037a94bdd60b5fc77cc3b18d
SSDEEP 12288:J1XLsswWkxy2lRq2czAzkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD4:HXYfDtczAxtd7mPuI7cpctubZk
TLSH
T1C0750128A7E408F9ED67827CC8A2C541EA3378554764E78B03E4D6661F333D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 e7f823a15c5e8f9d6e9d22904c3acbfb1290fc9470ce48c00d89373eb3ab1506
MD5 42bb8efb82e00b648d485bcf4d98ebb6
SHA1 257a4ac58111d4d63917a07842d2924a7022445e
SHA512 cfc04951c1db3d7a4a835bf8fa9f511d303b148c077282bf847c5f805239ddbc1912539dfe726e5e49c960a91af0ed09ddac1e91d392fca62d2aac2d23f63bf3
SSDEEP 12288:9XZNYVLeyUji0h90ZD0wxpGZIVuprHskkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWR:T0Le5ji0hmx2rMctd7mPuI7cpctubZb
TLSH
T180959E15F6788735D073C0B9C5D2A68AEE7230865B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ea0afc37be4cc6c55d06a48bcf77c13fbaba52959682135ece8142df7fdd98da
MD5 4fd83e47ee275f9b127fda98b0e35606
SHA1 1fff2292814a91e3fd2f07b0ddd8c9cc1fcd24eb
SHA512 66b3efa8a42d4b427c0f640e31f454e156caa81981114e28a168dcf7e09c8819b9191327d93f1ddcd072cedefc341d544b3c26eaa4ae2088d6a9385744e76823
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWE6q8wyuatd7mPuI7cpctubZc:s/ezSC6vUzPvxHjyPWPuIw
TLSH
T16E755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a43d6a104b6b3bce483fa60afb4755fdd91bc04cdc581381cee8985a9bcdcc6d
MD5 58e11302715f1454bd282a031aafabf1
SHA1 108c6fc68c0b66973c203a497bb0736a934e7925
SHA512 974feb4ce04091d95a1ade9dcb43e6d9d1c991bafa3acfedfa05010f9a07a1edb2eda6aa694f65c909cb50464d9ee9923493085133a405e462bfff99f8d483fe
SSDEEP 12288:XVJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im98vkt2VtKqbUb4mNdonIwsI9Ec7td:XVbqPb88hv/l+6ltd7mPuI7cpctubZP
TLSH
T1A7559E65F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 2f7d0f97d309dbdc7315d4c0a60f33ce39b6e8858e4d71ae96143bfd20e5d69c
MD5 15ab45c4a898336670b7c65eff365e9e
SHA1 1cec377cbab65ca55c50edeac2cf1e48fd664e1c
SHA512 f2cccf7ef443870dd23ff6f1ac934793c7091dc0ec63b3aa123fc56ae902dba9746c1c5b9dc46d5e2ec485a3b05219cf48159c31b11cb25efee6bf6215a1c20f
SSDEEP 12288:9QAkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDY:9Qgtd7mPuI7cpctubZ8
TLSH
T1625523148B1D8CD4FBB7C1B0F0F2C9D27A174E5858AC5752C647F39B1A7913ADA32191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 0d1fe7460ef03a6ba9ee0e1c02d8c9c674f797c38be21109c05b1c804ed29b72
MD5 b93f180d6550b3a004f591b32bebf5a9
SHA1 27187fea4dc0213054d1349cfd60d91f3872795f
SHA512 191d9c1ef78d12e8d95ca0b8dd30272f8826e5827c4d72541b5ce38e3bcc50d1d4125bae4d9fd19bf4a602ad979056522a9c64fde078c9c318506d196fc7cba6
SSDEEP 12288:ieBNUbTVO86U3kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDX:iJIUNtd7mPuI7cpctubZb
TLSH
T17A75CF3BEE28ECD2C27A8DB85691C640E77278304F61A3CBD165C30E9E235E55E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ed8161232150ed16c5c6de8d964d7592d760270b0412ad776230239d0693987a
MD5 cd49de8a9a773140017d491a41a80086
SHA1 53697a419bfcc4a2e3b937c3d532f065d6b3c657
SHA512 ddf645486e01bdded86018c5763df032848f6e577ed4f9703f3abbbcc9f737732a1733424907272aed8ed63b4d8559b12966fa6e08a660e0c5b696b22ff9f4e2
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THR:DQvGAdlCEL8c/yRNw5CVPuIw
TLSH
T112266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 3de780bfdfc7c384cac4c050e295952bdc8ddc6462d093fcedd6038081dc5b98
MD5 43ff4b898e78ec40a9ab5503a65602ce
SHA1 4844f5289a5fdb043a146535d6b0fefbf9a2d58b
SHA512 5ca43db78927e7fa0d4d4fb33bde1a713d2299ba6553eb3184dc2a228b4c26cf2e74a7ff61502c3fdd6b6fb246599ee9daae5b8f8f023e879194f739848592a1
SSDEEP 12288:pAwSfxL/2Dc30DLLmt0LDQewsAjRkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDz:apewsAjztd7mPuI7cpctubZX
TLSH
T10875E030FF74D436C7BB0DB22B76C716183D69204F611AC3E3A89A9E59302D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2bb01d71a0a7d0d299fa68e9af8743318b183561d59c63e2f9d3bdc7a4579f71
MD5 9c5bc6dd0010c45062030e3c8fcc5c48
SHA1 50e15a65adb6a3162c638646fab717b98523ebd9
SHA512 773c97965a037e733efa10e94c7a8617779ce69e3545ab81dca1e1329f7fefab8525e28eb9c09d33c67ae86fd62b3dd3589a8b9ca0fa44128ae55f8f6d3e491c
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH6bw:2UEtQevvqc2W1cpV2EI326
TLSH
T1CC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1105c964ec9951471f45ad72c9633ad1b4f0464a59db6ea469858dd34aac00bd
MD5 a92f1f981d7d8b4f0f0114d3970d4fa0
SHA1 941d743aa5d24c81162cf20b7a5e15e41b1095cd
SHA512 03b20c360b8bf2d6820b6235e79d59c688d442b4289a09812b05a68ed507e4fed4f15748fe060a6d4a6e40c3fbe8648894bb33fe28ddc4842741083c01efb263
SSDEEP 49152:MCbRquA/m2yL5zifFiV+XenmE3/zTWPuIw:loqHVjnmBPuIw
TLSH
T197D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7e821287bbd68616acb33251dd3252478a9600b58ab161e8a0c24835f4bc9583
MD5 e60dfc83f0f7414750369e65ec6d3b8a
SHA1 8d08f856920047b1b6f3b3de2b2a795b742e2b04
SHA512 6b18fc36873d806cf84d328044e503fda5a5f1a5b7b1bc9dd0ddf70a3c8179d180191829b6cf1634cb3c3c1446e6dc45da0f1518105a95cf78eb3a59ae277127
SSDEEP 24576:NAhGLJIFoiwtA5l7S532td7mPuI7cpctubZf:NAMyFoiq5GWPuIw
TLSH
T166359D80EBF945D4F5F3AAB899B68571EA76BCA95E31C20F1150D21F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 38f9fbb54c246a49790602c6576b24ff5b562553b5d535ceaa40ffe351a243c4
MD5 6ea22c0885a27fbab2bdfcb09dd02581
SHA1 295dda417630ddc8d52389a8efe773a68f4ab2fc
SHA512 eec854ce2bc81b13aeccc9b2aa918bc463bcf8f6caac08a925a8f80ac40e8fb45f4e262256ec51d3e98de752929218d0da2d7dfae17ec10f1a087c3925377488
SSDEEP 12288:2mw5HEjsChNJBFgl0WDm+CWkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDl:vwukOWvtd7mPuI7cpctubZJ
TLSH
T17D75F14977A90CF9E9A78138C597C532F7B3BC052A25D71F4760C65B2F37221AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 8461085d1c42963ed60b9aa6d9a828c5c04f8f8d04042b68e1f549e4585d4c1a
MD5 0aac47cfb84fa47e268e62aaa330bb2b
SHA1 8e59c78c4fcd7285d6dc0eb92d9fae1491001c92
SHA512 8ba270727bfbb68a07d3a19a8794b88dd7d684ae20ef95e6c254a4a407822ded4c8b803869c53b47a11ba4edebbdbb0f6a3e73af5fd456c9a15a99a00c2eb0b0
SSDEEP 12288:9WZ1Iyhkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDw:8ZuEtd7mPuI7cpctubZ0
TLSH
T11465124823E864F9E2A3C278D8F18AC1E7337855277943CF0616935A2F336E69E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6cf13494a2583fddf62d57df24dd77ad228ca9c328853a50bdf4b746ca388c76
MD5 d093c6f971d8b6c0cf9da9f3c8f0dc17
SHA1 54cf9533dfc7a071e0a267a21aa3ab4366bba2d6
SHA512 d4fcfb45dc168496dc6d019cecdd7ed4bfc020390de24607a91c5b8a41d3b8a6a6d69d9773c2c16740da9e0e9dc56bd1962cbd5d11c4befe2a75289588791fbc
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UV:qQRQyi36YOcPQLvw2gAf+PN3kPuIw
TLSH
T18B666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 61c8715a2e40c6c7ede66dbf8857347399d69657cf30de50f80d00dd617c0c43
MD5 496117674d1e475c08572af0df99287d
SHA1 6ca8073cf25eb91c82a5b75901d6d3801251fdff
SHA512 c4b33891369fd743e08f2f5996a2a918275e3fd4b1e75f9782cf465afc9752795a7c973234affaf49c022977c5b25d51bd9f0f54f4ddf597dc7d34a017c312eb
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UV:YQRQyi36YOcPQLvw2gAf+PN3kPuIw
TLSH
T136666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6e5097037dbb56aebbfc369daa64fd01a2e9d031faab5b83c250c399b77ee8bd
MD5 e1210ef20c3a24d8fd1ff5fbf1697cd2
SHA1 f4e2ee29e69d361afb0843836b2bfb8b78a69e5d
SHA512 b6133162bf55b91988b8306795072eb26dae919e454ee406684750233fdb0c536802bb6acfcb10cf795ad41c1d5fa75d452f74907609c9f2ac2f5685746b5293
SSDEEP 24576:awvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Utd7mPuI7cpctuI:U68Qg55nhheWu7PNU3/DWPuIw
TLSH
T1F9B54A33B2F600A9C44DE1769F4A873196D27C758FE0E3DB850572161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 379832e25515c5d32d59ccbbf7c8db54f1db8a1d938af14b9976f3fba2ea0e27
MD5 a11a071ff4cf9f07b06891df655247e0
SHA1 7690e5df0b2680daf1eabc1f10d1fc9d105abda4
SHA512 7f215070649e0906efb6f13af67fefa2b4e38901887608b5c09ab397e3b95c3a7d6bad8e199d87b1e4b2747404bf535e303b3e7f4fac23df9404d77f2e3c1543
SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99L:4y5112gYy5azzVvL69nLKnhZHPuIw
TLSH
T13E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 373106694bb74d1fe7c2e038212dbf7c1f759edaebb7b2b877105951522d03fa
MD5 97a4eef021f2be1a1017395a344f3672
SHA1 9d8f8693edb9413ab07358476d5700b027e95bf4
SHA512 a39b131a03999d8356c4a8d47cde0195284c97e68d631850f1d316cc2eaf9868aaa9324563ca7765871e749c21570900b68e066e8d1fdb8a3744463a550fc3de
SSDEEP 49152:qB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl1WPuIw:4u6JmVxd2dwPuIw
TLSH
T183D59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4858a3ec5c9671a0dd354c8d611cad24db92edf8860500d70c328b4cea57698e
MD5 fd3acf81d2a30e4a842cee5f314cd5cb
SHA1 455db2ed9b25f4a6e82bbb1a3e095118c10e7cfa
SHA512 ab18deff782d32549f46e3f5081388d302c7a8d8642c333e6dc9cc4f89990daa161e44f612885eaa630a3295c1d3a6f45c2084d283d5c368186b7e8754fdbb7c
SSDEEP 24576:Ehv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3dtd7mPuI7cpctur:o1hpsNoJpF1A6UU44CwH7R4xtWPuIw
TLSH
T15FB5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3325eb18297507ad17adb874639c444e132b3589f293d0640830cba14884a952
MD5 6c15c3d00e901d0ef5a5d25d4dc79b30
SHA1 91d375f794fb585b7ed92cc53014bd0cc32e3b3e
SHA512 4e63b7754bf61045cc4aa9c89e5070df9cf867b64c8da2b0b83512e8173bcb57a74b1f3a01814a33503e8fca2f8622f5b317d6677d42b11e0b532e0f64e77872
SSDEEP 24576:j4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6WR04FxGgVG2Onks6xt4bSMHnqEtd7mPu6:tSuZQIY0Be2KRRVtOnks6NMHqEWPuIw
TLSH
T182C5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 df5e2bf912a8f26ef64d811b3ea42c4d1caa90cdb62e7c549fdaa372faf8e37f
MD5 4f85752bbbff948fc9f6c64a9f7e7ec9
SHA1 a016aedd2f1456aafb36880912edaacfbeaff645
SHA512 a2e747aba09baaf9bfb5f41aedbb95c3fa54b5f06b980cd7d1f5aadfe9c3ae546d7f92d40cf32c4dcfc1f3414b9ea9cb6107bca47467b65e5674dfcabfb38af4
SSDEEP 24576:4hiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QLdtd7mPuI7cpctubZq:4htSn8EApI0figngiDn0AP5wxWPuIw
TLSH
T19C95BE13F2D900E8D05ED178C7568632EA62BC150B39A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 708e2eabff029234b736f7eb98006de177cf41f6156f846c2b4e119221b84b97
MD5 7f1165c3f04360f8f5c36ccf5b71d49c
SHA1 ce9285bdd3d0788300c3ddaa19401cf661065f57
SHA512 e64fe0121478048a09a3cba537129c7c6cf2f90c73a4776a875731d64f2ae400fd473d2f70a54592208005a17fe60c80a228b3910a29c225905c41590723c7fe
SSDEEP 12288:vIkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDi:votd7mPuI7cpctubZW
TLSH
T1E15523089B6ECCD5EA63C1B0F0F1C9C17A1B4E5DA8AD1352C74BF2172B7523EA6225D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 e38c63459ee5361c152988cf3fae6a46c1ac8e4ef6da452c21da3e658654814c
MD5 aafc3debc58d9f9a48f75168ea08073a
SHA1 f0a12cfc0247a5c207d78fd2abc1fb8f3a7597f4
SHA512 e02c71947d2193bd8db8860db668327d095a9146765598fe714fa52ed80f86fd44899fd65e28bea6b52e8c09200f2607ceee09f2b4feff699b59703ea7db8974
SSDEEP 12288:59kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDi:5Htd7mPuI7cpctubZW
TLSH
T12D5523189B6E8CD5EA67C1B0F0F1C9C1BE1B4E5DA86D1352C74BF2472B7523EA6224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 860b0d2c094e868f5a0879ddaef248b9df75963bca29f7a8d99dc86201850637
MD5 9dae265bb3032916e9ac97132be7a62b
SHA1 5839d97cb7402e3192377fcd59136eb4bd10cf93
SHA512 10770fa6154c382e97fae72ebf1f2d5b320688f4c48a0e578f10cdc24a9fbbe84d62554eb902c5e48c48c64145e778d2fd64b6e5785225124f048cc69afa15b5
SSDEEP 12288:Yfkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDr:Y1td7mPuI7cpctubZv
TLSH
T17D5523189B6E8CD5EA67C1B1F0F2C9C1BE1B4E5DA86D1352C74BF2062B7513EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 b200a99bbc1bf2ba4bde1f82aaa0328a01a924c750c40969adab496f4893334e
MD5 38fed98589a757b4e08859b30c29f688
SHA1 1ec1aa7079a8202f591c2460b8dc1cb862ede850
SHA512 dc90f203c36a888dd5c864102a494255cfd08219149d50f62fdd39f5f6fd2679da4306fe07c9f6be473233fcf049cd821c18383a1b257ea0fd1b030efc6ae681
SSDEEP 12288:gVKkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD4:dtd7mPuI7cpctubZc
TLSH
T1905523045B6E88D4E973C2B4E4F2C5C1FA377D98A939539BC702B24B1F71379A931A90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 f1233f9c54d73487a0b60993447146aa5aa17e37fb8c0fa7e5987a9f691efabc
MD5 3903dd527358ee5fb70a048ebb490400
SHA1 a3c703ff76b2f338bd8703ad0faaeda73cd23076
SHA512 fa3c14f003a7a9f09e1c9d1ecf4c7c3f121ff1a8f8c02c56720ba2d98ef222bf830de2637875f36f71834bba4c6cb65693c260724d364974cfb314fbfdaf4b04
SSDEEP 12288:LCkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDz:Lutd7mPuI7cpctubZH
TLSH
T1035523089B6E8CD5EA67C1B0F0F2C9C17D1B4E5DA86D1352C74BF2562B7513DA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 42fff88b6bfdb8d848a9952e50607a088a920afdc3705cde8d00f43152cf0ca1
MD5 0de51ccfa8b3f8612346b495ee02dceb
SHA1 7ff715494640397570f4830a5401df487eab93fb
SHA512 b325abcf520e25251255f06eb9339bcc3e16227ba53b4ed712cbad0bd940d324df43fb56fccf5e2f7cb7d6dd47fb8b1507e22b0cb71e1160ad456cf5510fdf7b
SSDEEP 12288:y5kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDD:ybtd7mPuI7cpctubZ3
TLSH
T1435523189B6E8CD5EA67C1B0F0F1C9C1BA1B4E5DA86D1352C74BF2472B7523EA6224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 4bafb22556385facbea2258cb8f9f989c5411ffa93e92a3a9cd41b26672d1088
MD5 0f717f195b40c6edd5c1060a4824e727
SHA1 88b4cde69c6a543ffe7af0925dd1a7cf1130d4c4
SHA512 d7dcf9fdacf06aeeaf1caf9dbe1c9f1b49b83f9f3fa87908ada9cacafbfce16a536399d231028043ec773eef70e1438a269259306bd774b0719c4852d913aeea
SSDEEP 12288:SVkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD7:S/td7mPuI7cpctubZv
TLSH
T12A5523189B6E8CD5EA67C1B0F0F1C9C17E1B4E5DA8AD1352C74BF2472BB513EA6224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 6f0d1602d30454630479a238b37fbd63ad428cfc0328c9c84b6faf65df9dd399
MD5 86285719d90786e35e3e84e1cc4226e6
SHA1 36654fcf068588a126634d1a599b3b394112ea3e
SHA512 e4db324e6f0db161eb9ff06e31822d1fdba8f78c532ca98641d62bd301b0782649b9863719662644125b4b6c20d2a5605e57d3bf6c5ebb9187b50b258c82d674
SSDEEP 12288:/iZwbGzzFEoS2cPvydkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDB:aZMGzFVSOntd7mPuI7cpctubZN
TLSH
T15C750194B3940CF8EC67823EC9658942E6B27C590A70C71F03A5366B1F733A15D3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 70c50b9204b33df0197a63c57f03426f20b96856979a7bb248eae970373ff1dc
MD5 9548de3869269c19e35fa302e4db5a10
SHA1 55fee774a088b74574b31cc7a24626a76b09ca03
SHA512 52b3cdf29c5bd618ed4e537e463a7ebe8012fb07845b7dc5261bedc836bf66b3b2b2c2f3a09c63b14119febd43276515714c9c3c4c8a5190dac955c452ddf109
SSDEEP 12288:lckt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD3:l0td7mPuI7cpctubZT
TLSH
T11F5523089B6E8CD5EA67C1B0F0F1C9C17E1B4E5DA8AD1352C74BF24A2B7513EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 8bbc50ba3e178b359b3e2eff78c61dc4cd66147b3076feca578a1ddc88cbbb0b
MD5 764dc09dbf8e8abae30d2296d80c901c
SHA1 8bca2eeb49fe8ef5b86fa6c7df6b2e3d59444d2e
SHA512 00acdca25853dfbe51416496aeef0a3687ca03a810a5ed55ca2c515fc5432bfba01f1788ba26ec173db660e757a180a43cf4d347f0f9fbd03d399897e05371fe
SSDEEP 12288:OQkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDs:OQtd7mPuI7cpctubZo
TLSH
T10C5523189B6E8CD5EA67C1B0F0F1C9C17E1B4E5DA8AD1352C74BF24B2B7513EA6224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 34415d08a3c60bf6a0ad82d26cbde12f94ed11489c78b8b09af53679859118dd
MD5 630a18d387eaf0f523f73cfb44672d48
SHA1 e012df9b55373550fa30e607be2ddded1cd0b2d0
SHA512 8da5ee8274e054adfaaaf16c2da41deeb1df218f5a3313e6976a2e557ca13f8c79fafe6f523afb6f507b7ef5e46d0d681ec8ba67cd37cbab34135b2a7e18fe4d
SSDEEP 12288:3yPz5L8hkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDo:6zyjtd7mPuI7cpctubZ0
TLSH
T15D65120777A520F8D177C274C8A24A82F77678354B248BAF479453772F372A19E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 e406f443370686b9c30e61d59db0c09a2a07f12c40bc28c1a150f4a4e0f17fc0
MD5 be5730757a6a36a5900b3900ba5b793c
SHA1 cbf136e3407717d719251556b8a31c0dc719bbdf
SHA512 70a661d1219facf467d9c0486093f9566bf16c8cb6d8b6c12c779f5dc9ce499bc6d3c89125af85241629cb32e6d7cb3b0901678ea2136dc27929fce2511d9236
SSDEEP 12288:1ckt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD7:10td7mPuI7cpctubZH
TLSH
T1E75523089B6E8CD5EA67C1B0F0F1C9C1BE1B4E5DA8AD1352C74BF25A2B7513E96324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 9207cf1a773868475dfc88e152ca258d8aaa5f2032003eebbf240d4cd52ee8d0
MD5 bd17cc3165f63c238ed1cb7fddc6afa9
SHA1 f8b3589d5ae59c6b47d13a321ebcb2a050644018
SHA512 8c634c9dae1631ae833a0c82bdaff87ed58c992c802d3fbe4c30d1b4fc4c1b0cd596339ec6767fd1791501bd95b9934ee44b0cfc323449f2dfdfa6bc948e0b3c
SSDEEP 12288:gckt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDn:g0td7mPuI7cpctubZ7
TLSH
T1265523189B6E8CD5EA67C1B0F0F1C9C17E1B4E5DA8AD1352C74BF24A2B7513EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 1f5b7fa487def7e6f98e4e7a2fa80b572a95531f1333b7de923f99756ae29ed6
MD5 f70922f9c42f196c81f5cc3f9d426ef8
SHA1 4badc363a2079fbc2743c246b704e621704327bd
SHA512 e29c4c4134734572393b1fd0ded06a6de9ea79cc24e56000a2fdb0b0511b4aeb991734bba613bdf002ac95f3dc4dac3b678af53735fc5fc20a2dc589b49379e0
SSDEEP 12288:OyPz5L8hkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDf:Tzyjtd7mPuI7cpctubZD
TLSH
T11965020777A520F8D177C274C8A24A82F77678354B248BAF4754537B2F372A19E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 4b5c0290cf4ce6cdbb8843fdf2f177ee4784b4014a7dd339469612630609a25d
MD5 281841a6804904cda6ebd48b9230e4f1
SHA1 dc9079455fe917ab2a84ab164532dd048debdf68
SHA512 7a48f0c222c5db6533d16df8d4b92a3d7128a271e718433c2eda7ca5dd60b124ead1d90e7ed49870a7e2ca21b9f4b8702e33f5e2522523ba483e3e5d09f9e044
SSDEEP 12288:tCd9SWYoaLHF3z0z04PDvhPkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDQ:4TTaLl3z0zDFtd7mPuI7cpctubZk
TLSH
T15A7501A4B3504CF8ED67817EC8618942E6B27C5A0B74C71F03A9366B1F333A15D3AB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 de11aaf4c8d994486dea86ff0625edfe40aa196fc0b4cac671d80bf7af9ae335
MD5 9d01f74d8d5a9144ebc10acafdea4d19
SHA1 3a06519a7dc714aa85de4b579ee38bd032cc42fe
SHA512 ed31124dfb174fa025c77dad06b06bc6b73eaab3c80ccc571e0fc46ab25ae79652eaa4ef412612982193a5396de012af86f65f42e9eee289d30dbd127b0ba978
SSDEEP 12288:mi4e7zRdTfgwCHKy7GLbbdIvOkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDt:m34d9CHKy7GZZtd7mPuI7cpctubZJ
TLSH
T1E385CF90F3E814E8F1B7CA35C9768512DA767C591B31DA8F03A4661A1F336E18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 df393171c19d3e1bcb7c8f37abf527867a0cadf564ec8f23364832be4f39955e
MD5 68e5a389442b478a76edb0a0ac4b3406
SHA1 dc6e7031a116c6a2d45da280c4050a95f3ccad17
SHA512 87ad06ddf04299613499ae580590a2a10a5f14fcab277ad20e9c131dbb1814f403c779442e35e98b83fdb5f0a965042bb5754b109cd5635854d0a450a3e24c5c
SSDEEP 12288:r/kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDj:rVtd7mPuI7cpctubZv
TLSH
T1BF5523189B6E8CD5EA67C1B0F0F1C9C1BE1B4E5DA8AD1352C74BF2162B7513EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 b8c4c1ce8c0daebc4264a653f724906d26b3a217054cb20fdaa5514c764c4b40
MD5 983f17f80f045b2392ca4f076545a318
SHA1 36141b6c186e6068da9251fe05c5d675e27ebf32
SHA512 9e1a56895ab75e68b40026484ed9960bd4c36bd9dcb25cd9f299b157f5d61a118cd33a9d6b96ceb215b9da598e17a68239d8a58232ee8b0b174ecb12bee052dc
SSDEEP 12288:8Bkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDv:8Dtd7mPuI7cpctubZT
TLSH
T12B5523189B6E8CE5EA67C1F1F0F1C9C17A1B4E5DA86D1352C74BF2072B7513EAA224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 744a423b8e12e674fec2845c80e9b6d94d7964a1cc4569b40ba46a62c3433329
MD5 d89e2d63018b33761ed06aa92768fe44
SHA1 340c3332fb5d3d5132ba2d595e2666dafce7917a
SHA512 338fb04146df29e2ff5dfc49694bddf539b35e566de4f0ea07718095353b3ffa9fb1a9d58c9a404894dd5f3c35e637beae5462b20c013b5feac2e4a15b4c356f
SSDEEP 12288:mOkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDL:mytd7mPuI7cpctubZH
TLSH
T12F5523189B6E8CD5EA67C1B0F0F1C9C17E1B4E5DA8AD1352C74BF24A2B7513EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 56db2ca10534cbf63b4aeafb6142080fe0b9c1f3319c6eccc9a31ffc046fa77d
MD5 7153429645ef90c9542a2f1e79753c30
SHA1 82d62561ac662918b59c01bb96f3859be0dc0acc
SHA512 8437e0d30a9ac34f4fb4964c27df6bdc8bab27bcb33fbfa7e0eec385ce6ca26237fd2adc3d08f7c042297d9c4c35b712f46f6f602ddf3284674f2064e0bfeeb6
SSDEEP 12288:Ockt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDQ:O0td7mPuI7cpctubZ8
TLSH
T1BB5523189B6E8CD5EA67C1B0F0F1C9C17E1B4E5DA8AD1352C74BF20A2B7513EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 dd4821d556e61e1d4633911138c3369501634c71a4a76fac20a113c1e4afb1a4
MD5 01455d2546d34d70849b3d645b48e958
SHA1 87923c55fa5253c3ecc1c12d5181b1c0bcec804c
SHA512 8d1a01ba495a353af0a59ce45227d5f7775ee09b80d3bd1c782208691ee09096c8eeb1be8006d6c6078330a0cf82140be983bd1c5319a505f74f95a0d6f7496c
SSDEEP 12288:2/kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDE:2Vtd7mPuI7cpctubZY
TLSH
T1CA5523089B6E8CD5EA67C1B0F0F1C9C17E1B4E5DA8AD1352C74BF21A2B7513EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 9fd93c1c0784b5f1c3b597f7c9084f5d59889a1830099bced17305804f35acfb
MD5 d71671126f5ecbd3c35e38bd5ff4b397
SHA1 4bd1dc87420bb8d62fea8d569dccbde1c185281a
SHA512 17c4958d2ba20a8ca80550000cf544258419b88eaee87279759d26bf13f278d9701d7319c9edd872c173c7435e6a263acba197a1730c4b88862d2ee394921956
SSDEEP 12288:fUkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDg:fstd7mPuI7cpctubZ8
TLSH
T1935523189B6E8CD8EA67C1F0F0F1C9C16E1B4E5DA8AD1352C74BF24B2B7513E96224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 e227596c64d0fc1a41bbfd7105f983cfcdb7e8828f5afd70e66f3cc01a7c43c3
MD5 36a02e9bbd0845d6d10f36f891ba4d5f
SHA1 c1ab248a5f74593960a4e19dca84a4e05f32307e
SHA512 36884a261c7e3bd60080071f9eda5e22d6020afe52ac0093fd9e9c8f689ae3e158c560122a27981f766985e2305b3a3e90b7549672ad654ed9b196274f7080ba
SSDEEP 12288:0Ckt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDs:0utd7mPuI7cpctubZo
TLSH
T1035523189B6E8CD5EA67C1B0F0F2C9C17E1B4E5DA8AD1352C74BF2162B7513EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 c75eec4c3373f2ab47264240ec483d23456af5944327d2b986deeadcc1f7865a
MD5 254807ffab5fdcafa5c2bab7e1794e3c
SHA1 fb72f6b07525a6e25d28768c3ef87fa86578a228
SHA512 41b3dab015ab59ea84698e618c3efaa4c6391907387993a627401bf5c5ddef1534bd61c34ad4b9c9b57beb21d3ac0d48cc90c9973932a9e1eaab276ac280d37e
SSDEEP 24576:1fwv0k9RX6wkyAIAtd7mPuI7cpctubZC:PMnYIAWPuIw
TLSH
T11B85DF29EBDC44E5E1B7923C99B34646F6B178591B31C2CF025A536E0E33EE49D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7f48fda50fd21ffe0fcbd1c755de11c3a2dd5b2563cff038743e74907061884e
MD5 e897bf8a7da38406622b08d9320f1a49
SHA1 e789eaf623b7d7185f4e5a870b1864d11679b10f
SHA512 6ceebfb36063a35b210c4de388b00af43c13642dd8b5929c05acd00a41132d0aebf0cc6d185303a71b2cb75ec4b1eef1f7bdcf983fe9626de46cc05a26fdeee8
SSDEEP 49152:fYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0RWPuIw:bySzPEPuIw
TLSH
T1B3066C96A16841D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556931F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a545b87e5374e79d2e2a0365ddbc79426d13435bf3859b882940630ff595039c
MD5 178cef5fa5847ecf4b1fc72181830189
SHA1 ec18f89a7206273b66688ee2910b12dc9cd3bf2e
SHA512 ef0a52010b5ddbf4b07d2aa9789a077ed90f8a3f50494d6b418cd69ad82278fde233113a1de66c9b233923fc342a62e4e2198298ce96cb9989f08d14adbaf7e2
SSDEEP 24576:U47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYXtd7mPuI7cpctubZ/:U47JUQj1irIhCnDHUPfF/BWPuIw
TLSH
T1AF659D1DA3EC01E5E1BA827885558A5AEA71782D1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 2de20823dea35f08ce41d946e0754319a5b16d9a1431cd3283ae1308c9218cd6
MD5 884cad22bdcd44df670bdd61c847290c
SHA1 d2309d35e9eb9f4d389476c1d16b85739a7db067
SHA512 824ed1e9a08b72c9f7c9c5670f0c4dd0a988bd173fa02e81862812fe3fdba5cbd0c5ac6c8e92af68fadbc33842c911939d79bc68b2c3f443efb73a0dcbda240b
SSDEEP 12288:i8sfMkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDU:EEtd7mPuI7cpctubZo
TLSH
T1EF65F108D39841E8D06F9275D7A28A81B7337C2597E193CB43C1F53E1F762A49EE6A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 5ebe8188023910d08eb607338ede2fdc934bdfe566858c6a5181efd752e72200
MD5 0424b4f5d0e4c2321002d3c0795ba4f7
SHA1 61fc8f4e2cc4a3437bb683081579f036332d9c34
SHA512 d9ba6d64306ef2dd90d88d953bb7382bf4db4503d6a1eea82fa8aed424ba38ba27170af52f94d405bca121a555212758cd815ba943a95a88028e030b48382caa
SSDEEP 12288:wzG97vNU3fTWsDR/J9GuOdnVsEPnf7i/S9Z7:wze7VUPlBsuOdnVhPnf7i/S9x
TLSH
T1143519007626DB8BC5A950321E76D6CCAB70BD06FE049F0772C9473FC576658BAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 8KB
SHA256 cab18173d2ea8645404b9078d1dae13cffe2292a9c1471aed7780510758fd5ea
MD5 4d65a53d6984608ad5a03305d85ed436
SHA1 4f20a9bd4f1619c8940d2e5021b0e9cc8d58498f
SHA512 05beef160ec36bfc690ec49369cc4f449c58908ba0d153ffcee207313c0735df0b55a26f73a14404668c6e13211a0381eebd991c0650850f57bbd533408b7d97
SSDEEP 48:9NQQ40ll5My3XllrbUREK0kENRu+UKnW:9qQRll5MKXllM+LRTX
TLSH
T13C027B11FFA0F132D87A067A8CE8A3ED5326F4A99C110343F55463FE8CAD5824D5A670
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.8MB
SHA256 3d76ad5303bb58b14d406b76457091db1bccd6c25ecc75a8d2fa092cf5094f0f
MD5 79248248423df41f5b2b84e7d55bcfe3
SHA1 0fd0e4a25d24ffa101fdec8063d9695833bb6045
SHA512 56d1e764a36d321d5878eb03c9264c6ae11d2f770f1d6af231d421fdf2976601c97f7e5197c8d3393c847c4ac4a06f515a8302f7108061e53735dbdcadd1bb63
SSDEEP 24576:0T77NAlU2ma4jOW2XYzjwh9cmaB6bvXgqlQI/4HSASBgRPoKbs1sPmQEX2qHKiky:S71a4j2onEiDYGPm7BHKw
TLSH
T19A853B416677EB4FC8BA80330332968DAB74DC07BB452F05A3858D39C8B665AB5F63D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 1bfb462e531e17e6f6a608254aebc226847c8ec6f268d9c1486f102a6125a6e1
MD5 3dcd34de33fedca1cb00f586fcb1a62d
SHA1 dcb3ef9a14572aba4ee11d033b32d97a8721ec7e
SHA512 e9273bc05fb605d96f8ba22f6bec719f480a944330e34d4431738ccf48bd33ae2034bc548bdbc7be5efa95023b749715126e48269b5251291a4ac2850c01388b
SSDEEP 12288:Ik7Ekt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD3:h8td7mPuI7cpctubZ7
TLSH
T1175523148B6D8CD5F9B7C2B0F0F6C5E17A1B4A585F6842D3C607B38A2A711F9DE32681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 cf20834e4bb3f27b0053cbccee7753726f0dfc1926b3ab8bf0ff6694338088f8
MD5 53f6284214bee599de251baf2f0bcb35
SHA1 4a0795e2a900cbe0133face24c6bb0bdee689069
SHA512 f834071d37ceba4e3f71844e5bee3a6c5f1ed794c246eb5d933cefc04d5cec79e45f4b060074f3b6a6f1fe2d8f3fd42ecd0d8ecff8392a75f421ec23a2128163
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYatd7mPuI7cpctubZU:Mgb4mBIBhGFXWPuIw
TLSH
T10765AE1E22EC02F5E0FAD2B8DDA64417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 b56e9fa4d046801dceeb796c294ea8e01343166507abe062f3ce72a636250e0e
MD5 f97b440bb9b0d6208dc938c761a9af2f
SHA1 9e1a734cc12aac36ea0578df5f162cd95625fd7e
SHA512 23b36203e2d5aa2c14690198fa5cd91494ffb29a309ff07e2001ad4dfd606adda7e9047dfe3586079674c3fde39242e3a1e4ca3273874556dffeaee5ae41e806
SSDEEP 24576:xG88u8FpJqH13zria7/mntd7mPuI7cpctubZ5:U7ZFPqVKa7/SWPuIw
TLSH
T12195F16567E501F0D477D138C98286A3F6B2B8250364EBDF07A88B561F336E54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 5c5bb05b26a0df564aaa78b62cae3628bcf64bbf8abe43b646692ef214e9da5c
MD5 78ae2f1997dc512d7aa1371432aeaf4d
SHA1 2f4a26eeab211072a73171d6be514a5ae7297dae
SHA512 86f500b3f400289b03cbeb2cdfffeba8f7838aff1dc9e140e9fdf68db5d0eee4fb6c5463e46b5a7aab0cf2ae51c4f69708c7d6ebe602571b1262ba0191ef0bf7
SSDEEP 12288:LHvUrBFrEjwaQJkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDE:LPUr+NQLtd7mPuI7cpctubZ4
TLSH
T1AD75E12E67AD1CE5E676E17CC5828649F772B862171192CF02D1817E0F73AE8BD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a293eeecee91157e5c91fa4574a7a226c39a50946e4d447290863f99cd324a2a
MD5 b3d112dd416f954b54c05b5846bb0167
SHA1 84ba4e403c3e76e685021be6872871b4ee0c0287
SHA512 25386c0eec7d64684a3e03b6f1851d7b13b0097cc4d94cc2d96036dc97c8a35b5f5611a987b4125b557f2f347ccebfcff3ca4435cfdab2b40f87dc69383e0e26
SSDEEP 49152:ZBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjbWPuIw:6G05lO43b/PuIw
TLSH
T12FD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23415033556CB02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 44f77d4fbb8d4dfbb2334120de9c115fa9032c53e56852a4ba40715db634a895
MD5 eaad1cfe06f127c95e0c803ed45b9f7f
SHA1 d0e6c5b26f049b041aba1437817976dcdc401e9e
SHA512 fa4f236efe332ba6ba7bb3d5fe3e4bcec369e1af1f9da679fc31b0b711b5e125633865790d2a14281ca21526a5eb466bf1848d8a7a007794f94c7c417d406b37
SSDEEP 24576:xfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnRtd7mPuI7cpctubZi:Ra5POZ3+Jt2pasx2+mDWPuIw
TLSH
T11465AE5DA7FC00D5D5BAD17DC583861AE5B2342553319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d2b9c9d8dc62a991b6574cd2f278952874676c7003e27069a32caf6974b6d929
MD5 6af6c9d8579f9c2e851b8836aec86a6d
SHA1 772493f3ba79c3d8f371398a7b4acb5215c0eb53
SHA512 217bb304a509cb7be4507833ccf5708108182d2e61916341523cc91ded941a31ef6e4178bddea54902a3e88cd18570023f5295274905e541c1f47cb6a87df833
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7FkPtd7mPuI7cpctubZA:INc/zEOVHFyWPuIw
TLSH
T1AE857B1623E901E4F5BBE1BE89779946FA717869133486CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 992e7db0d9f9e4440d55d3dabc744869f7c2781bb68e4887c1e68e6867f65e44
MD5 379b6ca548792d7e0382ebe253ade710
SHA1 87154b3c04a94c233efbc9e93b7ebf2fae62ba71
SHA512 bb5745cf1e2c174a2385b969326c969762440a4bfb904ccd432cff235923c13209f6118d44dc62373eaf92b8f5f40260b5cfa11dc9cae583109525a0b148954d
SSDEEP 24576:Z8kNvNnaFeYhJNtmZBmhtd7mPuI7cpctubZS:Z8MwBtOmhWPuIw
TLSH
T10E55AF6EBBB845E4D1FAC6B4DD238512EA727461173293CB4290C13F0E679D89E36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 d107bbd4fb2d4a9d1afee9bf392b8fbb293c987a0169dd84d5357fb617db24ee
MD5 3dacfa62be428f46940886bc7f7c6847
SHA1 5a59e5f5934a5a036a2fcad4fac05823a36cf0e5
SHA512 33bb564e02c2c6cd781ff9dc3a548b37a61ac913f74ad6d4fc168fc8b0f6a199dfbc693ea3029b8beee50feb4d2f482e50dcfc49748f3ec2d6c2662fb73ca0cf
SSDEEP 12288:3QcMxWDXN1Dp/fshBItT1IQgAokt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD7:PD3FHshBIYQgAItd7mPuI7cpctubZf
TLSH
T15D85E13DE75C04E4E57BC1BCD6A38A06E77238A9032156CB0294D1BA1F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/276-343-0x0000021CDF350000-0x0000021CDF9D0000-memory.dmp

Download

memory/276-424-0x0000021CDF350000-0x0000021CDF9D0000-memory.dmp

Download

memory/276-342-0x0000021CDF250000-0x0000021CDF341000-memory.dmp

Download

memory/276-423-0x0000021CDF250000-0x0000021CDF341000-memory.dmp

Download

memory/460-42-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/460-188-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/460-43-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/460-49-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/988-68-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/988-278-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/988-75-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/988-69-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1044-60-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1044-64-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1044-53-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/1044-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1044-66-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/1788-327-0x0000000140000000-0x00000001401F7000-memory.dmp

Download

memory/1788-134-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1788-137-0x0000000140000000-0x00000001401F7000-memory.dmp

Download

memory/1788-128-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2320-120-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2320-114-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2320-113-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2320-330-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2320-328-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2320-326-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2456-309-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/2456-87-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2456-79-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/3296-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3296-125-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3296-26-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3296-24-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3296-18-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3644-140-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3644-150-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3644-148-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3644-146-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3644-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3988-433-0x000001F749510000-0x000001F7496DA000-memory.dmp

Download

memory/4736-91-0x0000000000400000-0x000000000054F000-memory.dmp

Download

memory/4736-324-0x0000000000400000-0x000000000054F000-memory.dmp

Download

memory/4736-97-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/4736-92-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/4744-156-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4744-162-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4744-155-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4744-331-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4876-12-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4876-1-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4876-7-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4876-15-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/4876-0-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/6028-14-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/6028-38-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/6028-126-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/6028-36-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/6056-101-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6056-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6056-102-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6056-108-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6056-349-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6056-347-0x0000000000750000-0x00000000007B0000-memory.dmp

Download