1ab0de17f23875250104e3e172087e745f45f07fa747a172fd5a300600d80bb4

Analysis

max time kernel
149s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 16:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 3.8MB
Sample260604-tjf9qsbs2k
SHA256 1ab0de17f23875250104e3e172087e745f45f07fa747a172fd5a300600d80bb4
MD5 997ac61e264448f62f6908373991ab5a
SHA1 cfbf28d041b313a9e40c12a890660666dc8bc653
SHA512 83793f9d59960dbda76434952bbd1e8922dd1cee4342e43d48348bba27c6a35967b26b0bfdab79cec74b9a02ff1fdc6a72b0f92e5d08225382e2ace2a77ac159
SSDEEP 49152:O1g15A610nCjvLEt9sVZVGB9D2Of4HQOYnOKZUmvnMGAv+e/DI9yxUeT+uXEkjNf:ONUA0ZunZhmqa+uUkjDBHLpDz50GC
TLSH
T13306AE1AA3F806ACE0F7C279DE95C553D776B80D07B1A69F02909CA64F732608E79713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1284	alg.exe
2276	DiagnosticsHub.StandardCollector.Service.exe
3660	fxssvc.exe
2124	elevation_service.exe
2528	elevation_service.exe
2192	maintenanceservice.exe
4084	msdtc.exe
440	OSE.EXE
4692	PerceptionSimulationService.exe
236	perfhost.exe
1856	locator.exe
4520	SensorDataService.exe
1916	snmptrap.exe
4588	spectrum.exe
2172	ssh-agent.exe
1772	TieringEngineService.exe
1828	AgentService.exe
2928	vds.exe
1164	vssvc.exe
4732	wbengine.exe
2716	WmiApSrv.exe
4672	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dfe16be7f6d6c89d.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_169453\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a42b4ff93bf4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000891edff83bf4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d46c7f83bf4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006428acf93bf4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e06569f93bf4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a530f2f83bf4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2276	DiagnosticsHub.StandardCollector.Service.exe
2276	DiagnosticsHub.StandardCollector.Service.exe
2276	DiagnosticsHub.StandardCollector.Service.exe
2276	DiagnosticsHub.StandardCollector.Service.exe
2276	DiagnosticsHub.StandardCollector.Service.exe
2276	DiagnosticsHub.StandardCollector.Service.exe
2276	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeAuditPrivilege	3660	fxssvc.exe
Token: SeRestorePrivilege	1772	TieringEngineService.exe
Token: SeManageVolumePrivilege	1772	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1828	AgentService.exe
Token: SeBackupPrivilege	1164	vssvc.exe
Token: SeRestorePrivilege	1164	vssvc.exe
Token: SeAuditPrivilege	1164	vssvc.exe
Token: SeBackupPrivilege	4732	wbengine.exe
Token: SeRestorePrivilege	4732	wbengine.exe
Token: SeSecurityPrivilege	4732	wbengine.exe
Token: 33	4672	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeDebugPrivilege	1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1264	2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2276	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 2464	4672	SearchIndexer.exe	107
PID 4672 wrote to memory of 1160	4672	SearchIndexer.exe	108
PID 4672 wrote to memory of 3240	4672	SearchIndexer.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_997ac61e264448f62f6908373991ab5a_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1264

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1284

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2276

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1292

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3660

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2528

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2192

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4084

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:440

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4692

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:236

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1856

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4520

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1916

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4588

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2172

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4600

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1828

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2928

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1164

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4732

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2716

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2464
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 3016 3032 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1160
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 3064 3060 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e4e04eb4a6a41516073eefc4dd96e06f993f9bfeb363f1671926b2955cb56754
MD5 f44fe52e020122f3a082167d523684ea
SHA1 e000d94441e9fd98561b1b34e31e1478c30a1565
SHA512 a60e31febcc347d2ed9e03ab8eeed06883fc509f58bc85b7e3faa4e522d9b586f18bfca34e18735986582507fbab881bb7c4a9e0d2fc1dbf0cc15856a6efcfb8
SSDEEP 49152:ab+632BuPkFKRrdE6ohdstBhuXjfS4LWxnZtdnYz5d6JgCg:M3q6mjBRz50GC
TLSH
T182D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d28357082d149bf7ed8b1867038f405ac0c9281322458a4c24d7475628e2a055
MD5 c68b15872ce214b4d74e300732f46477
SHA1 f79dfe7e2a89f0000733f79dc2b094dcba3265e5
SHA512 886049b81c09f5e16caee71692b0a20d3baf620626ea1bbdedb466370a26b98895906590a89257891923c699a2c7695b7e3792b5d77408f242666b6dcc6da690
SSDEEP 24576:4XYfDtczAGtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:vtcPtdnYz5d6JgCg
TLSH
T19065016973E408F9ED6B8178CC62C501EA737C5547A0E6DB03E4AA254F336C85E3EB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 eb1bd823667a93b18384e3409c4318c2baa9f484e9dff8862b560eaf41c2ed68
MD5 b94a0439c3ac61edf8ce705dabf599af
SHA1 336537327000ae3ef6d2e4e781d1c99aef945079
SHA512 697c15353b612d90396daf9d3705ee3b470d5c70c803d49fb2dcc5c529663d89916dfbee4618e12677ace21c89b95d17bf68c144e6f26e13cebbce4dfd40e2c0
SSDEEP 24576:00Le5ji0hmxQrMBtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:0Pji0A6QtdnYz5d6JgCg
TLSH
T1E785AE56F6748331D073C0B9C5D2A68EED7234825B3089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a71c89ac602405b169903d1d8959a86bba1830909c27c42b81fd77ffa3c0ff9e
MD5 c0b9c15bfa04b3d01aac8087fe6ef816
SHA1 14efba4cdf8305cd718e0403a77c4104cba4f1cd
SHA512 9336e80497fd6cda9b14f1d20a5af430cb44c7723abc6f078f13f651acec662f903d54da5e5b01c89d1bad57ba3a643cc2935149a497845abae9b4ecbe6a82f8
SSDEEP 24576:Da7/ezSC6vUyD/aqgrvWj6q8wyuftdykir8q0Hsw47opM6g9+JVuOUj7Cg8:u/ezSC6vUzPv+HjyEtdnYz5d6JgCg
TLSH
T1D2756C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 58cb046050f9bc20f018b828af18a9dccbce1c07c37fdc6ab4f78ae33b010c93
MD5 264092449e16387682f863175da3e762
SHA1 40574dff38429b00fdfe51012c26e661430364fc
SHA512 3cbe540d33ef0989bc75706afd320b3b0f5faa1f39d5240d57d8bec4104d94caf187fb5c8dd31caf2d4dae25166891ed12f7c194055dfa8c6f881e0dc5c01ac9
SSDEEP 24576:FVbqPb88hv/l+Bytdykir8q0Hsw47opM6g9+JVuOUj7Cg8:FVO88hXl+wtdnYz5d6JgCg
TLSH
T19E559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C2E77BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 b343e77a52ba8c2febae35ddb8c1d4e2e11390d17aad1d5cf6389d9afdea0a7b
MD5 281979204046c55036de2c48ff7ab89e
SHA1 99147d2301fe1cb16034530b94c9d403e02bb586
SHA512 28626c29ec5c0be15415c36cd3adc03961d9b24383b6a3aa3ce55a248376fdf522402516cead659166688af3b47a2ea7f51e5b266dcd1a32a44233486e7392f9
SSDEEP 24576:dIttdykir8q0Hsw47opM6g9+JVuOUj7Cg8:ktdnYz5d6JgCg
TLSH
T1E54523D3A69C54B5DBFF45B1980ACD04665E6F5988EA88B7F2643659887CCC0C338B0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 9c7d1450bee43f3940ad3bd535f9ecff1b08edcb63e20d1bc27fa3dca3d88aac
MD5 f27c92ee675b8fbf4f4ef3af593da737
SHA1 9dd927f8adfd5fd0f522e59c2594b016204ca332
SHA512 282310839da577b70701dc702ece401617632ec6d7f7c03bc047ea91053a860ca52f4457e8521781b5fe6b8b0b7309abfb3a99ad3bebb91dd5d7836ae50e7ddc
SSDEEP 24576:hJIU6tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:hJIU6tdnYz5d6JgCg
TLSH
T10265CF7BEE28FCE2C67E8DB95A51C600A77678304F6293CBE164920EDE235D04E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 57f391371336775c11465c62195931ee9f1552fc588762c4951fa28cd002aee5
MD5 7b1a21db731332e9a1f98440d5980863
SHA1 36d742a49cbfa853a12b4567683c9ce903fb3fba
SHA512 abeb7df3bfa73319f87ae0b6efb692c2edab698fb81dfd5f85f2b34cb2204b8d0592a20a4a4e088072a6ee3f1d491b59cbf572682302dcc152d5fc3851ed05cd
SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH7:kQvGAdlCEL8c/WRNw5CIz50GC
TLSH
T17B266C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 ca9287ee97020459dc8ad80a391893a323378a2c56c77fe6a7da829927a6befd
MD5 689e4b7f6dcafed2be9aa4b9b0df864a
SHA1 7e79a101420b450cc93d21fa55921957819b172a
SHA512 7bc598071e914269ab16db476ec606b499b006ff493ccdcdfd84cb011677fb7d661621fc6eb53030c620f7559ab03fefa9acb8cee124ef9250ccf80b98c89610
SSDEEP 24576:wEewsAjgtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:hljgtdnYz5d6JgCg
TLSH
T1E075E071FA74E036C6BF0DB21B26C716146D7E204FA219C3E3A85E9D49346D22376E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fb298359c25496994ab976ba021e0a4b167a124269a25bf4d7a5e5f30029cf2f
MD5 2ced072a886653c17c2fe94d3d50e064
SHA1 7a06b494b3f0692901e60c2680776d3150251edf
SHA512 9122d7a6b8ef12c9cb9afb2bfe4b8bf3e753fe036ed12e78ac2786100610cd2a88d4f177b24be44fd5dbd10f12966572300a1e4b8769936f74703daa611a2fd0
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHn50:dUEtQevvqc2W1cpV20I32n
TLSH
T119474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 dfe2d020bafa5980c24f0ada3ef55fa821efb1878cd1228dad84ec4af0809c01
MD5 b1edf194a103b95d56eee3f1c5f4fd91
SHA1 466fdca6ba5e7efd8c71a1eb8a8a7ba9d912a2ee
SHA512 954bf4d69f12f69b1dcc833b3338fad77fbfa43d947760a80c42bdce81f088c0d8492b5b7c167b9aa9e4353c08a450b8b8a269cceeb135eed7c15bb5ce1ad274
SSDEEP 49152:lCbRquA/m2yL5zLfFiV+XenmE3/zAtdnYz5d6JgCg:yoq2Vjnm8z50GC
TLSH
T164D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e16e9fea1a65a1b711941079f7d57d75bd191084c9afc623792fe994a9423ee8
MD5 4f33d63eca86a7276815932878e5c00e
SHA1 f34bca3a9d03559006dc9d298d57161aa4dd0886
SHA512 4f63d8dba013c2d3d0e7a97ca9712fa59c3b72da3128bc824ce5310f6b3a9e7443fbdd0c90642f5b33a155454b5a191c9b542687eb996ae6038fc160e79149da
SSDEEP 24576:xAhGL6IFoiwtA5l7S53ztdykir8q0Hsw47opM6g9+JVuOUj7Cg8:xAM5Foiq5jtdnYz5d6JgCg
TLSH
T1A0359D81E7F955D4F5B3AAB899B68570EA76BCAA5E31C20F2150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 51b4055c16f0d515cfea573f0695e5aebb94ecc0855cf5203b9ecb6013841023
MD5 c00b5e97e623f464e2b48d2d4d8db921
SHA1 4eca4fec161fc8718751059f383b85c0aea5cb52
SHA512 337337e067c42599a7ca850163723df4b2f13977efe45e580a83959a465096f0e9b5436689ac3501c54a9ea6f8fe4fea9b96f6a162ee8fcc3b48bd2794bf9c08
SSDEEP 24576:6wu7OWktdykir8q0Hsw47opM6g9+JVuOUj7Cg8:6woOHtdnYz5d6JgCg
TLSH
T13165F18672A80CF9E9A78239C547C535F7F6BC022A65CB2F5360C65B5F37250AE2DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 6fff125816a0b547d2387f365c9c9e61ba9d42d570d522db6eb799d84f4b77dd
MD5 f49fb6afa7a3a6db38b0bcf51efcf231
SHA1 9b97a122c702b1588a47925233024855634e41dc
SHA512 e045af049de61fc7660c5fcae156e5703302d3d9e011d69bef6b2ae887936b50ed67db91a93b4624645fbf8c5faffdffa07790c9e45495685450dfde2077a631
SSDEEP 24576:EZuptdykir8q0Hsw47opM6g9+JVuOUj7Cg8:jtdnYz5d6JgCg
TLSH
T11B5512C633E820F9D5B78278CC958A04E7B67C5657B683DF226422695E37EC04E38B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b5a93f050ed0a1b1bfaa826baa148d7216e6a0a6f5264d86783f131f700422ee
MD5 f94ef485be6b77ea7d6a579cf243bc6b
SHA1 1f9be5521f8bd0a22bb15099d6ef2c9549e70d7c
SHA512 fa9a78c874e319a4980a47da15dd8c2e867e8afe64e5a4f4116fa6c386c3fcad18443c1f0f0f85ec7810b4ad816fda7aaf1482b086bee891edbbccbb3e85654b
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uv:4QRQyi36YOcPDLvw2gAf+PN3dz50GC
TLSH
T161667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9c8278d77dbfc125b4abb7d71cbf1df32754fb5063d009de7b83878900d8ddb3
MD5 0544668656929901db4a0f67f81e0f53
SHA1 4590a167b828348e3e958e5ed3775882bfd06dbd
SHA512 64cb86631a74f0c6e7dfd2c90c730be5278eed78541459728d8a8860050216398650d98a930d79bd1e47847b74fd05d35803558423faa05ff70d0980f9eaa55b
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uv:kQRQyi36YOcPDLvw2gAf+PN3dz50GC
TLSH
T1CB667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 744085eb37ca07feccc354f212c21c34fad483f174e35f40bc8f68b6fcd1a845
MD5 57c37df19735d50cf5ced3f343dc07b7
SHA1 81e1865a7d684a6116b61d125bc16cab59c8ad4e
SHA512 1e865ca74d764fc3661edd3e0b4c2937ae1eefca7abbc8b7f5ac16a885a68c4d0b7d29d5341d669c2722da099243e329225092bc124fb3b848b02ed0496da899
SSDEEP 49152:768Qg55nhkeWu7PNU3/QtdnYz5d6JgCg:FthTRc/7z50GC
TLSH
T16CB55933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2495e9a40e107b56af46407d634a22c8086a66d66cea40251db0e3e36134281f
MD5 495d939601e56ddb3bc3ca2613509e17
SHA1 730dd6d6c400f773daecda739e166637108a6d22
SHA512 158d4d3ebefe21302c506f67a518c5f038d98e491fa095a11e10722fa3aaf0ef9996cd9a1d53ae63171f4aee7f6a9071f3a31815915cd91af509a1964d3d8174
SSDEEP 49152:B3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99l:Ay5112gYy5azzVvU69nLKnhZKz50GC
TLSH
T15D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8c4deb25419eb88464be1913500801d1b15bc231dc5fc31238d728accc693a65
MD5 3b7a0055020e47a6b33b97be0527ec44
SHA1 8455daf21e528479c592b3ba08f2f18b158f1864
SHA512 e3f99d340bba4d72fedfbcf96987e68519c63decef16fcf17efbfbddd08eee6d41154d5efe73c9a00cc1101feceddb0119b942ee2e3ee379a4783e1369a14b81
SSDEEP 49152:/B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl2tdnYz5d6JgCg:Bu6JmIxd2dVz50GC
TLSH
T172D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a57dc3793498b0f029ce5ba40b879e56e6aebcbebfb62aa688a800225d040e15
MD5 407a03179ed6fdaa6a98f8bac29b385c
SHA1 0c51c9f4208382e8bbb87096a1a83c5002410e91
SHA512 6bbf11b5478a9f9f65dbb51d2a87fe1c7b3386e0c2c9609083ab1749ba2c42478582191066a20ccddc73a01e6c3fe6e3c55807f2aaab764f3cef09cde8523d7e
SSDEEP 49152:21hpsNoJpF1A67U44CwH7R4xatdnYz5d6JgCg:2mifPqR8z50GC
TLSH
T167B5BE13F2D900E8D06EC17887569632EA62BC460B35B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a6b00ac2d1bb64b543d53a98c2c5e6d3621b7b156df6e7f448c1ae44f9993cbc
MD5 c30b6d8748133c6850e9930fc49ef4d0
SHA1 31f23f79d7727415383e076bf68d23baa871b474
SHA512 8e6067e9d59edab545f94431f5b45d5cef72e69c20d1acbdd565bc521331948dcda40a0ff9e06070f6597fc03972b1a9e5ed678d5f7eccf4bacde810d7324df5
SSDEEP 49152:LSuZQIY0Be2KkRVtOnks6NMHqptdnYz5d6JgCg:Z5dKqi61mz50GC
TLSH
T14AC5BF03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a0bdfca3f91110df7b9c6040f12551c7fcb231c4ac9461de6cfc19a9874e5196
MD5 f7733c18722d3d77a3574ea835e0ddcc
SHA1 a5f38552dd3ce0c907f3536511ea4d9d57283561
SHA512 c61dc39e5003b8f199de14028869ea964ca61b9f1f3c62a31d3257662958797a0024fe5bb68f86948be231bb7f974a87e76b7ddf0cd78425624f0b1509252563
SSDEEP 49152:rhtSn8EApI0figjgiDn0AP5wGtdnYz5d6JgCg:qX2iWphwz50GC
TLSH
T1FB95BF13F2D900E8D06ED174C7468632E962BC160B35AAEF0A90B7561E7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2b6195431b2280e60d39550f07dc6daa69abbb39a790e8c09766362a24e516ea
MD5 f2e34014012c957c65726a67af9d52b7
SHA1 5a84da064acd3a634aa11803ee901309d5a91700
SHA512 78c21362a4ae5293a1ae74c971e5c61f456e2f7aafa777e8ab2a4189285391508c2a6ec2bdb2d5eae192686029945f1016e6c6c753ab8bfe2f8964f24121a41e
SSDEEP 24576:11tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:DtdnYz5d6JgCg
TLSH
T1EE4523D3B5AD45BAD9BF81F1C80A8A44659D6F5BD8EB80F7B35832158879DC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 915fa68e53ea21e26ca3bb486038934b07a253eaee08d059f0a699b3fc9e20db
MD5 cf5b9cf73551362344aba05deaff4e3b
SHA1 c35e97c0ea7b9d63594dafc92c8d89d8fd6a8680
SHA512 9d0ace600ebe7d431dc1f8e331d5beed746fa94608b6b30f9a1fa841a2beb9d1bd3b91a70cb257f65fe2461afd1ddcd5a07ec620beb6bfae708e1a2da11081d4
SSDEEP 24576:n8tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:8tdnYz5d6JgCg
TLSH
T1D04523D3B5AD44BAD9BF81B1C80A8A44659D6F5BD8EB84F7F39831158879DC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 370937bf2c714489739caccd0a10b9ec1bf075bc07d12024ea67b81d829f7fde
MD5 7e78405bb3c69afc8f2daa9aa2e51ce7
SHA1 adfb0357f10ac609024ae1ff87b6f6dd8e85401a
SHA512 e9e374f8994213d3ffe4479b35c903f8d9d010811f0b09ca8d3a6b1b573b534d064a424e84b93deb743d95b193e0e5a9023529ba1dbc13ff0997adde0966fd87
SSDEEP 24576:fitdykir8q0Hsw47opM6g9+JVuOUj7Cg8:qtdnYz5d6JgCg
TLSH
T1104523D3B5AD44AAD9BF81F1C80A8A44659D6F5BD8EB84F7F39831148879DC04338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 0b76a32dbe15817cc92e243377f379232f40f1d8bdd93fdae51f270068d8242f
MD5 a58a957d9d4dabdc88bf384351e5bb6f
SHA1 1f30920ea18249e826950a3e71417de5e2234810
SHA512 9c446c2260ba9259cd61bf3cd44306ac6ba2bd80656b1736a09e7c65bad72858ef6f53ecb4819f1d25d5ae24bbeecb621bfcba6c33f430e180751b7a727f4250
SSDEEP 24576:Ktdykir8q0Hsw47opM6g9+JVuOUj7Cg8:KtdnYz5d6JgCg
TLSH
T1FA5523D377AD40E5D9BBC1B1C8168904A6ADBE5ADAB784FFE35035194C75AC04238F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4a1c30ff1cb0fe3e01a6c84825876d977ab512f2c277b2b54b01d34d8e3288f3
MD5 c71ed056144d417c6e61e6ef96469dc8
SHA1 a8ca66ad58601d664266494da4bc2fe262ddd2e2
SHA512 3e280628ca9c40e0ffed8f90ca446af36bf63b9fd259829c89515ef32801626d74c1217a752274676ec6551e837a4350830bfecf60dc632071c16d5772c0930f
SSDEEP 24576:frtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:TtdnYz5d6JgCg
TLSH
T1194523D3B5AD44AAD9BF81F1C8068A44659D6F5BD8EB84F7F39832148879DC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9571b6d34f22feea38826cc49acf8db72417d42d1c90a477098d0e87d0f88218
MD5 a0ce385bbb15087f4f0c078d206c92be
SHA1 12da68e5148a4e486d558900d55a3dfc1ae6a845
SHA512 93040c530db6d070ced034028ab06756352c05c843c62210994b7ddf0e5829682e820738ee546c9c4e6a4cbbdfe0f4feb9e452ae63d35b40bd183c82b40cca00
SSDEEP 24576:2Itdykir8q0Hsw47opM6g9+JVuOUj7Cg8:ZtdnYz5d6JgCg
TLSH
T1E94523D3B5AD44BAD9BF81B1C8068A44659D6F5BD8EB80F7F39832158879DC04338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c1d2c1e25c14b1af25fdeb20433d621507dcd19a41cc8b1978e758d77de36a8c
MD5 7bdf3dd07d9ec31de2afb3dae5872235
SHA1 b3be7ff2b3957a571783be8a4d8b27d5cdb4cc54
SHA512 d4e54844460abc51b54fa0956f79eaa1eccaf699001e9cb840c05eec911aa73e08daf8a4a956ae3a339d6d2b279ce6af67441486b0fb63e246b26bb117256e5f
SSDEEP 24576:+Utdykir8q0Hsw47opM6g9+JVuOUj7Cg8:HtdnYz5d6JgCg
TLSH
T1984523D3B59D44AADABF81F1C80A8A44659D6F5BD8EB80B7F35832158879DC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 af92d9f604736f1ea5ce99d5b9ca7c117c417732cefad11e2fffa6be6075f750
MD5 b9ceac3ab4cc95f9038f4ef91919ed5b
SHA1 0d17fa17c2125371e704ac2f20a63f1cc8b0e61f
SHA512 902d33389ae7b5cbafdb6dec54594586461c13d54c9fd3d20a4280d77ec86f0046078a037f6171e37eeae02ee077eb98ea0bcc5571f6aa2e606ff680c061dbff
SSDEEP 24576:+ZMxzFVSOctdykir8q0Hsw47opM6g9+JVuOUj7Cg8:+ZMxzfYtdnYz5d6JgCg
TLSH
T163650195B39418F8ECB7813ACD158905D6B27C5A4BB0C66F13A4362A5F337900D3EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 bfebf63dd0863987d92313a2bcce184faf693019c502f301b923c3906672f972
MD5 3d687cbbff2b63329c96a3bfa9af8af6
SHA1 cf28ed4f18ec9bd058cd284f1daf8083c33aa672
SHA512 28638894db673f7d29faaf6d9bca815711ee2f6ff04013a04c7520f193d6cbb268b7b4a57bf37a0f0caf00702f3eb2b53fd8a036f0cf8ea58a20fec268b96ff7
SSDEEP 24576:z5tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:1tdnYz5d6JgCg
TLSH
T15F4523D3B5AD44B9D9BF81B1C9068A44699D6F5BE8EB84F7F35832148879DC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 5c667da63b588d54632946a2d9f354e768142684eec6421dd5efaa126f97355c
MD5 c9300e444aa48d175bf6b632afc9d10e
SHA1 be067f533af0f9a5ab1e219e429443ea7e1d69bb
SHA512 540b22d61db2a4af0ac705cf43622a24c0c6d164fd98667927da13e54922c2fe057a584dc0dc7edd49a917b112f1da3fa78c18c3fe4cb451f920bf6f273ff4f6
SSDEEP 24576:79tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:htdnYz5d6JgCg
TLSH
T1874523D3B59D44B9D9BF81B1C90A8A44699D6F5BE8EB80F7F35832158879DC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 3f48e434ffbe1b06732f3ea7d1e3d7282401aa585e5ebfc9dff2e22e21f3b067
MD5 461ffb9d5bef6904152dd03aa4271c76
SHA1 871ac4bf6b34711db1774a21b13e290e3d0e9ea2
SHA512 8ffaea4d6d35362d891ad256a4033f9df9e52e3ddb47c6d0b0a4c2985f05a982c1310a8a83bc13278654848a06e3317075fca903bcf1bf998371dd813fbc24fa
SSDEEP 24576:Xzywtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:XntdnYz5d6JgCg
TLSH
T1A055028373A520F9D17B8275C8524A01F77ABC364B6589BF63A423761E376D04E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 957dc42ebf81136a444cd3d9235a1d963365baa99418e37c3e1e91322a467dd3
MD5 af67ae125b9dfddc30081709a6484a2d
SHA1 9a580e7112989b1e83f11d221331a957789a8186
SHA512 bdf8c10f3e40235320fbf35b8c446cb1e9bd9ced0ea99b0acce8b360e0fc9766358a03bcb27c332ff32439736aff14ea9b0239608ff4c0d960762c3e1d8df7d5
SSDEEP 24576:h5tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:vtdnYz5d6JgCg
TLSH
T1194523D3B59D44B9D9BF81B1C90A8A44699D6F5BD8EB84F7F39832148879DC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4c56436ca64e25f6c9d443bd64250445b3c48106c7b905d41ed075c977ae7c36
MD5 c61665b1b72d29754ccebaa67ded5e24
SHA1 0f7b5644f1631b65a4f7dabe6457be1d34172ea7
SHA512 099bfd4221d0d28937f4549f3ee6e2b0efd69b4ed6312b13952f77331a3467e83b2c54af54b65ad0ece0e8d02a4d54784a0e45b3b50f7c98ae9ffe69ab847645
SSDEEP 24576:b5tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:dtdnYz5d6JgCg
TLSH
T1A24523D3B5AD44B9D9BF81B1C80A8A44699D6F5BD8EB84F7F35832148879DC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 7adf3647d156523cf89985a746fc898a5c8e0510a6171c54b8cc59459fb54413
MD5 bd410cbfc4e1eadb526d69d214e45e20
SHA1 43a15c1899e232af51b52d37af1ca9a77052b205
SHA512 df7978e74be55f62c4a0bc8af369952b1350d7de427b06d64e192f19da5293e25b1b038605e13a08a23750338dfb737154749c49ff8f15c5102561e9d06757f1
SSDEEP 24576:FCUApvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvA+tdykir8q0Hsw47opM6g9+Jp:FCUAPTY+8Wg2lIL8lrIUJLWwrtdnYz5D
TLSH
T19365AE1EA3EC0896D4BB813589518A06EB727C2E1B22D6CF2160C33D6F67ED55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 c51350e2a3c7cc0b074f566e9a0e9b59771ac156e8c5a8800beab50791601bb0
MD5 8aaaae950e75b7ba87778b95703408c0
SHA1 452e511c5e93e35c51e0bdc546e726443be5cc2e
SHA512 529ecafc8616561057fea942670321abb9a7de45bdc3ff9dec03ac55d921b4be09780a11a5fcbba3b23a14ac1a614450676a6ffce74bdfa9d76b024c7671d5cd
SSDEEP 24576:nptdykir8q0Hsw47opM6g9+JVuOUj7Cg8:ptdnYz5d6JgCg
TLSH
T1B055F15AE29801E8C06E5175CB468A40B3677D6587E2D2DB63D0F53E0F7AAC04EF9B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3d8f4a1310517d07161fa6e71f9dbccb8a9ab3a578cf4dfba97a0e94b6b42eed
MD5 cbf0d944a13a46dec3cfaf51730c49f4
SHA1 32891a2ab1eb7843480143c2e0c0f8e4c0c714c9
SHA512 fa0b0236ba7939fb2348ff1d873f5c321d8a52cedd7ceb019b766ebe7db72fe995b2af5a7529d3643ffc095286fb5cf76600b43a73612e4b1d924292c42b9c90
SSDEEP 24576:RCtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:RCtdnYz5d6JgCg
TLSH
T1754523D3A39C54A5E9BF86B1880AC614265E7F699FE684F7F24432589839DC04738F0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 35b3a81b6e7bedf1e66b4e0d734e6ccab2771d978bcd32c0b1e2c51f3d5629b0
MD5 c63b662bd191a1c470736fffab1af366
SHA1 351c1983ca4b148d7674e0603a167079eb080340
SHA512 01e6888252a9541970146b1581a4c27b7a6fbcba7e1624615c646ae0febd95a756fedf1d76a3ac46e6a26ff663bbc04ca42343099c9185c1e91f8ead5e3ac528
SSDEEP 24576:y8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCAtdykir8q0Hsw47opM6g9+JVuOUj74:zRZwQCyiHiQEaaPnMhtdnYz5d6JgCg
TLSH
T13F85BF1E62DC46A5E0BAD2B8CD674407E6B27816473197CF1290C27D1F37EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 8a483f8253bbcd403f8027cfd55dc6bd1254524d9b7f2fadadc16c6ce7bf709f
MD5 1fdf079544133e9cd25a6a3c761f9bcb
SHA1 c4f488020056e984ca54a0f26b6c53cb63057e2e
SHA512 d20f5b9040406c7184319d788784ff40297403c18eb2517f2b3c4ad90cf2af16c97ca43aa918c19d2b4501d50e2fdc1d3b7a8f5504f83cb39a24f3b245cc2b73
SSDEEP 24576:2bxA1UGStdykir8q0Hsw47opM6g9+JVuOUj7Cg8:2bxA1U1tdnYz5d6JgCg
TLSH
T19C5512AF62AC14F5E5BAC17988868105D3327C2A577183EF61D0A27E0E3BED44D35F46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 f10eb3f19514e950302ea8533966d1e8ed6742b20f3d30b2cc6c48be65e59580
MD5 18ae83834f8de0e77bf755d6804a36fd
SHA1 b346dec0c1d3fcea739e124a53bc49d44e66e64e
SHA512 fdc58bb2001ad9bc2a0c401db92ac26583e531d1a9d2ff13b29c770bad375679a777f7883cd67f26eece6b02d871b4c61d8ee1c5f710400e509ab4b388d14ceb
SSDEEP 24576:SjsmP0yHaqrVqHra44KDzMsrnjtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:SjRP0yHfVqzlAsrnjtdnYz5d6JgCg
TLSH
T1D545AF2EF2B910B9D4AAC176450107B5BB71B82D1F219AC70170C634AF1AEE89F35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 a5b1ffeab8c61acd8bdf60efba6b9bc32d83ec13d0cfb6396ebae39b18813ea5
MD5 c0a4f8b935d77c5f50ddcfa88d5c73f0
SHA1 3cb04a736efc4061d1b014458a320442f5eef182
SHA512 1aec89f0d9ab41bc61cb37c4cb0e248fd007a25f71eab56e0fa271ddb1ae0b9c5cd7ee39257ea9659f18917beb73cf9f6f65e237e83b1945440adaa295f1b30e
SSDEEP 24576:Rotdykir8q0Hsw47opM6g9+JVuOUj7Cg8:RotdnYz5d6JgCg
TLSH
T10C5523D3B29C44A9D9BF86B1880ACA04665D7F5A9BFB84F7B1943255887DDC04338F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 cb2c65a50083697dd9f46bc2de62a32f911cc6b4cc2c5fb4b29e02fc06ba2c23
MD5 3cd01fa4dc3e794a181d3640876de79d
SHA1 1c6afd4093091149cdf170c4cdfd4b1c4bb2692f
SHA512 55ddee55174de35ca57e02e584172fb90e3b20cf01345630f7e9f3783bd0f9a78fd72327bff4dec3c51beacfd51e69e73ffc623376dbeb7539476cc117143543
SSDEEP 24576:YSLBUTGtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:YSLBU6tdnYz5d6JgCg
TLSH
T1BE750155F7A400F9E97BC13CC8668A16E272B85D0764E6EF03A84B651E337E14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 97a1ec421f475912dd87cb7ae27282b61c1be348df0fb5e5444df47cfe6b665e
MD5 72a0ecafc478b54edc8eab03873a4eda
SHA1 17d4fc51c2351ef0d91ebc0f9956dd2b66f1b31a
SHA512 7ce739798f108a2e20b5fc1e3e03c8d9074fdc07d7eda77ee796e53e9aed672e86e722b1117117c5ec9c7c7e22ae800a93589e2ba2d4d6324744d9990951b8fe
SSDEEP 24576:hIYNH3tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:hIYt3tdnYz5d6JgCg
TLSH
T15065F16FA2AC08E4D57B9179CA838609F2737C66175192DF11B0827A0E37EE87D3DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 68bf6fb44011d6e4b1416a9627da25bbfd3772f03d131db1c5643dd9a1a1c4f1
MD5 974dc18e7fff2de4de61a1adb6951164
SHA1 aea728aa0c1518e3904dcf8f50c8b47479a3f8c6
SHA512 403d612452f226bc93ee4e882df955fcce3be1adbac1f6554d7a0be4d5738f743521a5a196bd6ba49e1e7df8eabd87505a119c6c67ac4783974f07ce6fe33f7d
SSDEEP 24576:KnXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKi:KnXoJJYH84VVS6AmETJas+cHBjSSKHPR
TLSH
T12565BFAEA2BC04E8D5BBD17DC5C24506F5B178661331C6CF026082BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 20d3dab0824d13a68b6c100850f9afe4d7d5f4139bfcb742eac11ac87f1e85a2
MD5 0f8506660020a90f224db6297a61d586
SHA1 75301ca5b0b954eb454aedb7dee44913e3b8e468
SHA512 1a41615b4ff924093a5f73d5471e98c9ac33ae8798365b0e762efb70962f05e2f6987c9108d1aff531d092ea74e029e3eff1481ae10776159a24d735855951fd
SSDEEP 24576:Sv7Xbxd9Tuycf8M/TYlSuxwr2PCNtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:SDLL9TuJ0M/TYW2PItdnYz5d6JgCg
TLSH
T178858D5EA3EC42D8E0BBD6BD85B79146FAB2B855173081CF1290856E1F23BF0593DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 82ca99a8eb46f4a738d99428572ef74655906c8d935b583dcd26e20f3cd2ebb0
MD5 35cdd9b2590730180df8ebdd0007b986
SHA1 7ae536140bc14209c096e91b28cc024934b394a3
SHA512 cba062ea15911891045d8c9671d96164bae5d7a4f05cb567881fa3297120b6ba8a6850283ca2ae4350703daec74f6293ad57822afcbe67ab46cd6af6f0a6e75b
SSDEEP 24576:YegJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wGtdykir8q0Hsw47opM6g9+JVuOUjc:YngOJOmPOHkGtdnYz5d6JgCg
TLSH
T1F155BF3FB7BC15D5E07EC17D8A968916F6B1782603255ACF0160827E5F2BEE42E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 e0210be004922fafee943b9bc77418a061b356957c42c92a8d8696710730fbb9
MD5 291bec3bd3fed2b182cf55b3ea19e27c
SHA1 94cfc9771ed9fca360e2b46a5bba8334f4230446
SHA512 c20111bb043c3ccd88fb210f601bd8790f1235352f250efe366bd909d63b079bcb9f4b025ba5ba38245bdd71d0193a71a27839256d155cf7191f064bf51e84b1
SSDEEP 24576:ULJnJiTk3R3waE4JrOItdykir8q0Hsw47opM6g9+JVuOUj7Cg8:ULJnJK8R304lTtdnYz5d6JgCg
TLSH
T10E75E06DD2A810E8D4B7C2B4815A1B56FF31387D2B2569CB69B4D5313F22FD09A39F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 7443c5ddf8e710dea3350dc0f4a0c8983bce81ddfd52c33bca20295be1721eeb
MD5 ab192b335ce7a7bfdea5d4cced94dca6
SHA1 3b8209892c22c537ace432a98c94dd517f946bd3
SHA512 2a1f4efc1d3b66f15c67b1ca94952f9823fab7aade84f96ac0b3c8d3d1839b0985acefcbaadac3aa83845ca42df2aa1c322d2a11557447439fa9ed020483e968
SSDEEP 49152:C9GqCzDScAZmlvTcFg8Ph6UtdnYz5d6JgCg:cAz50GC
TLSH
T154955D05F7EB5298E8B3CAF1C96694159B327C409B34F7EF4A80CA6A1E32BD1D534B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 731b238bdec34c1153374158f2f2954191c7c3384e5479ddc4ae139d1d3ba0be
MD5 310f6ae94377fe40087d825cb0ae4930
SHA1 76a7be1e3ebebcc31a548223104b6b4c93fdac0c
SHA512 966072a12a191e1b95343fab9dbc24b9de4d687837c120fdfc74de3e070b38b80ff7923ff0baa5e96449137a873180cb2a9e5b864ad18db3596b9ec31436c96c
SSDEEP 24576:/lYJeXm5jUuEWtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:/lYJeXmRUuEWtdnYz5d6JgCg
TLSH
T15A55129E76AC20E5D17F807588528A04E376BC66579253FF62E0E2798E3ADD01E38F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 c4debace320a8381c318cf164a75734270b390cdfb819579405b83083e4b9810
MD5 d63043d721bb3e69cc66f54855701a0c
SHA1 aa51ba458de5be33e62135e684fb08aa1e5effdb
SHA512 160a49189ebe51cd3d7912e2227be5f45ddd429e9631b2253d9aa9f315af6652b2111454c4173a25b8580b1243cc77c9bafdd58be637f64eae46bd7564ffa1e0
SSDEEP 24576:KjtyDtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:KjtstdnYz5d6JgCg
TLSH
T172651282739850E8EABA4674CD1382509A79BD259F6181FFA1D0F23E5D36BC09634F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 437c1705b5fdc5b94a6cd854834fc32c4cea57bfd0950d84f9fd5c22509b11a7
MD5 533998df981281b6ae9620f0334353e1
SHA1 9e1af1858d94b5473bd398d19519f5698ca560c8
SHA512 f3d914b326ba39573dd5df8e1e79779713ce5789ef5b5130c732cb76d50190e5b1afb3111ebbe58220ff14f40e1049f15ed055667b2e80377b282e26cc2f7f23
SSDEEP 24576:CGtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:CGtdnYz5d6JgCg
TLSH
T13C5523D672AC54B9D97B85B1880A8A04665D7F399AE684FFB1E4B234CC79DC04334F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 f4e470ab039da2556fbbbb88a1cc33ed5953ace0b80a2dd9ba8e18363cbd540d
MD5 90991bd36ddd62ceca8318ea1c591add
SHA1 fd40e0e9633ebcd56b896c833e84c7a197de9821
SHA512 369d6b66d9f7aa65f7d70663ecda445ff4c06873c84666dda148fd550af3178c3117fed7f04e5f6bc592c423a42c4c6159a969667a9006f837fb4a37ea9a2d56
SSDEEP 24576:MC+TyQIu93VAumZr7jmJtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:M/TfIq+YJtdnYz5d6JgCg
TLSH
T1CC558D1DA7E91DCAE276C675C8A34493E633B872137186CF2044C17D49AEEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 afbac8d2f48a632f981c86709fdc90227f8b93ef85c2d17ad477ffa1ea1b10b0
MD5 7409807f3f6a3c8a589f3e89984d3214
SHA1 439d478bfb04d2f291a47805385be9f5e97a78a9
SHA512 0462199f4a2e5d4842f033be9144847fb166a9df87e2bc599e24b30afc498921683b3455dc8dc8c40699bac19a8245d1a47debc35ae35db95f9902fd87626971
SSDEEP 24576:bLQikZqtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:/QikgtdnYz5d6JgCg
TLSH
T1D665F14FB3AE00A5D4ABC178C8458101F6B37835576262EF52A0C7794E7B9E9BE38F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 07e88a2cec40890af76553df96717a5a87f3dd929750a460978e83d357b63bad
MD5 de6ed15a1f711b3b91b1dc8b961c7057
SHA1 397ec3d02650007dc3251e8249e85b2e386be9d9
SHA512 c6fe6ccb7b30bd641bb998662e8e6f2d289f18d8e813a245c9ee8c7d68aebbbe2d6e56c0995be6f355fff2c834a1c65aa70c047a35db0214a646c22e58a0f8d8
SSDEEP 49152:npJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPDtdnYz5d60:spC7b4+80GTkHz50GC
TLSH
T1A5A57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 61edc11cadc9404c6a1bee5d3b01a83cf93a4bb488f072ec7615ea404aa195d7
MD5 0ec32beb05a559c548f160836503c88a
SHA1 c02c3315d11efe096bac13a4b555fd78f795ca8d
SHA512 e4354c1ce8bf57aec1d124230cc4bdae88041c805c4eec50f35fff4e55631e976b66c361acf20cebdfb37f42e88814dd52cdeec80083ae888383ceac044350c9
SSDEEP 24576:SSAwJPE1IDAo+4Kt+l4413lUQLtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:SqPCIo4Kol4jQLtdnYz5d6JgCg
TLSH
T13F55B01AA7F946F5E17AC7B4D663C601FB727822133163CF9290913E0E269E85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 1d864b3f68921ad2b513119a67ce251d68785292e9a784b6942a0aa19079245c
MD5 3c4cd64644ec787d674b55826d189e16
SHA1 e62565cc4f22806baec21ed187f50b0a20cb716f
SHA512 fc7a70e859abefc5375f93cc28e3ef4a897ffbb990a3c79c5d84d5309f21bf0f174efdf2ea2923c70974f196dc7ec7afeb21858b0c786b736073280e31d64248
SSDEEP 24576:1yLXPLca94tbtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:1y7PoNtbtdnYz5d6JgCg
TLSH
T11475D03EE66C08E5E47AC27CC6A38906F6723CAD037165DB15A091791F7BEE46939F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 86047509044a837ce7bae1ddffb7de17b524f059cecc1dc00cea4e50d290d73d
MD5 af1416a5e21b6f6511b1a3a893816ba6
SHA1 dbfa6193878b621eb1819472f8e64582d9f8536d
SHA512 8fb98fd74d152cac6a58a8891ed1bbb4788a565c5e14b9095b259fc5dc4e657a0cb77e784469f756f46ec5db3e43ed131a65fd48a3adbc8478a4c54134b92036
SSDEEP 24576:jWv8qjpatdykir8q0Hsw47opM6g9+JVuOUj7Cg8:jWv8ztdnYz5d6JgCg
TLSH
T18465128F62E824E8E47E8270D916821491B9BD7617B998FF71C4F57A4E35EC0823EF05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-103-0x00000000006E0000-0x0000000000746000-memory.dmp

Download

memory/236-165-0x0000000000400000-0x000000000053B000-memory.dmp

Download

memory/236-102-0x0000000000400000-0x000000000053B000-memory.dmp

Download

memory/236-108-0x00000000006E0000-0x0000000000746000-memory.dmp

Download

memory/440-75-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/440-97-0x0000000140000000-0x0000000140173000-memory.dmp

Download

memory/440-81-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/1160-419-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-392-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-412-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-413-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-414-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-415-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-416-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-407-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-411-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-404-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-405-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-406-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-403-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-402-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-399-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-390-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-391-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-393-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-394-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-422-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-421-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-395-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-420-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-396-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-397-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-418-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-417-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-409-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-408-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-410-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-383-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-384-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-385-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-386-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-387-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-388-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-389-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1160-398-0x0000017D1E150000-0x0000017D1E160000-memory.dmp

Download

memory/1164-374-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1164-163-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1264-94-0x0000000140000000-0x000000014040E000-memory.dmp

Download

memory/1264-9-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/1264-8-0x0000000140000000-0x000000014040E000-memory.dmp

Download

memory/1264-0-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/1284-113-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/1284-14-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/1772-372-0x0000000140000000-0x0000000140187000-memory.dmp

Download

memory/1772-150-0x0000000140000000-0x0000000140187000-memory.dmp

Download

memory/1828-159-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1828-155-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1856-170-0x0000000140000000-0x000000014013A000-memory.dmp

Download

memory/1856-115-0x0000000140000000-0x000000014013A000-memory.dmp

Download

memory/1916-122-0x0000000140000000-0x000000014013C000-memory.dmp

Download

memory/1916-238-0x0000000140000000-0x000000014013C000-memory.dmp

Download

memory/2124-43-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2124-34-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2124-145-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2124-40-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2172-146-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/2172-142-0x0000000000EA0000-0x0000000000F00000-memory.dmp

Download

memory/2172-378-0x0000000000790000-0x0000000000933000-memory.dmp

Download

memory/2172-136-0x0000000000EA0000-0x0000000000F00000-memory.dmp

Download

memory/2172-370-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/2192-66-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2192-69-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2192-62-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/2192-56-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/2192-67-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/2276-24-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/2276-114-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/2276-18-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/2276-27-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/2528-148-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2528-45-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2528-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2528-51-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2716-379-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/2716-172-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/2928-160-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2928-373-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3660-71-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3660-31-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4084-96-0x0000000140000000-0x000000014015E000-memory.dmp

Download

memory/4520-180-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4520-119-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4520-376-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4588-317-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4588-133-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4588-124-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4588-130-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4588-377-0x00000000013B0000-0x0000000001427000-memory.dmp

Download

memory/4672-183-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4672-181-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4672-174-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4672-208-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4672-192-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4672-380-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4672-229-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4692-85-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4692-91-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4692-157-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/4692-95-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/4732-167-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4732-375-0x0000000140000000-0x0000000140216000-memory.dmp

Download