6f6dd86ffeeceb9546400706d3348129277858dbe3517dcbe22b78055b6de705

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
Size 1.2MB
Sample260629-rertkafs41
SHA256 6f6dd86ffeeceb9546400706d3348129277858dbe3517dcbe22b78055b6de705
MD5 8e4c13c232e54d343a3a951a5018fc38
SHA1 04c23858a5fa6d0b1b8c14c4f7a626b84d2d5264
SHA512 cb12e2dc60d30ef00e9320e5e87df3accf54873b7d83cbe613250282bf931fe1ccd6b3aa4f9d3c87b6e78f699f7f90587b837b4685bbb851bcec9c9e500ee73e
SSDEEP 24576:n48fFk9RpEJVsvmb57GBiOl6a8JTth/RWZvR6wQQ92pN3a:hfiCdb5+Pl6bJTIZ5jdgpc
TLSH
T1FE55AF55DE5706E8DEAA8B758A832C06F2F1781A037165FF139211590F1BAEC3A37723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs

resource	yara_rule
behavioral2/memory/2244-0-0x0000000140000000-0x0000000140145000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2244-78-0x0000000140000000-0x0000000140145000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2244-395-0x0000000140000000-0x0000000140145000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 3 IoCs

resource	yara_rule
behavioral2/memory/2244-0-0x0000000140000000-0x0000000140145000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/2244-78-0x0000000140000000-0x0000000140145000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/2244-395-0x0000000140000000-0x0000000140145000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe

Executes dropped EXE 11 IoCs

pid	Process
3076	elevation_service.exe
5088	elevation_service.exe
5260	maintenanceservice.exe
1664	OSE.EXE
552	PerceptionSimulationService.exe
2848	perfhost.exe
5364	ReFsDedupSvc.exe
2116	SensorDataService.exe
1400	ssh-agent.exe
5132	AgentService.exe
5048	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 24 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
100	discord.com
131	discord.com
1	discord.com
18	discord.com
50	discord.com
71	discord.com
86	discord.com
134	discord.com
17	discord.com
40	discord.com
49	discord.com
73	discord.com
74	discord.com
81	discord.com
83	discord.com
97	discord.com
15	discord.com
72	discord.com
78	discord.com
96	discord.com
98	discord.com
99	discord.com
101	discord.com
128	discord.com

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	api.ipify.org
1	api.ipify.org

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\453a1c95a6e14f9.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102406\javaw.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6020	cmd.exe
4144	PING.EXE

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000249b4590d007dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042c9a9d3d007dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb6e3e90d007dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002892e28fd007dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004bd3eed3d007dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8c1c2d3d007dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a460858fd007dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4144	PING.EXE

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
3076	elevation_service.exe
3076	elevation_service.exe
3076	elevation_service.exe
3076	elevation_service.exe
3076	elevation_service.exe
3076	elevation_service.exe
3076	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	5364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5364	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5364	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5364	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5364	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5364	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	5132	AgentService.exe
Token: SeDebugPrivilege	2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
Token: 33	5048	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeDebugPrivilege	2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	3076	elevation_service.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 2444	5048	SearchIndexer.exe	100
PID 5048 wrote to memory of 868	5048	SearchIndexer.exe	101
PID 5048 wrote to memory of 1312	5048	SearchIndexer.exe	102
PID 5048 wrote to memory of 5632	5048	SearchIndexer.exe	103
PID 2244 wrote to memory of 6020	2244	2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe	105
PID 6020 wrote to memory of 4144	6020	cmd.exe	107
PID 5048 wrote to memory of 1468	5048	SearchIndexer.exe	108
PID 5048 wrote to memory of 1060	5048	SearchIndexer.exe	109
PID 5048 wrote to memory of 3044	5048	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ping -n 2 127.0.0.1 > nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:6020
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4144

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5088

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5260

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1664

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:552

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2848

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5364

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2116

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1400

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5132

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2444
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2894455325-857903158-4263030270-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2894455325-857903158-4263030270-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:868
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2944 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1312
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5632
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2944 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 10f2cbfab47eb0633b7d9258507917ed89133543bf52233f8e59da83389ff120
MD5 9cafdcfc5a0d58ab2c37959c5b4e2a12
SHA1 5607d6ec91b8a16ff96bcdaf4e07e83d27d7177c
SHA512 f85c4e9507903bb7c1c3ffb062d70cdc968c57d2c9bbb94986b52daebb12e4f1f7b78c7b1732bb1b11a79602a852d3ea7ac43864a762a152157a9a0ff530e955
SSDEEP 49152:Pb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnvb5+Pl6bJTIZ5jdgpW:N3q6mjBmslgJTIZ5Bgp
TLSH
T15ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 9909c6b8c0ce0e3df1b06871f263bcd67ac5f73ae04660d93c7c2e1fbbf6baa0
MD5 9a5a87f45fcd1908ee4b4973bc274b3b
SHA1 b088ec16ec81bde6322a3fec749f9533a7e50d94
SHA512 f6daf9d456d7497c16de4832ec8ecbeb8835e750b4f53260b11a64a5814bc09969f84299956a35b4230a4d71204e19c2f108ed30e5348022b085c6848322f112
SSDEEP 24576:DXYfDtczA5mb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:Gtcdb5+Pl6bJTIZ5jdgpg
TLSH
T19085F11967E504F9EC67823DC8E2C611EA73B85587A0E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 fd7c152164ee178a2be381519432b89ebf4c7a303cd6886e9929c91752a1f35c
MD5 ed6b22f394aa185a835ae9c4a0e96b7f
SHA1 bf35fd8b9b8a770d852c1329d314be53a1b168ef
SHA512 383c35b19e51f6b00ed16f7ff4658cc62360ffa30dd018b2512424d74ea5da70a87591878a279c1a0f0952651d272fcc9b56f01df7bc0180e28dc4b590bbd741
SSDEEP 24576:00Le5ji0hmxyrMAmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Q:0Pji0AI+b5+Pl6bJTIZ5jdgpi
TLSH
T1B095AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bda27fc2634f1047653d3fffecb4612ab2665331d0797545ad01d85ddaaf1014
MD5 24ca2963296174b3e039ccdc3978f84b
SHA1 c86edf04489aa1c6e56974084dae20851e294d16
SHA512 bd703d6a5698059292e4e04d0aa00c317015162eb1f2817ec0cb7a60dc362b0079cf6d1a72e78955ed795b2ca3fef07c57dc2a2ae09b3186b3b518876f4faa7a
SSDEEP 24576:Ja7/ezSC6vUyD/aqgrvWj6q8wyuCmb57GBiOl6a8JTth/RWZvR6wQQ92pN3W:4/ezSC6vUzPv+Hjy6b5+Pl6bJTIZ5jdd
TLSH
T10A756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f5db270f3a2753b2c18f6d1245495f1f8b07659922ee66c947be4aaf4f86d513
MD5 7db92d987e9bead1ece8fbce08571661
SHA1 53fec8bad95a4f910020dcd7bee595a799f1cc13
SHA512 9324cb4bbacec803051b93729f0a2502be7264456333322639e79ae64065d03499e8cde252068e967414d492f60ec71a84a38dd504390522d830af0bfa4c77ff
SSDEEP 24576:oVbqPb88hv/l+BVmb57GBiOl6a8JTth/RWZvR6wQQ92pN3n:oVO88hXl+eb5+Pl6bJTIZ5jdgpd
TLSH
T10F559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 bea6e58ec261312f90e939592d9c7ec8e032839c3faf04c3fe16d080afa3ff2e
MD5 d217d80036547136e4ff8626e66d1714
SHA1 4b3d7c43f7f183a2586a81c779aa0e76d1ef1788
SHA512 6d737d4d8eacd5ec4348a0c36a111b27402d362636fcbcc8f60c742ae0e83d777e5d8639878387f2968ffde182d00e79a333bee075ab2f17649b5d75037b1354
SSDEEP 24576:CFsmb57GBiOl6a8JTth/RWZvR6wQQ92pN3V:Ob5+Pl6bJTIZ5jdgpT
TLSH
T1496523834B6930C5E5AB1739D9CDDB00F879EF55CD866BB6C579282BF034389B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 ad8493ce73a079cb7bfe0f2e3771e478d0008f1af19c9ba3c05574daf2e2d4dd
MD5 cd0c620fb65eb6564ee2d45770f8ba3b
SHA1 1552445fce18b54ce47da49b538f3391c6df7ff1
SHA512 c5bf191bcc3d02d73c93f1e543de6ce59ce755bf3c6da7f51fbe63825a6d4abc8fa199e636686ea26cba76f51c6726ad6bd5d1285d33e3d080a2e48e38267c6f
SSDEEP 24576:sJIU9mb57GBiOl6a8JTth/RWZvR6wQQ92pN3p:sJIUAb5+Pl6bJTIZ5jdgpb
TLSH
T1A385CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55D7A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 569a83a85459c02d19605202414beb1834a54c3b6e64eb64e3292fc1fbb2d7c7
MD5 886549cea82c271e586daa1a0add3b01
SHA1 4fb7fe5e2b13ddbdf393a59ea2c9465f8beeee3f
SHA512 dc4dad5b82bfa5878ae967ca76f5b63ef88b5d7d3f4d9be93c8da271f2c6ea7f4cc28cdc01d475048e38a42cdf3ee1705e818362db2e1bb3a48afa64d3d92de8
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THR:WQvGAdlCEL8c/WRNw5CpslgJTIZ5Bgp
TLSH
T18A266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 283e113e27ca24b0b2fa85898b0b7cf63ae6b8e66f65d29de43698c44758ad04
MD5 0b29d88f3aede783acbe4aac400d096b
SHA1 b74be766332ae7dac789262331d4241bbba9840d
SHA512 53713b5f242f2b4c8853211788a3c7507a7c1ac7038027367d09832ae7f4b0868ec99a1fa40880c3415273282cd6ec8b1794c2ac4d0c20113ba65ea51737f4cd
SSDEEP 24576:bOewsAjvmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:Cljub5+Pl6bJTIZ5jdgpf
TLSH
T1BE85E031FE75E036C2BB0DB65B65C706647DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 13b9d9be1e5e5fec4ae282bf564bf88c1c4a3cec1a0756329a9ae2d2e1632b9b
MD5 1f098c5e608aa4cc837dc37fe316c943
SHA1 c2ae7531d1051c740fdc1d0812130b8c07b8afbc
SHA512 91b38eca2ba40777852d2431b6a595fe5e25cdd8746cbd86c79274d4ccdca4617a3638f4a614d7bd96b2ac3115cb87421f5d81d2ad592ea8cf261afb1f55af87
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH8sT6p:5UEtQevvqc2W1cpV20I328s
TLSH
T123474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cc502a50e86271f9c9b1c421c29cdacebc62bf978274215af8c962577b1c1b7e
MD5 bafe95d9c80c3ce037ac882c137ea1e7
SHA1 be8166ef29190e4d829feaf936c2ff40b522e720
SHA512 817b3206d66bc8894edbfff238b3d76d7b311bb8341c9b3a1de3f80ac574266d775c10ce1aa13e496675d6edf7f58e2c8bd98a0510a1b45527265615af6448dc
SSDEEP 49152:aCbRquA/m2yL5zQfFiV+XenmE3/zOb5+Pl6bJTIZ5jdgp5:voqtVjnmlslgJTIZ5Bgp
TLSH
T1CBD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2332514914950fdc710af05aa9f888ff388e61aea3087849d145ed52ce990645
MD5 57921bb5c1a61e46c23ae9793fb3bf5a
SHA1 96b468895b3323f3927681d459c822dafd72b88e
SHA512 6e8bbd9cbc83bad2063472d90b267f4c8a450fcf0e7fb1f3a06c493488dbbe5684990be9f7b115e0a56d42bd7418518bfeab32422c9f1d26ec5b55b38ed303c0
SSDEEP 24576:jAhGL6IFoiwtA5l7S53Wmb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:jAM5Foiq5pb5+Pl6bJTIZ5jdgpE
TLSH
T1B8359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 7eaa4882e7c1c9195d85c5a626c4e79b359f4af71d32a7031d27ceb874b91551
MD5 ab58382df036d8adbcff2ac1cfbac9bb
SHA1 72cfc580895a68be41637a1d6ee7ddf21cc161a6
SHA512 114ee412453513ad2c53c20e70c5bdc570c458365990eb65fedbe9e5f41b6c8df63072ddbc98381d9dd9e5e08fff9952bb06241d3870ded6ce0c789045f8767c
SSDEEP 24576:xwuGOWDmb57GBiOl6a8JTth/RWZvR6wQQ92pN3w:xwNOVb5+Pl6bJTIZ5jdgpW
TLSH
T19E75F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 ba3b7d8909f324c31e6c78b80ae3627daf4ac64b3ff3f8e6db6679f4cd934475
MD5 6a33fa9fb967b84edb790c7920340ce2
SHA1 5092e4fa799d5377069edcaeb0dc6ac5c4b158bd
SHA512 e8aed6f1eb3bf4fe3515deb8eb9811545a39b8066a47afc6314641958f2dd1515edf85b8e7fab423fece67b7ef6df99148e44b2e4c6a877fc45a317a76b07f5b
SSDEEP 24576:FZuomb57GBiOl6a8JTth/RWZvR6wQQ92pN3D:sb5+Pl6bJTIZ5jdgpx
TLSH
T13765128627A830F9E0A7523DCCE58B01F772B8529B7653DF4674056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 96996886548a012ef3331662508044dc51d184365cb8acf11bf05b83b4ab9607
MD5 be3150edea7f11545756ef7f30539df7
SHA1 cfeb26a8a847d41ce90c99a62fdd70b6b204df6d
SHA512 d7cb5d4b3dec4ffe9291db9f78095cf1965137fc17732da1a425e590a21b1b90947d36f60a9817383dbd8bd98bb8d88cea9efce5323ad5a1117a8d23660c75eb
SSDEEP 98304:+QRQyi36YOcPDLvw2gAf+PN36slgJTIZ5Bgp:lQyiKanX+PNqsT6p
TLSH
T1BA666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 eaeafd5ef07d472cdcdadeb7f8cbb8107c7194be3dc91095465e09698d40b86d
MD5 4c17b0802781deda7e251f4e9087a12e
SHA1 efc3883c4229e2a629eec12545a41a7de70cfa19
SHA512 14df23f92e6f12fd8723e4fc065df15730f0c3f211830161acc7d2e558d254bb0ce98aa34c19a299fd956e838044aab2acb0865316bd5ade0268de6fd79577cd
SSDEEP 98304:JQRQyi36YOcPDLvw2gAf+PN36slgJTIZ5Bgp:gQyiKanX+PNqsT6p
TLSH
T1BD666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e8744a9ac01ae78413079f37d362bed0a484b3709af00abd02a80da32f1dca9c
MD5 6054e7ec456698545ea394201c8a329c
SHA1 67373fb6dbde95171372a9fe1835ad3d2d45ed74
SHA512 5d28c1424be22557cc284f6d07ebf336557ead467f5f702f5b606fb68eda8e05d1ee714bb83cce65c9b2998b3a7f07a5d518a5fe1a767601187450723ace77d3
SSDEEP 49152:268Qg55nhkeWu7PNU3/+b5+Pl6bJTIZ5jdgp9:UthTRc/EslgJTIZ5Bgp
TLSH
T103B55A33B2F60099C44DE1769F4A872196E27C71CFE1E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d8ed10659df875ceb388c9cd9a850ce795cc088bcdad70cf45fd50ca207a1788
MD5 46bc13bfd74e3d04335c8da546f3f375
SHA1 e3c11feb66aa4fee7d698273524abb2931a0068f
SHA512 7b1ded390f9ccb6f66e26ed410fe6ff1185370d51d575f77869a233de543077f6678719797593e9f3b4d272851dff90c5f341797074dc69b7252a23b117ea6cd
SSDEEP 98304:Ey5112gYy5azzVvU69nLKnhZPslgJTIZ5Bgp:FLIHRWhtsT6p
TLSH
T19C167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 574fee7b4688666fdd887015680a9eb21d204eb43beeea5b505035f4811c7f45
MD5 77e8caae5cebc2f46bb86863f11cdff0
SHA1 5ead59fc25ccf633502cf3afd39d0e6813b61c34
SHA512 6aea87d33b10d87227507c5b5c1432e8c87ba825b72dc4f957f9f3854efad537ea565a4ca1b90ba7eeb2bf9d3624d6ef08f60bd16ce74c46a19955e4672951c2
SSDEEP 49152:TB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glEb5+Pl6bJTIZ5jdgpD:lu6JmIxd2dSslgJTIZ5Bgp
TLSH
T15BD59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 152f63f9a403b356ff33e99ae3ec35f9aea084575d35797a554b516d165fb937
MD5 3c0612e68fea7879cb9b1ad23cd5eb04
SHA1 3c59037bff292fe0290cb605758955bdf276c368
SHA512 81f334659d7aa08959a68b6d26a4aaeaf402f4fceecf44c34289db5e74b7b67dd90543cd90eb576ef0c946167268853bc5ccd91319c0c50f78fe35dae50aa963
SSDEEP 49152:Y1hpsNoJpF1A67U44CwH7R4xgb5+Pl6bJTIZ5jdgpH:YmifPqRlslgJTIZ5Bgp
TLSH
T1E7B5BE13F2D900E8D05ED17887569232EA62BC460B35B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8b78da10c1178bb8a2e1691993841a3e0235642e6f5e7b5aeb2114373b178aeb
MD5 dea9f7f3e6cff8b4940fca122981d6ed
SHA1 3c04e24aad96fd837794a6131ba875d292844c46
SHA512 40074bbd4f919a2ca7c77e6b766f94867ef4ddc7dd282461ea6f1ff81ef7bc16eb155165e766eb89bfebbd0ad2e42070bd9eb77ac9c0c94ad1a463562fdfa734
SSDEEP 49152:gSuZQIY0Be2KkRVtOnks6NMHqfb5+Pl6bJTIZ5jdgpY:65dKqi61jslgJTIZ5Bgp
TLSH
T109C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 dfa22726edcb83a4031657be8a85a3c0065ab17acfc9057c513884b6ae89c075
MD5 4232043bd8db8b2fb25347b5e27898e7
SHA1 e1b051e81167c99e579192ed07751f1f9c146e6e
SHA512 6b328f1bf26ee35ceeef43e5c1e1be82d1df0e71d7d8e15dbb1d80546e2a5d26271bd5c600e7d0869ce0ea15233bb093ad8330c09172fee6cf65e660cf79e502
SSDEEP 49152:7htSn8EApI0figjgiDn0AP5w0b5+Pl6bJTIZ5jdgpK:aX2iWphRslgJTIZ5Bgp
TLSH
T1DD95BE13F2D900E8D05ED178C7468632E962BC164B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 df9ec7244fc2c873fe4a00ead9908b7931448c268edc9c1e050c9f4c69c4403f
MD5 71aaf8043375eb7ee79b356c758023fd
SHA1 de35f27a94adcff2016b1f8404e31072cf0363f8
SHA512 e167cc3de781677d42be64d37e49ee2e2efec9dd5bd73eed617ec9ca13e4a21188079772f32af68f120dd0090b1f2b6fad51f872a411ae9ab67d333982811716
SSDEEP 24576:nUmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Z:jb5+Pl6bJTIZ5jdgp3
TLSH
T19E6523828D6B30CAE05B5779D9C9DB00F87DAF96DD8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 aae59cf83f28c8273108ed0ce34ef61ba34e081752695d41982a85fdc106b0a1
MD5 9cfdcfefc7331a740c84448058639bc4
SHA1 3c00f24d5ded2844f1a0b6870f5090be27c3c7af
SHA512 650b5bea330db88cd14483e2365f7d061c2277926b7f7db0dc911eb03d62616765043f63a393a121809f940f533f3f5443d3dbe7764c8905750b71cc297d0991
SSDEEP 24576:67mb57GBiOl6a8JTth/RWZvR6wQQ92pN3J:hb5+Pl6bJTIZ5jdgpP
TLSH
T1116523828D6B20CAE05B5779D9C9DB00F87DAF57DE8727B6C67D0827F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 542d229ff7e9985d09c434ea1a94ffbe6ecf12a9e690c6a23c401e5db84cb2bc
MD5 57f24cff8be15f9c9b8c55aff3676c17
SHA1 8a563099354056e241e3f725bd5dd0a7a596ea6c
SHA512 157b05a21e925637cb24e5c40e5888bdfdd44a9d691f54d4e410fb80048d5ac49f2779a8b350418f0ba98d076be4037ad9d92a32c017439837744dc402777c30
SSDEEP 24576:Vlmb57GBiOl6a8JTth/RWZvR6wQQ92pN3I:+b5+Pl6bJTIZ5jdgpW
TLSH
T11E6523828D6B30CAE09B5779D9C9DB00F879AF97DD8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 fdb1df1d4136a7233e5e612d6d86104bf436534538f9c059555ae269bd3c4acb
MD5 6759e0db3cc650bb1c6d7daaeaf9875b
SHA1 413bd2fa4c165860476c8fe1d62f4eab050b9dac
SHA512 689a3c99e29a8f7f67aa51ce52122f757afac793135aa308f4874598c5de2613f9553933d02451b2b6a39b90952c5c196818075b49a59b02475fafef79dac2da
SSDEEP 24576:Mmb57GBiOl6a8JTth/RWZvR6wQQ92pN3i:bb5+Pl6bJTIZ5jdgpk
TLSH
T1E76523424B6A20C6E4A79379C9D5D700F4B9BE96DF5267FFC675082BA9313883C3134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 738addbc29608f5f74189838c5114e94e59fcd7e6ca44d9af4ef7b41ec759277
MD5 e1d5a6d6f25775930d3a3f8483a69cc6
SHA1 b3f202b036d5b378862a85995942166a4cdf2279
SHA512 e176a7a1fd0ca827737e35caa473fd6bec6526b5754517d0bc8aebe2237493e9e70a09fc7605d1fcfe30e6b7a4717ef0b98db11da34eee4e6fc4886c7910d93c
SSDEEP 24576:9umb57GBiOl6a8JTth/RWZvR6wQQ92pN3Q:zb5+Pl6bJTIZ5jdgpC
TLSH
T1656523828D6B20CAE05B5779D9C9DB00F87DAF97DD8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 463c963890ba988f538f32375ba625a8feb4d07cbddbcef3b32f60f2ec6567cd
MD5 2f7e7240ded0494d3752a0fce87b02a8
SHA1 e0b1399e5642e7baaf8bb5b9e850a2fc1d195ac0
SHA512 61462a30bd93c215cf8c181a7cda01816e3262962fcf39ba2133be5803a2d5e8aa04e05a4be7e66f5f0f5cfc00046f48687c79b9a37ef85259bd784de9577f46
SSDEEP 24576:K3mb57GBiOl6a8JTth/RWZvR6wQQ92pN3N:jb5+Pl6bJTIZ5jdgpr
TLSH
T10E6523828D6B20CAE05B5779D9C9DB00F87DAF96DE8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 0312e1b2aa95b54e60a25ccca6acd24c0711d1db75ecc24574e0cfc94ee53aaf
MD5 bea987d611521f0b6859c8bc7bf35d87
SHA1 4d24566eeb4201329a077080669ba67973c8826e
SHA512 c87f312bbf3f9637b49fcdac91b1f7add3236df41e8d62472dfb478c75714c74d8f335d08650c45ada56b871125b5446938d60742444bb4d35576fc840eb32b8
SSDEEP 24576:jTmb57GBiOl6a8JTth/RWZvR6wQQ92pN3l:+b5+Pl6bJTIZ5jdgpj
TLSH
T17E6523868D6B20CAE05B5779D9C8DB00F87DBF96DD8727B6CA7D0427F130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 0552f7759956e0df23b9ec8ef4677ea55ee8bdddf757995f8d7481d2f826c2a3
MD5 02db9db315c83573c6b2aebcff7c832a
SHA1 d657cc9b0a774dbfd7f0df64b38033ad25605021
SHA512 bd7d7c6e9c859162185dd6f8a3f624b50fd62856fa5d53d92575ec74a08a6463c523927e605c9114ceedc53fa6d5ee48dc910e5d697378285e10f7ace9b0a3e5
SSDEEP 24576:fZMazFVSObmb57GBiOl6a8JTth/RWZvR6wQQ92pN3k:fZMazfmb5+Pl6bJTIZ5jdgpe
TLSH
T17D850295B39018F8EC67823ECD958A05E5B27C5A4B60C65F43B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 0619189af89d6e99aaed16f5ba1c734b486e843577a12bdff0d64b5a58058e5d
MD5 3ed5772c7a7d14e94d07cb0fd111aa3d
SHA1 94d51d675bdb29f7c793a9985cf56d320eefb23a
SHA512 f43b859b433930a0928430e5e5b825a862558fe6a99ef7ac35f0349ba95840f326f49e02339101a4e25f575e667c8b6d7bd4a06c19f481007c998f36716be231
SSDEEP 24576:WYmb57GBiOl6a8JTth/RWZvR6wQQ92pN30:2b5+Pl6bJTIZ5jdgpC
TLSH
T13A652386496B30CAE05B1779D9C9DB00F87DAF97DD8727B6C67E042BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 ff0e9534282527cd26d229f7e7fec3b681b0969c6fff3f925bbc168ff809149f
MD5 bab5ee7a2a611ae1f5da5c78d00287d3
SHA1 a4d3f899a64e0e31251dd7a625287d2074688a84
SHA512 78ae1c52cd7ed3d6db4de2d60feb0aa61af509167b2917bf123eef2fcc2a60ef925783e29efd89ac2645f9a9d796a6bca68b1d76cef74713a4466d697a40814e
SSDEEP 24576:Scmb57GBiOl6a8JTth/RWZvR6wQQ92pN3U:qb5+Pl6bJTIZ5jdgpO
TLSH
T1286523864D6B20CAE05B5779D9C9DB00F87DAF97DD8727B6CA7D0827F130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 5cc27e8b0100dee3f98d83852ad87cbe267bf441a3cd18d686bf4d653efe73e4
MD5 40d807bb278ba022f5ed55a0aa6f2dbf
SHA1 3cadce6db7369c60fad5af843e28b1ebd03d051c
SHA512 4f729a16a5d4fc38f413b2b171544962c41d3a9c40573921225fc9d595d4e54501698187ae330a2e3156b368fe55339ebc21072320eb49c66750bd678b416396
SSDEEP 24576:Ozyfmb57GBiOl6a8JTth/RWZvR6wQQ92pN3f:O1b5+Pl6bJTIZ5jdgpZ
TLSH
T19575024767A630F9D0678238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 e50437443ee7f4f547a8bb6e31bf88c3dddee9b489c949423647658774e095ad
MD5 417ffa4610929ff6bf340220221d75c7
SHA1 94c7c81069dd5bb27a04c3d590d09b1dae95f45a
SHA512 df55f78e2ec8d60420b8a6a02fb40e7406b1c2aeb9d8840513ff184cb27252fc5d73055d4003a1fe8b586ef0b74dd27d527d03568607d2d037c8011721e3403a
SSDEEP 24576:NYmb57GBiOl6a8JTth/RWZvR6wQQ92pN3G:xb5+Pl6bJTIZ5jdgpI
TLSH
T19B652386896B30CAE05B1779D9C9DB00F87DAF97DD8727B6C57D042BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 25f0950904577eed45b609b394aa6066c2d702fd9bb51509f6c4e7b3775024c5
MD5 435991dcce438b4535a4d16685d655e4
SHA1 9e5ffec4c39f67a88d8612e827efdc7d33f64f12
SHA512 4c584dd8bb0e819b18c15524488d87d7efb1c88e030ae2d96ed4d875963de58eb3486ff3ab233307a8a599f3f8d328ffd5f13a343fab13ba3614fbcbe7a1828c
SSDEEP 24576:TYmb57GBiOl6a8JTth/RWZvR6wQQ92pN3G:Db5+Pl6bJTIZ5jdgpI
TLSH
T18F652386896B30CAE05B1779D9C9DB00F87DAF97DD8727B6C57E042BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 67de9d75629fdd57f88ed595dfd3bd2c908a3933cc455d9550bff68eafa3bc1c
MD5 c5cdbace55a1013a04d5c20afc8b473e
SHA1 ee9b9cacb60798647553bc8760980e5d7818d355
SHA512 24236ac0eeb6438629332512325d1ad3d4d162eac64f0e6b8070dc2a689cadbe243349110aff15da7a793af08ba4b9c3cb715ee7a60ebfcf47ad0de287e6e22e
SSDEEP 24576:Uzyfmb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:U1b5+Pl6bJTIZ5jdgpg
TLSH
T1E275024767A630F9D0678239C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 30f6179c4bfab8e361029f8fd40341f78d0d8e87946b1c819ea2ac8c2fb752a3
MD5 7e46806dcc5976ec10e92e59adf7f48e
SHA1 0bdc9d560e60d9d9910d8723708fec9fa2ce1662
SHA512 0b1fe0be39d81b8b4d6cd5bf042618866e487aa3490f6e9e0739619c95a2d74dde3f191c3aecbca63a454ec7db049a68bcd85a3d48c019818a791e6f3a29f3a4
SSDEEP 24576:iT/aLl3z0zD1mb57GBiOl6a8JTth/RWZvR6wQQ92pN3E:iTiLljNb5+Pl6bJTIZ5jdgpu
TLSH
T1DA850295B35018F8EC67823ECD958A05E5B27C5A4B60C65F03B8366B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 8133e1c9d943a5f01447bba5d88273ce36e3c37608579e4661391e0c9543e87a
MD5 28801655ef5f649f38e0ebae0ff2d558
SHA1 aea1a6eb3b867c5dcbc3b627c76852a415f2ce39
SHA512 585ac24ac480ae9d00836baba0755d21d9a40ac2c167d1405ad772fbffe31399409e6e64d505bb65e1bdb785f253309f03c1dabe7bef8f8fb470058d69cec562
SSDEEP 24576:i3Ud9CHKy7GZBmb57GBiOl6a8JTth/RWZvR6wQQ92pN3g:EUd9CHKyamb5+Pl6bJTIZ5jdgpW
TLSH
T1FB95CF90F3E410E8F0B79A35CDA68601D9B67C5A5B61DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 1c9c20633483052c69a249a22a6ef7d3c0b5e13d0f2e56f56f7f4715ef74cc36
MD5 f6be3b291202529a4408a07c4bb334e0
SHA1 d76f5605c7286b5169c850d711ef3256feed4e0d
SHA512 38f9323011ef2a8420caea7dc85370fc5aece56664ae6d9f280eb63301126f513a2ad6573ba4e8fc81d86d69d47554c96e63f9bd446875e7b4d7856a4d9f622e
SSDEEP 24576:IFmb57GBiOl6a8JTth/RWZvR6wQQ92pN3O:lb5+Pl6bJTIZ5jdgpU
TLSH
T15B6523828D6B20CAE09B5779D9C9DB00F87DAF97DD8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 d7231fc8a52cf6f56e496f4223db8ded485e7e11e2a93a521b4ff14b7ca1b110
MD5 4b4626b23e3b2f0605dc54fdc506c0cb
SHA1 47ff06c42691e2c656aeca1e1506ed021ff986c2
SHA512 b5ca024f98228a8421b0fe8d90eec79729d6699a1292994ecc88d8df1f511787f3c33cafe89500e4e0520fc21a3f4479077e0e29a267b6040966e75118d34206
SSDEEP 24576:v/mb57GBiOl6a8JTth/RWZvR6wQQ92pN3Y:Wb5+Pl6bJTIZ5jdgpG
TLSH
T12F6523824E6B20CAE05B5779D9C9DB00F87DBF56DD8727B6C67D0827F134789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 60d8d3746775a01aabf17b90eb291c1feada2de611a179bd6fb6f7461c65ec99
MD5 4dab34e13cfc86035406a39ab1c32b7f
SHA1 e5b0dd2f1157e26f17a2b8443e247723beacd605
SHA512 c4ee1428a42c1fa82434876efb14accabd6ada74c018e418150ddc31dea6a0c3f7732d8dda37e501ff6bfb40b31bb579c7ce53bc506b0e95c3694da36906b623
SSDEEP 24576:T6mb57GBiOl6a8JTth/RWZvR6wQQ92pN3Y:Rb5+Pl6bJTIZ5jdgpG
TLSH
T18B652382496B20CAE05B5779D9C9DB00F87DAF97DD8727B6C67E0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 4b7b583804f93641e479e661ec71d2e0d214fc797baa1cf4caf9638535b04d97
MD5 a378ffbbd6724dd73f2582482543038b
SHA1 e9784bb5ff57f4aa5dc6fc9074455b671e432c2f
SHA512 7cf68029e4c95c1dd10da64adcfbafabcefce334a57eadc24a486042c2cc086223ecc2a34bfc35d7ce55df9b312e2f95a14e605cde84562aa9a87774519f12b6
SSDEEP 24576:fYmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Y:nb5+Pl6bJTIZ5jdgpa
TLSH
T155652386896B30CAE05B5779D9C9DB00F87DAF97DD8727B6C57D042BF130389381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 cf4ed667d62eae4faa5c5fbc5631788116f3a40fa9c62428bb546792004df0d6
MD5 431983b126e4a6a9511dfd66baa35dd5
SHA1 a57a290601c0bbc2ec2030e024d579b847c2d462
SHA512 55b4e5c2ff0ddf21f385025dc56db4a9929854284e71adf51b82b2c79ed022770ad629e9e5637a5284d1ddf21d0005928c19949409209d2189eca3ac28b7e3bf
SSDEEP 24576:QFmb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:9b5+Pl6bJTIZ5jdgpw
TLSH
T17F6523828D6B20CAE05B5779D9C9DB00F87DAF97DD8727B6C67D042BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 0f4a11969818da6eb86a07c27be45bb67216c3053f90b71e84e1ea7d556d65c8
MD5 d596e2d6573dd91e8fd9fa82d66e5a40
SHA1 f325e63941908493688e4f8742c4588add9595cd
SHA512 c9aa0358e694127ef6b3d4765a79bc4a8ca5b5bbbdb1b34577e8976ccda78d33a3fdbdbfc03dd65959bb403b8a7c44b03df494793c7addd48f805fa49892954b
SSDEEP 24576:IQmb57GBiOl6a8JTth/RWZvR6wQQ92pN3g:kb5+Pl6bJTIZ5jdgpm
TLSH
T19D6523864D6B20CAE05B5779D9C9DB00F87DAF96DD8727B6CA7D042BF130789385220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 ef371595dc400fcc56d57751db15e3859eccf3fb9fe3751a2bfe8496cce7849e
MD5 af45177d640cb13d2964a424c253709c
SHA1 eba87cb30616bf2c6caea9ddef7a8dfe7465c7c7
SHA512 b6f2fd8c11b6d6abf469eef23972f026a8c2cf71d6f602514805d73c9b50c47faaacdda3f4d9277ee4e191be433d4335064151657e43ec8a2655d91ed45ca284
SSDEEP 24576:Jumb57GBiOl6a8JTth/RWZvR6wQQ92pN3o:3b5+Pl6bJTIZ5jdgpa
TLSH
T1CC6523828D6B20C6E09B5779D9C9DB00F87DAF97DD8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 8d40af5fa894f05c2d58602d2af5d5d8d04406e08526c1c7874cab30aca01dc6
MD5 0e47a78687338b0f750d3ee7ea58e413
SHA1 ab034957a3e195192c261adc025a804425e6c8c6
SHA512 e5d248ee3cf0967a4ec3f601d2e0cca2a0e03c76b87d7c5a3ea751479ac73a92b68e8bad5885cd4608dae21483e20a59f65935ef7c66bd3451a7e4f9c354ea45
SSDEEP 24576:efwvhk9RX6wkyAIMmb57GBiOl6a8JTth/RWZvR6wQQ92pN39:/MnYIbb5+Pl6bJTIZ5jdgp3
TLSH
T11A95CF29EBDC04D5E0B7923C99E7460AF6B178595B31C6CF02AA536E0E33ED46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7a106c9c176dbcb16a89c537cd4c91d3f27ab7b2ed92221a1bc765360fec0ae2
MD5 65001365df1ebcfcef06565b57257dac
SHA1 68366d363571b094ae897505397f306b67507099
SHA512 0c14eb9cc0aa38d02943a250ce1403c3cf8885c4c0b26268dd71ec168169914921d27447d78699431392ba00e5e0fe69132ff3c9ad47f2e72be06180b2957ba6
SSDEEP 49152:0YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Ub5+Pl6bJTIZo:rySzPaslgJTIZ5Bgp
TLSH
T16D066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 864563e9ed2e4fa45b3e370e368e87961177637371dcd8e963f099c1dab5ebf9
MD5 1812a585a68485b7ab3ce55ee4c14a2c
SHA1 98023a78670ddb7150dff762de1d54437212ec7b
SHA512 bcd1474b00594cc291f4ae670ff7a5922aa340d155188bb761083ee110eedec9fc51706c24f3148d27ac0c44c1dd542f8d41a647fa1b436709bf0241643fe023
SSDEEP 24576:+47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYLmb57GBiOl6a8JTth/RWZvR6wQQ922:+47JUQjqirIhCnDHUPfF/Eb5+Pl6bJTS
TLSH
T17365AE1EA3EC01D5E1BA923885558A1AEA71782E5F32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 9c75897b5f94e01ec4e5ad478fde8518792eaf908c22f33dc4386c2c69c96b59
MD5 f3ca99e7875737d9e062cf66843e645e
SHA1 91efe9260a267ddd57d4925cdb282040a62e1c7a
SHA512 9b5ac780959299c0a8f9a14de2b54f0f459c26657dcfead7688d675c3fa1e7e7dd639f841206193e689003827b0d0ca08ed4e8e2dae953411e6b2587c4492e65
SSDEEP 24576:Iomb57GBiOl6a8JTth/RWZvR6wQQ92pN3v:kb5+Pl6bJTIZ5jdgph
TLSH
T14775F14AC29811D9D06E6279CB858A00F7377D65CBE293DB46E0F43E1F366846DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 802bb1cf39a8b6111bc47698182537f6ac406113ab91ef79c94f96e185960d31
MD5 636bab241cf68986cc69194b72b21aa0
SHA1 3a5a3398d2131144d85894a310775b67cae95c2f
SHA512 f6f2e47dd2a407f426cfdfda7e7944ee629b3387bec12356164db4701aab9a567edcca96cd115eb206be3f9b763194d8fb8bdb850d75de8dabeb1d23409d3179
SSDEEP 24576:Gvr1Z7UPsSx6ydwF0/OUcbIXS+HemeZFaxRKUWI:4T7U0Sx6ydwF0/lcp+rogxR9W
TLSH
T19C551740B626C78FC6A940725E36D6CCAB707D41EE446F0373C8873FD476658BAE6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 4ed33290d1ef6840b1ae5a4217a4c2e1900482b2b6fa7a44971095324ca0c53b
MD5 18924351e0f74cd8a34fa75ea6181004
SHA1 8c20f03bfcdff6317defe0566d71f981cdb32daa
SHA512 c67c00caeb94fe999ed74974b998ed29b9cf5d8a4151215d56b60baa6498ad71f106d18ed4499857e73ef49c6427f625724557806c515712ee32df073ebe888b
SSDEEP 24576:b7RHtvip7E5G6LwN2mXqQxCgjrOAEWRW4RtZhRc:BNvip7E5G6LwN2lgjruWRw
TLSH
T174652B00A5B3E35FC97A90774632C68DBB786C46B7852F017344883C9867A5EF6E63D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 0a0c40d2c9c11e93ec4fa8a39bfd7b6b067ec8e6866647cd13c578ecc653711a
MD5 122dd878786e81a5d45cef1212c5a043
SHA1 58b35f51069a0f1df62318f5d06a48a8b1604e51
SHA512 c53277297a36d9c18b9fdcb0909612e8f57576d89e0184082d8464570d69609ea0c04a95ae1c702fb5784ecc53b91a9b12b4bf4c0b8340e722798fb080fc6b71
SSDEEP 24576:ogmb57GBiOl6a8JTth/RWZvR6wQQ92pN3z:oXb5+Pl6bJTIZ5jdgpN
TLSH
T1D66522428A6A6086E4BB1778D8CDD710B83EBF65CF8566E7C569142BF1306C97C7230B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 56ceae5a1480960fb6a6db9e76618a1e68dc91cb4cd8a01174fc389b1bab08a2
MD5 293bb73585acef5a47ce9ec23fb2ee88
SHA1 7869f87f417bd4566732c0f87dd033184ab79eef
SHA512 a69b856b3113c1d98873a652798bd9fd5cefe8a86adaecc88531e814c0b9670f9a825a3afed6a186a65c05e56dcd1eaebc1a9ffd0fe8f70aea9867b79e48dec9
SSDEEP 24576:8gb6bmBIi49WNNFpg1rSvFv7bYCmb57GBiOl6a8JTth/RWZvR6wQQ92pN3b:8gb4mBIBhGFCb5+Pl6bJTIZ5jdgpN
TLSH
T1BA659E1E22EC02F5E0FAD2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 bb945d2062b272aadbff7d6fc2617cd4c30093601cdbfea87b1f8a0cf2f53782
MD5 1704355d6702a70c526143153a109dff
SHA1 c8fc392e7b77840be16508ad31de69f07bac665f
SHA512 cc42bfd5738a64a51ff8424d297c8c3ec9108f46225fc75424846867bb0ac8f453d140d558566706b7c376f5ff3f4b292a54bdd259b59325126a92695a565510
SSDEEP 24576:oG88u8FpJqH1ozria7/mbmb57GBiOl6a8JTth/RWZvR6wQQ92pN3E:L7ZFPqVXa7/Fb5+Pl6bJTIZ5jdgp2
TLSH
T10695F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 6d74f3ba03cde72f0932b55cca121a07770346f27096a08d229852daf5c1f9b5
MD5 7cb9811b4d7a5e4bbefa6d82b79f36fa
SHA1 dfc334a53e64d43ef32b4650492e355e3e972ba2
SHA512 8896eeacea4f32a4e8336807ecf0beb7df1f13cbced3a8f07ee94827393ba2291aa9ad28c8e9295c0c0b57d5ae2e8ea88fd4a92ea1f61f4ed9f08b6c18cde435
SSDEEP 24576:APUr+NQnmb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:AJQmb5+Pl6bJTIZ5jdgpU
TLSH
T13475E11F26AD18D5E67AA17DC9C68709F771B8624712A2DF02E0813E5F23ED87C3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5ee5f1be8f1fec1971741f4bd5cb826ba1b8a15a62b60dab83992e84a467b334
MD5 8291e5a20d26ba922e218c74b0c2de3a
SHA1 291497bd6a964fb174b553ee7fe48e1ef07ba385
SHA512 d6d7ceb49bd7b469db3c4ade898a94f03571d546acd3028e8f2a4c802321754749e26d9aafa81938818a6ae789cb4cc57e67f0bdda64512fd953333ed3b87601
SSDEEP 49152:TBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj2b5+Pl6bJTIZ5jdgV:8G05lO43bXslgJTIZ5Bgp
TLSH
T1A7D5C06E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f7c2aa6a3b3df2d0f018ddf7c7b87b7dd881c828e756a3f15698fa5d4735ef58
MD5 e1991ed59b3c00414f56b77f5e5d73ee
SHA1 f6dc580ee9dcea59f645fda6fb9642c1f8e2feae
SHA512 aa77b9f2c2a2b7d305a5f8fe5aa6795d4fa0ca18bc9424601e55ed8c59305c192b8360121a67095d8544ac1148995beb7d4af8a0c39be70b15df1f56114c586f
SSDEEP 24576:hfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnZmb57GBiOl6a8JTth/RWZvR6wQQL:ha5POZ3lJt2pasx2+m+b5+Pl6bJTIZ5F
TLSH
T11E65AF5EA6FC01D5D1B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 64ec5de3b06f588dde62f801758ba3bf36ff771f18675d9ac541404f8c160e21
MD5 d6943924fd8dcdcdb1d03700cc0251a1
SHA1 270646a4423426d4df62d0514bc9e94ea8131c87
SHA512 4a801ab05cf8999be25c5dcdbc861eb654db624af85b609e40e1418acc3720ed1d3cf199c183568497d00d9c34664f00293738a2c53722b7622b9d7f9b63058c
SSDEEP 24576:KNcwHdjbyQ4nLC18lb/EOjowL7Fkjmb57GBiOl6a8JTth/RWZvR6wQQ92pN3M:KNc/zEOVHFlb5+Pl6bJTIZ5jdgpq
TLSH
T17D858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 96a00f468481c5694685d52bd30006a8398c4ccf58e6dad28cf274a9456db333
MD5 2ce567506db25ce91b10bf19e3b6e800
SHA1 9d2f7c35fb61a77f04f37b7c600e2a57d95c11ca
SHA512 47e04c5979e0aecc0ec9fc1c5a0aa9ede7192b61f085eb38da2028763e4770a5279d94353baea45c189ede155a16ceeebb3b945c71605153b988e44bf14cafe0
SSDEEP 24576:9zkNvNnaFeYhJNtmZBmtmb57GBiOl6a8JTth/RWZvR6wQQ92pN38:9zMwBtOmwb5+Pl6bJTIZ5jdgp6
TLSH
T12955AF6EAAB805E4D1FEC6B5CD238512FA727461073253CB8290C13F5E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 90a3c700ea066afb7c9db3f19e0731c38c3f8660ea39ab95c30c5838fd147dc4
MD5 8c56e6253a7cafaba90755a8d321c89b
SHA1 82458a62a81c27521277766109c91d593fbf158e
SHA512 dd4e1b072038ce87303d2fc28476cad4e0a0256e6bcf347e96a56dd03ad874ae010b51072febad617c4c7acb4805c69fa095b046e63d5af96c03efc4afa447df
SSDEEP 24576:2D3FHshBIYQgA0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3i:2DVHeBIAADb5+Pl6bJTIZ5jdgpI
TLSH
T13F85E17ED65D00E4E47BD27CDA938A06F67138A9472266DB02D481BA5F2BED43D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/552-66-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/552-74-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/552-68-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/552-296-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/1400-117-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1400-314-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/1400-115-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/1400-123-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1664-54-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/1664-55-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1664-61-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1664-281-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/2116-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2116-109-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2116-103-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2116-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2116-315-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2116-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2244-78-0x0000000140000000-0x0000000140145000-memory.dmp

Download

memory/2244-7-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/2244-1-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/2244-8-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/2244-395-0x0000000140000000-0x0000000140145000-memory.dmp

Download

memory/2244-393-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/2244-0-0x0000000140000000-0x0000000140145000-memory.dmp

Download

memory/2848-311-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/2848-79-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/2848-80-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/2848-85-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/3076-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3076-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3076-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3076-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3076-23-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5048-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5048-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5048-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5048-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5088-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5088-127-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5088-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5088-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5088-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5132-137-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5132-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5132-129-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5132-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5132-135-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5260-63-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/5260-40-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5260-47-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5260-46-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5260-39-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/5260-52-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5364-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5364-90-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5364-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5364-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5364-96-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5364-331-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5632-329-0x0000018643770000-0x00000186439B8000-memory.dmp

Download