bf8f206f49768119ff75451cce0b9a45fed5f2c641f9238c13ebdfbb216a2bfc

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 3.8MB
Sample260704-2wp2eaax2r
SHA256 bf8f206f49768119ff75451cce0b9a45fed5f2c641f9238c13ebdfbb216a2bfc
MD5 38c9a611332018ae0600e06bf5242d10
SHA1 019b56a1437c59fb75da7950b6c8d4889a3a1b96
SHA512 35931d20b64e6052785f0ebfc797a6f497bf99b0369f51c6bcf6da0b6695495c66e5331fd426137e54bd3142b486d82b44a5455bc707ec1509e3fe6d09858c03
SSDEEP 49152:8zksfrJMv7WyI3kkv6h1oD8eiMv3SmGlO3m17PnKtbt/bs/UeT+uXEkjNEEBHLYo:JUyhvdvca+uUkjDBHLY+7wRGpj3
TLSH
T17806AE0AA7E406BCE0F7C679DEC6C553D776B80D07B0669F029098A64F772608F29723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3152	elevation_service.exe
6036	elevation_service.exe
3776	maintenanceservice.exe
1472	OSE.EXE
6844	PerceptionSimulationService.exe
5860	perfhost.exe
3484	ReFsDedupSvc.exe
7076	SensorDataService.exe
1316	ssh-agent.exe
7072	AgentService.exe
1404	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7f440417e819cbc6.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_88796\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2d94b58080cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0e8f257080cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c17e2358080cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000042272658080cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3152	elevation_service.exe
3152	elevation_service.exe
3152	elevation_service.exe
3152	elevation_service.exe
3152	elevation_service.exe
3152	elevation_service.exe
3152	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	3484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3484	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3484	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3484	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3484	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3484	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	7072	AgentService.exe
Token: 33	1404	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeDebugPrivilege	2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2788	2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	3152	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 4328	1404	SearchIndexer.exe	100
PID 1404 wrote to memory of 3696	1404	SearchIndexer.exe	101
PID 1404 wrote to memory of 1312	1404	SearchIndexer.exe	102
PID 1404 wrote to memory of 292	1404	SearchIndexer.exe	103
PID 1404 wrote to memory of 3776	1404	SearchIndexer.exe	105
PID 1404 wrote to memory of 4980	1404	SearchIndexer.exe	106
PID 1404 wrote to memory of 6644	1404	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2788

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6036

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3776

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1472

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6844

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5860

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3484

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:7076

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1316

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:7072

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1749168396-1890032557-311772428-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1749168396-1890032557-311772428-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4328
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3696
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1592 720 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1312
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:292
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3776
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1592 720 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3b281d4443df23a5135b3c594b06669e3cc228908f580e97f5f6a207be280cda
MD5 0e6bd800aa73b0293a3b24865011ed84
SHA1 d20819e8a548fbf173028431fe0483c01eb69a4c
SHA512 63c75e27684c9145dbf87fbca7e839bc161a7cec3b32b2f781ccddc4c7825d3e22ba14ef735b8d964846ff5066c92925b787e52443d28ac3818b70a7eda46035
SSDEEP 49152:Ub+632BuPkFKRrdE6ohdstBhuXjfS4LWxnTLNiXicJFFRGNzj3:O3q6mjBo7wRGpj3
TLSH
T13DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 62fa9f8712904c0cde539fc74f4f5677f1c22023d5adef13aa3ca7738bae0093
MD5 ddf880f8c2ab0352dba92ec1593ca8e8
SHA1 62da8393eeca58e06f3d612efbd135f53badd212
SHA512 bc8aea935bd215955ba1f0bf80fc2dff622fe992a410887086ef9a0b6efa758419bbc8f13cd57d9625559580fc39bf432917c389057465fe5834bc78a3188ab1
SSDEEP 24576:0XYfDtczAc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ztcxLNiXicJFFRGNzj3
TLSH
T15175012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 0d2e43e6aceb9bd2baf3b497bfff305a18d02b0e9befdfb437ef2a15cb9eff0e
MD5 ae4c6adb2f595a49236ccec19b920acd
SHA1 a0ecc2fd8d0282eb133c3edd311ae2d27f66c1d5
SHA512 cca90fa6032c9f61da4027ebc11f451a797c52bd6574f4b104315bf30e1cc5795517cdf26b144bdcd4efb200e08ed0ffd440e53f9afc97c7b5167be0e6471dad
SSDEEP 24576:J0Le5ji0hmxhrMr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JPji0AzmLNiXicJFFRGNzj3
TLSH
T16E859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f3c81d148ce8be96ae565b350076180d6f0c4d802a5d31257f3d236a01a8c791
MD5 336de6f05604f7069fa1e6de069c6cdd
SHA1 b18e07c57d8d728d2494deb8411fe03600cbe7b1
SHA512 216d915d7ed40972ae7b6e5bcaf76cef361c659deb5581a58d27c3eca9f19979d61ab928857d13a80e62d1de003102181c8e15b37756f0fecd6540a932daab2b
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWj6q8wyuh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:V/ezSC6vUzPv+HjyKLNiXicJFFRGNzj3
TLSH
T155756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 029938bd96efb678e395732db7e949855c70b66208cb83916b43ea61c914774a
MD5 2383208ae4c1bb188943ee6581c9fc0b
SHA1 6dfd6e75f3dcf82c2254c4992e78f70ea9238b1b
SHA512 834ce8fd75b325a716ead12f4aab4af84a7de48431f204d5451a967d07c97f294a14390c1a23fc6b7fcb44c3e8e82938a6cc9b639af37f570f2c2edd0f6f7a17
SSDEEP 24576:EVbqPb88hv/l+BY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EVO88hXl+GLNiXicJFFRGNzj3
TLSH
T180559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 cd772a6b587955bcdfe2c8412beec73e181c5dbbba27e895587c344d6a1bd75f
MD5 96be6764cf26458bd1404b6060b9961a
SHA1 531c6d29259b7485b455673701ec65b90a0e6648
SHA512 214785038c103ceaaa1426c4da06ac59a0fa1a401b1ec738df1bbc545f0c48f73261258dad458734f23c7f39b36a80abad05cfb2b317d6f24eabff508f98c674
SSDEEP 24576:UG3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vLNiXicJFFRGNzj3
TLSH
T1FC5523D3468855B1FBFD003A867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 3be61a28a8356983be63387ead6a0b205b89badcc8f3cfd55e72f2ea4b742514
MD5 4a7faccd5e66e83390fec25a450ad213
SHA1 06caf2c135a976f05d3e57f2af1bd3a1037959f8
SHA512 d500a6b2187f7dfc5306c578deec665d2de96798db3b7f80c37172cbaf5c478258687f72a3822aa99604b63272a18fb2041980969c686a8d00d7305263a3ec8a
SSDEEP 24576:RJIUQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RJIUQLNiXicJFFRGNzj3
TLSH
T19675CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 80fec8c271caef45b41f558bb4da59feb665294a43eab7b67b8e250f800f1fb4
MD5 12b8d35b6d32c49ef01d4fddd1dc1701
SHA1 fa0adf17bfebca976f841898b909612873df267f
SHA512 0acb19d0c473b617463f5b9c93e83df7bdd47c44a86dde2aa20343cb56693c3fe6ba218942498b5823a701ba2bbeae669b11af62dbe637cdca3fb47ff4bc4dc4
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THu:KQvGAdlCEL8c/WRNw5CR7wRGpj3
TLSH
T16D266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 ab7fd4275314b2397ea786afb94331c2e48de1ce16f4dc4791b46128ebc6c994
MD5 3e720b57699a619ebf0ec6414bf54b39
SHA1 2e63fd839b3270c4fa26131e20ddf951b25a2fa7
SHA512 d3aaeb001150179352daf1f36511292ab4f42440e3f342438fa435b8cdbdb2455783399b204c395521e596213824bd176f24d2af49d38c66e2bf2847930a32bb
SSDEEP 24576:7fewsAjW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7ljWLNiXicJFFRGNzj3
TLSH
T16F75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 91928d69ffb3fc22aa176d43dcf2660517c7e4ac611c3513749101abf69ef18d
MD5 27603ab2d4bd87cc0241efc61bbcc7ba
SHA1 2887e57c06b2339e397d6a3531726f88144db9b3
SHA512 420f853b14df4f3a6d8db85b6d385547e875189b425127fcc780c21a7d5e30e7a81f53f8feaa936a05200e3218a3fd149d9880163f60ef354748ded44ce2ed6e
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHSF9:hUEtQevvqc2W1cpV20I32G9
TLSH
T18A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 bcfdd6ee31b29d8148fb2c799e40096484f1316352ddc76b2bead861d2091fc3
MD5 7c09c43d6fb5dfe2fa67f1f2e091946c
SHA1 c72081c02e89a83888b9ce7b95e228c62de7fbb6
SHA512 dd7dd563da7de80d9721f58e916bb9afe736e49cd1a6747f31fe71f407e7facf3527165112ca8c2579f131d58cf2a4a18cc6d1e27e0e76376cf559b08f89bf17
SSDEEP 49152:OCbRquA/m2yL5zLfFiV+XenmE3/z2LNiXicJFFRGNzj3:joq2Vjnml7wRGpj3
TLSH
T1A0D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8043df8e47bc8ecab9151f84a7b01e3bb9d7b019e14557dfcf12ff79d51a09fd
MD5 95baec2816a6e6e7627b33ae447a397b
SHA1 68ffee0b52ba6c000ca050e705d567c4673dd400
SHA512 dbd61e89ef93a89352586a1618cf271d463bd4393b1231659f0c3a591eccd18d0b7c7b3b9f860f59643bad917806d95f75a52db260d1f07e9e3843814a1aa317
SSDEEP 24576:YAhGL6IFoiwtA5l7S53F/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YAM5Foiq5VLNiXicJFFRGNzj3
TLSH
T13A359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 eb0391e264c061939e0fec77a926ff940036b27892873973d0c7814ab837cbc7
MD5 973457b8e6e5d7eee29150fdd68e091b
SHA1 9ef7a269c187e8d7e475f00eb8576f585f656abd
SHA512 7f861f23c76fad5c20a195f4ffc1425b3543d08cfbbabf7a6fe80556f37ee34633bc459e3722f511ddd59d927ce14326cefe087dc97df4944b2f0642ae582e0d
SSDEEP 24576:DwuROWq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DwSO5LNiXicJFFRGNzj3
TLSH
T1DF65F18632940CF9EABA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 96f650c5587e2cd7b67d4b7c2c257115f028c974b896426c25a3b45d38665fae
MD5 392c35e3c340dc818cc094fc92f05ad9
SHA1 dab24224b5f0b45808123862062f433d086acb9c
SHA512 18895a7b2ef1db6ecc3b1a4f01d32c0ea537fc8a33ea4bbac69eb9215fc674519867c3584d3f32bd1e68dca44d9e65af11ca6e76fc691dfd873166eb0e974a62
SSDEEP 24576:GZuD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3LNiXicJFFRGNzj3
TLSH
T1CB55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d2e2b476aa07278417d72db6f10405e961703901909477da7697ddc4d0f26b07
MD5 48f45aebbe11c85303988fbff6c3ab55
SHA1 5ee7b566d8d1ebfa4b09da4b988c3d462ca0e007
SHA512 217072dcc284194d98be98e2608755af32e064d0b24df8b54a37b76ee3335f2b33ac3bbd6fc6a2a3e9ea9b2058a311dded5d323633f3916527a94fdb0f0a734a
SSDEEP 98304:+QRQyi36YOcPDLvw2gAf+PN307wRGpj3:lQyiKanX+PNQF9
TLSH
T1AD667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 27995fb2ecfaad3eb2b413b92ad15969886a5618fa424b3a541595841bd37744
MD5 c0a606b42d0f85ab2be898f1488941c4
SHA1 aa3d0bcddb9a7c2bba4fc2a115a0463c6ff7e9cd
SHA512 e9e93a34b09e17c4e40daf7f67bdd8e92d00d681d110f2711be22828ea25881f691bcfb2234d2a02045b45d0a4cfc40462e28bfe3945e9edc5fea43081ffb600
SSDEEP 98304:gQRQyi36YOcPDLvw2gAf+PN307wRGpj3:3QyiKanX+PNQF9
TLSH
T165667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1de1d49b03fac95dba8f12916676a3e363f729aa55f01757e9651c05fb396354
MD5 70acd2e18aa3367c4c038d1bed34cf08
SHA1 663f3509140ea5129691cec2aef65d14783baca2
SHA512 64cc48639327453fdb2e2a2c8d0f2eee67571116ba4028ab30658eeb05fae5775e93e520d6a8c4dc2751bc6adf77a10d4ef90da2962a6538eae525cf63aa0b94
SSDEEP 49152:b68Qg55nhkeWu7PNU3/mLNiXicJFFRGNzj3:lthTRc/m7wRGpj3
TLSH
T19CB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b4009eccd8233dc1d3c138c5d4d2ebe4a8c7880d965e73e12408e721bf7ad6ab
MD5 74cf3b304d1414bc7300953637148759
SHA1 07ace6fd34f68b51ba41bd3f4a9d6e398ff74561
SHA512 0334d6c9155ede48c1285b690ef7a281f77b2325ccb2d1af3a5d3cc39c58f49ec1761213dffb9f406597ade42470d5a1321a65fe33f801d9460b18dc66511859
SSDEEP 98304:my5112gYy5azzVvU69nLKnhZ37wRGpj3:XLIHRWhRF9
TLSH
T1A1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1f8fa5e464052b2085a67b02a0ca646f586751ba55ca9aae49c6835117af1ed0
MD5 8efd1bc42162e40e908d548c481e83e2
SHA1 cf3100a8a4ed1132bec92e50aed88be16b76187c
SHA512 4fdbf6a2ee7966890c60952b22b1fe344a93b7497cfe6cd09c39f6c2c4d3f40b7b241fc4a7430c5ce1e2e82b175bc3661950edc8c7a3604f01a85f939727599e
SSDEEP 49152:dB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glsLNiXicJFFRGNzj3:Du6JmIxd2ds7wRGpj3
TLSH
T15CD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4c5dcf2aa6b26ba35b6a91bdc2a891965e5e4f080cfb01417c58bdbec6bd249c
MD5 266b78ad5ad471948db7a02699dec1d2
SHA1 7585273624cb664f098bfafc6969756d7a92d3d3
SHA512 66489149175af3e26c04bb54ab5190b2378611840f41b3918041e851d7182e43f460634f17056814377267ad1e35f589fec6449f3566fee09c895c95fb9dcd5b
SSDEEP 49152:F1hpsNoJpF1A67U44CwH7R4xwLNiXicJFFRGNzj3:FmifPqRl7wRGpj3
TLSH
T1CBB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9a84afe1bda2607a3dffd68500b9a88d598472239e0fc5bddbeac35171a1c328
MD5 4c85dee59c444b3f1c3fbd0d1cb50b87
SHA1 a629bf7f717019f106b9b5b8b85faaacf5c0af19
SHA512 0792a751d49dcdb6a973a0ff05c3f57075767258f6a9271fbbcd0b20df93bca2529113f7ea4198fe4916236158e2351594bb95448007904f74f4b45a06c46b8c
SSDEEP 49152:8SuZQIY0Be2KkRVtOnks6NMHqDLNiXicJFFRGNzj3:+5dKqi61D7wRGpj3
TLSH
T17BC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1b7b4751e227e88c231d58d640d87e0bf2b7822e9ae50e56afc0404f500c8ac0
MD5 a424327f332fe00d0ad9d1eb8e2ad6b0
SHA1 acf8aecbc409f39f134418b93134c355e968fb94
SHA512 8005a01da4cac31a2533024309e0bf5335b2dda4f2cf8f0d5f7f77fa8e36cca5ff6168350f33a9f3561423a5f290c94cfcde4d7219d2f45b684139c940e526ad
SSDEEP 49152:NhtSn8EApI0figjgiDn0AP5wcLNiXicJFFRGNzj3:cX2iWphZ7wRGpj3
TLSH
T19E95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c9dfdf2daee46c39647579192341415e63e2e0bc9f0d8ec4ff5f91ce24b13992
MD5 041d5d432dbbdc71b91ab0b46c087082
SHA1 f70e59905382f411f7c2c93b56df8bbd53aee6ce
SHA512 bf200c740cc981379e8c5f0925d97e9c645a359ea00c6ed4f6c6d6e232888c575c6dc0b6245ad58d26caa2f1d9c7bd8470c217c2c1a6ccf4db65322c50c49f65
SSDEEP 12288:2biJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AC5523D3548955B1FAFC0039C6755428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 efe3556080a4d73b8a9eafcee873c70c3e0bea75475df5e36b31b0e979548021
MD5 0d42c12ddb1df34f3d3b2407ce0dcfd5
SHA1 d7ef5602cbaa494ccea832d2a9eaee4ee8b49746
SHA512 75722864c3a88919a344eee490c18535f6d366713bdb33341a9b8c1765bef91043af40bc5319d31ab678aadb3e723bf96c494ddd426ce34005e1fe1d8cc645fe
SSDEEP 12288:hgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1775523D3548955B1FABC0039C6764428F5885E2DEB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8a84e513f3dd1e0b77e766cdb00c24ce726ec7f33f8c0bdd077a8e85fdd425dc
MD5 9b7ac2ad9aa84e7882314a37f348fb15
SHA1 3686ea9414485d0d7f1e247b0a4f49ba53b5162a
SHA512 356b1181d16edc98dadb4ffa31ce24928fe99ca781fdba98aead90db30a99b6b2134d90b6afbdea1b04c05f7f1461a8b3034cca73588bd265392591b66cf2c00
SSDEEP 12288:MeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Mo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11D5523D3548955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 37b551a9a04286e5c9a9e4e8ba42a7b78f7133df39a62fa2b196f9777f721bb6
MD5 bb1bbfcafda9713601d3945b6ad06148
SHA1 f924e74cf3b113ed9baaaf5f72780b33974204c1
SHA512 8a185c0b197652dc7f722dcd15568ad0eb8cdbae74d7f7adfeabee180e7b27620e350404b89836afff1dda38d152c790103f7586651bd07041c7ed7cfcd96179
SSDEEP 12288:3V5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E1552392168901F1E9BD8039C6764424F2A47D6CD7325AEBD3003D1E5A75FDADF38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 cdda3e106c9e52081cf2f8a2fb60abab002b5fbf2c3c98c3ad2e8f8dab3d08c5
MD5 d2eff00b4050a5b60f02cd5e35649bf8
SHA1 58c10b507ee6ea70af4d71da103e22d7d7eec092
SHA512 66451b51ffeaf6eff7d12e11134d7f2eb8fdda43ff3cc5d61fd3a33f460c78e07156abca8b5d459b724943ed05452794c782c1c61d2e4f0b2e72e27dff2f9fad
SSDEEP 12288:8hiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8N/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1325523D3548955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 605acd3cc4680aebd3b3ca3dc3eb65ba6f15053c2486ead0ba0405ca96542701
MD5 a60e2543f9e61374b71a02153d1d629d
SHA1 4db0f8de0287940aad80ac7310240e459463e847
SHA512 9791705c615f61398dbede0710a4796b75c361ffff432b1115b868ff6ef86ac0a4ab06ec0bf63359384a344e113770549846403b1be9648565c96617d4479016
SSDEEP 12288:PEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:PO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EC5523D3548955B1FABC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 8bd62a4fa393740527aa83e2bf2c4e1a0959ef519212744dbd3d7fe58a02ed65
MD5 04820a0270278a11aaffb26e5f28c23b
SHA1 5674685823866d288ea9db7b4725bab31959f4b2
SHA512 925276e80a8912bc2625387a9d9af8b86481c8bb52db30d7fb44db675af761ab925ad9ebec684d91ffe9b180b2b4242fc74de488e815f2fb560e46c247eab342
SSDEEP 12288:pIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:p6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F85523D3548955B1FABC003986354428F5882E2DEB5659E3E3083D1EA278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 66aab2e908719a2ece23ccd388783e0e15400f5362d2cba63626aced850fd0eb
MD5 535177a4abbabed397a8281d1b6f4a19
SHA1 748eb8a0e5f890af53e903c6446334966c72d194
SHA512 8f6c85d69949b01682eff470df34d1f12321390e9454dc6ec95e9fa8f21761d952d55a94233ead3dfbe34e20171be1024571925c87754a3035ad41ab928c26ee
SSDEEP 24576:IZM3zFVSOS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IZM3zf+LNiXicJFFRGNzj3
TLSH
T16F750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 43cbebcbae545955c2eb5a1e214d2d8230f0acf84370b5ef5b1d327d0f6dada2
MD5 c2a5c0915a45f3358e2d269b21ae335f
SHA1 726f5a9327e56d075d42ea765aa5a811f5477ac7
SHA512 af7dfa1a53e546725e6241fda60a0c40366403fa87aee3c7b5593a76c653778f4a8fc36fd3a45a8ce1e284caf14be2fff29c8fb996d4e6fdfba352f8fa67c7ed
SSDEEP 12288:lHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16B5523D3548955B1FAFC0039C6364428F5881E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 6701cb3bcc6f8d42ed65bdcb95253f1c0ecc8acb13e02ce4807b08e4005968fd
MD5 d45bfe6ee7c58e531d68e9d726e262b0
SHA1 38ef3e86224c948612489d5d40c5b309f266a9b5
SHA512 0266d98433ad0ea4d58ccd0d32a38eb085c3e6b2ba8079e1165a98b10479f04b4657af014661f0bfba4926c854b81f9bcc45d4105ed8e0d573f62179ffdd7f2d
SSDEEP 12288:/TiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/n/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1755523D3548955B1FBBC003986754428F5886E2DEB5619E3E2083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 b98473ccf13b2cc1a0a4896ca331b46bdd039b815697cb9c5e94a2f9b39f7ad3
MD5 bbb47268b6cf848857a1cf8ecd6cc193
SHA1 9b8c121b7d3484122aec557159ecbe0b95c32e1f
SHA512 4461b27234fb17b9e41438bec3853cfdd0e463e32f491e155e38ef24be0792ad0b8d44f071fc4fd6d03b0de092a5c85e123f7fdf2825800ae61a2ef8ee944e0f
SSDEEP 24576:NzyG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NZLNiXicJFFRGNzj3
TLSH
T1B0650147629530F9E17A8139C9620911F3757C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 e2681c3ba1e56e9e880401ff3584a443fa5d0e8dbc4dd67ef5dc29e6313a895a
MD5 410f43a8605a4915d7cb2474af559c24
SHA1 14f6404a745792d5e6269ad6d16e61d7067dc417
SHA512 f3b5d28877a8da8350bd239b581b3ebb0824c3cac5ab07770b4e2b598d8bcb9fd5b587b03f6959986cb14cb7724c11cf106588db6bafc40288f407e37f10e5cf
SSDEEP 12288:MHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Mz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1095523D3548955B1FAFC0039C6364428F5885E2DEB5619E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 5ea80f519f7d0c5541f897db1261aad8a656f408cd6c865d280262cc0144ad29
MD5 1aee49e539206e98726ae95d4d1787a2
SHA1 bd3a07965dc3e1e32659c2e2d8a0c08374651b1d
SHA512 9003b541a8d436accdb70ba46f36cb8bfcc6383934163969a954c8df8cc8d2cd595141f4db2b101b041f1c873a318e134f9c1caa974b0c62e9cdf28faf426ccd
SSDEEP 12288:VHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Vz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1065523D3548955B1FBFC003986354428F5886E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 5fb2278972a791b005928ce8738ee0f40735798164569ead00dac6c7ba98d051
MD5 7014ea42e55f8f8665af170b016b0bc5
SHA1 5949cfe2cf5a06190c3b0276d7b6f2e6282f8258
SHA512 a32ac79e19f5db164e1b5aee0d7eede336f4ec9183a10efc44f6b474b22120f2b6bf170a3f7b6f18ad0b69c4d06e10bce92b9bf8bf46fc0be90e14ef89872c93
SSDEEP 24576:lzyG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lZLNiXicJFFRGNzj3
TLSH
T13A650247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 2752740e4fab25effb74047c98b84da137f8fc15273874ece85358ac7e996ad2
MD5 700e7fea7373f9a6a2d6d57f4e6fd860
SHA1 6e8a1a998ccb7185ec6a15cf23d5ac3521d86ec9
SHA512 18f10e8a67bf55da4ccd0a5a3953bab3928b217c9439fb1dbd150948581da180777f39fd963c2d1752df253e9af1ea7716877bae3b573b9873131dc15d50e1d1
SSDEEP 24576:9T8aLl3z0zD4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9T7LljhLNiXicJFFRGNzj3
TLSH
T1057502A5B39018F8EDB7813EC9258815D2B27C2A4770CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 b3b56b5728986354b12da63d0d6c3e3f4ec6a066e6879f46c283cdaf69b656f4
MD5 f3ff3077c346c33ddda90a8fc1728e3d
SHA1 0a282386ac6a555d8f02d68d97b59fb19920a435
SHA512 73f75791998bc58bef0d7460eb568437472130e728178be684aee29a28c56450b01a6fe3423035d36a490a5483ebd3ada508c4b37162b79526df25a8c8dbc7f2
SSDEEP 24576:k3rd9CHKy7GZU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:urd9CHKya+LNiXicJFFRGNzj3
TLSH
T1FD85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 c0654d17b401ab547de741f02eb9d663c8a135e2de44448e919ca9c7b17c5c71
MD5 c3aab4ddb7da944135125019a6000f02
SHA1 c66dd5e49dcc3fbc1c1782bfaccb8d86ce44f233
SHA512 780641a8558f42bae9736fdf1a294766c4a8870a53579899039a041b55a463472b889e138eeca23a87cde9854e080eb947941400c77c758e29a33dec46112d33
SSDEEP 12288:u+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1985523D3548955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBDF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 a441cdb5f95212ccce30425facd639e3b6077b2abf070f0582d9d192b44f0993
MD5 7d1b1d742099d19d183ca873fc4e039d
SHA1 7accd0275f7256b1af049bc7e1a7dab562333b41
SHA512 32028791ab559cddafc14ede586689a019cffec9d5b91a93a2080694b64cf240704e2bf8ecaf23e40a1b105371065f19b86e32e9607e603d39904161eca60cb6
SSDEEP 12288:LciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Lm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13A5523D3558955B1FABC003986764428F5882E2DDB5619E3E3483D1EA278FEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 84ac8d8b1630ef3a38a6b987b428beeef7b303cf2bc68cd73c090b8eb81fe8c5
MD5 f687a77aa98ae6aa40350f3d57a9f26f
SHA1 3119b2e699c6d5f4e781c372e99868de3c1c465d
SHA512 d65237096621124300d7f5dae29c173a06ff126c0a8b1ce4aff61c6b501b158846942170b838d66a7bdf27fdf56509acf37c64a1b55b6d9ebfe2c295d03445e7
SSDEEP 12288:lFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1735523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 dc9e38f792e2a5dc5a72e2f928070bcf43aec038fc085c9d28fd8d73d66c312f
MD5 72788842aeefceb1993c2defa5d8ce9e
SHA1 6aca9bcd527408c096f5427a8aa6ac923383d6a9
SHA512 4dfe2c58b8f5e2b7426e6fcca1934cd222064d6cee90ba624a09e11a509d26253d6c07dfff78a65987e1c8d668be1852c0fa8dc6cd219e2b3fee94e59390fe1e
SSDEEP 12288:iHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AF5523D3548955B1FBFC003986354428F5886E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 23eec30fa872fb8a7cbda75f54c01e9ee043e905d9bf807448215c2c6d8af6d1
MD5 ef23c16bea7c80eb9ef9669c077ce8bf
SHA1 eaf9f9ebc445d04fd06459cc3bb566d15df16c2a
SHA512 de33d066547f85337f070933d3c8d6a0a026ff27e03170c43066130c68c782d95e3fb2de28dfb049133bdc4b447c88d67c36c073230904175d772f92d35dfc5a
SSDEEP 12288:J+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:JI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10B5523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 68031f412d1923f52002d82fc928b70c4cb9b6b5ef33f76698d0393adb443068
MD5 0120bfd9e7f1cd4bb62886cf955eaaf3
SHA1 9e425b907448c0b7ceb90562f7534f5a7a68bdbf
SHA512 d4de04b4d426c876819036baae8bfe8a7923c38421432bce62c892a37278dd4ee6d53c86c3dd48c48c121d5f639e97dd21e96d50fe4a8f39e16dd9077bf2decb
SSDEEP 12288:5PiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:57/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C55523D3548955B1EABC0039C6764424F5882E2DEB5659E3E2043D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c99a689477e7e99f9a22fa3e0eb160c7ee7f110241077868bd02c08603d37976
MD5 62298d289096c4bcfc869cb0855ed448
SHA1 495635e5ad9665740235d548459a0656869594a1
SHA512 656c6bab1c14f783c648b7b7005987454ff63d53964e8bace97895f41a56bbf5b495f822a77c0348b56770a737876a5f5d5fa6b2cb26e9cdf8b820a228ed3f2a
SSDEEP 12288:zhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1675523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 80d2f4133dadd8d3c9384197f139acfbdc53e172f5ba03b79219a10fc3a226ba
MD5 a51d16ff98089b0814e48ed9c4ff2190
SHA1 c774c31ed639c4873743c27e57a638a85d4ae064
SHA512 04693fe21e884666d28fbaf1bfdebd406d42d19da967d362979773c08eeb480696c94d414a7b64b49ca6489b0d33d19c223588d12edb787fdc021693373f09d0
SSDEEP 24576:Rfwvzk9RX6wkyAIX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QMnYIXLNiXicJFFRGNzj3
TLSH
T1A385DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 85bc7c7e16fff926198e7efb94e1c375dfc913cf3ca2ea4f78d7fd6e6bf23ca2
MD5 8866d13bb4436d3d70636067a8be49d8
SHA1 0ba6e17f972ce52dcbe1cc070df357515dd56e14
SHA512 44c2f31be75ec6f5797f3c2b63be8ab89d0e80d2fa63891c91bdf5449f53745318d22d83321c6cf92dbdb390bc1f5821d7d53fc4c5655cb9d88d706d223e60da
SSDEEP 49152:CYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK08LNiXicJFFRGN:tySzPU7wRGpj3
TLSH
T1B1066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 79c6d1f417f0bad7a6a5653782e0ff5c923506db8f9d9f8902ce5a44b164bc3c
MD5 671aca431bf2cc093965dc2688202935
SHA1 b7e4195cde70f9f338f0a93bc857f3486bc29413
SHA512 6ba2273b90462517083c39a65c7018061de13d0ca1c37fdd7d3009f18622bea16a26ee524aec430282d49a1f709784c8ee24f31e9d9ea1af7ec3f111fbbe09ac
SSDEEP 24576:k47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:k47JUQjqirIhCnDHUPfF/sLNiXicJFFS
TLSH
T1D165AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 2cc9acf99cf806cc55ac83f07a9d3158c67ed6bc74a2a12559c39d388b8097d4
MD5 32c2d85f924e4022c4e3bcd8e629fce2
SHA1 20de347500bc25c7483468b16215ecbfc1b82266
SHA512 255bc3ca5cd9dde7f8786d6ae23a81243ab2caaa45024889436f73b2c973c0424c05a5eb1e50328a36f83e81370d018d29fa30b93c95f53cfb92147ce0ff90d3
SSDEEP 12288:Jpsf3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BF65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 980KB
SHA256 e45aebc7998d90861d239ef006cf375c7a7b5ba2d06295ad8ca2405fccd93dea
MD5 30e8052e7f88d942379d163d27f79080
SHA1 ec8d5438a0992062011a0db3278e1b416fa05f53
SHA512 52a4616e6405eda466d5674b549d608e58b7ca5585b5c4aeaddfa4cb1f5a4926009ecd53f9b854fc938897cfcef55d1bcba66f1f78683845adfe61833c5c76a7
SSDEEP 12288:EShysU3fsaX1sHD3hmM7mFXtVN6EzNdwQuLnP14Qfh:ESXUP4EM61ti2NiQuLnN4
TLSH
T164252814B26AC74FCA6940321E36C1CCAB707D51FE446E0773C88B3F9476A59BAF2291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 b117415edc42fa18144922480366f9645a7c16c2954fa7a07427df655f73ee26
MD5 436dfc078df6f90c7ba2ba90fadc508f
SHA1 ccd108355b5c63696d74f5d06686321460e4a569
SHA512 538ac2ef2436f2974d3f70cf39dbc10d1405920f349ff9ef1b783525ad7b9719783062bddf3cf9441f0f0f03bde61c9ebb3d100206031e434ab347612429eb1d
SSDEEP 12288:dlVgDUAqODb3u71uyFgL+XG16nGndgtbNcqr4eeva9EH1ECt0l4s:KDbwO0Cvmm1ECul4s
TLSH
T17E750940A137A38FC5BA5072072A5B8CA778EC17B7457F16B388453AD826B16B0FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 38105fbbccc14cb60891388090091184ff5cc272d2cf0d648c39b9c55bbe83c4
MD5 731788cfef76f58ea3a87c91c0de2d4b
SHA1 8561f49a1427afe350111a0cb12c7f54c537ea7b
SHA512 12d0c57983e69828bb35bbb2ebeb814609c62b3bc6a784d87175abcafd4652213feef6dceb26f584f918a9fe75285d13aad85e3e02757ea7d1b28a218769fbf8
SSDEEP 12288:5F7/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:HL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1575523A3568D59B1FAFD0039857A8434B54C7E2C9F1594E3E2043A5EA238FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 dc3fd63d33e4ea266d7124c59fdec5fb72b62ca73d045e5697610f3c6c218a0f
MD5 bd9ea7f8e8b08646d51ba681ee4b3e68
SHA1 fb8be7df5e8b33f848d2063616eb690d196a4a22
SHA512 31380e1b0693a032dbc4d16fe0872914a4d95bcded0cbc77c25b83e22bab5aa92566d7834cc995e1e5a054b9041d9d01adfdd9126556d26a90ce3921988918c5
SSDEEP 24576:wgb6bmBIi49WNNFpg1rSvFv7bYh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wgb4mBIBhGFCLNiXicJFFRGNzj3
TLSH
T13265AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 408b5be47293051164e44723c5865f9d05cb871b7c5383d3029ef4574a355b12
MD5 043929146dce8c4990194e0b5e83d5bf
SHA1 88db97a81b49f0e14a4fc5b8fbea949bb8923745
SHA512 f116b9f91d0418ac6b6966c796a531c9aa5fc92e740a42df2aefaf476f199f65b9e32c4daf58017e1bd6d4077152d4d7eff2987c9dce5a6317051366aab5b95f
SSDEEP 24576:pG88u8FpJqH1vzria7/mS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:87ZFPqVya7/pLNiXicJFFRGNzj3
TLSH
T10C85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 7b327e974a21e7c0856f50b342b4506cbecbc6e6ed91e05376515b8a9fd08e93
MD5 db765e72c59e3241f3b09de777a39b9e
SHA1 52dc823bf873028048b6e5f88a9a41cde538294c
SHA512 86d1d1be599911ae8237fff4468b6230643cbc1b7eaff49d796630f4be6f3c2df0bec35cf3af11541c84569eb7a1f02a57a4fb47c608dcb5d8c85dbf73afbf80
SSDEEP 24576:tPUr+NQ+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tJQ+LNiXicJFFRGNzj3
TLSH
T15265F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 28f98c83a6d3cb5b2442080535b1f3d553bcc4a8407c7bcaa106c0184c77adec
MD5 04a495a3cfc94aa8d8e5d9d1b22acc61
SHA1 cf233f2e9e93782df9a4015089910acb66829f2e
SHA512 0b49f887234381c567e9142f652e58e9ef8076978ada26e69578f926480c607c206c9579c3fcb4c88add1ca5e1e52e16e8f549b837239789f8de427ac6706577
SSDEEP 49152:SBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjOLNiXicJFFRGNzj3:dG05lO43b/7wRGpj3
TLSH
T1B4D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3d0c90868e6a5ac9a103dc4a3b6c700bfc7e1137884172308267e11f7ad26579
MD5 fe1da2365ee4239f666845f95f8ff4db
SHA1 e235d6aafe443397ba9b1a5b80a5167394503389
SHA512 f95ce609148806b5c2434455b31eea41ae4afd77ef1f384f080dde0e040f9ca40c6040de2970122976df857fbae5bd8806d6b17829a09cc1dadf9408f8d41a30
SSDEEP 24576:Gfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn8/TwSfVcYG3K/cJHlnFR+IGNe8jg:ea5POZ3lJt2pasx2+mmLNiXicJFFRGNf
TLSH
T13565BF5EA2FC01D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6ce5eb94bfcdd72c76eed9afa42175acaff8081ba35d280fa6c6515dc51032eb
MD5 9c17c43c20a1e4d06f65015a5c6e4cec
SHA1 e071c766cce9caf0f94141b77923c4a1af03af53
SHA512 1732e7d2ebcd9780c256f2c256753dcc59a7a73581fb36369d270b8c41f292ac626aafafe6ce08b018adbcff2783a40b2547b3ada926b35f67080ed4f222e494
SSDEEP 24576:eNcwHdjbyQ4nLC18lb/EOjowL7FkK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eNc/zEOVHFJLNiXicJFFRGNzj3
TLSH
T1A9858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 657ccee87bc676452b92ad40658691067a80424582c4554e4d67c66034a55b3b
MD5 6ba08ab33bebcca4489d7bd94b9d877f
SHA1 24e3913f36f1edf1a4ce55f4a784a769703d46c8
SHA512 f3e6474c9f8b0148204dbec77b58126645e80f3934f07ca9d3bfa752c548a05b006d5162ccd82a18192286e2974575295849f674fe0779bd5ba384e90b792835
SSDEEP 24576:IzkNvNnaFeYhJNtmZBmA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IzMwBtOmALNiXicJFFRGNzj3
TLSH
T1E955AF6EB6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 feec71911bc47bf7af69e4e7838f2f9cc82bacacb63b303bc8213adb9d6819aa
MD5 80bfe5ca6a04620e0498d0a0da8db159
SHA1 57c41b49855e6a7b7c08ef20f89eabbd70176253
SHA512 8b854544e3e107af460b3dc1b974f7db94a026053665fa07f26abf467b3f4e062205769f447aab6d5e94c5c1268238c6b5d9cc7f5325aa7ae4131aac5486b6d8
SSDEEP 24576:6D3FHshBIYQgAv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6DVHeBIAAvLNiXicJFFRGNzj3
TLSH
T17A75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1316-114-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1316-115-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/1316-121-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/1316-311-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1404-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1404-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1404-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1404-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1472-306-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1472-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1472-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1472-50-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2788-6-0x00000000020F0000-0x0000000002150000-memory.dmp

Download

memory/2788-77-0x0000000140000000-0x0000000140412000-memory.dmp

Download

memory/2788-8-0x0000000140000000-0x0000000140412000-memory.dmp

Download

memory/2788-0-0x00000000020F0000-0x0000000002150000-memory.dmp

Download

memory/3152-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3152-22-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3152-14-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3152-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3152-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3484-88-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3484-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3484-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3484-326-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3484-95-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3484-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3776-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3776-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3776-39-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3776-52-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3776-54-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5860-78-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5860-84-0x0000000000A40000-0x0000000000AA6000-memory.dmp

Download

memory/5860-308-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5860-79-0x0000000000A40000-0x0000000000AA6000-memory.dmp

Download

memory/6036-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6036-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6036-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6036-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6036-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6844-307-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/6844-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/6844-67-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/6844-73-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/7072-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/7072-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/7072-130-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/7072-134-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/7072-138-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/7076-102-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/7076-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/7076-108-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/7076-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/7076-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/7076-312-0x0000000000800000-0x0000000000860000-memory.dmp

Download