87ea1d09e18e774a22343115ba4e24abc5937e3313f1b1b3e09a112ab8028c34

Analysis

max time kernel
118s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 3.7MB
Sample260708-jbjpsadv7n
SHA256 87ea1d09e18e774a22343115ba4e24abc5937e3313f1b1b3e09a112ab8028c34
MD5 6f9cca3c6ac4b20088f95c6e7db54fe1
SHA1 4c86b8818ed74542c409bceb8936b2098ed9afcc
SHA512 c05aa98e9790a4ab3ea62f72d9e50f02410945f8bc1549ae8fcecbcf19f0993a6a027aed8de694cc860cbac02a722be0be411e67cf12f6df7bf22f9aa736aaaf
SSDEEP 49152:57JynhJ8EhdVMw7Y9odwfDFqfFFJVgrvqzbut1wOq/eVgXUeT+uXEkjNEEBHLuGf:IsoEC9Aa+uUkjDBHLuGix8EVy
TLSH
T14E06BE1AA3E406ACE0F7D679CED6C553D776B80D07B0A64F029098A64F772609F39723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
2512	elevation_service.exe
1296	elevation_service.exe
1000	maintenanceservice.exe
3928	OSE.EXE
1436	PerceptionSimulationService.exe
3940	perfhost.exe
5400	ReFsDedupSvc.exe
1004	SensorDataService.exe
2064	ssh-agent.exe
4052	AgentService.exe
260	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d21ebd98d8ede1e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128406\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128406\javaws.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd1b6898ab0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c794398ab0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000001ca04299ab0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{7E651229-C8CC-47BF-B1CD-7BA0D820F83D}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{2CB58DD3-394D-4634-9182-B522726571E5}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5800	explorer.exe
5800	explorer.exe
2512	elevation_service.exe
2512	elevation_service.exe
2512	elevation_service.exe
2512	elevation_service.exe
2512	elevation_service.exe
2512	elevation_service.exe
2512	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	4052	AgentService.exe
Token: SeBackupPrivilege	5400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5400	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5400	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5400	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5400	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5400	ReFsDedupSvc.exe
Token: 33	260	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	260	SearchIndexer.exe
Token: SeDebugPrivilege	1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1948	2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeDebugPrivilege	2512	elevation_service.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
4048	sihost.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe
5800	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1468	StartMenuExperienceHost.exe
1548	SearchHost.exe
5800	explorer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 260 wrote to memory of 2220	260	SearchIndexer.exe	99
PID 260 wrote to memory of 4908	260	SearchIndexer.exe	100
PID 260 wrote to memory of 5960	260	SearchIndexer.exe	101
PID 260 wrote to memory of 2012	260	SearchIndexer.exe	102
PID 4048 wrote to memory of 5800	4048	sihost.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_6f9cca3c6ac4b20088f95c6e7db54fe1_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1948

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1296

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1000

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3928

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1436

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3940

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5400

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1004

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2064

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:260
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2220
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2532687178-1633831978-1202193935-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2532687178-1633831978-1202193935-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4908
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2808 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5960
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2868 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2012
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:3088
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2808 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2868 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4244

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5800

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1548

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b64fb437f88bd32f92fa49a8154aef9cd0a00661f45c5bac6c47857fe6bbd83e
MD5 4a5ced14778912933f8add0a8298f355
SHA1 61172ba956f819a63f5cdf4627cec7930729d000
SHA512 2d9dbe17bf1222087a59f039a732ea7adfb24e33cc855f2b6c41cd4064a7ed14926c5653531187ff991e0316c36da2ba7a5d5d48492e951bb20a73cb692353f4
SSDEEP 49152:Tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnOx4x8EVep:x3q6HjBdix8EVy
TLSH
T1C2D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 c3ac83be3266f93560878735656d9813ac91230a04691f4ff8ac56fb6c6376c5
MD5 eeede481f66405eee9129ee8a08a8b85
SHA1 55e936f6e182472d8042d1c5d5ac554703a8226e
SHA512 a7892c98804f9865d5224322b276e6b99700c8ebeee4f99c7f4b2ab83202f431d499ddfb7a62e7ad4c8295b0e0fabc657866815d3f6c28f0abbd24bee581211b
SSDEEP 12288:71XLsswWkxy2lRq2czA2+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:BXYfDtczA2yxknw4FYnshx8OfVe247
TLSH
T13875F12877D508F9ED6B8139CDB28512E633B8914770E38B03E4A5295F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 b45b70226f05777f7728a4945d64c4777dd01c374324669b23e3592e1ae73433
MD5 6efc2532c3385dc0325c3c7e2d4e37c6
SHA1 ff2772ee9f3b048755df2b88867499564a6982d9
SHA512 67465359c23cfbce369d61120712ec6750d44010e6ee89ec18a86a673b5a8e954d41dd644fa29534d0143eb4ea2bdca905bfb932314a69ee5f3a950d4ee28113
SSDEEP 24576:I0Le5ji0hmx1rMTyxknw4FYnshx8OfVe247:IPji0A7bx4x8EVep
TLSH
T1F695AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f39d1a050b598b1112d09cfae564d31b54e1763f76907298c7f4b4fb9f342f6b
MD5 2c931281a90c357742ac67131fb7e10a
SHA1 b98f288d892e46f418e4806203a81f67ebc13eca
SHA512 54fa8c50e1c6d35e139af41a66bcd3b009737f88d8d5b9abcbd1c4f67b7d36060e02a1e678e3ed8982e46d1c456933e05db1745eac5579a8e3b81a446607ff73
SSDEEP 24576:ia7/ezSC6vUyD/aqgrvWE6q8wyuRyxknw4FYnshx8OfVe247:F/ezSC6vUzPvxHjyHx4x8EVep
TLSH
T15C756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b6d3f50133defd0970860a34302e0c879150aa33bb7e04633405d55cddc94ad9
MD5 ee9421c8519bfee41753eb0a2cfa96d8
SHA1 ed181ddeed35a27f200f40e9ac9643a14292a72e
SHA512 836fcad1f3a5209bf4e43ef72629204d56d24ed349033d6f26f9237991285e8f8974586aab93d79edad139a33fb30038b4104acbbd25ccd18c4edf18a09f39d3
SSDEEP 24576:dVbqPb88hv/l+6Syxknw4FYnshx8OfVe247:dVO88hXl+ix4x8EVep
TLSH
T101559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 fa48b02af431bff308f43377e73599a14d1817fe8c86e6b2007c245084908cad
MD5 9562ee0b2dbd73efd89a1e484526b719
SHA1 8689aa66feb73c258d019d127e22dc0fa7d1a039
SHA512 ec35b3fea35b12f9148c042f9c24cef7e67556c35a7e3cdfab02d7bcc68864a775990ab20cc99c2faebf9d98457d76c827882df8d6d75435db4b1c1f8a0a196a
SSDEEP 12288:zNP+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zNPyxknw4FYnshx8OfVe247
TLSH
T1CA65237CA7DDA4E1FA5E14331B7572622616BDA4DAB4C11BC778B14EE0F0C60E06E223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 a5ea05af88ce0f775dd3f462e81c97145e9c1127319deb81507e8818e838a8c5
MD5 dc1e392961870649ecf4b990a6d5f4f9
SHA1 80dd5916d3501f2cc963a6125dccc1d9476de001
SHA512 e03ecc476c940780934a39755031a5ff7696dc2533b0d0c266b61d851b45d8d84cbe09c6776703061ff944d8e0c919adc37a2c6c49c9de0e8dd69c949fcb0efc
SSDEEP 12288:CeBNUbTVO86U6+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:CJIU6yxknw4FYnshx8OfVe247
TLSH
T12775CF7BEE28FCD2C27E4DB95B918600A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f54e569301e18348ccf6ab82d4fa5d7c1d5f1fb8fb61a5adfcc8e2961afb0b04
MD5 7b6b6bc42611560e9e179d37b6d8c53f
SHA1 997fd104a204502f27e18e49f14117a64460ba87
SHA512 f3c5eb98565d14ac18a9ac31950895bc04bfb8a5d1ea4fb6e5743051b88a81bf673737e446bfd3c94e9682f2bb64dcd6bf3b2a3028010d1f2f2e5d307e151ba5
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THV:1QvGAdlCEL8c/yRNw5CEix8EVy
TLSH
T1C6267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 d34542bee8681c5c7c3d352087ea409e03d208376c6c3720def5a85294a49114
MD5 fd4b8b8450a21cac66e6f21a3cbb6051
SHA1 cd960dee39c71d57f012ee64f80234ca8ea586e6
SHA512 670a24f39132e3cf1c08d0eb03a7fd2eb43c11bd6b8f4ecaa08739b2d571c4be1d35c0b38a31f9708dd54f141f1d8f71912f0d1770a74691d9e00e4953ce40c0
SSDEEP 12288:7AwSfxL/2Dc3LDLLmt0LDQewsAjo+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:k6ewsAjoyxknw4FYnshx8OfVe247
TLSH
T16385E030FE74E032C7BF0DB21B36D716142DB9604B611AC3E3E89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 cb59af1c12586e11809f2844e7e5a0eaf227914fe7b23acaff9d28d71cd096c2
MD5 e2a01b0e8ad858126df59510897bed31
SHA1 7937b17765d3c0fce339c369fa153231b8b8533a
SHA512 b666c288b71ef362299531d09a3048863acf8913660a38f0da7db2c9c7ffb02bc4bf07922950a5441ce6202e4ea1702e73c02a77b5373fad39bb1fe6762ad2e1
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH2:XUEtQevvqc2W1cpV2EI32
TLSH
T183474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6bd51202b3279a099034dec96d569933d3f92537e1707f29defd27b4c8ee39eb
MD5 5582c0dfb7f61bc5a1177fe102f3d59c
SHA1 fcde695d5ba10e21bf7cf1544c13a3d7a3473c80
SHA512 b4bf793c5288a9653311e5efb4ab0a2f23ac68cae14c6da99d6bcaa2e79b9e5d97273fd18b973c99bb02cb6a71b97d28e3cb245690279954a42ff22a0edb4535
SSDEEP 49152:+CbRquA/m2yL5zQfFiV+XenmE3/zrx4x8EVep:zoqtVjnmQix8EVy
TLSH
T1FED58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b27f33e5473fff80b77f4f473f6f60983242e075c3d4f8044a40985c7111d47a
MD5 ea5899ba5f67f40f1eeeb32a0388b1dc
SHA1 197cc727fb842c1d5e98523cadd0e06c0eb391c6
SHA512 92d7f877c437c0e5061496a6e4d4afd59ad692af1d791617f332b49444c4bb546247672e241965717a3b35b1cac8f56755f547eea740f86da6c6af4c1bec536d
SSDEEP 24576:TAhGLJIFoiwtA5l7S53lyxknw4FYnshx8OfVe247:TAMyFoiq5Ax4x8EVep
TLSH
T10C35AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 a9cda88938f99cd9c98e43608073f66402991de4b25bf1104142c5cd4f572cb3
MD5 2441769e1428881e21a095a729001d93
SHA1 93e2d7e4f90e22f572eb6729409d957715b31c6b
SHA512 424230f8270250636fb7f125bf039bb6994442fa1b9a3d886815a06405d7d11adf026be02ed4a63278c70bc16c13ed0d588ee497466404d7c9d4368304c99a3c
SSDEEP 12288:zmw5HEjsChN4BFgl0WDm+Cx+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:SwuVOWMyxknw4FYnshx8OfVe247
TLSH
T1BF75F14977E91CF9E96741398697D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 824a8d0fb14228f30fac6f50f2a77e6237feef9b5bfba22f4eb1629ab74a7c1e
MD5 c8b2fd4b906cae2613b4b7b53c348d91
SHA1 ad71cd0d3a6b041bd78af4e039a175c03eabb7e2
SHA512 50255ce6805baf6300a17f8b1a63e64913dd666b3e8b2fdc8108640bf4776de1beedc9b38cf2e2d19221f7534dd7a0626e561c8046e530655f2f43a3b47d4741
SSDEEP 12288:+FZ1IyY+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:MZubyxknw4FYnshx8OfVe247
TLSH
T1476512AC33E860F1E1A7113A89F15205E76274A2677183CF4768625EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e204dccc2963dc12a837cec3006148644dc8bd26d9bd8232814f30dc0f4cfea7
MD5 cd6470c10d1fed2a6a45ec7d4ac159db
SHA1 b59e7f504666e2e0850b5d4fb94c8210b3a72653
SHA512 90e97ed211f9cbfe4ad8f0407865b0e111fae092d56fc97ff56931b0ff0ab2f6477dbfac8dfd17860d68095dda2b909572a9785da6ba7318f32086ec4cea7b3c
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UJ:iQRQyi36YOcPQLvw2gAf+PN3xix8EVy
TLSH
T184667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 eb44128daa58c6908ad11811dd21abf3a71966ae380b8a52859364be738dfbf3
MD5 9171f3754c8d3a2414f6dcc46a24ea5b
SHA1 ed4b4e5c5cb6f450e6677b4db9af5e8df32a2b96
SHA512 f19f66cb024076da7299c1561abe28d194faf2fa43e50387b2b3173d2e14ef4f91fbd7157353902b99766c193f5339056623fc8f5f91b28baac02fd139beb4f5
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UJ:/QRQyi36YOcPQLvw2gAf+PN3xix8EVy
TLSH
T1B7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ce2a57eac23a11ed04c22fd7e182ea8698a56f082c5f0ef3bda19caffb58acea
MD5 dcfcbdbfe55357a0fed9fb7b00b401b6
SHA1 23faf9184bc6673378dc27395f3abdc40e1a30ba
SHA512 ec1e699236f79df4ee920a3b6be50f236bbc6180f8f8d0c669c963e5b5a9e3fb1105957fb08b5b6c5a419cd9903f1872fb96a3f5786eabf18ab6ab3ee240e814
SSDEEP 24576:VwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0ryxknw4FYnshx8Z:R68Qg55nhheWu7PNU3/bx4x8EVep
TLSH
T157B55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3586e53f2370c05c9316af0580ccbd2829468a4190a856022dda36671fec3eab
MD5 71565fffa84b6e9bee61c5a5aeda1617
SHA1 5f6f6dfd476c54dc48377a4397b587bf623032d2
SHA512 485b6b1569a956a29c7860a1fc9a3c5ff2dc1bff3643483acc3e8bfbe503b2d35490aab9003ce6bedd9d4956bcd85ec9deea73aab2f35aead89d49b03ec9bfea
SSDEEP 49152:F3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99r:ky5112gYy5azzVvL69nLKnhZ6ix8EVy
TLSH
T1B2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e1747577d4d1b3d66acbbd7a6017f3283769323c282b77a71047a042d72de21b
MD5 4fbfcd8a8ab5e60a615caef7ed7f187e
SHA1 0ea649c046c3fabef44c8517f4fd32d2e259b2f9
SHA512 41aa78e688eef206a6dabb6d69c4ada68cd0135e12daf59478e3bcad976277d7bc732c5f79d8695f298f53ce44e3009b3a66d2899b6fb099929f3bfac25d344f
SSDEEP 49152:vB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl5x4x8EVep:Ru6JmVxd2d5ix8EVy
TLSH
T17CD59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 873118c8ffd725334f9efb07b044cfd422bbc12cd840dcaaf84a89be130f514d
MD5 dfd892b6d961e273ede0e67bfe689ff8
SHA1 7c422543f76e6cb870863f46308252c50839aa31
SHA512 e22bca57a26fe1a7eaa981796b63b5eb07776d9342f23b78a2f5ec183e95c042f73599215fa3ae1781aa7122a12f284332bc9e83c58b7df323b4232b5f1993e4
SSDEEP 49152:a1hpsNoJpF1A6UU44CwH7R4x1x4x8EVep:amifPbRQix8EVy
TLSH
T1A9B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ab16914fd34f05b6d9b038d28afed9603714481553d902ae0973f158d78f46d4
MD5 1f4d7f2e15b6a90d9890350696209b59
SHA1 6da18ae049462a21cafeac6a5ce0f0f483e6c5e4
SHA512 a1c1957690995253e82c1b7fb8e84faef4d06b09c74ea7047783314f5b1c64d7e15e023b239890733393f9991b5e64186d688583d3b5675b4f3b7488ee94dc8d
SSDEEP 49152:nSuZQIY0Be2KRRVtOnks6NMHq+x4x8EVep:95dKTi61+ix8EVy
TLSH
T180C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c51bc9c4650f482325150f8f0f0ba98840f52543be13e39d59e355ed1a83a1e2
MD5 e52754ddf7d59905693b3ce9591d8486
SHA1 5eb7bbb546c4ac72f99b7c2820d3e5467f809b62
SHA512 27bd240f0f78b60f81f0e26e07ab3f04ea3a9e9770e3aa6e295e6d45a68b0a523629675a23a2b235140df50785e53de13bfc784b42a72b4abadaa191d0a05b49
SSDEEP 49152:ZhtSn8EApI0figngiDn0AP5wpx4x8EVep:oX2iyphcix8EVy
TLSH
T19D95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 43a1622d965af02434ae363b2f6faced8d8193eca4ebbc24c77dfe009bfc4e73
MD5 760641f0daa2da44d64207869214131c
SHA1 90ba1a13200995b400d7722a96422969ad66c368
SHA512 0d9a4450d566c3d6b25114d165331d656b5b659569d669f14220e8e8498ca2b7c769cd65cb09a85d82556a20005f1967ae22cd5b793a54f38e51a99d00a86536
SSDEEP 12288:dX+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:dXyxknw4FYnshx8OfVe247
TLSH
T1D365237CBBDEA5E2F50D11734A7173626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 51770dad0277bd82c5dad1b84b20f9e6d7915c472c6cc1624af32dcc33f97ffd
MD5 a9858e332d0c78160a4410435da0e6ac
SHA1 abf75fd6ed081beb39518c0132055e78c5bf4f49
SHA512 dbdc3c1d4383f663fcf1cc3c033c4769f421e5c70d193ded8c7db0cb7ae35c28da1bc71a41feb7dd11cbfaf45de499acf229051ea64ccad64bb41c880af0f999
SSDEEP 12288:Ek+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ekyxknw4FYnshx8OfVe247
TLSH
T15965237CBBDE95E2E50D11734B7172626609B5A6EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 4c109d10200b3b276af755396a8d8bfdbe35248752e0c3f1ef367eca60155ac1
MD5 d659176ec8d938bb525a2eb79d49e031
SHA1 3f65e15cf717ab1d2ec53034e4573ac47a2308d5
SHA512 f9e6a1000bd989b30ec8ad89b525aab6cd5c7e0a2f874b24a2936eea6f871af5d1f0c68eeff8ba9d36d1512624d982921124602906a140a51144c3dd32ffa135
SSDEEP 12288:si+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:siyxknw4FYnshx8OfVe247
TLSH
T1B765237CBBDEA4E2F54D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 05b44ba0905b27be6aaf9cce3f7238589689a99cae8f6ae41a43cf75771c77ed
MD5 a6e9ebbe0ed9da5d40dd20e72e1c00f0
SHA1 dbf035b5ddc70dd1279cb32c43485852c220b2e5
SHA512 0bd3a69c20b7360f0e5791ca3325a72251dcf6ea760d1cf4fa7a1ab52767d521131b7230379693a2bc74a30939c0bf5df9d9f257e1fbf2c9158081d644663612
SSDEEP 12288:uVF+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:oyxknw4FYnshx8OfVe247
TLSH
T1D265237C77EE50D1E85A51738A726222B365B8E5E731835FCB24710EE9B0890E43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 737117c8f895428ced255a9b99d5f4c1390e8e8025818d715411148d0fee62f4
MD5 1f595b770e3225cb1dd3f8728e59935d
SHA1 59981b1c8519c2fa1c45e2c92b8b03e89bf71036
SHA512 c23b18c162fc4d6df078b0a207b3d05f156d8e413be052bf9ebc50f123438f5dc134279f5d06877c56bcf4e94c1aef892a42523fdf21012f0c5ba50cbca9a377
SSDEEP 12288:y9+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:y9yxknw4FYnshx8OfVe247
TLSH
T1A965237CBBDE94D2F50D11734B7163626609B5A6EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 41240216bea12a26894c0a39d26aca74be232241d2b437f7e25cbca319f64b9e
MD5 4c58db57a3fdeeda1e6864d0873e12b3
SHA1 27a81f469003741f0f6a35d0998d2c1115a3a77e
SHA512 36218d6507182f9f81bb72abdd101b98dc605d574b255085d96567b28de78d0740a45283e029d3a10784e4e4ccb09de6f83559e97f13bd7dfe319a58f6b1aa3d
SSDEEP 12288:jQ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:jQyxknw4FYnshx8OfVe247
TLSH
T13F65237CBBDE95E2E50D11734B7162626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 f216415e7edfd2f3641653e0dd639ae5dd4e46c4cc5862686d3af6514c12df35
MD5 22a0423749e0f39ada998f916f153cbd
SHA1 f15c0aaf44e0da1ca6acb136f51d1a33222de155
SHA512 f07e560c53733b0f4ab21763d58455b7b88e13fecb3c99385a44545577ee93fc4ee3279d56a11b4b2b6d837c4ca6223b9f7ec085aa2ddfc275416982e03ca556
SSDEEP 12288:Vc+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Vcyxknw4FYnshx8OfVe247
TLSH
T14A65237CBBDA95E2F50D00734B7173626609B5A5EAB5811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 9f614c42ae6ad103f22f4d2adf222adf6c3535ccc426948d005b926e2c030f67
MD5 ccb3f08af6c1cf6d26f6aa6bb501eaf9
SHA1 1d425fcafca05139d6ed60e7136fc6d0617d88a3
SHA512 efbb679d8babca6162ca8c25598f6e7e35aee3fc2947b954ad456bcaff63a8c8110f76f9cb811fe0731905997af7aa1e2b1a3deb81da3112c15d560fffaffab8
SSDEEP 12288:6iZwbZzzFEoS2cPvyE+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:dZMdzFVSOEyxknw4FYnshx8OfVe247
TLSH
T1B37501A8B39018F4EC67413ECD259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 e5a6c46f4d173b72f4304c61f89b8cafc3ee48c3570abf2f71bd4a5e0f912599
MD5 d35e28655be1da7c4bd4f5b252f99081
SHA1 1d25b27d2c9895123f84fb436e4fb45a1c9a5b85
SHA512 8665c84f016eac249a7687492eb89761a174b7e975eb871e1d2bb2b68726caa539e792390596dd86ca33d2505f1d90c0bb2a8e1b33d7dfb2267948685dd11f0a
SSDEEP 12288:AL+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7E:ALyxknw4FYnshx8OfVe247E
TLSH
T1536523BCB7DEA4E2F50D11734B7163626609B5E5EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 7072c18ad1d6c293aa1584c257169745aa414425c458bd6fd7796845183f754c
MD5 52dae07d735751b44074179317128b4a
SHA1 7552a94e838e18bf3fb64555bbc2d6178aba63f3
SHA512 e2f672da205405a390ef0668e5fe9106a03eb4f326225c07ee8cfeb58c1b8588aa4ee447ff501b6189b0a75fc09b9166352de5d2423892f65da2e2e53870b6c6
SSDEEP 12288:V/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:V/yxknw4FYnshx8OfVe247
TLSH
T1EC65237CB7DA95E2F50D10734B7173666609B6A5EA71821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 861b977b462dbda0e01c954e57cd28b864c46a5b1dd6ec3cce49e7b6a2fd5bcd
MD5 f6c0d778ff48d9d37543b7758bfa8382
SHA1 340d9d5f9a0a022b0c10b802dabe41eb8fd5335b
SHA512 81924acf124245f5098391b08eac3d2cc997fb24bd710155531fe3e34a5d94c80a89f57280df43623ccecb33069fd0ead4ccbf21e2adab3dce8fc1b81645af93
SSDEEP 12288:uyPz5L8Y+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zzyYyxknw4FYnshx8OfVe247
TLSH
T16875125B73E530F5E13A4236C9621612F372B872473086AF87A4527A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 20eb6294081c52ebd44d7f03f2d4d61b351be274ac110cdb5d9b4f99e90867a5
MD5 c9e223babd643056a2e0fde10ed7946b
SHA1 1e45d61d087b0c351f360b9f8ce60286a9f12310
SHA512 a00684756b3f23b2daf77f6c80728f568cb7fc0181e888ea34926b32bba34e87dc03c3123a5f2785504ac352816848d6358b036d86127dc045e7386d0c8d9a58
SSDEEP 12288:SL+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:SLyxknw4FYnshx8OfVe247
TLSH
T1DB6523BCB7DEA4E2F50D11734B7173626609B5A5EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 4b33799ea245a27b74462cbd41a76e72d6abd6fd393998df345adf5496c79b5f
MD5 9a3879bc74c489cb4543a35b252ff865
SHA1 27f41de3361d42bfb9aea33bd36368f653d9dbca
SHA512 5373be50baee02088c4cf6d75e24fe1525c17b54b0e521742e92a97f5028978bcdf7453a27f2c63a95f36b2e97eb0553cb7a9c50007675f6369cf5c15aa926eb
SSDEEP 12288:PL+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:PLyxknw4FYnshx8OfVe247
TLSH
T18D6523BCB7DEA4E2F50D01734B7163626609B5E5EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 f429a75151580cb4f8732c58d4d554e45e4a712cc6ecd98248f4aad5394be78a
MD5 29053218f41b5836cedd6d6cec6f38a6
SHA1 763d4d93ff80392be21213e230cd79ebde98e413
SHA512 d0115acbfc499dba90937f6cef770a2adfa86927363cf71227e9d35797b408798bdd54fa66c7fb8d4f49f0d6308716dcc51c4acea2ec4cbea7eddc9259bd48c9
SSDEEP 12288:8yPz5L8Y+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lzyYyxknw4FYnshx8OfVe247
TLSH
T1D175121B73E530F5E13A4236C9621612F372B872473086AF87A4527A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 a07a2ef9fd585a8fc1a0a224012f2d96d5e74c2c82695fe2d902428f7a8ca3b1
MD5 cae4a2d07c06e449125d5781f50cee77
SHA1 1c3ff1579e562940c6f92922a19169fec1dec74c
SHA512 55471975efd65207e1bcb77d8e81006108780ce5722b6b9b7553232f66315a0f01b325c0fa0b93878d35d5534956d0a05a93b12371310084a870aa285d62a3fd
SSDEEP 24576:5TGaLl3z0zDyyxknw4FYnshx8OfVe247:5TFLljUx4x8EVep
TLSH
T1057501A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B9F736A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 ea62745f98247290d4ae95e7bc485ec303d17f437392c1cc2800aa80550fdbe4
MD5 cab1be0137c743b1b5ab410a4f4d4019
SHA1 46457c3cef1e4d63db47cb17b46e632ee83915ba
SHA512 521cbaa83c20ed323179005a274ecc36ac1ce078f496b5787d32115f603be625d4ca3422586e1b3bc577fddea38e28db374501fc92e04cd7c78b770eefd02bc3
SSDEEP 24576:z3Xd9CHKy7GZeyxknw4FYnshx8OfVe247B:TXd9CHKyaDx4x8EVepB
TLSH
T1F895DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 440a9262421e33a55fa51105258c075b1f25e66b4c3b3cbde7d2352d01e6137b
MD5 ab6c39e816fe3eb40490b3b7ef7d9341
SHA1 ad3727bb7e1ab576cd6fe924a0c84695de99f1db
SHA512 b2ed7c7964ef752044aea59558d09db844096cda6cd9d7be176f143b54ccf5ea3bade8fa6b84eeead730b62c2869cefd7c6962aacbd36f33b820543f9266457d
SSDEEP 12288:6C+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6Cyxknw4FYnshx8OfVe247
TLSH
T14865237CBBDEA4D2F50D11734B7173626609B5A6EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 d11bba4e7425f9d8265bd086e16484584b3008fa6f2b5fb00169bf38fee59e4b
MD5 5e7025a0796a96d90891fc8ad45f49e5
SHA1 39e9f9f8a005960a9ae14c8d0dfa70eb5291924f
SHA512 726756bfb7275b2e8d73313ccf25a8fca6f56666c424146ffe6f8ac776bda52a86e784dec24901c20444a4cf65334f12cbc7421d583c9e4fa3c92847fb2331b4
SSDEEP 12288:X4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:X4yxknw4FYnshx8OfVe247
TLSH
T16965237CBBDE94E2F50D11734B7163626609B5A5EA71821BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 194c0926b37594e4630223257496246ed825c6e9136bfaf351ff0dcde78222ef
MD5 4a18c21cd1a73e07e87fb1e3cede08a0
SHA1 4e3c10fd87a3338d0abf1684f2ea1880fc0a8f45
SHA512 3e7caa71dcb6cf555a7905bc5a6f8bfe9cbe06a21f7e3eb49dae611974e79dfb884a4fa084af269f671301f0f9b867189a743b264adc25cc41d739b50975c55b
SSDEEP 12288:oJ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:oJyxknw4FYnshx8OfVe247
TLSH
T1F16523BCB7DE94E2F50D11734B7163626509B5E6EAB1811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 b78b685161c19835181af5a36641d6bb393d4e542396b57a0e64ad4de39c6e89
MD5 0acc2260bfdcf338e10719fa86ba23cf
SHA1 bc848a0e8d21c6a1b956c3a81026dece2e4f2dac
SHA512 80de037ab7cbee8ffb79386740ede5abf552346d2dfc122e6a066b638cfe698e34e39d92638491f5eff09f3ae2a12b23ccb52473411fbe9474d63fe726feb9a7
SSDEEP 12288:+L+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:+Lyxknw4FYnshx8OfVe247
TLSH
T19465237CB7DEA4E2F50D11734B7163626609B5A6EA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 a45599127f34a10412014f2e8af683cda5022a604497516de0894e0709bd2dea
MD5 28ea60a62893d9e40e5aaa1f425b72d5
SHA1 155f234db5bf5ee708bd38d9f75dfec17df9f024
SHA512 42a97a50f2378891ec63f6d18df34b9b7f7ccbb38ca5285a02f801d0917a5e605927da6c39075c4f426655298067a89d2605d7a4afd0e88e00287c0ae243cda3
SSDEEP 12288:HC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:HCyxknw4FYnshx8OfVe247
TLSH
T19B65237CB7DEA4E2F50D11734B7163626609B5A6EA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 b5baa0da7deff8c0144ce15b8c8248bc1dd2af4c4b566a2ab974ca5693eee8c8
MD5 d9b42dd1f8abf72a8b8c4d4f22c86f26
SHA1 73362ec6e377dbbdf7c43ab505408152a876ba39
SHA512 fc28fe2cfe013ac4cc750f1402ebc07ccb058a58c75d1074a922f873520bb595eb1db7b5efe5b5fcf29543807c1f73492a9d9fc912c967d3803e6d21d780bd5d
SSDEEP 12288:Xj+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Xjyxknw4FYnshx8OfVe247
TLSH
T1AC65237CBBDE95D2E50D00734B7163626609B5E5EAB2821BCB7DB10EF5F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 fc1b35b6161f1dbd01e2953bfd17ed99970e8f11b2e08d3640974146d1cd7d31
MD5 0c07eed87eb00df281bc02d3ddbc670c
SHA1 8f162314d4b8bb8f9b8ee59aa36b3d3a8959fc9f
SHA512 c4a76a6b25fc95b3b57d67b4d98e4edc722b54adec829c68fac5ac52ba16fd51735c731411b09a9202bcfbb8bf2f39193032e1037c1dcb84ab59955126553f7e
SSDEEP 12288:b9+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:b9yxknw4FYnshx8OfVe247
TLSH
T11565237CBBDE94E2F50D11734B7163626609B5A6EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 fef8d45b290a6357a5a652c8ecbd9d92268633a41bcbf69556e83d33b851aeab
MD5 0dbfda15b1675691425e0d0460b4098a
SHA1 3b36e695d0a2c5dc7e15f9406a33139c67d8cd32
SHA512 752f5878e83e95d084cd017a76fd0de97846f6b688be03025c22d62891d8048ffcda16353b0b70092180c8ee28b737754ab4fa5f3b682e78ff8c0b1006215698
SSDEEP 24576:kfwvJk9RX6wkyAIvyxknw4FYnshx8OfVe247:NMnYIax4x8EVep
TLSH
T1F095CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d59f8e8fc1b04ca043f65aa7ddba62c9277115772a42bd7504036b6d91c15d01
MD5 f8cb18a55eb4a790f6c38d9f3745b192
SHA1 33c5709e4449004199c4685de7d8be4bfe24da51
SHA512 06643e166554aa8c1e30183bf4ae0db799b467275ac045698e67c231eb1ad1807f5c4c3b2804cf85b7b9f2bf455cf1f47b507048802fb6e24c4c6104f8ba3e9b
SSDEEP 49152:6YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Jx4x8EVep:UySzPRix8EVy
TLSH
T136066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c06a020f199741915c9ce8214da253725970b4d93727e09129a88596170a36ad
MD5 c65b9514af648ccfcda0b9d7b1c23e98
SHA1 ab8de81eb82a82aa0332fd95baec273cfdf9e790
SHA512 4fe83e6c225201e32d6c750607f8bfa5c2c3e5267fc0e9b755b81e8a8959575e6401f9a23abd8aadfd10f219886f9fec091ef4969330c10ff936ae1d133484dc
SSDEEP 24576:447Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY0yxknw4FYnshx8OfVe247:447JUQj1irIhCnDHUPfF/5x4x8EVep
TLSH
T15765AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 1e52dfec7be50941d6ab9a82e9b8f65061463cb7826c6abdd61a635679079a04
MD5 2597b47f69e9384257cc3e5ed3608632
SHA1 6d815f7bd9c69274136ce57055cbbbf8ffa6bf37
SHA512 401bd543aea33d069b79080745065a9b653136c088818a805d1fc1e1628c310bc896f2894973defbf946d9f0e5caa502176a4d8737f31b4284062b70e4a5ba91
SSDEEP 12288:K+sfb+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qbyxknw4FYnshx8OfVe247
TLSH
T17D75F028E29842E4D06E2176CB625641B3237C6597F1D3CB93E0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 0317bb234b2125dbc99402beb9ea46b22ff47afd73a219aff57b2d30dc9f88b6
MD5 70686fbe4f4148ac1be592ce37a1a6e4
SHA1 4b0caca803723d00403b7bd193b67a1f83f6d975
SHA512 a629d4b78d1fec95f9fd906d6be7d5bbe4dcda25a0ee2201e080b1412b24357b40c539d5467e5790f45062242bad0162e497ba4b205b84526888357992316beb
SSDEEP 12288:efUFN6c6bkkccLaKd6jOG3ZXboaj56/1+:ef0sxajjj39kalYs
TLSH
T19B5517007626D78BC6AD40725E36D6CCAB707D42EE049F0772C89B3FC576658BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 12KB
SHA256 56984f7482d130d04e0a38d923c104338ebaf6867ea934c31d65dcb7a4dc2775
MD5 8510cf48e0db4b0c19fd1287b3a94ea8
SHA1 e561385e6e8e8f9f1c32d046b2f6d2b3eb26ffde
SHA512 d53971197a63aba25a5259f5d4a5aa3b8eb8e38a855a4e76ed691d8a6ccd49e9bed042b03d90fa7521d7d3edc019e666a8bc3a06c795fef920f8a17f6528b35a
SSDEEP 12:KMdfO3lWEEEEEEEOkwYtEzBRUtPuEEEC3UyEn8tJ15RvEkvsMlE3Uv1/U3xsXHWH:K+fH30tP418sJLRsUs0sk1/l2
TLSH
T1B9425C79EF535A64DFF38030809277850F25C81C290943C39295133B6D651D80C3D73C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 929KB
SHA256 6cb32304eea3fb44428a6c891bfa17c2bc9f1c5bbb963610686f55d112d3f926
MD5 cbe69b46a0a4d366d3e292be42c1bb7f
SHA1 85da169f549c0f6c5967af02ef7f1ef8d1dab46c
SHA512 778770f914d7b76a8347ecf8d8ac8477d7f31733260026eb949ac9ad41c8616f2841046f6cf2594949af19d5b7ac32bab76905dc050e9980d3418cbf987f6f90
SSDEEP 6144:E0YUTUkUIU9UU9YU3qFt+Xv9HD+fsuCU7zwR85Oa3txEU1s284jfHSMYj6d8Y7vH:E0YUTUkUIU9UXUyfsfUVK2Rzu6vSozz
TLSH
T1A51529056177B70FC5BE90B313318A8EB764AC46F6453F06738C4C3AD82AA58B5E67D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 9b977f280177a848741477089e31b2348e3de881ffa4aed21acbc7f718610029
MD5 4b0b5bdfc7518ceefcc5d7e79f1f0745
SHA1 ac4a894d2445ab8d30722baa1cebc7ec04e53b11
SHA512 334f733bbec74ebce8f8a2c23ee266fe8a05225827c481a49a538aba5eac49435a598d525e589156db04225b8be70aedc8cf1007ef16b112638cca800b5f56b4
SSDEEP 12288:h47z+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ezyxknw4FYnshx8OfVe247
TLSH
T1BA65237CA7DEA892F86D11730676A231360AB5B49B70C1DBD728B14EE4B0CD0D93E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d7a623b8e31417a1c839880dce21a6048a87227319411526f9469beb7fd158c0
MD5 92beb8077aab5b73c8019c567e83ab5a
SHA1 a86eb44772f0af504f185edbb4938a9178881832
SHA512 4aeb2be16b4fb0d5769aa873d2932c58555229857f4d0e83360a18724d69fa9262eab7e067f8b87f5e93e9bdbea20a31663d4fe7f06b4d921f75eab5ccba8b5e
SSDEEP 24576:Tgb6bmBIi49WNNFpg1rSvFv7bYRyxknw4FYnshx8OfVe247:Tgb4mBIBhGFPx4x8EVep
TLSH
T18365AE1E22EC02F5E0FAD2B8DDA64417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 7e3ea54c6e8c2a43a4bd6f30e0a2216ad58b2d89739ea17d19aa24c43ea7e335
MD5 ffc371b427a6d7b6776d849b74aa1de7
SHA1 8ff21e3b91ecbb8b0759af0871a6b35390cb8eff
SHA512 8a9146c9217ab5f9216e2c3be6bb9aa040b906fbc9a722c7891ab13208deb3dee7c918bff12619c8904d0865f9fe80d9e339a1f4c4b5bc07ec734b2c8cfd19dd
SSDEEP 24576:RG88u8FpJqH1azria7/mEyxknw4FYnshx8OfVe247:07ZFPqVla7/sx4x8EVep
TLSH
T15395F16977E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2452be65765422d01d29431b34a9906778917c4b2a73d465d73590179ad51c21
MD5 7598af154b5cb8314aac390bc4bbb4bc
SHA1 3e94b994127e17f40e3ee8a1b493b4b75858f3d3
SHA512 1c9377ec8f3e66e65082706163a6e4c28cddfbcecfd1c5ab8c0e03ff3019df3f2cb466c0ce88f9188274ce12128e6294faf51daec280f7f2b12e792693b4d720
SSDEEP 49152:MBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjTx4x8EVep:vG05lO43bSix8EVy
TLSH
T1D4D5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b49d73d80d42c24e74c23f85cd47f29ef8b613aaf104a9af0c15d72350444fb3
MD5 38e7ef76e6d92e13dde4012738451728
SHA1 76b76b0862bb82afb604f33cd1814dfaaeb9744e
SHA512 c15193662eeef9b81c9939c0c27de13829378d60a50e2cdb35c1799667f902d140e33b253e688fd8b5cec4b6180e738871aeb17969e7042f6488d441afa3230f
SSDEEP 24576:Gfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnWyxknw4FYnshx8OfVe247:ea5POZ3+Jt2pasx2+mbx4x8EVep
TLSH
T14A65AF5DA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 57226bb5aadd67f5a73c29b3c159fa65614611049576dec72b3a84ea1da897cc
MD5 832051c814fa5e8ec35dcc5536762cb3
SHA1 f071bdb2e72660b896d0608d75af99908d56a36b
SHA512 0c802b4aa7487d2f8a685e98f5eb1822edc7a10ca74b6acb81923d7fcba4b1debe36bb12f7c2d8c529cab797dae7c130b482afac219072fad34715bb254b1fed
SSDEEP 24576:UNcwHdjbyQ4nLC18lb/EOjowL7Fksyxknw4FYnshx8OfVe247:UNc/zEOVHFMx4x8EVep
TLSH
T144857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3dfee3e46556d31d5a2f22df6a928f981425cee8d46516f1e558dbcb25093a0c
MD5 429b556da5035568ea06bb838429847c
SHA1 2d0a605b589124cf31f4a76a540acf2f7de27fb6
SHA512 91f0a3dbebedf90ef71b5c3331604d060568b362f275ac829282983448db1bbcf682deeb12c8fd6c5ab448a4032246fb710be238d23e5cd5c95179d90c88291c
SSDEEP 24576:h8kNvNnaFeYhJNtmZBmqyxknw4FYnshx8OfVe247:h8MwBtOmFx4x8EVep
TLSH
T10255AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 f41c5e1e5f67f76fe541f455e488ff37b4ca8450c6a2e6900130f71172c3c4ec
MD5 189c4e221d30a0410434c632001c1522
SHA1 dedd4d2f0477b039dca98e4c5cf14d8ea5e8b1d3
SHA512 7016355d3c11d2a16724cdd1077cba771683dab510bf81707f6436d132bbdb5e4940af93a6d6237f0858bad0593f6615923668a0b17209b1383f0abdd7baecc6
SSDEEP 12288:PHvUrBFrEjwaQA+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:PPUr+NQAyxknw4FYnshx8OfVe247
TLSH
T1D075F12E22ED18E5E67AA17D89928319F771B4621711D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 15b253f2bc069a8e536057882b5e15ccccc37f2b71935bf2a31a0b4dbc592e21
MD5 748edac3ef629fa08685bfcfb2d9cdf4
SHA1 2f2f44f9f4b8ae71880b2106d76f1024c3d3c8be
SHA512 aa5594305e3897aca45481fd4d35e85d19a1f31dd85bc774e60dd1489491b2ca89665a374bb6bbe095cfb39caeba5b9cff919f5bef394a256d80eeecb91e99ec
SSDEEP 24576:HD3FHshBIYQgA3yxknw4FYnshx8OfVe247:HDVHeBIAACx4x8EVep
TLSH
T1AB85E17DE79C04E4E57AC1BC8A638606E77138A9033256CB02D491BA5F67EE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/260-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/260-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/260-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1000-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1000-40-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1000-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1000-53-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1004-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1004-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1004-108-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1004-102-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1004-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1004-315-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1296-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1296-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1296-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1296-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1296-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1436-66-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/1436-74-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1436-298-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/1436-68-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1548-359-0x0000028201A20000-0x0000028201A40000-memory.dmp

Download

memory/1548-379-0x0000028201D60000-0x0000028201D80000-memory.dmp

Download

memory/1548-396-0x0000028214300000-0x0000028214320000-memory.dmp

Download

memory/1548-352-0x00000282001E0000-0x00000282002E0000-memory.dmp

Download

memory/1548-360-0x0000028201E40000-0x0000028201F40000-memory.dmp

Download

memory/1948-8-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/1948-0-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/1948-7-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/1948-78-0x0000000140000000-0x0000000140410000-memory.dmp

Download

memory/1948-6-0x0000000140000000-0x0000000140410000-memory.dmp

Download

memory/2064-114-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2064-124-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/2064-120-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2512-123-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2512-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2512-22-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2512-24-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2512-16-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3928-62-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3928-56-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3928-282-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/3928-55-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/3940-85-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/3940-79-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/3940-312-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/3940-80-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/4052-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4052-133-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4052-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4052-138-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4052-127-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5400-96-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5400-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5400-90-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5400-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5400-329-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5400-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5800-523-0x000000000A600000-0x000000000A85F000-memory.dmp

Download