b1a0784b498675b8dfdc5ea19638ad92709e1f6a80b516975e14df0b519a1683

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 3.8MB
Sample260709-pyf53aby2y
SHA256 b1a0784b498675b8dfdc5ea19638ad92709e1f6a80b516975e14df0b519a1683
MD5 70d1d443bd6a546dce17c9471d55af35
SHA1 7e1163f17821d872deb3fe6e7df6e91eeec6e29c
SHA512 97a2b90db4fa22233d03ff3a5d927405de73dc6e20d573a08869aea6de894a86f91b965d0d9944edd52e8d46a5d9c45b5f6491d33215a5554d2287512de98ea6
SSDEEP 49152:h7JynhJ8EhdVMw7Y9odwfDFqfFFJVgrvqzbut1wOq/eCgfUeT+uXEkjNEEBHLYPr:QsoEC9ha+uUkjDBHLYP7wRGpj3
TLSH
T1C706AE0AA7E406BCE0F7C679CEC6C553D776B80D07B0669F029099A64F772609F29723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2096	elevation_service.exe
4364	elevation_service.exe
5008	maintenanceservice.exe
1560	OSE.EXE
6108	PerceptionSimulationService.exe
1812	perfhost.exe
2484	ReFsDedupSvc.exe
1388	SensorDataService.exe
4892	ssh-agent.exe
252	AgentService.exe
3524	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\933b9ede3cd8d80a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab8ae1a9a00fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056dfc0eca00fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000129e91eca00fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000006e8019aba00fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c64647a9a00fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052e69faaa00fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f258d2aaa00fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e51df9aaa00fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000743014aba00fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b442a5eca00fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000658273aba00fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2096	elevation_service.exe
2096	elevation_service.exe
2096	elevation_service.exe
2096	elevation_service.exe
2096	elevation_service.exe
2096	elevation_service.exe
2096	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	252	AgentService.exe
Token: SeBackupPrivilege	2484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2484	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2484	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2484	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2484	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2484	ReFsDedupSvc.exe
Token: 33	3524	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3524	SearchIndexer.exe
Token: SeDebugPrivilege	1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1648	2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2096	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 5456	3524	SearchIndexer.exe	98
PID 3524 wrote to memory of 1304	3524	SearchIndexer.exe	99
PID 3524 wrote to memory of 5208	3524	SearchIndexer.exe	100
PID 3524 wrote to memory of 4404	3524	SearchIndexer.exe	101
PID 3524 wrote to memory of 1148	3524	SearchIndexer.exe	105
PID 3524 wrote to memory of 1152	3524	SearchIndexer.exe	106
PID 3524 wrote to memory of 2888	3524	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1648

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4364

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5008

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1560

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6108

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1812

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2484

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1388

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4892

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:252

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5456
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3575702013-381963388-2545377694-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3575702013-381963388-2545377694-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1304
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2956 2960 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5208
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2888 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4404
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1148
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2888 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1152
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2956 2960 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3dc45445b5029ffdd81f7e357b4fe3c0cf1c5a8ffee7cb35e2becc26d68fa497
MD5 fa0897c2f2857cb82ed258513c2a82dd
SHA1 01357857643ba5ba769c32127b206d16d9abe203
SHA512 70b5cf70d77c38a1c5f0cbaf87b40488b0534fb1cfb4723867ca2361b5f276233b0baf348a1f5ad190c6a34c9b2a87e07c7958e80a2b6e71e297fca60ce8ddeb
SSDEEP 49152:Bb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn3LNiXicJFFRGNzj3:H3q6mjB07wRGpj3
TLSH
T176D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 16d95b0034480d1f5e66d1c58ac9d3cb74ded8f9afc76c84ed720a19d21a1159
MD5 1e215c190651dad2472e77b1a5e2310c
SHA1 48c13b72a2b0627b90687e66b8ca6d85181e0f01
SHA512 edcf8343e819087b02cb4986e7bcd14a5049a43c152aff6017f07b41816bade0e8bc5e4399f6091c05e4ef9051d6cd0355d3e35a09b08f3d01f653b30d42ac1c
SSDEEP 24576:yXYfDtczAg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZtcdLNiXicJFFRGNzj3
TLSH
T15775012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 b17b2c8de31fce671c9623c1fbdac0500a28176038cd388902efb3bac0d459af
MD5 680c1889a7a1e526980e39c422e645ed
SHA1 b96b2b9e9a3155ef76c1821de781ef87fdf84ccb
SHA512 ba26b19ef60953977cd7e00dd2c6b9ef9db2c4bcaf2ee4a71b001e7cfbf6a3f3d375167152954c5fc2b581adba49ed3374311055f5aff9e9b49230237176dfa5
SSDEEP 24576:90Le5ji0hmxhrM//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9Pji0AzqLNiXicJFFRGNzj3
TLSH
T1A985AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 64de970c09e8b50cff3cb382d6522674f0ada6a24952a1a05b9b55a49f3ff923
MD5 847ef1b4ccf1be0a82518a2fef2002d6
SHA1 7f62d3356695ab870244097893994eaea2def9ab
SHA512 94c3aafa04f78641a5a11d41e18b4b5047830efed37550860dcd8a3e73e55e703691c2b10cfcdfee70222b6c82d3324078c6eaf7cdd320641be3bf20e6bf0b54
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWj6q8wyut/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz://ezSC6vUzPv+Hjy2LNiXicJFFRGNzj3
TLSH
T14F756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ba0c8a60d851707c7bf3b9b64f48914aaf0697a58b934df5b4dc2fa084199361
MD5 000881ea218270cf8d6a9ce63b2a457e
SHA1 caec384b47420fce4b880498470d9cdbf1ad5e4a
SHA512 e4c872d6145f5f6a785286e92f5d701a67834a4fdb67e2405dc66cdc72238175f94331739d837208baf9750259ff3c3432cde3d206110ab5306b0883a39f94c4
SSDEEP 24576:KVbqPb88hv/l+BE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KVO88hXl+KLNiXicJFFRGNzj3
TLSH
T17C559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 840c2eb762b472a37540adcdc0b58db2f20477fca4d25aec8364cacbab20bdef
MD5 fa393269c681998aa20d14533ad3ebf9
SHA1 9f230fbcd313da6140aba4b2a286f4a03b44e7fa
SHA512 86c89722c9ad77f3ca3d0197d0e26bc0223912b5d090f5eb82c196b73618dec8e446f4b19754f69a4378ddacdc3cad3f2c87ef0e9f058cd3578e72a2fbde58e6
SSDEEP 24576:JGz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YLNiXicJFFRGNzj3
TLSH
T1125523D3468854B1FBFD003A867A5828B5845E2C8A695DE3D2543E5E913CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 810d757fe32a31897a921e0b4c67db1eb9ca8f8d14a60e903f52901e940ec899
MD5 942d95fdb8f58642e527d143c3d6e6e3
SHA1 cf23b4225ed0be5637d992ac83a63f5199f34ecb
SHA512 868c55581b5138dce865ad1ac8a132b5ccd12672e0a81d59195b1031b75219bfc1aaf60abb776d8d960e752975e574c196433614fb1920efc7d89908a0371a6b
SSDEEP 24576:ZJIUs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZJIUsLNiXicJFFRGNzj3
TLSH
T10E75CF7BAE28FCE2C27E4C7957918600E76278304F6293CBD165830EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6bb5732a937ec351c0805e9dae081e6cc301b528f1b8ca52d4d9f0485b47b8b0
MD5 8c20d789d85f61956da1c058d64dadaa
SHA1 c259d04f7adf704e53d282b990378bcf578ce060
SHA512 42569c3bdce8309870b335fa76be1c23e0880e263cb2745cb9dbe82b85bad43d933a43c34bb46bcca998546a11342f217eac093bacd058855a954deca6107d4a
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THi:KQvGAdlCEL8c/WRNw5C97wRGpj3
TLSH
T1C4266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 6e1232f9244e3a6626212a48e0f627461534006e0fc1ad5e1a9d126322aa4da8
MD5 b46c4a091edbd51d3df5d1512dead133
SHA1 90237a58a9cc8ff8ff1fda727f0306f730b018cd
SHA512 46d9c59b4c1a11bb45029dfddc8fa616ddfec72fb483a1a7987beb1bec3ef45d7e44d298d086636970fe169c7a44e5c7f7eb53f7bbd22c868c4a6d9b6ad77188
SSDEEP 24576:ZfewsAj6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Flj6LNiXicJFFRGNzj3
TLSH
T14C75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bd7925771af32f8ecd52f22428947676221bf9b6cf87ed647877dc1d5f0b372d
MD5 605118539fc1cab81fd2d8885c7ca987
SHA1 0259c76ec488c574222c6d5dfbc73b0667a227fe
SHA512 3f4ce549caab472c4fe3fa243679c1d42890bc9479225cec4831acb9aa4b603945ae190f163c819d87bed2d28ad335577596c6daa21d606de283ae2681dd2a7c
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH2F9:JUEtQevvqc2W1cpV20I3269
TLSH
T161474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 96507a225f633822b5c1675d2a605bb0af72a10f377875a09ccf4dce870a3a67
MD5 a5522d7120b4db85d0cf079817ca1744
SHA1 fa2c715bb8a61ea9eb172b4afc693006abdca29c
SHA512 0ba4583d21c857c9ab5f11d05d771a61a8a4ecd6bcbf0f3a39b098ab17486d02c904bb1908a0570931703dedfeb7739a5ece782914688204ca7d2cb35715bd13
SSDEEP 49152:+CbRquA/m2yL5zLfFiV+XenmE3/zaLNiXicJFFRGNzj3:zoq2Vjnm57wRGpj3
TLSH
T156D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 400c66e0ad00b51a292cd0d861a5006dd4640f505280f83ea4a5be758c7c28dd
MD5 0aa018e95741a96c85f6a9dc777752f2
SHA1 332211d5b73136041a864b81d7aac96fce77af41
SHA512 07ddb18f2f893fc4c0e820fbcf33d9bab6445a204e4ecdcc0e8a8fe402790a1908728322694b6fca51b3a916a20b8c6cc4ad3af2b6563580da99f61eb1d720f1
SSDEEP 24576:oAhGL6IFoiwtA5l7S53Z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oAM5Foiq5JLNiXicJFFRGNzj3
TLSH
T122359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 321a0568aa6e145ef8cc127fa7b19cc8df85a212bc01af4b9c31975be7dfb2be
MD5 1eb25cea68408d34ccfb3abf253d6748
SHA1 3e85d7748ff9453be68a9e07232606c4677bbc2b
SHA512 38807d1af593653111743edda1026c7c581fc6f328d40546a84b3b9d90fc0a266bd1b8a1136641cb98e08195c6889195921de0cb512222d40303eacb7fb69473
SSDEEP 24576:owuROWW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:owSOVLNiXicJFFRGNzj3
TLSH
T19565F18632980CF9E9B641398657C035F7F2BC152A21DB5F5360C65B6F37362AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 32e7a15da8321b5848b347e8777a3b808289a0f0b15c0b17c1d2ed7fb71cc67c
MD5 e27f459be43bdee858c0f3de25851e4a
SHA1 ffb9838ea7766883f770c74bc566d6f6a2306db3
SHA512 519b57f573f07b18811fb4c9e95f1b61214287060b431a35c4ec3d334307fe4c03b6d1796c2e00ccfe8f54b0b658470e6164f25260df2cfad46f47eb673f0266
SSDEEP 24576:xZuH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cLNiXicJFFRGNzj3
TLSH
T13455129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a6863ac1cb3c32742d4dfb6e3169bde9a68de50484210da06b1dc9388c54ffec
MD5 6b349dfb69fbf92d3a359ece5bc7bc34
SHA1 513c54b4692207b93edd0824916dcc138ed8e842
SHA512 aa053b1db57ce58372e318ca600c8ebe00da9b207eff01bf1941d884051b61a5af63a01819e71313d17f2fec5517c9097ab696158f866d6e522ef40cc2deac62
SSDEEP 98304:LQRQyi36YOcPDLvw2gAf+PN3I7wRGpj3:6QyiKanX+PNkF9
TLSH
T13A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7ae2bf8c33840ec5f6fac5bd6f8e136407bc3fe7450fe89c3f0bc3e99b08f75f
MD5 378137a1f59ee18e0b0c27e90e32991e
SHA1 653a1362e08bf7c52ec5a76bf97c56a9b5c4ba8a
SHA512 71afc9c2916c4e3816bbf81f61f01a7d374c04107937d8ae61862ba28b50251372fe59a39972237239041c910265acde04cd6953328bcfb85c8ac924d4258386
SSDEEP 98304:CQRQyi36YOcPDLvw2gAf+PN3I7wRGpj3:ZQyiKanX+PNkF9
TLSH
T150667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c99382bd2cb9cb479e1756740393f517c8c99fada6b27ca1648b0e209c263954
MD5 2d38f5313014c1b4f1957432b5d39870
SHA1 92b5af54e561478e8c601b6c56ad22f2656696d1
SHA512 5a277690886872217739419f6e9d64d29afa02e4c893c3e56d4f43474c9b96f77f5a962537b50481cc9cccd088a0279df9a717dea4ba59365460009d967d62d6
SSDEEP 49152:Q68Qg55nhkeWu7PNU3/qLNiXicJFFRGNzj3:KthTRc/q7wRGpj3
TLSH
T1A7B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0c4ec5ca01c48752857b0cbcb975b67029f50f53b3b24bbcc3f356dde154cf07
MD5 5a88bae59f6d1812b21903b39db6314f
SHA1 5b25126311583a9ac7eb1ddce0e61d0f6704e23f
SHA512 727d524b5e098fd58c522be59901b51f159b57034dcaf74f6946480723cadbb4c5fe48b4fa6d2fd5c4eaa320c7463cdce8299b7a63909bb5dc046783aed04c1d
SSDEEP 98304:+y5112gYy5azzVvU69nLKnhZz7wRGpj3:vLIHRWh1F9
TLSH
T1FF167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e328e21520f4e64755978748c9cc203df8cf34f01d17dd3b612f311aac8086d9
MD5 6e06fc7b021bbc427dae539d8d265a5f
SHA1 845aa33df47990d65a05c366ce0d17b2320af64c
SHA512 06ff3bd5fb9e4daf5184f648c9ecc50bf888059b929b22ac441aafcf710bafe472a69cba1a30fba73b2dec7c6c36f04024e509765616be72e4336e733fc8ee8b
SSDEEP 49152:+B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glQLNiXicJFFRGNzj3:su6JmIxd2dQ7wRGpj3
TLSH
T19DD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 814e75a73b0e507fadc83866cbd1a288688cbc665fa4d620fb3b67badfb864d0
MD5 5a9c4651722bb7e08e5a6b8b2b4a1f4b
SHA1 d7fd93aab7f9953e74807d5d44c4cd7d2968c953
SHA512 d1e56b505615dcb129cf206b604faf10153ef390532c2d9bbdf9ad8f9768cc52e8e26c1c266fb6177a3be3357daaf2ba2f039f69a62a801e740aad82aa341a77
SSDEEP 49152:Y1hpsNoJpF1A67U44CwH7R4xMLNiXicJFFRGNzj3:YmifPqR57wRGpj3
TLSH
T1E5B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 33c4167981da32fc95d501dadd5a77e328ba8cd0216fcbc7e9b714d415189241
MD5 f597de2d7d82659fc1ba7babfb29fd7d
SHA1 01d6ce8448d0e2182b54b520d11e3acaac9ee5fb
SHA512 7f008150de1488a47d29514ab58219e40ff0eebdfb109cc8d8aba7351f004014f68dcba3f484dbe0f1f9b4a91889c5091bab422164c4c17bd55566de70118198
SSDEEP 49152:0SuZQIY0Be2KkRVtOnks6NMHqHLNiXicJFFRGNzj3:m5dKqi61H7wRGpj3
TLSH
T192C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 bb287cbeb6c7e6f0a407ab9d5b390a337aa5b007742254471831bcea11d3ce9b
MD5 dbdb0d30f91e4569b15436d380f6c1e4
SHA1 cdfcc54a5183cb53dd78247cd91f2bcf1bbdfb1f
SHA512 d063cac921cebe543bfd36dfc46aefdcc5a7b2e1e1af48f69a660070d1de3d8307bf7863a0c118d176de8915b8f1bd9038ca8c40c89b7fa5fee0e34d14056434
SSDEEP 49152:bhtSn8EApI0figjgiDn0AP5wgLNiXicJFFRGNzj3:6X2iWph17wRGpj3
TLSH
T1D995BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 640f472a6205bdd0143b40544d7ebcbeee98acc0e0272f95198ca6903f8dec05
MD5 a84754f34296c6aadc947924475b3a33
SHA1 ece26ca65b5384a75c1b1c8d3ab7e115728ec6f0
SHA512 2392e6d5d092867733286611774f9fa4261eb94849728b439a9c5d21477c967e0f9ee6e9d16eb59d94ef0480f628ceff76296f85e8a4c9e3af1ed948f44ed91a
SSDEEP 12288:EPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:E7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18F5523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 108cdfb803d547a558f497b76a4dc22554f393eaff9eecc1196ae2fc2d989c5f
MD5 f5e1fbeb97950b0bca29fa3a2319da3b
SHA1 fe35280528c97471f39215daafc803c4a32be1a8
SHA512 6ad3a31f20f6488a80c20eb2b7cf22472de8f20ae1dfd81d3331ee94f52596b60e1cf264c9769f8753e58bbd997eb9794e55807d2de5e1e2c1d0076a57ed2e14
SSDEEP 12288:+kiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+u/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16A5523D3548955B1FABC003986754428F5886E2DEB5618E3E3483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 75aa14b6b2ed18ea3fd0b46a58a2b24808e8ca6afb15038ac396867a0eb23cdf
MD5 14a1ef66b099d08cf4b933c59191fede
SHA1 311b37419da6783c7053e8ffbfd76915dc72bacc
SHA512 26643c072bc0ae6e23240e3dcd68f5929b3092179306a99eda5a19677cdc00fc5ed21c971c3b0bd03f789bdb5e9a9804b967f6a0e1a443401a53a35df1ff8efb
SSDEEP 12288:ESiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:E0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E95523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 6d956b6fa47af92619a55be4ac948d8648d62125815491b0dd801bc2ef6c2843
MD5 026c637b9f6ea7845c55e7feb05043dd
SHA1 3e9e848bceeeaa3fff2a276d284c67dbff7d6a91
SHA512 4b15f134a049f656bd5c6cf487a522781fbab9c7fb1a8f08292d76485c060668ce1abaaca9ebb12f135422773f8c78b7e664600d475e7569dde24f4a6ccfbaf5
SSDEEP 12288:0VViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:I/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T143552393168901F1E9F98039C6764424F2A47D6CDB325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 5b4deb90389629fba99b884730538e91db49718be54f7f3f023b1eea3658447c
MD5 74b15bbecf6c4ba70072e77c88a17629
SHA1 696d3b83596d4dafa690fc184e3eb8123899dfaa
SHA512 c568064b8da4b2ee1d4aa3e0749d0beac309228f2ee7f469b0b7483d74f3eecbf33ff110c243a4abaf2e3b6bd825cca8e2209b1c8aa3e7e685b38d508bebeaea
SSDEEP 12288:/tiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/x/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17C5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c4be8b699a234cf179e294ba4b20af2dbbc3f9b506ed68dec30ea62b0579fef7
MD5 853719edc405b0df3df8cad660d6fe1e
SHA1 52517e3fffe18065f6b62372dd01c5eff597b5d9
SHA512 958edbd03f3cf9df4e49a6e97edeb9dcb330e4787e53e0129687aa1e8d36c202ec8cbca34781dc329f9f975d71a18f765e10da7f7c2d551484d77e95fee3a0cc
SSDEEP 12288:3QiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3C/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D95523D3558945B1FABC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 72261a22a93d857d7a2498d52a00f6c1d361372441e1003cea14c2d26579c313
MD5 fdfeab64b708db12a1be8662a2c718d8
SHA1 0e84185178c7a9140d59a44af6a4d7d46e084ebe
SHA512 623336bf3fd348c30be38ab76170f2d8f12fa52073ea778c88f263792ff20e36526f362b87a2d4f9fcf6c835df450a874752aba476b74f707c6d0ee20ad4d9af
SSDEEP 12288:h8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1665523D3558955B1FAFC003986754428F5882E2DDB6619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 997d991d42f8dd063e95ffbd4f22e4deb64ba05ac1a65c1c8041760ddae0d61d
MD5 ac47d817bf5cc75210d5044ba2127f28
SHA1 aab18cc596db0d856df4b94c03feb7037f565c6e
SHA512 d060546ef640bf732477c9a84e4cf23fdf45613f6a1762bb5e61e8341a19a33b0cb992e22e8db6f4c317001071ba41a3df453f97ae089a6e08ab5699c1ac1e8d
SSDEEP 24576:TZM3zFVSOO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TZM3zfSLNiXicJFFRGNzj3
TLSH
T1BE750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f9623fc52ceaaf3af6fb3bc3fb756f2122fd6c28103887569196d339e287e8f0
MD5 e61e67d16456f9f015aa05e9f8758d18
SHA1 d1578cd61324982622874253246f0202e05149a2
SHA512 9953d59533bfd39ffb11553bdbf61ea87e4b45deeaec2a8f26fb338b9e4894ea1405eeacd93b5abcac0179187845032877766762781a68144462e8bdfc7c733a
SSDEEP 12288:NjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:NX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1435523D3548955B1FAFC003D86764428F5885E2DEB5618E3E2483D1EA238FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 8bc04fd194e17f6f4464cf81267d23f1444282349c9dc371e0004886bb2b8516
MD5 6062630f2e0fdb14e58ef89c918f2b03
SHA1 22ae0d99d226ff6fa3236b6b61cf1d6d0442119c
SHA512 f44be762d656cd40e79f93cdece82d6a8983ce54775195392f874188c4190afa066a3ea8e8ad8f1dfa34640dc869f975b31338b20e86c1f7328a33de30799f7c
SSDEEP 12288:S3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DB5523D3548955B1FABC003986754428F5886E2DEB5619E3E3083D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 e1c1c80527c1b2fdb661087d65a0cf5779775c00ea4a77ca3cab8c013d840425
MD5 c81782f5726783c6874492ad5f4999db
SHA1 66910459de50bdd19e67a3bdae3fa2241432fa9d
SHA512 c5933027682cf41aae4790f786c98eab093fca08330fcc1b87c4791fc619615bb128aa55e8ef92f760377bfbff2333b2a363c2a76a9324bd857acbea4375fab9
SSDEEP 24576:WzyK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:W1LNiXicJFFRGNzj3
TLSH
T11B650247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ec08e2275af4c304c2af026090a6bb34aabef0a3fc7baabc03098af5c0271fb1
MD5 04a250a9c9729c4beb1b5f03860219b8
SHA1 a7f8d6c06e44b8f834ab2f2f658eb3aba0d429b9
SHA512 62d341cf9ed3a15a844e62a58496e25a326d943c547b3aff5be36a6484cdd62658d47286584c3c8585587655c0e9811ab060f1655b180159d26b2a8ff0a2b3f8
SSDEEP 12288:zjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CA5523D3548955B1FAFC003D86754428F5881E2DEB5619E3E2483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 14f70ff88a1bf5b49a1e4eb636afeee067462c4d964c6abcc56383f5acaaa003
MD5 bb11630402b3b4a2c60abe960fdee251
SHA1 25c32b4e97511c8bb7b3d8324703b451aef38ce8
SHA512 61d230f8a11ac43d8446947f96d6fbdfa7e48f0c29e9226884213ba777b47d9c3ef84b6cca9b9d423625e8da995701b753df448f9eb619b7dd6d4fa13fa7e4e8
SSDEEP 12288:JjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:JX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EC5523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 7b95785a9041e2cd488373dd0438a7637538492543fe41649c0811efe78fc95a
MD5 d3629abe751969c230ce294c6eee18a6
SHA1 79e8edd789b46c907cc37ae952e276e784754ba0
SHA512 a88d6f940fd796310eb0ed5290051c72ebda221d70f105748ea8140e2d665d816d35c5cc872a0a05294fef4388f6b1d2c7e3acaace1a59a388dcadec775c077b
SSDEEP 24576:IzyK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:I1LNiXicJFFRGNzj3
TLSH
T18A650247629530F9E17A4139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 a79c70790a397d5948dec00dc242457a75ba2373f8840f38429d09822d3cf36e
MD5 fcbbc1ef5938716ba551d2b8d68361f7
SHA1 39175be426211ccdc53db5a4dd67dc18bfc9256b
SHA512 314b83029a9c805843276ba00a21b4b5676c42965f6841df7e292c56ea6c016b3a2d475c9b0c9c0ee6fc31fc4a71c9f84a6339f08cc3db857fef0ceed8953e17
SSDEEP 24576:/T8aLl3z0zDk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/T7LljtLNiXicJFFRGNzj3
TLSH
T1A77502A5B39018F8EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 9d4fb20b165b130b8fa84c08a64ddc0700c38393da83e2ee2ce49120c1ad14b4
MD5 e9c529f8711c65e7b5dbb56a46ee0152
SHA1 5e1ef10c18626101f9b38717e0e81c7702c76c57
SHA512 4051567740a27b7d5fa0ae1199739fbe66d1f69349872abca307540a90e4ee134a789717056b6abe9afa541759791d0eb5bf3599692734d0d4104d75a7630a8b
SSDEEP 24576:83rd9CHKy7GZo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mrd9CHKyaSLNiXicJFFRGNzj3
TLSH
T19A85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 37efeea33fb2df51643a738cb0517b0240123d94c266298b08413c55b8fe555d
MD5 f59de3289181ed614c77527e549c3910
SHA1 4854d4ff33b210cab8c5d66cbe7cb9a93e01748a
SHA512 8cb6dc2d3a8c528b9b85f0650b5ae4ac1c29cde63b735f372c3b0efa5ffb5732dc1bd7d190875712792672f50eadc3f88dda88a3d99fee2db976ced0358f859a
SSDEEP 12288:xyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1445523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 5b63fbfba2d00d559f72ace1f8be8296cac04b84f5df9513290d8ff3f4c117dc
MD5 c470955b053bc1715506ddfb7c97b917
SHA1 ad6b43500f65ce53165b8e60ca9bd34c6dd0d813
SHA512 ae92083ffb46575b00078d15473a88c1125fe54b671f2a0541d8720acdb5f443bb383226304eb6ea4ca4178c05938dd21c49f467bc1dccc3cd1b125f51891cc3
SSDEEP 12288:BYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Bq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15B5523D2558955B1F6BC003986764428F5882E2DDB6619E3E3483D1EA278FEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 fb8ee2e2d9d0bce419cce0632263be8db2049d05f0f0da7ef3ef5ffd851be41e
MD5 8464321258d72446af4c8de18ebff2e0
SHA1 dedbdae6bea5faeb2c96699f5c9771128abd5b04
SHA512 17dda43afde4fe10626d7aa020e1c789c75ae926a0757208c6c3e80c080c303f02c722489b2652a6acf96fda62a3fcae9024952a1a24bcac5570f208571656c0
SSDEEP 12288:aZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:aF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F95523D3548955B1FAFC003986754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 9de9a4bafcafd9af3d0b2e4985f88b5bc8c4d6b8749693f73c3e63bed48c3db8
MD5 0af129417fd684feb2c9a621dd4d1e5b
SHA1 91d9afe3947f25a1d9282ee228b6eabce751fbd8
SHA512 3e84db8790109e5b3b31495c1c6bf3b046a4d45f4dfead3e261eecfb42e87050efed70327db037b7792d680cdde75d793bba532806f23791cb05c8dda869147c
SSDEEP 12288:MjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:MX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18E5523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 22dac81fa35edd335fb8a44d1caafa0b34632c134fc76a15465bf946263866a3
MD5 7956ddb7f06b7f1bd360fa2638c06465
SHA1 3a5a24e7a4565eaa7c1be923569424b8551a8049
SHA512 b281d12e01267edaa60bf6d94f77285d537920aa0a3a15f032c5af0218a0faca42bf77430e116225a0287d1650061b58d7856d9b0376a94a0b15aa634b844c8e
SSDEEP 12288:JyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:JU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EE5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 fb65c4191ea63d69c780916460f3de7f11ac5bee3835ca20be783c78592fda14
MD5 1d437f68037a1805136ae7716b441090
SHA1 548a4772df6d546f187957723ae0879579b71ffd
SHA512 1f82d37c5602ca52130f10ab527cd5c08d2d51c89ab82c5d77ef1dd41c7c43f76fa9c182fea2c7dec65202581bcdfd84010b01120eb08b3cd35005f55e83313a
SSDEEP 12288:+7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+v/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18F5523D3548945B1EAFC0039C6764424F5886E2DEB5619E3E3483D1EE278FEB8F38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 24aa70fa603a1a2933e5bf25e0e56f0158056236d7eeb37ef6cda9002454807d
MD5 5a7d771895a679432e65ee9b4cdf5523
SHA1 1433a44b26405e45783ca4b7ecdadcc1a35eb869
SHA512 141796aafb715062e4be4e6707359ab681f64fe3cf1e29622dfe8112f216c9dce3bfccdfbaf0e173bd2bde6886f3c47b20603bf0a4a9a9d49cea4054a5c90baa
SSDEEP 12288:UtiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ux/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1775523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 afa6bc8a927b109d4da1b6a4370777ededd0c71410b96921c4241561c907db04
MD5 cec95b6d2a4c4ce51690e5f27501fcaf
SHA1 223c6b8d0eeeadc795267b199f7f91d38d1bb4aa
SHA512 d4aa1cb295a4ebaf8942040c9e1b9543979cf712c8bc3e999367a767f9bf8ad6018ffb1537b3ee5472801ca925fa82b50fd4d4f2edb7c874108955fc969cb4a2
SSDEEP 24576:ofwvzk9RX6wkyAIT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bMnYITLNiXicJFFRGNzj3
TLSH
T1E185DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 446109baa8fc7a09eed615732f2046c437a01e91fd502f34f08c66ec0f375c3c
MD5 23af0b410b9f40ae76fe15d3ca83ad34
SHA1 f79ed56414e7c3c9c62eb3a50df6678b54e510db
SHA512 f986d8b8e4caf231456ab5530d689b9b0ce5c175f477e7a6ac8513fb7f8b3b8c9a367bb7d19f4e0f14c5e8db7d18e529282adf38c240dc648dcc39179dfdd5d2
SSDEEP 49152:hYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ALNiXicJFFRGN:4ySzPo7wRGpj3
TLSH
T12B066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6b30d855c412df674f1c158d570a0e74e644a95a3d5690dc83e251610e1cc33e
MD5 95714b542739542ed22a2c0d34280dbd
SHA1 f930d8f3cb694f27edff4475a7b419cb772b089a
SHA512 db6fb90b853579e723766471e8c50cfb34f573a435140e29879d871b4b74cf06cdfea807542b7ed7d36383bbd52733f0acecceee25608e932f6244610322b4d5
SSDEEP 24576:h47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:h47JUQjqirIhCnDHUPfF/QLNiXicJFFS
TLSH
T1E265AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 4c26c586be0ceef2d84842afd1ff161254ab5d265fcf214220c0a6895852764c
MD5 eb1cc017b5acc13714de77d54a0531f8
SHA1 06b418f33e54061301cd104e97510a658d800ee6
SHA512 d0c4f2867c4a81d1052717f816f7f1b3825b140d87010d5b3c532668f40146598d060d0c817504ee2d7adcc8031b404e5869695acc4cff4921f673b801045142
SSDEEP 12288:apsfziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FE65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 c9716799d244ad7cb0217eedee2f7e4657f20e36dec2ee4376748d0d006509fc
MD5 da8b8b06cffec70d1d84f9a4b4bd58d6
SHA1 9e241bff806353e1e8b3ccdac7324611e6c35b2b
SHA512 c08ee2ecaef95109d85370ad7beec90ed5df618e70003979336864c7cce57573b24b92453f351c48b89eeb78b08cbcac7c627fe5e2139f4961cb91e9c5738e9b
SSDEEP 24576:eCpuUPPeSs2IMX9808hWmjaRtXjnzlOj:huU1jN80eDaR9DzlC
TLSH
T1123506007666C75FC6AD80721E32D5CCAB707D11EE44AE0773C98B3F8576658BAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 d5582fe410c3be772f15ccc892a526dee95011324f7659a1773357917b895bf1
MD5 a652e85972a8e73ff7c7babd533c1523
SHA1 8157b6f1ef05990f3d2ae2dac3fad488d7cff6c3
SHA512 4115d3f185948d568352de0b0190814b9b54b0a81c7b6cd3e2eb71c4d0a92c840508639d81f791ce62d5fc949a411d95a0247777b6d828f390be1477549c723d
SSDEEP 6144:vM4992lng6Q5YdDSv4SobS4rVLZ1qFsokZyK0/cE0IJwitMxGJwitMxyAs80uRZi:vM491v6dSwS0SwZFlNEZrOlVbE
TLSH
T1A865D8819036E28FD2FB607113265B4D6BA4EC07B745AF26B3CD543AD82AB1560F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 dffa3c31d263508ed675548b5903cd95d4cf261f0cea0c7f45bf03d81f5009d2
MD5 eabddee2c6beffc012676fc6b6e9d2c9
SHA1 563848c1c1c43971537b9d802d9c4401e23cd9a8
SHA512 14285f7734e868bfa89e234d5a204a3cc15759250c54a87b1f1846580de0c7b304bbea9097029fa5084035355348cbff334de15b50703cc5ec9a1725b3afd3aa
SSDEEP 12288:XF7LiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T162552393468D59B1FAFD0039857A8434B5497E2C9F1598E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 107cecd85ac1f73fbc377154250b6ff3b2cfc61179fbc42868d10d4a1ccc6606
MD5 11144bb78d1630b9a877e8c20ae5cdb5
SHA1 666fa2a8540d1b8e651c6cefaa55cd6ec811394e
SHA512 59cce46f2b7271f02dffb281326575372571e362ed6211240aeee07d69acf9ef5ecaa64c78d3a9ad3cde1fe1faffac783d55658f5d010a0b913738e47253fbf3
SSDEEP 24576:wgb6bmBIi49WNNFpg1rSvFv7bYt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wgb4mBIBhGFeLNiXicJFFRGNzj3
TLSH
T1A965AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 5758debca4940712d693186570edd466c97bcd1ce64005aa91cec3078bdabf2d
MD5 97113297e50c2e481785f007339c5f7b
SHA1 12854a0ec9c58522fa6f2dc6b0e3c6c0557a06b9
SHA512 c514fdd51985073ef047dbc99faeaa4b3887867e477550b427b01e0c0027ecf523624ece0bdb955a9405bdfcc12377a17b662379bfc434ca3b1487c744600253
SSDEEP 24576:nG88u8FpJqH1vzria7/mO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:G7ZFPqVya7/lLNiXicJFFRGNzj3
TLSH
T1C585F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3fa396137bb3cffb28e5e820f17e2c0cdecab4d4bfe697dfde17358f57ba7405
MD5 4a78dcf90fac5fac9d71ff92153e1327
SHA1 d2ac74594cf080bd1e3a6ab953c5f32f1bf71b9c
SHA512 d4558c64cfc25319bdd719181d59569d6dde505a537323fb8b82277f16cc7d4f43024b3c389cc198cafab6da32014e7009d65703cec96f47fcf0f1c8e8ef4223
SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjCLNiXicJFFRGNzj3:uG05lO43bL7wRGpj3
TLSH
T1C5D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 61820246722ef20d57eb68a6c08a6bb62ac624685111d0551f851d7423e8f345
MD5 258c4cbaa4e8ed5d2d994a2a70ae1dd2
SHA1 cbd9734bdf39a00e72f8b92f4e1c21ecf13ec3f6
SHA512 4d2051f7ae7c3e73dc9ffff347575f0b33ced9c3e7f6e5e0a37060d8685b4ff8b816cf50642d6e0c49e0b52358d1b5e156da275dcb97e053f9476161c915e61b
SSDEEP 24576:Zfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnA/TwSfVcYG3K/cJHlnFR+IGNe8jg:Ja5POZ3lJt2pasx2+mqLNiXicJFFRGNf
TLSH
T1D165BF5EA2FC01D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c7e5be4e261e8af3728a4ed06dc217a65e563f161e35a1404cf3f795c9dc7037
MD5 9b8f6f09a2c6c11a26b90748b844537a
SHA1 55d4cdeca3349400d458609b0896342452f5434f
SHA512 b3969925fb5b9584dafae768d41d31b35e7ec96c89058c4a241807e505147cd67e56307579439e0ac4018e87c193e6e5642242c91b51be08285f0f22033e0f01
SSDEEP 24576:dNcwHdjbyQ4nLC18lb/EOjowL7Fk2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dNc/zEOVHFFLNiXicJFFRGNzj3
TLSH
T1F0858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f242bdfe6154555ebe18f27bcc901b751a1811f34ab9682758a1080a48e4b956
MD5 1a584648a6006692e4648e7eda830bc7
SHA1 d92deec196dc6f403bc40631371ace92a73c9ce2
SHA512 06484dd5d492a202284c1b7411aeadb584d7b1bb51f21f7dad60b71ae2da63c2047fe2e389953f5419ff3618037062ba400eafa20f65825ed203080d7d5e35e9
SSDEEP 24576:qzkNvNnaFeYhJNtmZBm8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qzMwBtOm8LNiXicJFFRGNzj3
TLSH
T17155AF6EB6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 1b3b3e00db3c059bd6ddf80883dd6e91cf8faf6e3c21fa8101994828423638f5
MD5 f1c54a44fc2275b2f17f14dbcb7b5581
SHA1 17acf07b5ed2770fc86e069829802ed182e196f3
SHA512 afe6040c2802af6f0c4ba5353f1dea3e1ad9cb3296f87800c8532d57527265e6af4c4e21283570cbfbea888d7a181718b440d3ccdce5266dcef01612cded8f6a
SSDEEP 24576:jPUr+NQS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jJQSLNiXicJFFRGNzj3
TLSH
T18465F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 ce5948c7c822f27edca23fc0160ac3ac6e0b67c4a1840d008cb673449b58a680
MD5 701cc59ae03c24f4af0bb27e05eab46e
SHA1 e4ba46f0544d29d6477960a01b0e44f526583b46
SHA512 60682b40b7dc645b84148704c224c9a292dcbde7f63264bdafc3d8fb827adc903718c04ad3db30fa26e7a2024a7d49d8efebee4f21dbd35cd590a9acf384d545
SSDEEP 24576:BD3FHshBIYQgAb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BDVHeBIAAbLNiXicJFFRGNzj3
TLSH
T1C875E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/252-133-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/252-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/252-127-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/252-138-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1388-108-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1388-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1388-313-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1388-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1388-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1388-102-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1560-61-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1560-60-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1560-290-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1560-54-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1648-6-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/1648-65-0x0000000140000000-0x0000000140413000-memory.dmp

Download

memory/1648-8-0x0000000140000000-0x0000000140413000-memory.dmp

Download

memory/1648-0-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/1812-78-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1812-309-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1812-84-0x0000000000AA0000-0x0000000000B06000-memory.dmp

Download

memory/1812-79-0x0000000000AA0000-0x0000000000B06000-memory.dmp

Download

memory/2096-23-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2096-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2096-14-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2096-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2484-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2484-96-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2484-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2484-327-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2484-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2484-90-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3524-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3524-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3524-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3524-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4364-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4364-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4364-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4364-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4364-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4892-121-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/4892-115-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/4892-312-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4892-113-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5008-51-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5008-46-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/5008-49-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/5008-40-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/5008-39-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/6108-66-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/6108-308-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/6108-68-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/6108-74-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download