7e578331a338e131f32780633824ee90f61bd8321a87ba76c4bddedc6f016bf7

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 3.7MB
Sample260717-ns69mady41
SHA256 7e578331a338e131f32780633824ee90f61bd8321a87ba76c4bddedc6f016bf7
MD5 e69e9aa5f752b9c4a6a381411e3db7e2
SHA1 23abdc0c367db2830a80f956997a1e38d631b264
SHA512 03138db0906b391e50543cfe062da369e89cf3e7e03c413433c87909901c1e00cfc25cb23c1f1b96a30ae34303d6f35383cd5ef324635387eeca9636aac43bf2
SSDEEP 49152:J7JynhJ8EhdVMw7Y9odwfDFqfFFJVgrvqzbut1wOq/ejgXUeT+uXEkjNEEBHLu4l:4soEC9ia+uUkjDBHLuk+k
TLSH
T1C606AE0AA3E406ACE0F7D679DED6C553D776B80D07B0A68F029098A64F772609F39713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5044	elevation_service.exe
5480	elevation_service.exe
824	maintenanceservice.exe
5520	OSE.EXE
5348	PerceptionSimulationService.exe
5988	perfhost.exe
6128	ReFsDedupSvc.exe
992	SensorDataService.exe
5220	ssh-agent.exe
3684	AgentService.exe
3420	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\271d15d8e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f540c625e115dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d304366e115dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050f34a27e115dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027286725e115dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5044	elevation_service.exe
5044	elevation_service.exe
5044	elevation_service.exe
5044	elevation_service.exe
5044	elevation_service.exe
5044	elevation_service.exe
5044	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	3684	AgentService.exe
Token: 33	3420	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3420	SearchIndexer.exe
Token: SeBackupPrivilege	6128	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6128	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6128	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6128	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6128	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6128	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6128	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6128	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6128	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6128	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4208	2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5044	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 6132	3420	SearchIndexer.exe	100
PID 3420 wrote to memory of 5844	3420	SearchIndexer.exe	101
PID 3420 wrote to memory of 2020	3420	SearchIndexer.exe	102
PID 3420 wrote to memory of 3252	3420	SearchIndexer.exe	103
PID 3420 wrote to memory of 1396	3420	SearchIndexer.exe	105
PID 3420 wrote to memory of 6072	3420	SearchIndexer.exe	106
PID 3420 wrote to memory of 6032	3420	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_e69e9aa5f752b9c4a6a381411e3db7e2_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4208

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5044

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5480

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:824

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5520

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5348

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5988

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6128

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:992

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5220

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3684

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6132
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5844
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2020
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3252
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1396
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6072
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d64aea5fb0888b9e242010c59f0e0d07401b66047e86735eae081e31c8267204
MD5 a85f22d4a59bd527fa17f2b3a1a7bee2
SHA1 a805e8414557b226bc35b6a4a31594c0587159ae
SHA512 928df082af180bbfcc2eabbed38a706f9f161f631cf341630caf18b882a688bbc6b290234fb40d93e65ae80e42c2c449f040d34f875fb3d643a65a87a7f179f5
SSDEEP 49152:Bb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnZB+kn3Hnx:H3q6sjBY+k
TLSH
T117D59D03F29900E9E06ED178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 3263700671593f75f83c7861c085a735d7fab8b9f8a798369a4e8237a7f2fd95
MD5 bd2f43dba6f38bd8730254e67db3bacf
SHA1 86f3679d99b613358a4e815d8004ec1f75e33b5b
SHA512 bc4330a0655ac12271723414ea705326e7a45870e3eb679ee2631cf8bf827fd0ff64149fd98ca95fb8935163e11b7093520e14d4b1af16c31e643be6ae669f6f
SSDEEP 12288:r1XLsswWkxy2lRq2czA4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:RXYfDtczAnNyBo4kx929bL3Hnx
TLSH
T11265012967D409F9ED6B927CC8A28511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 3cc38ec7fdb83948d613ed3c340b939ad4a02f4218b40096805842f1bec9a944
MD5 f692143dcb97225ff76668bcf40f65c4
SHA1 fced9c68c9f4b2193d4b899b85b97900e255afa7
SHA512 28f53e520e3d2bf34cb7e39d87ee272e84e4922f6d1e7a01fc6e6efd8881f75032fe4e3dd50361db1ee46550b187398517c4dd48df6877b343c627e5f2c55852
SSDEEP 12288:zXZNYVLeyUji0h90ZD0wxpGZIVuArHsNLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:l0Le5ji0hmxfrMSNyBo4kx929bL3Hnx
TLSH
T167859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1b56a0816b4c64bbe21fb3fc0cc0bbd9721ba3ae018fcf312bcde8e43e851967
MD5 029929f1a85bb932a6ff6736df805bbc
SHA1 2dbe4b88d2837ae6ed30a9198eeb2b0dc760f68b
SHA512 2aac915fb47a9bfbe3a8c97b738f76733fa7daba1da5719bb066e8233fb38a1baee898b481195bc7d9102a2d1647df6614112e2b0d942d595f6728b5e863c6af
SSDEEP 24576:na7/ezSC6vUyD/aqgrvWn6q8wyucNyBo4kx929bL3Hnx:q/ezSC6vUzPveHjy+B+kn3Hnx
TLSH
T17E755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1bd2028cf7633123941de9bdaccb06e25c9decc6c568af67a46ab72923a2db4d
MD5 7247e2d7c283e1e22ef4c3925ef67d89
SHA1 5a0f4396f240ee1fef9cf2c074296c3a7de869bf
SHA512 ee770eae597c754f9e46cfff7defad7ac904382ecb18ad5c3935e09dba041547eca7689218e7161f6cc7b693ca04fe8d717e261663061967288262987605c044
SSDEEP 12288:JVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98kLDAptNyvUgXZ32dT4ePc7N29CD:JVbqPb88hv/l+Y7NyBo4kx929bL3Hnx
TLSH
T12F559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ff6225042f0bb07d44587ef5fdab2cbdc5f371993271c498832ffde7093ab35b
MD5 cc3eec26bff9f1820de188c0238500a8
SHA1 5d20794414317d3d0152c4ed79a36a19d540c7c4
SHA512 481ceb556d28ebdeb9c3dfddbe443586bc822921bc5e6bb1b7fb75dae3f9403556fa244e9fba4a95a00eba48abfca6ddc8cdc82f1297d0130807282baf9a0e27
SSDEEP 12288:tmpLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:tm2NyBo4kx929bL3Hnx
TLSH
T1194523124B1C627AFBBD3E70745E8454CC35BC8D0D95DB98DE62ACBB58BC9A2DA21103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 8ddf269b48481fd0e78a2ebea4934423a210a81d7413d250158955372eba1c3a
MD5 bba6b13966ee5279c0c372ee17d3d6aa
SHA1 4940b383721b79d72b1f90c48d26633514fe9d1b
SHA512 ee0a3eff0a344ee80a3c28a329a6cc81f35ddb7000317e8d00bbaddd1616d9339b5d62cc4e868d90058209ff217483dd42f69a0a3b7c3371f877507ca934175e
SSDEEP 12288:xeBNUbTVO86U8LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:xJIUjNyBo4kx929bL3Hnx
TLSH
T12A65CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 afc5dbdd3cdc9403cd8ec23c0f132c86ef4df3fa06ccb8e074a97dae29fac7d9
MD5 89562607f1c88a37876df534b430d445
SHA1 a36fc6e44646850b3afbddffbaad3b0c3d8036e0
SHA512 e9bed818302adc3e217d88c37888ac13894f1af6a3d379dfb74a7a6354a81b034b8d5adbaa8e1c8ad89743d4b55a5f9faba0611cecaf616caf07f65fd3f8ca97
SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THe:FQvGAdlCEL8c/DRNw5Cx+k
TLSH
T1E7266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 c77206e5d7d834af67b27588e06e142e3f9c207782898bf3857d2b14c57df2c9
MD5 df099426d0ffe36dee3981f7f889c81f
SHA1 d9d9827afa6cc754529eb980006ffdeab46aed7b
SHA512 e83e11cd9742072e40794ed4af48555d3ab105f5573554190c485dd7822751dd2c9fa14aabce6489dfe4a6f31c762157b564cc573de3c7b265a38f8862b52029
SSDEEP 12288:YAwSfxL/2Dc3XDLLmt0LDQewsAjOLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:9OewsAj9NyBo4kx929bL3Hnx
TLSH
T13C75E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 96d8bc410db5d940a389be33866e25710dbe3db096ac189be3f26e4afe74d255
MD5 e8dd0af7b66f75cc69336d87115ca964
SHA1 41868e2d24f58a7f2790c1d3b7c217ca3779a700
SHA512 d51f02439ab538402a12180836d25c1acfa3e7a21ed9f0bb8159ec33154ffdde5d0fbcfa35de61f7325f98f7fa5fe2fbf29839b9dd9d8750d39eab614f13d2cc
SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHq+k:zUEtQevvqc2W1cpV2tI32q
TLSH
T14F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 edcf85874f510b4497ab9cf22a998de187d3e8c802c9b97a4250310e2757fd64
MD5 4a22c751477626f004a65ab3addefe5e
SHA1 3bcde593d1610279152a66146c2a9a9faa27c42b
SHA512 8b512c284c244b1f1b392be19beef7bc55f415b6a32d1102c2b2e8a48ef81285b93a6d93daf1ba5bccb8a347a319497b6b77061d1197f071b92428ba45264533
SSDEEP 49152:5CbRquA/m2yL5zTfFiV+XenmE3/zaB+kn3Hnx:WoquVjnmN+k
TLSH
T1A3D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7e17eed74c917075174f6b4aaf5efa41fb6430495f8c9258b2eda7ce10132603
MD5 c21359ff54336c4404fcb9444065e501
SHA1 bb8716c651e0df6c00e9e98ffd93fda817424b5d
SHA512 515d6780deda5764c34e37c5224b4bf25d962fc6dabdb3a3fd61ac9e0b1b86e381348e1f23b9ab7ec99b8e4bee6c1e57d076e80996e8d5f1c79b31a073ab3c74
SSDEEP 24576:GAhGL3IFoiwtA5l7S53YNyBo4kx929bL3Hnx:GAMUFoiq5rB+kn3Hnx
TLSH
T1CE359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 9e8a88405782cb7e0fcb5b4e9347d9ff340647af979920756883b98c381c48b5
MD5 e2682858d14816998bbab7f63fdd1ac4
SHA1 f10b6d165e2cee64fa49cb84f397e131261075bb
SHA512 6d500e530e0d13da5b18ac4572c6e54959086eaa44ac7a4ac4bb48cdb3f06adc2df46c3a9346619b14c54520abe159c5ca19028b47215ff97d51c91b63fbeff7
SSDEEP 12288:gmw5HEjsChNzBFgl0WDm+CHLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:9wu6OWZNyBo4kx929bL3Hnx
TLSH
T1CA65010677A81CF9F9A756388547C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 1ac0e490385dd5c3de1baea034706490db4dd6a773768f08109ce5b4ab208db1
MD5 24f1920a2eec9d20661b1995b78b14d6
SHA1 9d87059627c81c6ef364b813dc72724b7b7fc36d
SHA512 2e0eb622acb08fc81ea5f76e5a60005ffa128ca4d3b3420b7516fd67296f47c65e3aad3d19eef1fefd659f4a8ab826fc4387197c28e3241317bf80bc8604e71c
SSDEEP 12288:/gZ1Iy+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:4ZuaNyBo4kx929bL3Hnx
TLSH
T1D6551216239831FAF2AB2678D8E58505CB327C461B7183CF5A2145BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d55aedec07ed9998ed4249a170beff3c13fadb6b1e494a059b6fd8db83494654
MD5 13a10c66228fee0862f8f9199eeca5c6
SHA1 2c76ca3c808e2432cac53a65129d72f1af3175b2
SHA512 fa9723c12d34ab92741730ec5654af3831f705afda0ced9046450499ac1d49e1149544f4bba7c90dab78e01ef7b12541e39745545f2715573878930055c0b95a
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ua:1QRQyi36YOcPbLvw2gAf+PN38+k
TLSH
T18B666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5830875b9d1b7734e877b4fda7d932e724b03ebae6ebacaab7164ebf9a03a2e6
MD5 8345cf58fce595018d5f5c68a2c11c2a
SHA1 4408f833aa37535c28907bdffab4e34ea7ba6227
SHA512 380c4133868d220e6de5142192cd001eeb2596b8e211d3c1beb2003137b7df0b11f51e58b09b8043d9b15acbe638640d177430b0695bc351b77473589829c9fe
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ua:bQRQyi36YOcPbLvw2gAf+PN38+k
TLSH
T194666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9740bb93d0a8682dfb5639f97e0924725cd2ef76170a314251f2a225ad2c094a
MD5 ca28b379af8768c608b499bd6631702e
SHA1 d458d1ec6864ac74c1da9f774cd97e0add254128
SHA512 91441ae5a1a05fb5f7df32489fb7a26ab4baf3a5418c948d51450d2a994ed8811df016d061ab039075e736dcf5cd6302b269b371e4fe89eae85ac1044c3f3cbc
SSDEEP 24576:WwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0KNyBo4kx929bL3R:A68Qg55nhceWu7PNU3/KB+kn3Hnx
TLSH
T1A2B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0b7a9cc826b4856fa527c267330953875da11ddf51dd8aa42d349932078b4612
MD5 757253bc6502971e064dddd1d7012a6c
SHA1 674cac08dd307a4ee26c6d981164ef7d8958c206
SHA512 0fb5feb48c701ebbc6ac88ce18dc3d203e4cc45037bbf6a57ac439e1cb8989dce59c36708e44c9769a4f5c1ab30374d91fe7e232dd5313397b49d1acc4a4e198
SSDEEP 49152:63aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99U:ry5112gYy5azzVvt69nLKnhZ7+k
TLSH
T17A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 341687f2d0bc18911560995df70a06002960f1e7e68d9bbf3ee540f0cc5b3f5b
MD5 8217b48a28970367a5499aee2a54f5f3
SHA1 bfebc8b5beb29ac4e22e6e267e6b36d92ea5716f
SHA512 0378e5186dbe4df704144dfce238959f957b431b487b23b5c6d5edad71c9e232c2d80eeca852f2acdc541176c25111ca94d8fb133163dcee3416643ce0dc5a5a
SSDEEP 49152:/B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glYB+kn3Hnx:Bu6Jmdxd2dE+k
TLSH
T17AD5AD13F1DA01E8D06ED578974A9233E962BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2fdffe4f825e9588befb048e1dc4801c0fab251fc2545ff011dc217ff6a0eb1b
MD5 c4ef47e3304d4c003ec9b13992bb6aa0
SHA1 7ac08dceca754281a6728180bda90793a483cb45
SHA512 6d6759f758031d93a700186eb536751f127d04e36738196ea3a4e153a7a420dda0de1646348198b9c1cd211fd1c7e53c25ddb75d94760c242e8b35334f07b76a
SSDEEP 49152:J1hpsNoJpF1A63U44CwH7R4xMB+kn3Hnx:JmifPWRN+k
TLSH
T17AB5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 24da6530a2dffa054a57d776c5ffadc4a07c8bdd69def2d1deb1e0891efd084e
MD5 c27d5c7a366f86191d56324a0ff2bdfe
SHA1 c63e6fce9c00ec14e4e052fdbf529b747be4bcda
SHA512 03a3c2ee5ffda680989c0630edad7eb8da9b51f7a532c84598b231a09cbc0d52f1afd645dc38ba5f0cd1aead461a4ea5bd69151d86aa55f5ac5f2b55d296f8f7
SSDEEP 49152:PSuZQIY0Be2KcRVtOnks6NMHqJB+kn3Hnx:15dKii61f+k
TLSH
T19FC5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1ba1aa01b92b49aad00c8d499e3e487ebe03bee81e332c52ccb0598eda9b45bc
MD5 ca39312af7600a600eeda67cb09c6b26
SHA1 d66796f9f1f16b8876d9eefd6c4abe2b21af9bdd
SHA512 461e3e6de45edc8c74bfbbb29195536fcb28413cb5d0f61e9122958a458b602466608fdacaf05bb53ac86f0c58b187830fbdf6a8539276bf3c41a520c5b7e75f
SSDEEP 49152:nhtSn8EApI0fig3giDn0AP5wIB+kn3Hnx:2X2imphp+k
TLSH
T1C395BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 90b57781e960335797adc5923e367fdfe16a72311396b0217f6f2f87c4a0392f
MD5 3a99ff78987ca9952e0517adf990b9e8
SHA1 3ab22e03022053fbbbdde87fdfade68c9f2cef6d
SHA512 0f0dacb9dfca61ebbf8f878fd13b8d68189845bcf8f9617064b49f5e635c10581bac4f394024ddbeae35deef6f0f2c20e24e3203864dfc30d432f71cf7f212a7
SSDEEP 12288:7hLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:7eNyBo4kx929bL3Hnx
TLSH
T1804523125A0C637AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c26a4abfc81a0c2478fba1f0eaa7df240be7b24eac6eb22a9085d6b18538894b
MD5 3f63115b93e8603cd5ff543a62553cc8
SHA1 ff01f56547ab38ae06e17af11809dddf4e115257
SHA512 a3b07eec2e3db55cff04a3c8b94daa61fdc31f86e18ede5db6ccc15376b69eaead958568753a5c87c837754e2f6b27cc05f4474e1b875edb45783e4a94fb53a2
SSDEEP 12288:SaLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:SxNyBo4kx929bL3Hnx
TLSH
T13C4523125A0C227AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 2be79cfbfd4502dd034aad003d95205ae41f0c3b29836cbd351ca542ceb1b4a0
MD5 f59adb372d8320c3a9ee976756bef64a
SHA1 51dbd23a141c17bd73351b9278f5768741747761
SHA512 9f1b3163cafd09b3620afa232c77bf5fddb9280fdca5d85981547f8f4087727d734c338b148b9470dc69721e664a3c421eb4034c8fd9f7f4db3562b0167bec3e
SSDEEP 12288:u0LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:urNyBo4kx929bL3Hnx
TLSH
T1DC4523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 92c1d389f4cdf45b24e4b196bbdc4894c7565e43158fa286b3c3d92c911c3eb1
MD5 7f2684f2b8b2d7890072b01852d8dc8c
SHA1 32e615f61a5838f2674fc4ad52f7fd9653c80705
SHA512 527362841f8348910d81e9996e62ade0a22abc4438e44d0e08a37862d7ef8575be84c91cb0962c5f7230faaed914c595039f210ce5d0bdc9f4fc42c755ccdcac
SSDEEP 12288:cVbLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:HNyBo4kx929bL3Hnx
TLSH
T1384523021B5C12FAF97E7BB0985A8054C835BC8A5B7197DFDF1248BB0DB9BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 703bf33222f4bc068346d18e23ec64839f64de5d13ed386b2d3ed722e4d73d4e
MD5 2213a9716b8db8cc6edf740867423ead
SHA1 1af0a798a751207e4aa7698c4bb39dd74e61d8a2
SHA512 4ac66480ba10b9b03b2f8e09f852e1b578695b3d778ff57877e3b1e4e93a4e400829e03ec4fa629ee53eb360098ffedb14104ff66e204634cf9078580d935f22
SSDEEP 12288:hDLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:hQNyBo4kx929bL3Hnx
TLSH
T12F4523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 62923a5109c12f47e650f08d9111a05becb2b29799cf56233ce4aeab1169d5d5
MD5 9f811e48ae6a343eff311be0e207cf6d
SHA1 267589ebeffc854ed0ef2f5e1c38987c5d57d9ca
SHA512 92d60cf3fea71fe8f3ef9f1cdbcb201d2df4a7cb91f276676c5fa50283945597c15d44de1df51677571532e4355f7ba5ea03d40caebc72d6ca80443eedb5be56
SSDEEP 12288:cGLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:cFNyBo4kx929bL3Hnx
TLSH
T1A44523125A0C627AF76D3FB0644A8098CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 fc8fac7f3cc295a2bd1294d01e6ac52503b4599fd063278683ed4f9f12142444
MD5 234c776299288b1a4dc7e4b258d101a9
SHA1 627ba67aecb62c8aa903c6b0ec67c038d6c6718c
SHA512 ba4bc5daad2e4aed76b85fd63399419260576c88797a15dedab3a7c9a1b9b95f592be029a37dd30497c44f546f1cbdc67b7e02f0d8d633be779bbbf0cff7c28e
SSDEEP 12288:xCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:xJNyBo4kx929bL3Hnx
TLSH
T1A34523129A0C237AF76D3FB065498498CC34BC8F1E9597D8EF27987759FCEA25A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 bbba7ea97c8d53be8672707542d487d485f0c3f03496c52547172e176960861f
MD5 b3aaba96d8312982bb67cc25011a15a2
SHA1 ec71c4110b4ae4baa6c378e0f618ed0812bca7f8
SHA512 26ee41a36c8f1ea28bf3188ab0d08413438a615bb235d9082743d0314b0558fcff0bc885befc55f34172b9f74deeeaec754cdee74f1fd9a216e60c3a9d99b29a
SSDEEP 12288:GiZwbjzzFEoS2cPvy6LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:JZMXzFVSORNyBo4kx929bL3Hnx
TLSH
T1DF650195B39418F8EC67823DC8158906C6B2BC4A0BB0C65F07A4367B5F773A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 1bf21a0c83c4bb02563280cbabb27ec616a97f5e83cec75433496bf775638d39
MD5 1783ecc7d342c8c98824b89b00c55cc3
SHA1 d3c5768dbdcd6c77691f5f5dd374e8b4121d1078
SHA512 047202720d665e451f8819bde055e884a288543b2dbf1acf8b638701a65a71fd038babb9936fd619f4fe9590450e0abed20dcce752479f84c96f52bab5f8f8be
SSDEEP 12288:O1LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:OqNyBo4kx929bL3Hnx
TLSH
T1B74523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ece564df141159f0f3db8f40d1664dffa93b14a81baf8cec0fb5fc7a07396998
MD5 eb4e814d8a11b87e5ed6388556b93529
SHA1 6fda57b2be9af2270c6548037237f249da89844b
SHA512 c613dfb4e1ec37ec2776797255f9ba7f6a226fdb936e2f6aba5278c5188e35f10c7e05e2552817f644b9d9c20a8219a2e6050a5b48b483011cfe601c536da522
SSDEEP 12288:OZLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:OGNyBo4kx929bL3Hnx
TLSH
T16A4523125A0C627AF76D3FB0654A8598CC34BC8F1E9593D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 d8e051e581ea068861d876748ce9fd55f3c1fdab262155c02ee141d3ec7ca020
MD5 33f9274a568a9ebcd9c13a434123b217
SHA1 a04575798c6275b986fa7ceed708252b7cc5618c
SHA512 3f3da00e8ca0f767580dc973edcdcc78b4fab980549f962c531b2ab72f1a3beeb7d97b5d50a3712401cac86212ae593e67d076a3c40f8fd53cfec916c2c7fd57
SSDEEP 12288:9yPz5L8+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:0zyNNyBo4kx929bL3Hnx
TLSH
T1CD55120773A831F9E17A6234C8960A05E731BC360B608BEF576046772F776E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a92b58d0f530564b9b28951ab7df1909d5d1b7d026130a90ad754a961e39110a
MD5 f4b54dee41c354a4c5e62070dc565b5a
SHA1 8e02fd2bb65f7ce8c4edd3e4d2b24aec8ed347a4
SHA512 384689223c8eecad1f82da6d0eabd28c2f685ff9d894eee9866825a16baf1a01f609b760e344596dcfc2c06c0e39f9ed8cae2e655808f3e457b1c2503d541e2d
SSDEEP 12288:t1LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:tqNyBo4kx929bL3Hnx
TLSH
T1E94523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 028bd90f0e57998f8da982e26ea5aa47468c5763e6203d2b64dc1a6c3c930ae0
MD5 401c99249eb75c0a15cfdbe8da6be81d
SHA1 4e0a2d526e0bad04fa845de6fe06b207ccc1bf57
SHA512 d3f1bfd368dffe887f7e59d41a7b77fdc4a501e4bf7a460a9858cdc2eaa7ef768bb1b38f2aa3e8174a0aaca7926fdff6fc4ca8f157ec5576675d20e970694d37
SSDEEP 12288:m1LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:mqNyBo4kx929bL3Hnx
TLSH
T1134523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 3b94f7a209b54f3f3a1b526550c31b39ef12ab31dc6312d0ac3b82891f464dfe
MD5 ee67999dd7dcd88ebb9e0e209080471d
SHA1 f29052efeb8dee3a5ef903f5ca8e94ede18e4aec
SHA512 01f71c1d277a36ccbd88984f834108643a5e8dd66602a1d404f89a4217adbdf0d8065a237f854d575f665790b4789efa13669cad86b446d444999dcdd7226ecb
SSDEEP 12288:kyPz5L8+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:9zyNNyBo4kx929bL3Hnx
TLSH
T13355120777A831F9E17A6234C8960A05E731BC360B608BEF576046772F776E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 e79febea93ead1af1a4f3852e5d63d9b6aa02ba960e6c4ddd4afa4828d00a2cc
MD5 3e9ea5656f58627d7cb946f8fd870383
SHA1 18a4c6a3659474a11ebb12a53745b38d714bc440
SHA512 50325ce58477bf7b2580e61936452d71a67605283c3d6ef8b4949e00100865d59fce33965522f467963d1da228820e35238293bb77ab6e170ce24ac56b2bbcd2
SSDEEP 12288:sCd98WYoaLHF3z0z04PDvhELDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:1TtaLl3z0zDbNyBo4kx929bL3Hnx
TLSH
T1AE6501A5B35018F8EC6B863DC8168906C5B2BC5A0B70C65F07A4367B5F373A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 78c6c703f846f7fff46ede5ae6142d220ff5fcb648fdc48df644cc9ebe94b38b
MD5 a546b23dcee55197757f0f5cf7354b4c
SHA1 a0b0947159ec1ed0c10132ee7a6f61c5964c288a
SHA512 5f8cd4d7196932792f9ad93c6827841a2bbc312e1f0461945d991d4001d629753aec6ad1f7107536ffed2f4d5445a850838c68885f774699c1b61392f7894f03
SSDEEP 12288:ii4e7ARdTfgwCHKy7GLbbdIvvLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:i3ld9CHKy7GZvNyBo4kx929bL3Hnx
TLSH
T17A75CF90F3E810E8F1B79A3489764511CA767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 fc1a62e3acc4571943b30a190e2e3a7f73877cd33d8e5b817985d9e9f90d0424
MD5 b76b83c4828cd90615c45d7a49a89b38
SHA1 9b818a15bec0f4cbc48666c51cb38f0a7ea67d50
SHA512 bb5a8a8093094bc3c3ceafa215dc61f0697a057514d740b7f6a552db53cea7e93c2943a0dbe3ae49da42268cb84f246ddfd0a297bd97f96b6e4afaf136ca9688
SSDEEP 12288:aULDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:aLNyBo4kx929bL3Hnx
TLSH
T10F4523125A0C627AF76C3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 647ee35773e868f6b19166329b3dd9e08af27d93b9d8a34c996077bf6cb60f4a
MD5 7232acb375763edd3e9c2d2f2cd7f1d6
SHA1 07b10173666e3eb8e355a644df0a7dcec7ec3c4d
SHA512 77892775bd25cc53675e7a1657d62fe1c55dd6bc02d7dc2f0ecc3df78d0a4f6f5e0db32c74493979ecd5e4fb36d2f9301bbfa1167591185420fd9fd150da00d4
SSDEEP 12288:9eLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:9tNyBo4kx929bL3Hnx
TLSH
T1894523125A1C227AF66D3FB0644A8594CC34BC8F1EA597D8EF27987759FCEA34B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 28e99924e09af5ad424614304e0cf4be8764c029224c7b643c5f098396585439
MD5 69178b9674df8c020f8240dffa6a5c1f
SHA1 7d85776449e8ad740e5f75efdc07192369641adf
SHA512 921e0a14937cf01dfec4181f79e7e74af85019e48ce555bdd2b0569b5596158b017371ee5d6c3d3ee93c0febc29ec9184b2ec1fd8c049a1668f59e5165109bd3
SSDEEP 12288:UvLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:UUNyBo4kx929bL3Hnx
TLSH
T13D4523125A0C227AF76C3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 8b151276e695bbfc757db6ca889fa90dbec9c9e3706c4229f832f28f2d64187d
MD5 4bdf979e9aea40577da303c51168bc4d
SHA1 b5321333aaebdbb912e140ef80fa50c3193ce514
SHA512 2e463ce9750f2d5ded09432bc6bf47201156bbff9f4f72d64f8ec3598d2f6cd39804cc5a5435478375ea129e8bea182380b42db0707753e1d0b94164740867f8
SSDEEP 12288:j1LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:jqNyBo4kx929bL3Hnx
TLSH
T11F4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 272a013eb93742a9c3442955ea5bd8eef2dc24116deff2bf869cb9751dfccde7
MD5 9a8a80e646c2faad52e9744456804e0b
SHA1 5fe2298791299f5198cf83f2c8d5a772e232713c
SHA512 3228536729eb82cfba6dd1625603c5a6bf506f566cfb59f40f009c56b07e950dd4d9b6acc7eb168a0273ca560a52d8e5dba7bad2aa6799bd01418d400b1fa84b
SSDEEP 12288:tULDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:tLNyBo4kx929bL3Hnx
TLSH
T13D4523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 dc6185e9e5ff1010929c2943b3bce4ef42b3b1d09d1e0620706860f1e12c15f9
MD5 d11764f5ace40a8629eeb03aa27cb76b
SHA1 feff2b7e2579180fa5f34370e287764c18d876d1
SHA512 c91ed3d376b93460f8665d25849bc50d6d1e6ea768de2173560a4419af078cb4abd4c1bbd38775795d5a686d769c7aed222b57c4bc657c8bf5e40fac329d3618
SSDEEP 12288:WdLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:WCNyBo4kx929bL3Hnx
TLSH
T1834523125A0C237AF76D3FB0654A8554CC34BC8F1E9697D8EF27987B59BCEA34A10107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 529b0c0ec4937d5c2d4bc9eb15188f87b8e1881f4a7d411975890c1d824114d9
MD5 3cc344996661a8bbd885d986a1f620ad
SHA1 7b1c3c550f99732f68e561fa5ec3a17934e6706b
SHA512 53a257cb1f1b91bd6e247ba1b88c7257fb42334bccdd2ba5509c9e3fbd8b9483a975e92d4ce90dc452f0afbd7c9fffc316f08e769a600def24d473d190621a73
SSDEEP 12288:bDLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:bQNyBo4kx929bL3Hnx
TLSH
T1F64523125A0C627AF76C3FB0644A8198CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 1d85f6cb6f5f6205c300c23791850cb358153615d9f0c38c7738272cce0ce04a
MD5 f2dca093f63dc13a10f5d23867f4c7df
SHA1 57af5d7bfd9d7e5b8c4b670beaa1380fa0ec82fc
SHA512 e9bf508e67584bbd3ea3114362c7f33c77eedcb8b188c24647720c4d4f6fdb1dd9a22c5d9e6953bfa9545e9b4ad9526a06a64dd5be458f4a7f70596c147ca664
SSDEEP 24576:Ffwvqk9RX6wkyAIWNyBo4kx929bL3Hnx:pMnYIdB+kn3Hnx
TLSH
T1C885DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53BE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3235d2b02ac6d858b12c7074e7248e6fa28d68b30e603d62f6b302839c68b3f5
MD5 1c6bdcb68915d0d11282481dc440e7f3
SHA1 008398b1fd2da5a908049cab8a16daf9d8bc96fe
SHA512 5d410ed20afc14ac313617384adcfa107b033a31c6f36e267b969167146dbcc4896489c80dbd007be75b881e07fe1fc043c6f53683badf8b4db7f4f218803ac5
SSDEEP 49152:YYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0oB+kn3Hnx:PySzPc+k
TLSH
T179066C56A1A801D9C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 db09284c42ca2eecadc780d142baa65dcf4871fb1c5047d5c344a93f77a312d4
MD5 e362bee2cbd3496bca40e3ffdbb6c924
SHA1 edbf56c97cf261c8df055dfa30acca767bc223df
SHA512 0142265ccb117f90f13b9700ddea329146086eebff2e967557011141dcc248dd30a1a5d35afe1097a2fff07c590e204fca929f2d29e6ce1cc3fa4393e491ebe8
SSDEEP 24576:X47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYhNyBo4kx929bL3Hnx:X47JUQjTirIhCnDHUPfF/YB+kn3Hnx
TLSH
T1CC65AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 bf5838ab4f6e286b529212be88c018210dd772749927518d1d2156a29546cbc9
MD5 6698d1e42d827186981b67eee4494062
SHA1 45a73f45371591afda0b028fc5bcf7c4e79aa39e
SHA512 5230835441aa06d3fbe8b1078dbd4d1802b13fd187bb844d2798c755600b02d9841d7dcf602a7a7bd4570c4d1347fa1f2b01d1b4630b8d81d4b31ce2dd5e5f19
SSDEEP 12288:SpsfFLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:raNyBo4kx929bL3Hnx
TLSH
T15255F00AD25812E8D16E2274CB468A40F7337C5947E1D3CB97D0F87E1F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 623248ab30f01b59be40f8dadaa1f26113f60974f01a5823350a9609def0340b
MD5 13fb415be2eca2e2afe433d65e25a6ff
SHA1 88ad256cf7a46773edf43e41d8c4745003666b5c
SHA512 553e96b4eb992d15fc245f51a1211937d94d908a49999779992e7d4ddba4ca2b35f6e1d659fb50b9535d1098d82dc7adc0cdba33cb8f5dd570e07fca5ea079b1
SSDEEP 12288:yYj1u+1U3fyPpVUkljcABQD1HFDtdKgDY8dQQa:yYjkSUP/k5BQD1HVtdxk8OQa
TLSH
T1AF352850766AC75FC6A940321E32C2CCA7707D41FE05AB0372C8973FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 271d6bd14d038f703fad107d7175b4223d41016ca5197a133eed9c0843fe554f
MD5 5f57fd78c53a6810aa6fdd472e3e3a12
SHA1 d91114cf941f64ddc7afb4624091c20ee3d4e50f
SHA512 58c753fa9f5fdb9e7f5b016db6eb0aa5fe903a25135225b35ccffc3f9b6d2147d1487dce5c1ff864fc577be020c28288035a955fcc14757595672c0db057caf7
SSDEEP 6144:Ts9D+thn9pcIbyve26tMxW26tMxGrZllYwCsp2F+xiV6NIV:gCyvm9fps+wRV
TLSH
T1F765E8815537E2CFD1F66032072A9B4DB764EC07B7056F26B3C8453AD82AB25A0BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 84c010c026fea6b66fc7f8186c426013039b8e5e4437d7732b8e2549b3344501
MD5 a2a5bab9eb15b1341ae0405445d1634b
SHA1 b5fa3941e5ab71b8b6d897906fb1ec1d56d38af3
SHA512 1ccf8673ab574a15aa2bdf19a29a2dd3b39d1a6b911740408942ca18c9294bc1827700e5bafde33e2ebaa791508132f03615a60e3508aedc276c1e3805619a1d
SSDEEP 12288:Wy7tLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:VyNyBo4kx929bL3Hnx
TLSH
T100452312975C623AFA7D3FB0645E8124C839BC4D0F50D6DBEE1658BA59BCED28E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c46bb74021d4f81df1ef7ba4dcbfa51596e979bc2d5d058fa3a81d9dd19dc2c7
MD5 603a093c61007dad54441ce49f961a60
SHA1 1d28af1547d541691d6ebec79755141e581ee616
SHA512 1f050ef348112f976fcb412dcb9c4343482186be658bd0d3e41702ccf76dd1c8f817223a002bdcd0fe577c712ffdf4c4100d58d986fe86b40df0761779588dea
SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bYcNyBo4kx929bL3Hnx:Lgb4mBIBhGF2B+kn3Hnx
TLSH
T16365AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 0f300c1b5e0e8aef45e9fc81760c5fe63f71e8fc7cde94f2d143923bbf4e1a0b
MD5 3a13eb3d60189d4aa01892c96297e883
SHA1 ca446976b6d9d2f9ec6c40b005d8ec7295dbf815
SHA512 1bd8eed7821540e29b2bc81679a1e8c650f5e0fa336f673ef05b7e6587989e9e33d3edff58dc02bedebe3ffd434300e15efca3f7fac3cecd71641065035447b5
SSDEEP 24576:HG88u8FpJqH1Jzria7/mRNyBo4kx929bL3Hnx:m7ZFPqVAa7/PB+kn3Hnx
TLSH
T10F85F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 aa009ce70cd941f7b78aec1b952238ac1f0fc88710b677a17cc7d81dee491fbd
MD5 05e6fa5cf4d826b5fd85e3787b922208
SHA1 ae38da9e64c53a3580381523af0cd1e2fee94afd
SHA512 6ff7ad95557054695293fc5b2c1ff15cad115db683b1cc77d7759f7dc3351f7b8a0b68d2f0b600fc9161b5afc248100c45b6976a227022fb8b0483400f53bff8
SSDEEP 49152:HBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjSB+kn3Hnx:4G05lO43bT+k
TLSH
T105D5CF6A62EC11F9D0BBD17CD9C6460BEBB23815033556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 56687e3b72475bdadc78f9cecb59287188d166922eec3b4c4547bc2327835b01
MD5 0e5222f1d7e3e2c8f214661dcd4c1719
SHA1 91be6be2b3df075cde221256e0198447e86374ed
SHA512 a5b22e999249ae9996a6a3382ea79c3fadc44fe1278e1a96bb6a5adc35b4f5bae28515428e16dea17aa553c044ef64b3643ed498ae83163c45665716f477eb14
SSDEEP 24576:Wfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnHNyBo4kx929bL3Hnx:Oa5POZ3BJt2pasx2+mKB+kn3Hnx
TLSH
T1CD65AF5EA6FC01D5E5B9D17CC583861AE5B1342653319BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8d45fff724bf79a1cb0180f678fa507f5875453c314b4e083dfd03452748a883
MD5 c8398f1e5ea2fa9d9e29aa2bbb572395
SHA1 5ef4d15ae94fe36cfc3db4e9c099c581e5cc09d4
SHA512 3c92ce2abe24b6b7764786b6e99c40c9d11fe62298a6a4c18ee97e786fc61bff51fa49045c8cec411b7b1af4886fe769609e135636dcb93a102c573b0d6b5d7d
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7Fk5NyBo4kx929bL3Hnx:HNc/zEOVHFvB+kn3Hnx
TLSH
T112858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6f135ef97bad2678e2b1fe554211fbc00150036d4ff0ba0bc5dfee7d4586c3e4
MD5 22d45ce8ab42f3b831b57c674957ee03
SHA1 377880de1ee6f5bdfde47c81c363dee8ceaa6d4a
SHA512 bd82604661e026b39c2ba3c68bb47185660137875b13d66a7212593e1d5212ca7d8281c0e8b418333bf168c6fc4061e2aa716803dbcbe2d85ee4c8df32b64440
SSDEEP 24576:XTkNvNnaFeYhJNtmZBmzNyBo4kx929bL3Hnx:XTMwBtOmcB+kn3Hnx
TLSH
T16155AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 d8d612bccb3192e07bdfd480b230a893aec8d5a4f97ab89433a311aa3f389994
MD5 6cf69380824412cbfa0987f01fc6ea72
SHA1 4af24c4dff11c01da8cf74c9fb8156ade09aa5ea
SHA512 4d5276af9f8476a3a79a82226a58b92ce18dd4c05f047aa4ec2c254aa101a580341a4d347bf160f5da94dc862efc0fc8453ce9a3f9d215c75fbb0639fc713f72
SSDEEP 12288:XHvUrBFrEjwaQ2LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:XPUr+NQVNyBo4kx929bL3Hnx
TLSH
T1EC65F21F22AC18E5F67AB17C85868609E771B8560711D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 665c0bf69f055613b7f74bc5c3874dfae6f22f8e4e5b09dd80c013e38438672e
MD5 f22f4d6d500bee4850e613528d8943e4
SHA1 c75eb065590d2923e35f1d07e02539329cc09536
SHA512 c105ec5c61f511e2a010810d7d723cf87cdb390900094c804929e93aa27970594e53896719db1b5ad4ff1a94086632ae03c528691ee596403416622cf262c21c
SSDEEP 12288:5QcMxWDXN1Dp/fshBItT1IQgABLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:FD3FHshBIYQgA+NyBo4kx929bL3Hnx
TLSH
T1D575E13EE75C00E4E57BD1BCDA538906E67138AD072266DB0694C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/824-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/824-41-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/824-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/824-40-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/824-53-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/992-101-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/992-95-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/992-306-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/992-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/992-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/992-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3252-321-0x00000201ED0F0000-0x00000201ED221000-memory.dmp

Download

memory/3420-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3420-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3420-138-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3420-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3684-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3684-126-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3684-132-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3684-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3684-120-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4208-9-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/4208-7-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/4208-81-0x0000000140000000-0x0000000140410000-memory.dmp

Download

memory/4208-1-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/4208-0-0x0000000140000000-0x0000000140410000-memory.dmp

Download

memory/5044-16-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5044-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5044-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5044-22-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5044-23-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5220-115-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5220-309-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/5220-107-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/5348-302-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5348-74-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/5348-68-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/5348-66-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5480-136-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5480-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5480-29-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5480-37-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5480-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5520-56-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5520-62-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5520-55-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/5520-287-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/5988-78-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/5988-303-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/6128-89-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6128-83-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6128-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6128-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6128-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6128-322-0x00000000007B0000-0x0000000000810000-memory.dmp

Download