b2b279d32a7909d5e7c0e29f767b5bccb34541b76a3e4548a17b4e0c9bab8f4e

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 3.7MB
Sample260718-va2praf13q
SHA256 b2b279d32a7909d5e7c0e29f767b5bccb34541b76a3e4548a17b4e0c9bab8f4e
MD5 6eb78172178a40a9c122c72c2bd01c13
SHA1 be0145641d829bb37bc35753c6196e19e417d772
SHA512 b8825eba52352522e12a3be27eed5ed39aee8f48e19455db97cbdd2511e6573f5b96605186849f92cf42a1645bdfa3bf16de46b2bac0838db01cb2936f866bae
SSDEEP 49152:37JynhJ8EhdVMw7Y9odwfDFqfFFJVgrvqzbut1wOq/eVgXUeT+uXEkjNEEBHLumw:WsoEC9Aa+uUkjDBHLu7sRwsla
TLSH
T13B06AE0AA7E406ACE0F7C679CED6C553D776B80D07B1A68F029098A64F772609F39713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3304	elevation_service.exe
4532	elevation_service.exe
748	maintenanceservice.exe
2240	OSE.EXE
5772	PerceptionSimulationService.exe
5904	perfhost.exe
3132	ReFsDedupSvc.exe
4072	SensorDataService.exe
5916	ssh-agent.exe
1748	AgentService.exe
1140	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\75df77fd8f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e692503ed516dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c00e4c3ed516dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e900cd3ed516dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a1c0f3fd516dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d71b73fd516dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006fa2d33ed516dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3304	elevation_service.exe
3304	elevation_service.exe
3304	elevation_service.exe
3304	elevation_service.exe
3304	elevation_service.exe
3304	elevation_service.exe
3304	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	3132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3132	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1748	AgentService.exe
Token: 33	1140	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeDebugPrivilege	3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	3432	2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	3304	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 1308	1140	SearchIndexer.exe	100
PID 1140 wrote to memory of 2876	1140	SearchIndexer.exe	101
PID 1140 wrote to memory of 5744	1140	SearchIndexer.exe	102
PID 1140 wrote to memory of 4704	1140	SearchIndexer.exe	103
PID 1140 wrote to memory of 4132	1140	SearchIndexer.exe	105
PID 1140 wrote to memory of 2952	1140	SearchIndexer.exe	106
PID 1140 wrote to memory of 2724	1140	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_6eb78172178a40a9c122c72c2bd01c13_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4532

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:748

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2240

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5772

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5904

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3132

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4072

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5916

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1748

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1308
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2876
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5744
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4704
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4132
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2952
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 293b066d1b0c0cccd1d4248e66d7156b01523a96073a4d8b4951ade9f395a3f7
MD5 a16010f3451d5051a05ccc5c6b99a36b
SHA1 6b337b092aedf41bda0ea6fa00d59fa0bc8e23b8
SHA512 5cbe38d090ec988343b250cf20302ff98a50d448aa46ef5cc49ebe5351aab8d59b3a3833448ee459ec020f1ecdced947c78617c6fcfa7b58d21648620e49cddc
SSDEEP 49152:Jb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnXwxsRNWgBlhk:f3q6HjBNsRwsla
TLSH
T1ACD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 8141a75e443253ac5402b96bb2722ad1e342756eaacbeeeb6cc7538e9dafa5f4
MD5 e44f469dcb25512bdc68d04912dd348a
SHA1 b526c096dc95a340fe0ad54565976bcff99d9c99
SHA512 78785cb1ae59da220b5237eb4d90aa1959a63f31d1f05a6634f72f698f4bb80541c5ab042ef5a43413d4be3b0a2031a5c96f70bf08d82ff3c65961f8d926b401
SSDEEP 24576:8XYfDtczAduDI1xyowzRNpgEQGTRPrlhk:7tctwxsRNWgBlhk
TLSH
T17E05F12967D505F9EC67823CC8A28112E673BC5547A0E78B03F0A9261F377D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 cee283c30cbf44fb45184f1381aa9620be61fb4a944524ce2302a78b88c40e59
MD5 8d73f0d710c6f5a5de8ce58260117676
SHA1 ca40d2a5445e247e32b0d46d96046f83eadb66ae
SHA512 92b03108182339284332a43159e4d34301df56de96b66a7b45138df4a3cfa5c63d38da3dd93427bbcdb5b5dbe01ff8d06d9ac2450bf5df1e1ffc4dfe189d63cf
SSDEEP 24576:P0Le5ji0hmxirMcuDI1xyowzRNpgEQGTRPrlhk:PPji0AciwxsRNWgBlhk
TLSH
T11335AE16F6748331D073C0B9C5D2A68AE97134865B308ACB4286D77C7E67BE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e2b290343f24a001946ec81eb864023cbe51b10059a02f57a27a88a78cad399f
MD5 962ad59ef5ea1f715a32e7146945df72
SHA1 726a8215a849c5c6255c2034a11a179ac6e6cd33
SHA512 e13def92b06fda16f8352a4d8a20bab710641d176798e5a9b86e89a057d8067b4e1cc53643fa78f08f5abc9cb3e89b01d11729c1277cad30ca01853ed440aa46
SSDEEP 24576:ka7/ezSC6vUyD/aqgrvWE6q8wyuWuDI1xyowzRNpgEQGTRPrlhk:T/ezSC6vUzPvxHjyWwxsRNWgBlhk
TLSH
T19C755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 633a4f51ed4c2a7cfa239b44eaf12fe22807f7b1776c3572ca3ab88633ee3a71
MD5 0bf0ea36ec9dccf0924f49c548f51107
SHA1 97211f449d5b364f3715de2931102aef0c40f250
SHA512 ca973a939d639a611e708bc25a32519c26ace3f7fde0a85badc018f67e9966a2e938112d144ecefef22d6e5476d2112b9806a7c69bf8066aa8b14d29ae51a578
SSDEEP 24576:dVbqPb88hv/l+6ZuDI1xyowzRNpgEQGTRPrlhk:dVO88hXl+TwxsRNWgBlhk
TLSH
T170559E66F5748331D073C0BAC4D2A69AEE3234425B318ACB1246D76C2E77BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 af2da2a63ce04ceb1c211df733a93fef5b60496d2bda26b25de54924e93b2e01
MD5 94672e17024550b10261bd2d320e7309
SHA1 b4b42fd0c512fc8f2a34abdb73fe672fc4796ffd
SHA512 1b9b3cc9c2c3b9749ab5ba3c4e13a850395b89589973aa8c6529ec324fc743792f7d80a7fe75bd81a07dfb557d1b69f8779301dc7f68267beda869d53d1d8ba6
SSDEEP 12288:BRo6j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhIr:BRouDI1xyowzRNpgEQGTRPrlhk
TLSH
T1D7C4234E0B4663F5FDB3423405BD40D2847A9D29AA92E10B74B2BE47A0BCDE0D57B78D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 07d7d7975b769ad43d9856132bcaa5d5381b8faa8ffb3b9c914d0a39bcb8585d
MD5 38b8cd89aa949e2d6ca5d161e8607fa6
SHA1 54d0ba4eab7fa957178acf4af35fe39ab7aeedef
SHA512 11da21c1a243344d17cd73523f2cf749a573891c36dabb0981c7be7d83786700ccda7df2e5ea622ef3dd32c75c21bd802335ac1346a39c01f98fa6baf0e55119
SSDEEP 12288:8eBNUbTVO86Uh6j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhk:8JIUhuDI1xyowzRNpgEQGTRPrlhk
TLSH
T18205C03BAE28FCE2C67A4D7856918240D77278304F52A3CBE175920EDE375E05E7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 337e3bda2e11da02391a989602454e2bef98eb3de263c049c02983ef31dfd15c
MD5 6f328a7352bb15a6d6e0ff87b463b1de
SHA1 a70fcb98cd70aada21c61ca82207f06e395121e5
SHA512 16e0a65e42ca78a00c995beeab54b1e2049e8198349788e99506b67045bfe4c02cee0cf44c4b471be200888cfc2d3347f72a870338615139358109b53394527f
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH3:ZQvGAdlCEL8c/yRNw5C0sRwsla
TLSH
T16C266C656BF880F5E0B7E138897A85B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 104f916afb6a3e0d99faefe514113ded324eff7ada6e82a21cdd56def65838b4
MD5 4a3fd54956704659ffc931fbe36d5462
SHA1 f8471b618417743e9e30313cf63c13aa94e544c4
SHA512 aa8c8d357551a020a7f70dfb1aec2b8bed38b22604dfe64180a34dd761bdcf2f831d8d95e363b8ac75e8d7aa54afc2e630b48ac563a8f59017a55eb291616c32
SSDEEP 12288:dAwSfxL/2Dc34DLLmt0LDQewsAjr6j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE3:OdewsAjruDI1xyowzRNpgEQGTRPrlhk
TLSH
T19215E031FE74E036D6BB0DB21B36C316143DAD204B5219C3E3E89E8E59746D26376A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 92615ccb82f45a52bd6d0ad38ca5ffbfd23ecfc0f163e3dde5a77ecce4e86b35
MD5 3cc9054fbad8519b73ae5aa77d4c24fb
SHA1 bcbd0130bd9b8bbaaf928a605cb596e9ac90b5fd
SHA512 599ed537359b02aa22e650e5edebc5fe251f5c505dc48d08a5103e087aed80646a04b2aff3e385e46a0c815a22cb13a0666844d6852dea778c08fa2c363ec8e2
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHvV:vUEtQevvqc2W1cpV2EI32v
TLSH
T1F0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4c6769cfefbc4fd1793f1c3e3d5c084518d26dcec95df5b2f81819fb2cbb465a
MD5 0a0662a08589ce0087e8bd933c5ba461
SHA1 36574ed5448371c0aed3e5fa2d10b035827138a9
SHA512 38de93ab4ac77aed21ae6890c82710b63df255b68ab369c24c5bfd952570e9114437f11f5a595388b3fe160b54c3320de31a9fe1204a641ae713a122ef5e278b
SSDEEP 49152:xCbRquA/m2yL5zQfFiV+XenmE3/zSwxsRNWgBlhk:+oqtVjnmIsRwsla
TLSH
T143D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a63d6d6ab51c2be12e4c54bb36796675cd1b808312338f6cbb781e3398dddaf5
MD5 1db52b432a3daf4c4c7934e95f89e350
SHA1 b411360d47d357fd3b2038ffc5ab914712e4ad8a
SHA512 f73e2bc28955081746990830328887263c2540c6a09121726e9d1672560f6c480ee85fba8310e035470160077d4c02dbbf2b42155541f96987543f96e45d81b9
SSDEEP 24576:BAhGLJIFoiwtA5l7S53auDI1xyowzRNpgEQGTRPrlhk:BAMyFoiq5RwxsRNWgBlhk
TLSH
T16A359D81E7F951D4F5B3AA7899B68171EA76BCAA5E31C20F2160D10F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 c6e992a9da1f26707d609b69fa44e690207d0c2e8115e962e920a8ad198c8d23
MD5 0afcc17692bfd16ca907e04f5203bdbf
SHA1 ff7f9934428b4f8034ab182d82e2a26e85c5f883
SHA512 fd4a4f63c41a935b440d4081913cd21698849c5672d50afe256e62845dd18c8d7ca20b65084531dc1074bd0754009c2c727697ac9b48c86903a48720b37f954e
SSDEEP 12288:5mw5HEjsChNVBFgl0WDm+C26j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDu:UwuoOWvuDI1xyowzRNpgEQGTRPrlhk
TLSH
T12905F14A27A518F9F9738238855BC132E7F2BC122A21D71F1760C65B5F37761AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 33c4cfdbd2fd9704880aae707c3419c57b0a9f05cc3e13996486afc64f37d3e8
MD5 7f5ffcfe3922e4179cfe884e5ff739d8
SHA1 2039dcad7ea776bfbd8da16e5dbaffbbcd370b11
SHA512 3a84a3e2eb2436381e964c568bde4272ace9b538ad6ab4af483aec87f4fcbca02e93b7f6b625ff7f045de08308bbdae056addcd721d2be7dac610b7068aafec5
SSDEEP 12288:IBZ1Iy76j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhIr:2ZukuDI1xyowzRNpgEQGTRPrlhk
TLSH
T1B2E4128E23D432F9F9B3423889F94181C3727C66677283CF246166562F76ED19D3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bbb3e59c14d603e029074749b052ad4a36b14f04c921db183fa563c8cee08e08
MD5 c91c8b19835f298d99b17f943181ed88
SHA1 b3323691aedb4671cdf539417c30bba61c33dbd6
SHA512 fcd528a07ac699eb199d12cb6be7a5081a860c4736355a5ef70521790967f757c7d9597e42b8a704698c2d58f022a0ac68c44106dde23cf8dca60f8cfba0084e
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UT:EQRQyi36YOcPQLvw2gAf+PN3psRwsla
TLSH
T102667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 23a3c7fec04b41b12faf0e46e7820556c48be5b032bc55bbd511256cd55b114e
MD5 775264d7f2ebc54b0a9fdcb3cc3392b9
SHA1 40c5637e41d6f33c5fc8a948a892b70a892991b4
SHA512 6a0d76b1dbb476f51bf263960d31862a591ab50ed7ffca9918591bf3033e1a3a8286fb625550a940f999497ef44527e6f6d5ba90ab9f38a7f9ed5c3c5e8ac7c3
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UT:kQRQyi36YOcPQLvw2gAf+PN3psRwsla
TLSH
T180667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3500d3481c0d622b859eb51f857eed2c5a0e12ec0220f87a37be9b985a017bf0
MD5 c2a4851ba7ea8621524cf72720c6d529
SHA1 bf5a9ae272a128d1a6db729a38f0d69c23805f02
SHA512 2589749f2cb12ea884b819b6db70b4457265d04cc6d9c513157f19c2d8cf6c3c92b21be7178935a2b4ee66498b7c80288ef41b665145673cc7eb7ba9a5845dda
SSDEEP 24576:SwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0UuDI1xyowzRNpgJ:s68Qg55nhheWu7PNU3/iwxsRNWgBlhk
TLSH
T125B55933B2F200A9D44DE1769F4A873196D27C758FE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2b1b8e3a496fff3d8ed43bcb148f51b678d550004c961d8590392dc8d6b8cc5f
MD5 30e7373a460f6727a2b2155e0cc8bf66
SHA1 a9a5da4dcde0e63894bbd3042970275adf36477a
SHA512 2b30d7c70c5f6d33f168ad9132d19bd04ed84de97e58a9a36836be9511d0c02fd5c477f583b99928203abba9c4df0c901e4f5dc4e98a22f12b27f8e73618c5a4
SSDEEP 49152:13aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99F:0y5112gYy5azzVvL69nLKnhZGsRwsla
TLSH
T1A6167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ab870567fb7d1aa889311a4f859467347e4e6b4c96ef4d5cb5d17ade13679ff6
MD5 1e394a4e9c5c50f87f90bd1fd9a05e9f
SHA1 1f723e1b0321bec99412baa8d1d75cffdb39eebb
SHA512 8f54610beb3f3b69563bfa617b796b79390c45a946004218dba62fc11575b6d1cb56f3fc22bd5361be723c6758881873157cb13046cff31a46dc0200b5d5e250
SSDEEP 49152:oB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl4wxsRNWgBlhk:iu6JmVxd2dhsRwsla
TLSH
T1B0D59D13F1DA01E8D06ED478974A9233E962BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6c1fb66e9958b90d9d6bb0d0c4ed10be7cee9aa089aed7ff15cde4a9cc91f8f5
MD5 5606de0e43ba1b92b2aecdd6453b6020
SHA1 224c471fe5bef259f29adf46a2fbc9e0abf7a001
SHA512 45984f08f10654d83a34c9efd45f61b91c3f0f3932ec480e7ef2d88d0100310385f3b5aa0f6f90fe7f89dbaaeb6e835f25dc717154f205ed310916414a4e6b7f
SSDEEP 49152:r1hpsNoJpF1A6UU44CwH7R4xswxsRNWgBlhk:rmifPbRIsRwsla
TLSH
T1DDB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9829c0f0e45855c8b14f7e3ad35b9fec5f70e500d0dc4d9c9be7babd6cc39701
MD5 3c980dda4ec16e8f3202b12123b8cabe
SHA1 6d8856414bed72f80d97aa900783ce188fe2bff9
SHA512 56d4ca0d990606bb670ad58a6aebcebfb289ae27f519948d581ecbd9f333e02f1da1a6d23d487a42508dc62296dc486ef9665d3f1171a92f05bb1ae4ee4153a6
SSDEEP 49152:zSuZQIY0Be2KRRVtOnks6NMHqnwxsRNWgBlhk:x5dKTi61CsRwsla
TLSH
T12CC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 82f06deea01fd0b112111499dbfda1406a56e2c92b3d527fbb8e48ba60c650e7
MD5 d8260b69af4d1cca3bbd6fbaa015d30d
SHA1 11b3775a10907823c2f990235ee999c081722634
SHA512 a11527ec248ea749a388a98169fbc1077474516870122aa50521d0b3bea786e9188fe70844263627118be650331fb3b929d945f0704e077bfe3266e4ebbf53f9
SSDEEP 49152:QhtSn8EApI0figngiDn0AP5wIwxsRNWgBlhk:BX2iyph8sRwsla
TLSH
T1A395BE13F2D901E8D06ED178C7468632E962BC160B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 a2facf5987441b7c775e2fb92418f0de6dfc194d94d1043b7f41e5625442b0a6
MD5 989cdb619bb34594c613a58d6cfae117
SHA1 8db472852890894b1c1e18e93de234fbaebc88ad
SHA512 afb3de6ad02efadc636c45b8e834fef532d8098912547e09035b467753a9e5ba4a0f05397a2349a68e1d21ec3a9bfef3ee091f03588b020890b34b5388738a3f
SSDEEP 12288:5Q6j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhIr:5QuDI1xyowzRNpgEQGTRPrlhk
TLSH
T13AC4234E0A8763F9FC72427505BD40D2806D5D6BFB93E10B74B2B502A1BCEE0957BA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 b6c4fa28529353f7fb409f9367af23485a04f9b40162631590c9e837358e231f
MD5 cd08d7510862dd4e0138061b9caf98dd
SHA1 716cef3ab7e84204fdef1feac68f434d2f9b3614
SHA512 ee892f0736a108e0e4fea3f165503e08d8c5142ca8d83244666ed041e0865cdaf0da99e8169cdb1a4daed91a5409d1bbf6edd6b41ead11977307cb028a85ce75
SSDEEP 12288:qn6j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhIr:qnuDI1xyowzRNpgEQGTRPrlhk
TLSH
T196C4234E0A8663F9FC72427505BD40D1806D9D2BFB93E14B74B2B502A1BCEE0957BA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 70b79f63332f0ecc7a34b5ca4dd16661d1c87668e9782d0b56523e51fbc0a501
MD5 e983ebce88395c681f933ae5fe5202c2
SHA1 3828b86f57dc0c199158d787418fcd0c0ab7692d
SHA512 4fb27a4371576f36f3c94f1e61d9f6e829cae156c0c559a3b34d4bfbc9a3bc89bec14553e44e69c0ed3bcd6ef3d070ab02428a8eeba4d2b950f6769ed1cb56b9
SSDEEP 12288:WJ6j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhIr:WJuDI1xyowzRNpgEQGTRPrlhk
TLSH
T15AC4234E0A8763F9FC72427505BE40D184795D6BFB93E10B74B27402A1BCEE0957BA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 2275e2916823e7e1b62d81be85bf7cef8b6a0a0029599f35f7949c2f39f3d2cc
MD5 28d127c633225e3dedf23dbf88ce6234
SHA1 a3ca758873c26c75b09e07f1e243d574965cff06
SHA512 4090def542402bde6bca791d09c98ebfb0c5683231be4496d29634a8620c33c0514df0d4fa602af1669e4714b53eb9f543f385021b1d30bf00317de3c541350b
SSDEEP 12288:DV66j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhIr:8uDI1xyowzRNpgEQGTRPrlhk
TLSH
T175D4234E0B8612F5FC73C27485BE4091C1B9BC6AF772E24F7461390619B8FE09536B98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 b87d0c4473f4be541add7f6172f562cb7cbb39b3d2213f5b5bc530fb434ccf56
MD5 bc21c51532cecc56dc19f2402d79ab52
SHA1 05c38eb077064c107a09feb767c9699b90b8cfa6
SHA512 1d782c4a35ec9161882098fcd4c0429d78cb5441d29e4911dae04a1d63dab2911e726340014b66c3bbe1fc41c200f5fc5bcf1d132b5ec2531f1ede41b9a0254e
SSDEEP 12288:Vy6j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhIr:VyuDI1xyowzRNpgEQGTRPrlhk
TLSH
T14CC4234E0A8663F9FC72427505BE40D1847D5D2BBB93E14B74B2B50261BCEE0953BA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 fad17e1dc1dfb3fe9a12a7c54aabc020afc3168e3f6f3c109f26d76df3d2bd97
MD5 6fd6e7a654b2de6ce30ed116c2bcb985
SHA1 0f7ccd193bcdf6808396554287995c2a05e22c3d
SHA512 5b126a11a8c7d3773d33c0d0ed3328060f47802f89137f272f1b0322984ff224af0920c439fde9cb61a09442aa62d0eefcf7483bbf392e1d6affd4529dcb3d7e
SSDEEP 12288:CT6j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhIr:CTuDI1xyowzRNpgEQGTRPrlhk
TLSH
T178C4234E0A8663F9FC72427505BD40D1807D9D6BFB93E10B74B2B502A1BCEE0957BA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 196aea9b85a900d1ede145ff9d3c73d945a8a4e0ee5608c6d3d180481974ea08
MD5 3924e4f9ce7a0a8cb4aaf806c97a02b5
SHA1 beb9b51f5d569915d34d4dfaa02deaf48d630e2e
SHA512 c101112af2db3f2dbaa09457675d9d4ba14f4c6f3270e6a74d596dd3ca8200ab08731999ebc9e8eb119e014f9be6e81aa8e182e75d4af8737ba47078e8da480e
SSDEEP 12288:af6j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhIr:afuDI1xyowzRNpgEQGTRPrlhk
TLSH
T134C4234E0A8663F9FC72427505BD40D1846D9D6BFB93E10B74B2B902A1BCDE0953BA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 4453f67b28dfc97a1538c81b1cf754ac59b45dcdde4f3d6764052676b2a72d01
MD5 64b422a9f74efb3fa56d41bed370927f
SHA1 9ababd94f137bd05ace008e18221588210e68fba
SHA512 cd8e3e4c487d7a8d1afa5f94ee3230e1dd08520359911ac2f484ff952ed9d41cfd0529acf209f630a0ad198364eb34b53f51c829129e059bd406d8ae5c2579ae
SSDEEP 24576:AZMSzFVSOHuDI1xyowzRNpgEQGTRPrlhk:AZMSzfKwxsRNWgBlhk
TLSH
T1A8050199739018F8EC73823E89698542D2B27C1A1BA0C61F13F436275F777A15C3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 899e6c17a4f32c711c727d405e4708ec847347c872fc4637abadaeea9608dee7
MD5 e9027a19165063fe3a4f94c2f6db29e8
SHA1 896498fb9fe1036eadebbbf7bab3056bd78d6fd5
SHA512 da15dd5ffa1a7fc5d5d2c1e0eb4113350e82c5e0b91fc9909a7636b432651991e9a912899683ea7e974e51c925e2a62b13beff4de103544cccebdeb03fb1f832
SSDEEP 12288:e06j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhIr:e0uDI1xyowzRNpgEQGTRPrlhk
TLSH
T1F0C4234E0A8663F9FC72427505BD40D1846D9D2FFB93E14B74B2B902A1BCDE0953BA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 c472b233df5fa1b196e694aeca7dbd35fe4202f92c6d460374d46a5ad30b0580
MD5 814aec68754c79082fad8726358f7d99
SHA1 f4e4fa9fe522df05b086e4c06122de86a9060168
SHA512 67b9031b6300b9c070bf835ef9d29297f84cb20cd3890d8b78ac932c7ae6aeb4e82e88a9486b9f11936387667d4d5716e46d691bd05cc18bb65e410e66b44b22
SSDEEP 12288:l46j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhIr:l4uDI1xyowzRNpgEQGTRPrlhk
TLSH
T115C4234E0A8663F9FC72427505BD40D1847D9D2BFB93E14B74B2B90261BCEE0953BA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 4ca1c2ce7fed75070bd459cb86591940364d62ee3d1713648855096b5b62484b
MD5 f1b9ff4893960c56d559c5866898797f
SHA1 80e089eb4c2e372b9584bc9731bc5276451a5182
SHA512 b8b8b18cfa75e2c86acdeace730ae90613a180dbd092149a1fb95cd74a66c636b492e959ff9edc5c809a6d67bdd52b9d6070a69bb0b238618666db7e3233aed2
SSDEEP 12288:ByPz5L876j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhIr:Qzy7uDI1xyowzRNpgEQGTRPrlhk
TLSH
T1B4F4124B279131F8E473823488A60542E376BC365761D69F22B067772E77AE09D3FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 cb8d159379c4ae3adf2775eebabd34a85b6ae3ac79029ecfbca3ea41b3c2bdac
MD5 47111692f01456e3afdb8aec3d383214
SHA1 f496df6fa6825772cb3ecad46bdfa4111aa1a260
SHA512 507110aad1b0136fbcebc711c8edb1009f8f20fb28120244e80f55c31912ad48716af4260a1d1533517d37d5ffdbd415eb025eda5179677b04278f129be34389
SSDEEP 12288:r06j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhIr:r0uDI1xyowzRNpgEQGTRPrlhk
TLSH
T1D8C4234E0A8663F9FC72427505BD40D1847D9D2BFB93E14B74B2B902A1BCDE0953BA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 49b1804de54d62d76d1f4aa321f6bd135a6b504972019bd3c80e6ab8848be833
MD5 b1fe6491995efec44e20d20785be26c1
SHA1 202043b733115eb3aa4a337f829cf3a0b6668a15
SHA512 b8e2888897614e9b30831ca547a06fe7fd9c34ecaa1372c2beb45187272b78da451e958fcb96bdb6b6804532138d6989fbf87dda51c2528ed7203ce2c17f31b2
SSDEEP 12288:B06j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhIr:B0uDI1xyowzRNpgEQGTRPrlhk
TLSH
T1C9C4234E0A8663F9FC72427505BD40D1846D9D2BFB93E14B74B2B902A1BCDE0953BA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 a15619d05ed3c53c9306c3c594a193edd9ea6698e6d57f9555e9271b3374ba5b
MD5 114bc224050e7e2509ed9baa6e610fbc
SHA1 ca40827f02f6f966462af60b77504e080b06d0b8
SHA512 e4c5687610306720112e3555679098608975821b684179a305f9cfebabf17023fcbdf8e072d751dea6e652a67657dc65fa5fb9131886078e58de05c3bb4934ee
SSDEEP 12288:iyPz5L876j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhIr:/zy7uDI1xyowzRNpgEQGTRPrlhk
TLSH
T1C6F4124B279131F8E473823488A60542E376BC365761D69F22B067772E77AE09D3FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 a83f6666af1074dcc591050312bbd3663ad907b5ecd31d685970841782aef244
MD5 e7669ecd80d1e3a3e5d4b9abaa6d6ecc
SHA1 743243130aa1fa956cef82f0ec78976c6576a3f1
SHA512 7fab7e04f478d88d3a12a69c4e8cdaa00fde78e57a16db7554a39aa91f25b498f71a832d2804b6cccb44cd03dc733888bb8cce28dcac964ce3ee0a1131388ef8
SSDEEP 24576:BTHaLl3z0zD5uDI1xyowzRNpgEQGTRPrlhk:BT6Llj9wxsRNWgBlhk
TLSH
T1BC050199739018F8EC63823EC9698546D2B27C2A4B60C61F13F436275F377A15C3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 88c609a7c7e868c80c40ca1bda21dc06f3c699b7d5a26d2d21f3d84e1b1a1ee6
MD5 b5b1369ec4a5c2276ee7b065207d712e
SHA1 3f76541bbd8d80de383ceb8a1b380f7d31e9613d
SHA512 4d7cc09f1db430b9b0ecddabc8d321573ba4aecc23cab89db779f82955c0cac7190145063260f2b967a4c6579d61b3a8d58457574de1c30687371e93c548fbd1
SSDEEP 24576:B37d9CHKy7GZFuDI1xyowzRNpgEQGTRPrlhk:x7d9CHKyaKwxsRNWgBlhk
TLSH
T18A25CF94F3E411E8F0B3CA3589764512CAB67C5A5B71DA8F13A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 8d438fd07cbea8196648c159e9e90d94bca7523219e20bfdfe61d2d623195c0f
MD5 3f104948e6b47b808cc903e9d3261825
SHA1 82fbe61597c8857d04cfe249e5efcd1c63b133e9
SHA512 118ec0fc75a0e6bd32a120990d63beb764fa3b85efbefbdd0166ac96947f916ebe34eefc3e78e4a83a60d1460ea9a39c380c236f7276b1043499add1446e83fc
SSDEEP 12288:9p6j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhIr:9puDI1xyowzRNpgEQGTRPrlhk
TLSH
T1D0C4234E0A8763F9FC72427505BE40D184795D6BFB93E10B74B2B90261BCEE0953BA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 eb889c1d57aedf7eaa3301ba75c431771aaf5b46246d495bacbda34ac126eb3f
MD5 2e82452a10c52ee81e0b7bbf4ea4a607
SHA1 3717cd35a5627001397077697e5252cb125516d3
SHA512 9c673b9c528b3460bc55ac62fb5b4dfe8babd99d4dce02988475920e3d563fab4a8caae95813ca1e41c17dcbd36a99d0cc2acbe874b7d59b8cee9a5da706dc30
SSDEEP 12288:5b6j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhIr:5buDI1xyowzRNpgEQGTRPrlhk
TLSH
T1FCC4234E0A8663F9FC72427505BE41D1846D9D2AFB93E10B74F2B80261BCDE0957BB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 42ceab747a388920b53979ab7ac76588d22d1d1884e7c3558e01a91e4f606d32
MD5 bf9d7a71feba545ad3a6a64a24f223b6
SHA1 a7f39a32de500b62a2e1d89c8a1e89698a329423
SHA512 11c5a11d354b5df90d09c0e323a022220edc4e98db2182e79bd39763b1753db48a07757e0756d1c07d23e2b69e4d8ba3e8c49663bd37fd285a20a51cc6463583
SSDEEP 12288:TO6j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhIr:TOuDI1xyowzRNpgEQGTRPrlhk
TLSH
T11BC4234E0A8663F9FC72427505BD40D1847D9D2BFB93E10B74B2B902A1BCDE0953BA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 4644b9ba6d823735d37edd14be21d6c8c76ff3360d0a53acfe8a8b9964cf11e5
MD5 f7e745e019d610d8c200e80e834c6b77
SHA1 2f89d00c021ecf585504f2cf3f1024ccedf22f16
SHA512 0db39f341d211611d18bbb0f269c1c42833fa0fd86522669b33bba1452ff40ce281d784245f97ecd51c073dc6fa8ed76a97044cfc5ce419c797e308d4db54529
SSDEEP 12288:806j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhIr:80uDI1xyowzRNpgEQGTRPrlhk
TLSH
T104C4234E0A8663F9FC72427505BD40D1847D9D2BFB93E14B74B2B902A1BCDE0953BA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 0b9387a357c153096e1d6dc63f9926137f489684569d7f3374e7dbc30441d318
MD5 6970f2926009ba04ba9c13a6ae962eb9
SHA1 fe84a4440bd4125249bc5067b3b03ee4b4dcb746
SHA512 e5aaacc4fa0c4eb90b7a7ab67e16052749e3c9e701e8b4dad76058739416adc4998ea6dde3e823b284cb89edd8b55fc628c0e78c1040ecc3a2abee4e0f701f18
SSDEEP 12288:ap6j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhIr:apuDI1xyowzRNpgEQGTRPrlhk
TLSH
T18BC4234E0A4763F9FC72427505BE40D184795D6BFB93E10B74B2B802A1BCEE0957BA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 8547bfa6d6ea58a27870722890f7d904c2bc53b70b91ebbf09dd7ab2fbbf0bfc
MD5 4c11207e9543a079dc4c34568b6c5b93
SHA1 3255d51ce87a059aa81f13c9d874681084f7e1b3
SHA512 98015a82e4c2501c65dccdc0c444f9db77eec801857411422d61b34f4950425a8337d945cab4ae14cfa45c4bef66c6d94663833f6f180f6a01957fd0e8631928
SSDEEP 12288:hM6j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhIr:hMuDI1xyowzRNpgEQGTRPrlhk
TLSH
T1F8C4234E0A8763F9FC72427505BD40D1847D9D2AFB93E10B74B2B902A1BCDE1913BA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 6240d53b64983008864bb7c8c3b3dd1ff8c36ff6687b7b05739ff3841ddd6534
MD5 c8fedec00ea61a9097d0f1f265e8d8dc
SHA1 d077bd1fe3a99a48a56ab3d58430932e557aec4e
SHA512 abde4bee145ebd0bd47b4dc15f99a87edbd2e77bf3941e0f4fbab02073978dc2595bc2045c8135da95828d8286b12176db29f98c7ad8f12fd26926bc710a6bef
SSDEEP 12288:Ny6j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhIr:NyuDI1xyowzRNpgEQGTRPrlhk
TLSH
T16BC4234E0A8763F9FC72427505BE40D1847D5D2BBB93E10B74B2B90261BCEE0957BA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 61c58b0d0f25e79167a433fee496f9b3e608f5d0e6530db284cae062bab5f461
MD5 e9eb329896ac61a86123552f348c9fd9
SHA1 0b53e376886dba9d7d493183ce38033e83a90f22
SHA512 addd3aa6d8d052904b2de2a60528edbeecbded3ddf36f0542bf9fc65e15ded524768b75b19a9e0009af066a5b664a4610b4d6d03718045754856542866d587cd
SSDEEP 24576:sfwvok9RX6wkyAIIuDI1xyowzRNpgEQGTRPrlhk:MMnYILwxsRNWgBlhk
TLSH
T19A35D02DEBD844E5E0B7923C89B7464AF2B178691B31C2CF119A536E0E37ED49D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a5248b588e4d93d6a095cecbf722d50a53876cc9f566dc5b259b32b5a3a35097
MD5 2c6ba6fd07a6ffdc63d77bdc742eb849
SHA1 ed54f997d598bfed7c818a434e1d4ce726c4c0e9
SHA512 cb79d79f0ad06536f9e35855be4b9e3743da66b6c43dba4ae31b2bff21ed12648f2ca834bedd734ed9d579dbdec0db6aea23258819daa64b97ae2d657cb8650d
SSDEEP 49152:RYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0owxsRNWgBlhk:5ySzPJsRwsla
TLSH
T16E066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0f0984f74e2ebb5b788e29a8a78fa5161a93bb806b7d861d938aa841dcce9a93
MD5 0917b6e77a0129dfb94b7c2106daeda4
SHA1 c32e30229795c9bab9f03c94ba6258a4f919237f
SHA512 a5a454714c7a868786e2c8e0d44fb684ece6f95113cedc6b5d7db53a7d36478b14b9c106847dc71c29793ee052a109a5267403ae158899bc9007b538b0f04efd
SSDEEP 24576:I47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYXuDI1xyowzRNpgEQGTRPrlhk:I47JUQj1irIhCnDHUPfF/4wxsRNWgBla
TLSH
T16165AE1EA3EC01E5E1BA82788515465AEA71782E1F31C6CF2270937D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 0ffb7e49c0e88b69ee0b83b12ebbababbe3386529b9a6acc9aa2bb0bcef6ffef
MD5 7c945411da3300800275b9c948c0220b
SHA1 9a7adc71d9211e08bfe68975a4ca30e38dcc8a00
SHA512 9a5723760d65a396a9e964de2d39d9efd843a2755b1e0c52d8a55d0c3ffabe0b028c35a8cb2703331a424eefc29e24098cd503f1dde6d29c86f3417bb6290604
SSDEEP 12288:sNsfk6j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhIr:dkuDI1xyowzRNpgEQGTRPrlhk
TLSH
T10DE4F00AC28412E8E46E5275C75A4281B3377C2597E2D3CB62D0F53E1F79AD09DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 f378c52136584fd142c9bf4c5945ac6fc1aaaa69f59873cc22839457e3fd4b68
MD5 5ead3941b633d0467ed6b05402ca330d
SHA1 8b16d18e2d6605543a35227c0cbf3af4737d15ac
SHA512 7abc1fd75e2f0d512df0879e1e891330fb10e41cc7d4a8987a5e116298ca87c46d2afa092a61f7544b4780a6f855fedd55bf2164423cad5285f8e44157bce115
SSDEEP 12288:J4+f0PU3fIhzCmEtnA1MUublLRJNy0B7wMKhEp/qltlq:i6KUPI5GnAy5vy0B7wMIEp/qlW
TLSH
T1E23528007667C74FC66940325E32D2CCA7B07D52EE046F0773C88B3F9576A59BAE6682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 d47c4f4f98afe01e553e0c320208a3eedfed1087692fef240841b271a99d9e96
MD5 ef7b3ddeaa05f6f09bcdceadf5da2636
SHA1 3272057a7fe41796865a3b38a2aee8aff2149037
SHA512 6f52600d13ed102e493ddc28fa6f9d11c52d4f377684f85a1425ce95acb576d6e103572469dd0d7465fd333ea176a67b0983cdeb7545f3822077a7fc3f00406b
SSDEEP 12288:ACO+helS/P0Wz/xWj7piuhfnkxD2sasaG0yV/kLhN7aC35lUOisKc3JJZePVj:nOSz0JA
TLSH
T12065D5416037E38FD1B66072472A5B8C77A8EC07BB056F22B388457AD46AA15B0FD7C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 54506a53868bd72f229293578d5a07af30c4fa50edb733b0dcbfeabade31d086
MD5 4fa6dee8f2e27c164553e696f1f2ab7e
SHA1 fa04ed6e126c6c5f6a4062f23e334e7a1cbb85a9
SHA512 f6c23afbeb3bf384ebaefc83f58289356aa42f1fbd592cbc263e7fb4f617b0dbb9850455b30908df6d91c6f07f66be4db3ba76d9f41ec53c89d3b09c12f8081e
SSDEEP 12288:dM786j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqhIr:W8uDI1xyowzRNpgEQGTRPrlhk
TLSH
T1B6D4234E078A63F5FCB2527405BE80A1502EAD39AF51E0CBB462754660BCEE0DD7BB4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c54f93826a928202d81b4066e1218e1c8f5cc7f53f733ffc54c8396efe019891
MD5 3c0bd4b78b45200c5f3a43504ca4d489
SHA1 c6fda1a15736a301c9caa048185920552bb74627
SHA512 202edc84d0fbf918084a7f1a786f5fc770d0f2b699c491856545d5ab1cd195c1c1a577dede1069a6f428ce10901d10e2ef5f22ddcafbe3744a6779ab9a0822c7
SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bYWuDI1xyowzRNpgEQGTRPrlhk:0gb4mBIBhGFewxsRNWgBlhk
TLSH
T19765AE1E22EC02F5E0F6D2B8CDAA4417D6B278161732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 77c0b9ea6a9af7ee123ead1ce9f443c7bfdfd28a84f9bbe16e2da040f58d1cb5
MD5 fbe83c820c28fd0a2f2e26d2caff3aef
SHA1 51f42e325bca641641f7aefce89d25960b2bfea0
SHA512 b7922a4aa4f2d9ad67b7b1216fc6f918f9173d7fe7fe0c8b6a3403a886a15639ae5565dfa390d7c201170d67cc579a42cb9f56728a0fc3b87ab5fca60e5bb50a
SSDEEP 24576:PG88u8FpJqH1bzria7/mHuDI1xyowzRNpgEQGTRPrlhk:+7ZFPqVea7/1wxsRNWgBlhk
TLSH
T1B835026567E102F0E477D13889964263F6B2B8251360EBDF06A88B511F33AE54B7FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 19fa7306a81bef698333dea53f552bedc025fd663cdaa2e1ee97d40eddeb30da
MD5 e5a9c453f6e690ef7780a5dc04b30284
SHA1 0560808573f54092bbf373386527e4081d9710e6
SHA512 4a9199af2e7c71e5d737996685f58d00bddb7f6ea2f1018da93b8576f182db9eb1b398c0bd82daf8919647ffd33446d4ff014fd114d64fb1aac6f4d836c9d14e
SSDEEP 12288:hHvUrBFrEjwaQj6j/DJ8ZYuU3FoxyowzKM5NJw310ghR/sVlE2wGfDPNo6b7rMqa:hPUr+NQjuDI1xyowzRNpgEQGTRPrlhk
TLSH
T18305F11F22E918E5F676E17C85868209E771B8621712D2CF01E1917E4E77EE8BC3EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bc00deccf11f345b86f54c758f560443e17d415d8319a5c3eb5b09b3c70f20b1
MD5 0a422caa4394efb1fa85a01b9eb67b95
SHA1 5cf75adcdace59a521d0f9c782943bbd6051c99d
SHA512 3c550d13aa1ecd7ba369bf722b950a8a65fe92f4f4333735c6f2f1e7af5f9fdf0de820ac08f28c1496ace21879299ef9e9e5eadcf552ce09899a20a9f56382e0
SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6wxsRNWgBlhk:tG05lO43bOsRwsla
TLSH
T1C5D5BF6E62EC11F9D0BBD17CDAC6460BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d14a80e328bf08a5389b268a7cd35108ed2e94ab06460d9a91e97781cd7b682b
MD5 ab382eda2d532aa0a5dde0006088bf0d
SHA1 4719acda8a273125839e68af419ddf51d329800c
SHA512 5453cec04f7488bb058aa22abd42360d29dfd447621f1fe28d77632e7e46891baa29508a6e2fca8579621fbb15f96dcf74ccbd9c644610132eeeb62fe2ed93e8
SSDEEP 24576:Kfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn9uDI1xyowzRNpgEQGTRPrlhk:Ca5POZ3+Jt2pasx2+miwxsRNWgBlhk
TLSH
T1C065BF5EA6F801D5E5B5D17CC583461AE5B1382253329BCF112182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 01ae12483030cb207ac1f44c9fd0fa203784270511c78da3339565b13bfffb89
MD5 c5ca32b7971e2e0ff6b67f1b17ec236a
SHA1 1378dbd556e3574a0202d886b6bb23842d99a228
SHA512 6c3bb37947e6ae97f68e63cb3351361b3e904bfa78db82207f2ef03f4ab939ca3e12b4763f6cbe81278b02fd572b4d4c46abcf867aef1c3492aa8184cefd799b
SSDEEP 24576:sNcwHdjbyQ4nLC18lb/EOjowL7FkPuDI1xyowzRNpgEQGTRPrlhk:sNc/zEOVHFVwxsRNWgBlhk
TLSH
T1C0858C1A23E901E4F5BBE1BE897B9546FA717865133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8964203e5fa87f6066b8262e2aa1dd871250e395d35bff2b03a0d8429f0ff0aa
MD5 abc6121510baa12d8259cf14cc1c48b1
SHA1 ca6cb13d2b03534c7723d555de9197a8697ec22c
SHA512 7a6ccb0f00e332c73cf54473f919cb53740e33ec592b250202b95061108caaa2854c2d8241ec340694da29f27d96d7886f436488ba00e3f4468bab653d98649d
SSDEEP 24576:p8kNvNnaFeYhJNtmZBmxuDI1xyowzRNpgEQGTRPrlhk:p8MwBtOmcwxsRNWgBlhk
TLSH
T11455AF6E76F846E4E1FAC6B48D238112E6727861173293CF5290C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 0e60567985868a0ac5a3ede8d222a72a3d62436d3283004a1b11aae912d7da3e
MD5 b124ca5eeb3f8ae8e5962e6f56ff17f1
SHA1 2b7ffd02e155e54c77d0dd528572dfc0409d38cc
SHA512 63257f7c7f5ab635e1d3792a000ea6d92b3427ef30d235ea1a22f4978bfdc8ff5f6f2f382ebf03464b08941eab20a78dcedeeabe83d7ac8b246bd31e4cae2966
SSDEEP 24576:pD3FHshBIYQgAwuDI1xyowzRNpgEQGTRPrlhk:pDVHeBIAAzwxsRNWgBlhk
TLSH
T1DA25E17EEA9D00E4E47BC1BC86638606E6713CAD032265CB11D091B65F7BEE46D3AF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/748-47-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/748-51-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/748-54-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/748-43-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/748-40-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1140-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1140-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1140-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1140-151-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1748-138-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1748-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1748-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1748-133-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1748-127-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2240-55-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2240-62-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2240-56-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2240-293-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3132-327-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3132-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3132-96-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3132-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3132-89-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3132-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3304-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3304-16-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/3304-113-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3304-24-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/3432-9-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/3432-0-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/3432-6-0x0000000140000000-0x0000000140410000-memory.dmp

Download

memory/3432-78-0x0000000140000000-0x0000000140410000-memory.dmp

Download

memory/4072-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4072-313-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4072-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4072-108-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4072-102-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4072-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4532-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4532-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4532-29-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4532-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4532-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5772-307-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5772-74-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5772-68-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5772-66-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5904-309-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5904-85-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/5904-80-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/5904-79-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5916-312-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5916-115-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5916-122-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5916-116-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download