0225a551cffdc34d8ef6c783d2fd01ba01ddbde683dacaae2c735c74e8652460

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 15:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 3.8MB
Sample260804-sw9w5stcmd
SHA256 0225a551cffdc34d8ef6c783d2fd01ba01ddbde683dacaae2c735c74e8652460
MD5 69e4ada01067ea836a8267f20c249ba3
SHA1 a40275c7b3daa91ad7d0e49cfcd74039456e69c5
SHA512 80e0b38bf0872334796d67cf597f26925b178f150e4c273a8785c097e5dac63ddb56eaa2bd73204cba672c98bb0f8d446131be5f048879b5a51d0c816e690702
SSDEEP 98304:jNUA0ZunZhrqa+uUkjDBHLppmqrWETR9b:xP04nZhIuUc1j9b
TLSH
T1D206AE1A97F806ACE0F7C279DED58953D776B80D07B0A69F02909CA64F732608E79713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5076	elevation_service.exe
1472	elevation_service.exe
2384	maintenanceservice.exe
4168	OSE.EXE
4516	PerceptionSimulationService.exe
5384	perfhost.exe
2148	ReFsDedupSvc.exe
2856	SensorDataService.exe
5924	ssh-agent.exe
5136	AgentService.exe
604	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\16e2b7cc83806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b3e7d3612624dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fcfc31e2624dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000002fe7211f2624dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000302c98202624dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	2148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2148	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2148	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2148	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2148	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2148	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5136	AgentService.exe
Token: 33	604	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	604	SearchIndexer.exe
Token: SeDebugPrivilege	4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4536	2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5076	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 604 wrote to memory of 5736	604	SearchIndexer.exe	101
PID 604 wrote to memory of 3468	604	SearchIndexer.exe	102
PID 604 wrote to memory of 4532	604	SearchIndexer.exe	103
PID 604 wrote to memory of 4368	604	SearchIndexer.exe	104
PID 604 wrote to memory of 5632	604	SearchIndexer.exe	106
PID 604 wrote to memory of 2644	604	SearchIndexer.exe	107
PID 604 wrote to memory of 5956	604	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1472

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2384

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4168

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4516

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5384

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2856

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5924

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5136

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:604
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5736
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4368
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5632
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2644
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 77ab42e332d34644ffb0d33b5202de6b509aeb85b6302b44d0c6315fe35d5fde
MD5 dacd87b89bf16d5a57f9917a0b0834f0
SHA1 6f4c651b6d0d0e6206d56e288e8204c6af495ab4
SHA512 571470ca449616998daf0088b5e6c9e00fa33d4c00d96945ea74164d89a5102a35f1c8578d27b434b47114f0b0f109f6c8eca89decaf387fc088483c2489d4d7
SSDEEP 49152:db+632BuPkFKRrdE6ohmstBhuXjfS4LWxnkm+brLC2hTR9quLB:j3q6HjBtmqrWETR9b
TLSH
T125D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 862546549b36e59b68e07343da0e52d92c1b405e54c1d8a19aceb4c3e8c52c15
MD5 124ebcc60fea177c13025e64facf7513
SHA1 917a9b397f0789a24eda42bc9bb17936a1e9eb92
SHA512 ae3c03c9418cd74c1b72f1f05b2079739393077a49b1fc2a4650a8c5d10d8020e9de77c931bab82e2c5ff9fc12546628aaf1af95c6aa21933f635a237e299e47
SSDEEP 24576:9XYfDtczARRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:otcym+brLC2hTR9quLB
TLSH
T1F205022867E408F9ED6B827CC9A2C401EA73BC914760E78F03E499651F336D85E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 b2fcab7ed37f837790de317df55b912383c2f8bfcb359289b71aec11aaf06515
MD5 72d208f60f9272e6238ab43ae224b165
SHA1 4cd495510ec1940bc6a4316fe7a6108d66a9d5a1
SHA512 68e227886f5d8a3ed2d486b94584dc9e9ed0da7016ac8f59be78bf2a1f26097b3e4dcb48ab2c0773a41351d548590f187621da07ec994a632ebe8260bc96c105
SSDEEP 24576:10Le5ji0hmxirMMRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:1Pji0Acbm+brLC2hTR9quLB
TLSH
T17E359E15F6788335D073C0B9C5D2A69AED7130865B308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 77fa6a2dabed19b5aeab69ce9fbe7b73ae117c5f6dc749eb73cf72949c7a9741
MD5 8a245f1d42723737042fb706cbad6a19
SHA1 4ac1da0e28c236c8f6ef5ed85d7a1c0c1fb52387
SHA512 a3d8eeec1b3ee3f6a4be6b7f90e083719be734cf0ce2c758e9052c3258a7f9920c68323496c72af9f47b61b3924230198c65c8e6c296158705244fc7cbdae60c
SSDEEP 24576:Ba7/ezSC6vUyD/aqgrvWE6q8wyuCRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:A/ezSC6vUzPvxHjyPm+brLC2hTR9quLB
TLSH
T10C755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2879495a8a2dfe7015d2c55831ef7fa6b1b8fa12e5a70dc1ddd1401a28862fae
MD5 99755412cde267742e7b13c5402a5b55
SHA1 1378814222276979080082b4b2a8c9d07299476b
SHA512 8031e741a4deaf684a193c775b84617a06887b032a1ccbf32ea876ade3a094a86e8a2212e9e6dd1e4c5296105d79b67f090830440b8bae5814a402708e36207e
SSDEEP 24576:PVbqPb88hv/l+69Rmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:PVO88hXl+Qm+brLC2hTR9quLB
TLSH
T1A855AE65F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 bca0477622094dc4ace3052f7316cff76b0a3963e628d3561b9227e5213cc6e5
MD5 2ddbbbb83d5f1d2766c111d91b56a23a
SHA1 d54975be384a5ff6baabcb6494189f2f3cd01396
SHA512 28f7fc9bad931d3a9850fd05240ac0ce25323f7a81f4220bccbca0124c231abf08536931d780d733f4e0c1403b35e6c64e4a820d9cd29f35a1da8a92ea191827
SSDEEP 12288:jR9WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQoj:jRIRmlh8t0D+7y8G2G9yL0cMoThTR9Ph
TLSH
T195C42358CF2D0082F39FA2B1B2E1D8D699BDFCF1D984AC0EF0817DD01674CA4962595E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 6289d53496e486d8d896d0e07508fbb6b8269fe407b4bfa4cf276f1c147f7954
MD5 65cb116cf2af7639364668826e4894b2
SHA1 999141b4482917864d5b5fb9a522af00f85ec776
SHA512 9e7020fdc1c501f9eda0bb90cc0172b9aa455875db09e44ee3cb945c13f3d18ebb4db19b2fc4a7fda236c5fb51cc47859b5b62894c5e3f92197f8e397a374d9f
SSDEEP 24576:DJIUlRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:DJIUlm+brLC2hTR9quLB
TLSH
T12005CF3BEE28ECD2C27E9DB85791C640D77278704F51A3CBE165824E9E239E05E39C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d9fb0393c71cbe74496afeb3ffbe67cbffc5295042c34e35f92f60de0f1e1f86
MD5 57784dab4ebfe04b37d77c10afa5b116
SHA1 d685a1a53013055b7f68d1840fdcd7bcd8e3ac16
SHA512 e3452dbdf523a8ac7dec6d4c7be7b82505dc5d81fc4b966a7e2badbcc69a4708d845bda84336580321b031f640dc77c6489249a530829c99cbd9c7faffff9703
SSDEEP 49152:iQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THT:iQvGAdlCEL8c/yRNw5CSmqrWETR9b
TLSH
T1BF267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 adce88a40e88e1ade9c3f9184d0e27e967aaccac8314d377fecdbfb68fdca02a
MD5 e3e613a3c4e0eb06d8d6fb8b5117ffde
SHA1 55df67a0b6c9baf5666b8535de03c8d88a424f42
SHA512 96905e906e18b7c9f07d87c1d5f3278877601e0503288364043897852b43a6875c6fe6a9c3a235774fcea007ca5ca614ca2c1244f169ae36c7042c59ae3b5eef
SSDEEP 24576:cdewsAjrRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQoY:Eljrm+brLC2hTR9quLB
TLSH
T11B15EF31FE74D032C3BF0DB22B62C716587DB9604B9119C3E3A89E9D59706D22736A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 acbfa58a30c2987ab2e6edacc628238c3b579730b3e1bb3f29c6b32130ee1d6d
MD5 a6f388cc1213faf723fd4f79533cf2a3
SHA1 7d4389c093f2d9392bbe21146b7f42a14100a3cc
SHA512 096e8a0000276fcb5764aa318a890794df03cf3f61e23e9b3e3a052fffbd0d6ddfcc585a80d7f7e7d4a3a6ace2a9b27f6f63e7252f54cebd5d9bec273dc142ab
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHd9b:rUEtQevvqc2W1cpV2EI32z
TLSH
T15F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9c1b9001693cc3697b5e5fc29886fa2052899ff38b4e0c685c187c5ba6c54f02
MD5 93c9ccb8b0ff10b3b450459eb8d1f6d8
SHA1 dc610eda5f7d1e9e8b91a0a50d6d97bbc3abc201
SHA512 cf99791dc9c0319df65d5d42beddd18b249ee1088802a16c5eefa0fe1be05a28b4ad70f52eed6b1fdbba97771eb89132c9f0c281103667564e4075064eb17a29
SSDEEP 49152:eCbRquA/m2yL5zQfFiV+XenmE3/zLm+brLC2hTR9quLB:ToqtVjnmmmqrWETR9b
TLSH
T115D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 07fd8ea912a3d65eb881b5609730fb2cd4ccd2356f47aeab6027f541fb9845a4
MD5 70272b23d45e849f94d9293be2f1aa24
SHA1 906b9d71c54b6a52a5d474034634d0fe9d473d52
SHA512 e389ada301d3b14d1e3450e5e5041f1673acfac576b1ae205298a075452464912e2ac5fba57e4e566961fa6689f8686db8e85fc53e990bbe11df0c74938ae095
SSDEEP 24576:cAhGLJIFoiwtA5l7S53GRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:cAMyFoiq52m+brLC2hTR9quLB
TLSH
T13F359D80EBF945D4F5B3AAB899B68571EA76BCA65E31C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 c4c921d5196a9c8e1e804521148dfa155f836f065ba11bdd76d613b9820879e8
MD5 a8b2b25922294ff9e5dc65270fb852e3
SHA1 c3116ab52ec848fea924827bc1b34df330a0bd0f
SHA512 c3381b18e7733f85d5aeab7eea908d79f861949532c19181a572016d0a5a7b8118e3e6ed880b43fa66ec128b31e62ffd8a2dc944e23691ac051a16f346cb0e87
SSDEEP 24576:qwuoOWvRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:qwDOKm+brLC2hTR9quLB
TLSH
T15D05F14977A80CF9E5679238C293C536E7F2BC122A21DB1F53A0C65B1F376616D2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 7699490fb8f0714b067d71da1fbf8752ff5cd37b528e9aee93058cf1215bbbbd
MD5 080be5a979ba8220634e164df5a55144
SHA1 29dc6fc4eca6f7e2698d48e8c133f25030db6ad3
SHA512 9b0141cb2041632b14c4b81919dd261cb792d56f50c9a8f41a3d418b7736690c9b96d2bc4dc77bd736fbbb8860ad9ccc052dae3abc64d9c3a84b4bf117eec564
SSDEEP 12288:PBZ1IyaWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:ZZu0Rmlh8t0D+7y8G2G9yL0cMoThTR91
TLSH
T12FE4224827EC20F5E2AB9278D1F18985D7B6BCA2673183CF219056E51F33ED11E39726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b5d8359400fdf49069c7a4376a86afe0a39a21abdaf5865ba48d775181770208
MD5 9edee8a3292ac0f5e73d21bbbb92596f
SHA1 351608a960914658c7c5f8fe5ff152767b9c02eb
SHA512 c9e5f7493942c9dd24105009f5440d397c4b2f10dbee6ccdb9779cd9f0740c6d6b1351459dee73c61c7204ea8c8772551985bf44a058ca05a7c3f6660d631962
SSDEEP 98304:5QRQyi36YOcPQLvw2gAf+PN3ZmqrWETR9b:wQyiKayX+PND9b
TLSH
T126667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a9121445c471f30ff9fa3fbd7d866b976bf78308e010d6b16d410980c9a45949
MD5 2b42b1ac6c705cc46d72a11dff907dd3
SHA1 bc6206095263ecc411308dead45d74173671349d
SHA512 c0c71ca606c8fae30ab9a05639c81728ec026116b3e5675e9374c34f89bd40e691e669a35a7848c9029096675989b35311785eb7dfa80cdda06e408118bfd13b
SSDEEP 98304:7QRQyi36YOcPQLvw2gAf+PN3ZmqrWETR9b:KQyiKayX+PND9b
TLSH
T15B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4ff3dfb984e8a3a619734d001fb4f7dfd231118153187b1821f2d7c82c206489
MD5 05548e2444538336ab9b47fc6f647f7a
SHA1 d19a07a0f063d649dec5323ab1bf6988f197beae
SHA512 ddbcfa69313887d6dc8d8921a323e8a534d9301562b78ba1c8dba7d6aa55b5278e74b06ddb9a245d57310cc8657749f1a5bfb498792e1603bde16e8464a22b4a
SSDEEP 49152:068Qg55nhheWu7PNU3/bm+brLC2hTR9quLB:ethWRc/bmqrWETR9b
TLSH
T129B54933B2F600A9C04DE1769F46872196E27C75CFE0E3DB815172561BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 45bd9a5e0a8e47a2b1ac92c413e7444764d174e35ee77d715c48a2bd3357ec6c
MD5 006f0fd96aaaea21968e562b6cc35c9d
SHA1 a60b54dc58444d13fd14a2b2b4206c1bd3efdadc
SHA512 34eea89efe17653a07821268dce3a234a965d457148c3a2aa2e009a4efbe4698c6a3b813cf5493a9df5df51c6156ebb51475f5e8dd13aed71e7d87b36cebe1a5
SSDEEP 98304:ty5112gYy5azzVvL69nLKnhZImqrWETR9b:QLIHmWh09b
TLSH
T155167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e0017d7ecae9094c10cd5c85cff2b56d2fc4fafb086e009891b56501147455fd
MD5 44e291afc64a60d1e65d95afe1f9fd6a
SHA1 82e95975909908ad62192358a26f72d986dd2538
SHA512 419070e58f1c0a77ebda65cfe15e4809ecadc76cd6c1d31f2f436326f3349c7adcfbcf9c262bd37035af79d191b2bef67ac4317176b0beb9fe29dfcda59b447d
SSDEEP 49152:TB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glBm+brLC2hTR9quLB:lu6JmVxd2dBmqrWETR9b
TLSH
T113D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bbaa693b37846c3ecb175f636faff0b618f84ac3da905208f3d29512520bf488
MD5 fa678ea8707d1efce65f731a7b2e3dfe
SHA1 45cc8550c193041e91083d5b1a344a8463bde2b7
SHA512 72209d7bd6eff8aa18dc810ac4839460f430c5f9856956804c5439d233ed23e37400d7edbe73d7e190435e4fadefa310da1b7dfe16ff4801d12dcc7bc1e31597
SSDEEP 49152:b1hpsNoJpF1A6UU44CwH7R4xFm+brLC2hTR9quLB:bmifPbRmmqrWETR9b
TLSH
T1ACB5AE13F29900E8D06ED17887569632EA72BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 beef6f1da8b23085d63d3ffba903691c930d97d595f2772d9af34a36df9132c7
MD5 b40baf2eaefd623d44d1fa6825a4d943
SHA1 836b0da25beeb37f41fc2298f24779dd2c28f475
SHA512 b0c8e206ac1092560ef0efd7a3ede45fdb96009d7162896bbb20fab1b1a0c83812dfbf730c5d69e5fe09b37e8dfb24b251cd87f470c858cf9f13e92931e10acb
SSDEEP 49152:cSuZQIY0Be2KRRVtOnks6NMHq0m+brLC2hTR9quLB:e5dKTi610mqrWETR9b
TLSH
T133C5BE13F2E940E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e56878c0cc30f499afad214db86f65303bacbccb9e30a5f956050d2064fcb2dd
MD5 da414277e8eb5f3c81fdd66428a3b253
SHA1 28741e5b48cfe6c1933879fc9b17721300cadedf
SHA512 ceec8918978a5c7ea1af486c90a2443d895e0ae291af876c79339c5104f7ff8bd337a098f1d889d1a1aa1d29515bfba29173032a63edf81a0b1ca8632ddbf1b3
SSDEEP 49152:ThtSn8EApI0figngiDn0AP5wRm+brLC2hTR9quLB:SX2iyphqmqrWETR9b
TLSH
T18B95BE13F2D900E8D05ED178C7468632E962BC160B35AAEF0A90B6561F7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 5564cd76c23cea646c6a91796bee2cdaf1df366ed97afadf138b677d3968ad7e
MD5 0c6137f1ae9732ab8a31967286794795
SHA1 97adb4f23e22cc3f9b28a22a3eccaf7d8feb5cd0
SHA512 a6fb0ffb979947ae5f12734aa0733efcfb4925fc2f59486e0064fd860a85b032fba2696ff6c4d1c757193c1e6400391db15482ae045797d50061b5d455bfdcb4
SSDEEP 12288:K1WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:KQRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1E1C423188E6E0086F25EA3F1E2E184C5D8BDFCF2FA85944EF1C578E017B5CA4262599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 5c99d42f4e70aa84c3ad9f0473a56f3e9f0addcb8c4524fc3bd3bb035f1a8853
MD5 670b1c239e07070f675e61ede73caa5a
SHA1 279236652761afebb249978b54e59d1629512927
SHA512 1f7848e7f8294e1e7fff74e87381ac5fb8e6a39adef316786e6244df955bc0a6ff3369ea6cbe43ba4e8ced01228445537281c1236cb2e90e722692086260e3db
SSDEEP 12288:XWWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:XnRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T16DC423189E6E0082F24EA2F1E2E184C5D87DFDF3FA85944EF1C578E017B5CA42B2599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 6a923fcb7debccab49fe448779b62252c8b7dd947de65525339afb4822107ccf
MD5 33d6421f33ecfa6889eeb7a4049dc2cc
SHA1 ca3eeac91131391db174b05fe86648d0d3b2052a
SHA512 84d473fcf9bf885503e72cc7ecc7d873eda520082ea67c32d6169251d7323be1f2b17e7fd0d750a84ec35d181706585b9675881c7c6727ed7b8e809693f9e1dc
SSDEEP 12288:BYWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:BtRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T122C423188E7E0086F24EA2F1E2E184C5D8BDFCE3FA85944EF1C578E017B5CA4272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 911a1ee0d67fa130e0449c0e29f481cb91d8ff2c69073f26c5c40a60071f9459
MD5 c058f62a3e7b55c7962eb2ea87b4c3ef
SHA1 f81da5245011e9d2d028d6cd8eb6e7128e3f2b75
SHA512 4f4d9974f758ef397c599fca758590643e7a2c47cccf230fa4a67a5107020a12645a61fd7e92fb109ea1374977281d27b608eb8cab088b2a94a5a8b5cc93b351
SSDEEP 12288:UV3WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:5Rmlh8t0D+7y8G2G9yL0cMoThTR9Pyul
TLSH
T180D423185B7D00C2E16BE3B1D2E184C5D5BDFCE1EB51A68FE28028D50F71EA46A34E9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 a483b53d52d748e7c60930e3191b7d1ac608c792351199118fc6e0bb2a3905c2
MD5 bbfdcf4323097811dd5b3711c18155b4
SHA1 5214c2c7d2ea147ae273512ec871b6e849f461d1
SHA512 2139fde7dd57e619bfb5ed9392fbf6ce73b4be6f156e43f724dfa454851eec53c7ae357a39f3395f8c8f6cefe267f86fa06f114315195feab835ba8761752303
SSDEEP 12288:m/WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:meRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T179C423188E6E0086F24EA2F1E2E184C5D8BDFCF3FA85A44EF1C578E01775CA4272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 98ebe198d9fda9ce0304c6388b8a140a183f95156f9e01be1be6359a06bd57b5
MD5 8be3bf79b3e2b1d89227722154ff3069
SHA1 b88ddb8da84b346116801331830296d7e56306d9
SHA512 5311d033459d5d1060770eb4669c7f733ea088577f581fa035b0012c813630b93168002636e1625d1b1595e9f939c7f56e8d883dcba53afc11e0b0ac8d7c5845
SSDEEP 12288:QCWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:QzRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T170C423188E6E0086F24EA2F1E2E184C5D87DFDF3FA85A44EF1C578E017B5CA4272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 0ab298d0afdb25139ac44d6a418ba7b12c51e8be481f154a5f666340daa1ba59
MD5 dfc91e8803bd99aaab3879bb33c792d4
SHA1 b85693133112b9ff2e29a66ee0e8111f4e4d5688
SHA512 a9b2ceda8f08ee516e80f736df9220d1d1842911716e3f1c1f5836bb6d8356be880ce1d2cb02e592ee0d10f6fd937ed3f6b33afaf31023270b12e2f935f40602
SSDEEP 12288:j+WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:jfRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T16CC42318CE6E0082F25EA2F1E2E184C5D8BDFDF2FA85944EF1C578E017B5CA42625D9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 af1aa8814a6c408c8a8b1f4e1eb736e676c6e83a9af515ea3b96c58417451a66
MD5 3f6930fdeac6c642497d906ee31ca4df
SHA1 2f8cebbcf94a9354b6ffc513df4c1a3c97db5dc8
SHA512 5d46a5751ef1563e9b424d31a3c72d7c0b6a650efd9dc5fcdb99506ef6d1295d12f40ac3f6efb46282d99cb07ccd671b1d71f6052719b125982e5f93f26144e7
SSDEEP 24576:1ZMSzFVSOHRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:1ZMSzfDm+brLC2hTR9quLB
TLSH
T12E050294B36408F4EC67827EC9618946D6B2BC664B60C60F13E436671F337A11D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 f4312867c08267f3ab53614900c51ea0fa50e10b842e0509fbdd3f94482dc84c
MD5 9995c852767c80f524d1e82be6e0a891
SHA1 f6e16db7e8e5bc92bc49cf135a8d1760e45e11d3
SHA512 5f41772b7721e71c695ed350755dc3dc4c2890345e97e96e71de80a70296da05d6083fcc65a0023fde3808e208fd50c9e1a873196025781730d82588845b10bd
SSDEEP 12288:y5WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:yERmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T147C423188E7D0086F24EA2F1E2E184C5D8BDFCF2FA85A44EF1C578E01775CA4272999D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 8885e8a33a244231b64238775894a6f4c22e293bd6a03fea6ebc6c921b24effd
MD5 6cb6c6d0c0d3ecce93d229f5bea16f1f
SHA1 30a785e3f8546bfedbd8f591d0a07ad714f775dc
SHA512 8471d4fc90fd83feac9c4711d4970eaa29d002a144fe985346fbb5da5f1478bca6287c15d34620e6749bf370c79ec8aa81217d146b9d5a6e6efebded8ef302b3
SSDEEP 12288:8NWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:8YRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T147C423188E6D0082F20EA2F1E2E188C5D87DFDF3FA85A44EF18578D017B5CA4272999D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 f4b8d28bab8b5df758bcf1c5ebd9df23a04f73989cc0a4558b24d2d29a91abb6
MD5 76c60efba5d9367e580b538fca2aa982
SHA1 6af07e3a9fe06ac38dbfc1c14b70aa5dd26406cc
SHA512 5ad9ff68ceb55c5b61ea2fe32ff917304c8aa2ee64355febf46aa406fe26f1bf69d01d542fc8096120003bab87b4e0a8a5db9663dfe4e796c001d52132122de9
SSDEEP 12288:zyPz5L8aWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:+zy7Rmlh8t0D+7y8G2G9yL0cMoThTR91
TLSH
T1D0F4120777A520F9D17B9274C5A20942F776BC7257208E9F639016B62F33AE05E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 85f1bcb8b07175e0aef89fc22438cbf55bb86d9600786d05e44117b0d94f89d5
MD5 77554b6180ed48d2a6e6d3c209609141
SHA1 d79d98c69b3ed102c5681526a67945b1e3524919
SHA512 f82b3c252d2568d69d430569ba3a826d62fc54998947063d473926dd22ef68a1ef8116477892ea3ba1719525af4cf65c697dcce7e502e8a37edc551cbad84d72
SSDEEP 12288:c5WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:cERmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1CAC423588E6E0086F24EA2F1E2E184C5D8BDFCF2FA85A44EF1C578E01775CA4272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 95a0467f91cdc80038c2ddf9b775f71d128c28c7868a8332b40438ecc2072a03
MD5 bddad6aeeeb5a26c48309ca46c561ddd
SHA1 8332e39436116acb457e6df3efea9b279229b321
SHA512 218aa5b4fe54dedd946514feb81dc753d0af50e813d9b8d5843677b53558720d000efdf7997fbfc4dda9bf064ec8079dd62c0a50de7c9a93c61a6c5d1204ca96
SSDEEP 12288:k5WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:kERmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T10CC423188E6D0086F25EA2F1E2E188C5D8BDFCF3FA85A44EF1C578E01775CA4272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 eb8970de4cdbbbc50809e51150ea7644ebc8982b71128f0999eca3d326a708c2
MD5 d5a262309b7a47166c056f5489cf8d3f
SHA1 bb94463fb26d4e2e8efb07f8bf1e08d7e600a0e8
SHA512 2e30e197dbe01418304e4cc460fd2469506f6d50befcc86e0a1938f10417e18107af6264ce8f2a446d8df89312d72adbfa8e6f142d407de1073d499bebf4521f
SSDEEP 12288:KyPz5L8aWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:Xzy7Rmlh8t0D+7y8G2G9yL0cMoThTR91
TLSH
T172F4120777A520F9D17B9274C5A20942F776BC7257208E9F639016B62F33AE05E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 1870c400851028a2b5e6290c8f07bf064379ff8ae1a7798ff0c91b39e556cacb
MD5 b3a7d47ef21e73871ef7d3705e183753
SHA1 a4fa6ad70eef88bc1ffd97ef69957f911a1da2b5
SHA512 7bbc14c8c0960269db7aafa6feca8ac049e30d6fec546f54d374683669e0042542eaf98825e9b2656eb91de41421eb6ab860109d6e7a0866a50056e6a91daca9
SSDEEP 24576:TTHaLl3z0zDdRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:TT6LljCm+brLC2hTR9quLB
TLSH
T112050294B36008F8EC67827EC9618946D6B2BC6A4B60C61F13E436671F337A11D3DF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 3500ee708bf6d4cdb09d419a818b1ec6033d3123d65af2fab084618efaa449ec
MD5 e3534121af9fd71858ef4b82395f02cf
SHA1 ba19cdaf648580f0c7ddfc878502b88da1f55274
SHA512 cbf84a93672e76fe66801c5bd6cd2937830c954edd9fd860bb40817e964ad94b87920f9d0fe79a7260934368ee3f57cedf740276978d03dd4c1e593576b67cba
SSDEEP 24576:137d9CHKy7GZ5Rmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:V7d9CHKyaDm+brLC2hTR9quLB
TLSH
T1D825CF90F3E810E4F1B7DA35C9728511DAB67C9A5B21DE8F03A4255A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 65bbbeab67f815ef54e780eefbed1910ae3406e0ec08776e90e6b5a90b9fbb5d
MD5 f1af4ae638758dc04e45cc3e2d4d8e92
SHA1 587af77b682cf0c33ec94ac269eab2031cbb458f
SHA512 5bdf512ba8a29b14450d3ca75f12f264831d79cbd8dd65fc32b92c38019acd28e740c1018580892efae809f9f3c2102f3d99ff4bd401468d0ab8980e2870ef86
SSDEEP 12288:z4WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:zNRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T187C42318CE6E0086F24EA2F1E2E185C5D8BDFCF2FA85944EF1C578E017B5CA4272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 2aef021018b949b33f39bc1754662009122cb52ce9bbc93ffcdbffd0a6a8d359
MD5 bebe6aceb08e08a864abf31a6c4d1e7d
SHA1 c4f4e43f80272773dce6f634d1f7443c033107f5
SHA512 42f5e533fc70b5a596c1663632014bf224214fa27ae7652773bfd0202b23496b30d16f90c5ca0380dbe39b1c3248f4788027e464e5a2258451d2220c941d4a4f
SSDEEP 12288:a6WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:abRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T148C423188E7D00C6F21EA2F1E2E188C5D8BDFDF2FA85944EF1C578E017B5CA4262589D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 67fcaa45ff0b325aa107996724bf2b8d9cd89aaec19f51f79ba1c031bfa91ae0
MD5 700b074161680fa331ad88e95ac46638
SHA1 e2f8a7b3e78de763b01d3ad6b6a878c322bcb203
SHA512 ba58cb44279eb327a42948aa60b1a4de4e7317347158efd098c7bd58ba3295794948cad13a8bd07ce703d71f3a5fb2021773fa6c82b4184d7e52243dc3aec008
SSDEEP 12288:8bWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:86Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T182C423588E7E0086F25EA2F1E2E184C5D8BDFCE3FA85944EF1C578D017B5CA8272589D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 b0ccd3db9bc1a8d3a0632f9edb0efc87ad4d1f0a43af4faaecbbda323a3c1f4e
MD5 c4c77a13281d0a54f9ee7f8a98b5ad6a
SHA1 0e26671f38bff846ceec2fb758eb47be8b31d74c
SHA512 e842c8f00bd6f6d26e88c24ac4b1f6b503cb5417a7edc8925e26431b393acd675849b56d23067149dd06e722f4fe2e44f153bb80d66c92824488de59a3c49ef3
SSDEEP 12288:i5WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:iERmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T129C423188E6D0086F24EA2F1E2E188C5D8BDFCF3FA85944EF1C578D01775CA4272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 02877cf60c643eaa5c1bcc366e605e111613ae9ee65d34a0c53cbafcbbcfd73d
MD5 065c0d8a65dc60ab714ac67a3032de3b
SHA1 1e7dd5f47543480f0412d6325f54220728b99b4b
SHA512 1ac753bf2ed44b54a1ce6517688a4327aae05b4600b66610e47c1f6098c24143d357f951e9fe0afca1d9e28b098b4cfb540ca2dc9b502c93d48084bb7142dabb
SSDEEP 12288:D4WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:DNRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1B6C423588E6E0086F24EA2F1E2E184C5D8BDFCF3FA85944EF1C578E017B5CA4272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 da0d7f94627bc19a9f4852a11d113a5212bd5422649558af35832c091c4d68b6
MD5 2108a3ad14e21cddb332b08e704cb5cc
SHA1 8cfadbb1dc411d76f8117b4e374e1737a676bd82
SHA512 f6fe1acaf074d0dfe1597b742d64b5417f331b9b05d68b2b87129221d792a5d6e41e215262b7cb58bc85873d62cad2eb5738f19ae14e7b32cf4d7ec577484655
SSDEEP 12288:wBWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:w8Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T19AC423188E7E00C6F24EA2F1E2E188C5D8BDFDF2FA85944EF1C578D01775CA9262589D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 55c3acd5679319bb8f539d94cc41acb51bec5aea58e535286802851807d8cb69
MD5 b38b8a486df718e29cfddf4beaabe7cb
SHA1 d0d6ded98bdaf1201c3dbc039dd04994f2043fc5
SHA512 595b204f377d0f83a20751d30ee1732a474fb1e4eb433357c792670fbe70794aabf0c524f63199b0e3687624b6472b09f100909cda3ae653e5c1ccdc904bbc94
SSDEEP 12288:Z/WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:ZeRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1F2C423188E6E0086F24EA2F1E2E184C5D8BDFCF3FA85A44EF1C578E01775CA4272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 23e6ba850102a949441ab78cf2cd8c68a9b7d44fc9a85a5df49bc9448e72f6ab
MD5 8698390cdbc318cb7b56792880ef0ce1
SHA1 40ed4ae4f761ab78b7f93e4d7bf8e96e4d2d26ac
SHA512 758c4cdbfb28549724f958a2b983c22937999488075492ea253e4e9b25af3c7cee904962c0e797e063ebd8104808af256850437792e2467ba1ab16e26c29f3fb
SSDEEP 24576:Afwvok9RX6wkyAIoRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:IMnYIom+brLC2hTR9quLB
TLSH
T17135D029EBDC04E5E177923C99B3460AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 26c8854427974e7b8eaddeb48d1f26548aefe4db411dc07090579c21c6d85643
MD5 3dfc70369866a7ef08e6d1929d033ac2
SHA1 169e62aabddd054b65271dedcb2269e0907a3708
SHA512 6729496d85d3e9d5a3e6af887ce130d816b4739ca0ddd1d1f700ba5c75fff5e8b5251e342a3cacd841f39f56f4487e5df6dcf3e3e171baaf154274b408f46fdc
SSDEEP 49152:IYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0xm+brLC2hTR91:WySzP5mqrWETR9b
TLSH
T120067C96A16801D5C1B9C1B98B17CC1BFBB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 cafea0b3befe84eeea482485eb8a1634b9358a8ed028631af15e1d0251ce213d
MD5 f1094362ffd4b5f0c07a33becb7d7362
SHA1 1a77d314005287e4f2d5784dfba05303ed84dad4
SHA512 b9bf24b321ed3635d762354ab61d87d28e7d43f28d0c30d3f3128b5e8920f527b9309fe3ded606cc3260eca1a7e5fa5535b92389eb895f5dd287392011a6fbeb
SSDEEP 24576:747Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYXRmlh8t0D+7y8G2G9yL0cMoThTR9PN:747JUQj1irIhCnDHUPfF/Bm+brLC2hTd
TLSH
T1D465AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 5c43fb4423dbe59fbc4e6a3ff3f8c75ef25fbd603454527a2151c42760f0b426
MD5 6c2ac105b7cb18bf51ac1dd8cfa6bcf8
SHA1 7cc91423b4010c861df8f26bbd45353dcd9a20be
SHA512 3fd0a228f776db0f88e271e5c9ab5016543b2f7b5236bf1e15ede8d2b0876da0de96b0f5f3ff1031aefca63eb472714e67da245f380bb0dd91dcc3151054661f
SSDEEP 12288:ENsfpWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:V0Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T142E40119D2A801D8D06EA275C3928A81F3377C6197E1D3CB62C0F87E1F769905EE9B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 afcabcb6a91cf39c17f490556bb10f2086a9b0f7dec35458a7529e04e13325cd
MD5 3c1888d5e9b8fef7427aed2d23875e45
SHA1 351f6e6794d4a0a6e1b93050c3428be3de36909d
SHA512 ba686d19a14e0f16ffe8376b945aa81ee2a639e6a194ddeba36a5a1899c82858b00b62f948e0ab179e6aa556c9116b38537540275e363a494109ed4fa91b2bdb
SSDEEP 6144:qsBC2naIS5aLR9yJfcbPotMxL1ITU3fUkvAk4gZ6F6PD0KTGjgCzbBrPZfyOpl/q:vtqXU3fvBZe6PDtGZBrPZfyOpl/4e+h
TLSH
T1E9353810766BD75FC6AD40325E77C2CCAB707D41EE059B0372C8972FD476668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 ddff0f0571be2d669ac1c431422da7bf92184d129c4522650be50e349829f162
MD5 c9138d7b35c55b2d182972196e2cd05b
SHA1 93855e6ec3ff2d94ac99424c37662fca560724fe
SHA512 5436360bfc3e5a854e54fadca5750c7104219e73408ad673dfe61c7784584284fe714a32a62bc26c52b59f7b37fdd4feb18af7f3f381c15952d7246926b145ed
SSDEEP 12288:TZRBzRG47wTgAync7QQMpnc1McZCEi0R/0SbzAdGHkMn6hrcfxw0nM4T:4Bz
TLSH
T11365F881A537A38FD1FB6072072A5A4CB764EC02B7056F277388453AD82B765B0BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 ae38b219017c78a88ffe2a1d0f89d69c79b0b2ad6f147c0a363fd4e497c4a75f
MD5 f84363324bd28547a58b8005d0c751d2
SHA1 38686c9af81bc8fa8987ef9a9d1d80182c8a943e
SHA512 85ea0bda25d6e76f8403fc0c2ee0ddf4876e59d725d0d40a9e3a2d2237eb85a35fd1f24b7e95de99fc383ba72e12638e71b83a230ba736e6adc26bc3c290f3bc
SSDEEP 12288:kM7xWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQof:FsRmlh8t0D+7y8G2G9yL0cMoThTR9PyK
TLSH
T1A9D42318CB6D4482F27EA2F0A2E1C495A57EFDB1AF40D4CBF08575D02671CD45E34A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7e5193e064d33ba582c86a2deb842d1c1c3c5e5f451d612a4a6c63ff38dd7c17
MD5 ed9e06cc54104f9c9b74e746ec0a7544
SHA1 b33f4db1a373bbc34b19434b12cb6861ef5683e2
SHA512 7e6e1871ebc912ec0344f6e6f5b83b040a794d8df0354db65a3d10e9a4692c658863ed5fbbf94a088881f3012b373dc224595205b93d9f242e7af163ed2611c4
SSDEEP 24576:Igb6bmBIi49WNNFpg1rSvFv7bYCRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:Igb4mBIBhGFXm+brLC2hTR9quLB
TLSH
T1AA65AE1E22EC02F5E0FAE2B8DDA64417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 701a9a5ee872d843c15da31517981a55c2bc40029947048041cf5063ba749e1a
MD5 3bec1727d53d41ff16a2213c99a508ab
SHA1 13d15c920344c5d0140bc704fedf58d5e21b4889
SHA512 fed7cc8b14f8c484c84edd6be2c0c91c99465fee34052cc8f80e4c2e1a8cb1b9580bf3c16f96bb2f018f3245f5a0ad85a8d4483573b84fc91aa526cdefcbf6ef
SSDEEP 24576:9G88u8FpJqH1bzria7/mHRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:Q7ZFPqVea7/am+brLC2hTR9quLB
TLSH
T1F935F16577E501F1D07BD138868246A3F6B2B8251364EFDF07A88A511F23AE50B3EF25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8de2dcd90ec63b4ba550fff1f676185bb377fd2b3687bf97d87f54bb2f7f1bdd
MD5 7dba03020b95175d49ae1ce9cfce2ca4
SHA1 4c17e0813c00a594685ea3466c0751be0894104a
SHA512 379c0d65779ace304982037905b61e55f52e861ed18b3475f40583857766495bfa7bb66a47ac205dc6b729bb1094de5a4ea3ad542ef198825b38dbc12eab3ffc
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzm+brLC2hTR9quLB:FG05lO43bgmqrWETR9b
TLSH
T1CDD5CF6E62EC01F9D1BBD17CDAC64A0BEBB23825032556CF02A486A91F27FF4557E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 644a931a84796eac491a68ea07273c7b32ce7ab691f137e813acd48f1dc39a4a
MD5 aad883673f4f7dd54b5381196b39cffd
SHA1 10e45f36f0912f607a1319ca65d4f1fc24d5e858
SHA512 0228a822054e852a28a089cebe1995ccc6decd095d7e1003a78f219ec7d9a9db171f6e44e72ab8fcd5e57d22fca687809f8d8dea0d3a6cbb65d2630aa9f02bab
SSDEEP 24576:Jfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnxRmlh8t0D+7y8G2G9yL0cMoThTRD:Za5POZ3+Jt2pasx2+mbm+brLC2hTR9qU
TLSH
T1BC65AF5EA6FC01D5D1B9D17DC583861AE5B1342253319BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 257490fc62b6341a0111885cccd5dede799cb50d474eca60e60af9d00a5312cb
MD5 179072beefe87bbba5613bd38982031f
SHA1 e95ce422ba715eae0c40bed6534d18192c4a9632
SHA512 ec7556faad93ddba01284519be99ffe238c3fbb825bc3da51b03ee9c257d86c06b932e9f37cdb68d1da538a3b4858bec3bf2ef255e94a780791c150c68ec898e
SSDEEP 24576:+NcwHdjbyQ4nLC18lb/EOjowL7FkPRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:+Nc/zEOVHF6m+brLC2hTR9quLB
TLSH
T127858C1623E901E4F1BBE1BE89779546FAB1786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ac6d997a9b519679f954eff5a0fd2d6a0e56645d254a5ad2cfe1cb8d43ccdab0
MD5 4178ad7fb9eac2fbc4a8939056677ddc
SHA1 ecebeb76c3ccb61856eba8c94bb22bfd143f7416
SHA512 90f407d74987c23e45ce97e4855aa1863daf087246879c84284a942a8a649e8294691c7698b1db650d8c913eb644568fcaadd4e92edd67322adaed5a18d00106
SSDEEP 24576:i8kNvNnaFeYhJNtmZBm1Rmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:i8MwBtOm1m+brLC2hTR9quLB
TLSH
T12855AF6EBAB805E4D1FEC6B5CD238512E6727861173293CF5290C13E0E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 ffe9e0483b9910428e09994884e98d394237fbcb5bbe15c6f14540a3c051490a
MD5 a59f73113c6b6a714600ae9575bb8057
SHA1 bf50aad40908a276342af442d545a3e9cf84955a
SHA512 515c23fdda12e3dae5cf715fada1de8d5fa8a08b757b1014641eed484ab12542f1a6cdcad9699788b021ff6899fd4d8d09b08b16ffa935624931429651e0755e
SSDEEP 24576:gPUr+NQDRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:gJQDm+brLC2hTR9quLB
TLSH
T1EA05E12E66AD18E5E27AE17D85828609F771B8621712D2CF02D0817E0F77DE8BD3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 9efdacb047c3a04ef68c1330a1b249d98d61d94de8d885833db6805604bcde48
MD5 c0a7e4c5aff3470b29ecec73a6faa594
SHA1 870b262a71f2ba4d6b8d198639bde0c96edf78ac
SHA512 a74965e3894715ed1545debab8ff4d9916282f3798207b5fa2da799299e4a8af97729aa6c17aa1bfc1ab5ef6cf27f831d0fb64292dfdb31d2fea1e4c12926ffc
SSDEEP 24576:TD3FHshBIYQgAwRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:TDVHeBIAAwm+brLC2hTR9quLB
TLSH
T1E425E13DEA6C04E4E57BD1BCD6A38A06E77178A9032265CB12D481B51F6BEE43D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/604-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/604-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/604-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/604-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1472-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1472-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1472-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1472-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2148-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2148-95-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2148-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2148-327-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2148-87-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2148-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2384-63-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2384-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2384-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2384-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2384-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2856-101-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2856-107-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2856-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2856-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2856-313-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2856-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4168-279-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4168-57-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4168-51-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4168-50-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4516-295-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4516-73-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4516-67-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4516-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4536-93-0x0000000140000000-0x000000014040E000-memory.dmp

Download

memory/4536-1-0x00000000021A0000-0x0000000002200000-memory.dmp

Download

memory/4536-9-0x00000000021A0000-0x0000000002200000-memory.dmp

Download

memory/4536-0-0x0000000140000000-0x000000014040E000-memory.dmp

Download

memory/5076-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5076-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5076-16-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/5076-22-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/5136-126-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5136-137-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5136-132-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5136-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5136-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5384-83-0x0000000000910000-0x0000000000977000-memory.dmp

Download

memory/5384-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5384-309-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5384-78-0x0000000000910000-0x0000000000977000-memory.dmp

Download

memory/5924-312-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5924-120-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5924-121-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5924-114-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download