727f89c10e00531bf19747c2232cba258e85e2cd041d0b0000247591a88838be

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 3.7MB
Sample260804-tspbpsstfx
SHA256 727f89c10e00531bf19747c2232cba258e85e2cd041d0b0000247591a88838be
MD5 2dba6d873cfd97858602dbfea52c04e3
SHA1 c97f102988caf3619f7aef5a1dc786d839100844
SHA512 027280741dd0c37ea5a51111f9f28ceefb2a70517aadd9c42c840ab77bec84d94ab21527dd5fdd74d3b88cc60b57279ca631c4039f06e7d4807575c0e2b05491
SSDEEP 49152:o7JynhJ8EhdVMw7Y9odwfDFqfFFJVgrvqzbut1wOq/eVgXUeT+uXEkjNEEBHLuY/:bsoEC9Aa+uUkjDBHLu7Lm
TLSH
T12B06BE1AA3E406ACE0F7C679CED6C553D776B80D07B1A68F029098A64F772609F39713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4232	elevation_service.exe
1924	elevation_service.exe
3064	maintenanceservice.exe
5796	OSE.EXE
5172	PerceptionSimulationService.exe
2072	perfhost.exe
1096	ReFsDedupSvc.exe
5456	SensorDataService.exe
5712	ssh-agent.exe
3576	AgentService.exe
4300	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cfda38f6238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a29ffa0e2d24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008fa804102d24dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000664a58102d24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000fb207522d24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000048ce5c102d24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000057a7a522d24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003298e50f2d24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4232	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	1096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1096	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1096	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1096	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1096	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1096	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3576	AgentService.exe
Token: 33	4300	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeDebugPrivilege	5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5264	2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4232	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 5656	4300	SearchIndexer.exe	100
PID 4300 wrote to memory of 1372	4300	SearchIndexer.exe	101
PID 4300 wrote to memory of 3944	4300	SearchIndexer.exe	102
PID 4300 wrote to memory of 5328	4300	SearchIndexer.exe	103
PID 4300 wrote to memory of 4684	4300	SearchIndexer.exe	105
PID 4300 wrote to memory of 4944	4300	SearchIndexer.exe	106
PID 4300 wrote to memory of 2232	4300	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1924

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3064

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5796

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5172

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2072

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1096

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5456

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5712

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3576

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5656
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1372
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5328
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4684
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ea07b0791720bd006d80786938cb9dfcae9c7b19c1d2cd76c7806facc0a8fe5f
MD5 4dc70b657b9b117397e9b246f211b4a4
SHA1 76e979333ca93d5c1b0f45592008d79df5dfaabd
SHA512 7a257de5d620b2a91bdf791a2512b503c33e6979a07d4afb585df697a850ab641ac3ff7fee28160765fba81eea3244eb6ff2eb0ad5ecc06dd917c37e015a0772
SSDEEP 49152:tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxngQ/lFTjN4:z3q6HjBILm
TLSH
T11CD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 c52dcfcf1f4cbbc1f70bf78a22642e797e52c4263e6e7ba3e345d206386a875d
MD5 0be34e7e07c4591bc223864ab22774b1
SHA1 75824e4ef14c376d08ebed93c8c8e9ea3bc3ba0a
SHA512 838004bed6be2b34916d88632355116d542a7eaf4970baebe4838c06fadc7ca19f36d24815ccd52576ff68fd56035b57bb160dd55f3ff2f3dfc159622e6cd0f6
SSDEEP 12288:Q1XLsswWkxy2lRq2czA3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:GXYfDtczAXnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T11D65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 658625c7703a54e68a58c821f3370349b337e5b9ff388b0024d922808928075f
MD5 0399cf02b3c368b921073ec476c30be3
SHA1 2ae836cb81c6c575e110fd6e1d9d334337b4ca69
SHA512 e639f5303ea180c5638ecea65b6be1f5fbf7b9db48b4067adf3fc1e9f2ec6b2208a31cd37b6f243b7e0ce593be991cd218a9a08ac51ceb7eb2e62f3e0b987f0b
SSDEEP 24576:v0Le5ji0hmxLrM4nQ/tbw/2Mkjy6Fr7g0or:vPji0AlFQ/lFTjN4
TLSH
T1A1859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 40a2c0207f7e36eb72c5f116c14cff03944d1b0949c8f630fe519e069b1370da
MD5 fc1c58c51d464edb4cb411289842acdd
SHA1 300ba3efccd5ecb9dcc3522699412eecd648ed58
SHA512 51045e884a0fbb85bcc068f4d0e4f86df2d7f8db4b6efee32dcc7d97f90f3d498ffcb1a6cd152074a24ff932f996fdd49d7fb36b6e3adeabb92bf8b6d97694b8
SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWE6q8wyuSnQ/tbw/2Mkjy6Fr7g0oS:t/ezSC6vUzPvxHjyJQ/lFTjN4
TLSH
T126755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 69a8e5453d80793a1d486df5e5c4a7d2da99c09fae711150db9e91448c8936cc
MD5 ab78163743a129ce4348286ea885d889
SHA1 3173d2ee72ca0370b660296bc7f902d7578e9aa3
SHA512 657bd5f9129a6c44d80ef9814d3a4a03f21d137a7f5aebad993c6fb2f2f3a54711bec6a8d7f5f6bbc9013905f083254b20e4df40cd79c17223b2ad056a8fe46e
SSDEEP 24576:eVbqPb88hv/l+6znQ/tbw/2Mkjy6Fr7g0oe:eVO88hXl+cQ/lFTjN4
TLSH
T14A559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1733d0f025b09ee2296b560e91caa61ecc5822eb2a2411e8b1507bc9b26e9f05
MD5 283fd6620d029952838d3a98f6b88d66
SHA1 cc4bcb35bf17d591a047a1c9e1caf7a4673c97e5
SHA512 8f44920eb966911976d0fa75a076b1b4ee56300a94ef04281e42edd1116bded06e033fb3e4b6bbd0a1198f56393119f82a4d5c98a8b7b96da597e078fa7dfeb6
SSDEEP 12288:czkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:czEnQ/tbw/2Mkjy6Fr7g0od
TLSH
T17F5523796A24F897FF2B06B15CC284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 d5d9b302d5aeded3d06fa3df3522bf024323eb3f61a90e585ddcb54629ae7b66
MD5 7d5322556b52cfe4b0a46f3b34e70dc9
SHA1 2da3abb5e2d2a8e6c579da761b721d268e46ee92
SHA512 c4fbdc740080e69bae25faa51132e5db0bb2d2dee11c2cf11f26b7be67603b9d3ff121997ffa8ad13f7d20a49bb629bea6120b6f73d95358b87c47c9495ad506
SSDEEP 12288:beBNUbTVO86U7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:bJIUrnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T12575CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 062e68a908244df162814dba00c1f937bae61af05141848dbcd4f5553bd4b3d0
MD5 246704bd8080bda0b166d5ea721a534d
SHA1 88acc41b73a1bbfa0a727d1d56f0860bdc26f494
SHA512 66b89ff3b0bf47d3bc3d79ddf3b863c24361ee67e31792c5779b4c5ff6c3dffcd63de082ecedfe018b6a6f4bab33b7741a0cac8b6829d4cb265e31da7402264f
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THL:OQvGAdlCEL8c/yRNw5CtLm
TLSH
T1D9267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 d9af8b95e7eb672c6518d7661b456b1e57ee48fbf8725bb8d859d04a53b28697
MD5 e101e133814ffcb95edd2d9c275ab6f8
SHA1 67bfcdf1630782f75918042ed1b235c549f7b747
SHA512 5d732f88458a5a4934f73759e10dca3302e9fdf1715faf7ff0513f07f0a9e9d6f82c2adb41d9fe5ed1dd64fdc078226bbb82b26a3322c633d642ac803e89d859
SSDEEP 12288:nAwSfxL/2Dc39DLLmt0LDQewsAj1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgz:AQewsAjVnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T13975E031FE74E436C77F0DB21B22C706593D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c7240fb911ad050983ba0659a27e5e4b43dbbe17b5182e9d517b9bf39e180c20
MD5 6b86d41fc06242d6ec486af17e1ec863
SHA1 7078057839540f424d72f7ca708b6890c771e815
SHA512 2fe921678b853699c1387f67d877686ab1900dcd76861fb5ce6111fec9e89df8b03732fc10e3dffde9349ee56ea7b6916d80de184c3ca6c544e6acdaeee73013
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHyL:rUEtQevvqc2W1cpV2EI32
TLSH
T168474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7c75e02a80b288676bc0e79c2da1d7b53beb9f87cc67e2cd5c910c756e3df028
MD5 7c90e214d660790e466e6ff8c892982b
SHA1 a10900f34aae563a6bb0608be3ab4363fa0b1433
SHA512 eefecb999807f58904b87794261acc0eaf8aa385e634f4cb39bd6445a0539e6b4cce225cb3e8bdbf718584b8919e0acfeab0384ae93f39e05ce3fe56565e9d28
SSDEEP 49152:1CbRquA/m2yL5zQfFiV+XenmE3/z1Q/lFTjN4:ioqtVjnmxLm
TLSH
T117D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2cd870316fe78f7f1383b207a1e5d0952e881150e02ecc4b6e43060f89bec873
MD5 9b324204be1eb9b13011a58900ee16f8
SHA1 0c3e281535dcb6f65fec3e6a45c1d8328a5d3326
SHA512 2ce5da662a84e266ca695371b7dc630bf25a9246f9c99af030b13cf777aaebbe3f88d7b0e4a048ee8abc1bae7df7b4baae915941d63b29ea38596659d7828aa6
SSDEEP 24576:VAhGLJIFoiwtA5l7S53GnQ/tbw/2Mkjy6Fr7g0oX:VAMyFoiq52Q/lFTjN4
TLSH
T1C935AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 d379aee1edef1d90d34e58dca843f6f575717b807de375351cc9517afecb8dd9
MD5 bc8ef27e8e23ba9d0fbb81e3f0fe7053
SHA1 d7a3906db64dc57553f6de175f159e55b7d0552b
SHA512 4b93b93b1da3b60c033f12bbc3693225cb84ea5d1b5bed43cd7e2a05b7b876a7dad6ef7f480abe6624bf0f71b2362ee88421c46c4ec033c2193c725bf6ea4781
SSDEEP 12288:wmw5HEjsChN2BFgl0WDm+CyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMr:twuHOWpnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T15E65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a11ce01e89a5c381415483708ea87d31c60439cadd2276e59cfd804951c5ddf6
MD5 043de4480717446aa027d24f21e96234
SHA1 d2dd788d77b033f2cb415fa447b3042252b1e44f
SHA512 dd2aab756934f7df339ca12e8e867f4f3c468572da751d79b7d9ac82e87637ca6f438345449d9d425e16ecf4e457aacc871d94f29be03560cf01d930ef122ecf
SSDEEP 12288:bXZ1IyFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:TZuwnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1B455126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0e9337790247bfc460e95915cc376685ef9da3cf157f58a54d6844bbfc87036e
MD5 b37c161e3471c00aeb7fe5ac60125f99
SHA1 c6ed9a9911d3cd98fd20096d3f39785c46109d18
SHA512 3b992c830d25a10f0c1b43f39acc264de458e55ec208f54c4aca75a0460f11c36b52b266fc81a9b44c0d0ed20e069da2942c9666aba72a48ef42390f3190f49e
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uf:/QRQyi36YOcPQLvw2gAf+PN3ELm
TLSH
T1BF666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 add41b1ebe2390eea79e4801c2a6696d5df4c85bc7b886156d12e5e128381414
MD5 7c88001094e5e417844da86bda8a4f56
SHA1 2774557f6749294f22d429c9118316e49e4896d0
SHA512 879c033a1c97db94a15f23c56bd23772231c6cf53f26f5dd7432f36cdb2f09b1213b24a5e692bcfdc086bf3516403b5fe1a568e06e8253baf740d406e1d0a950
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uf:TQRQyi36YOcPQLvw2gAf+PN3ELm
TLSH
T1E4666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ef2393bc193b2e6539b17625964f359f60e560ad25606894c9b912343f31e37d
MD5 dcb975306f253016f5542c220bf4eb0f
SHA1 932cbcabed4008daa3b83fc46b3758360483190b
SHA512 43c8acb0cdd4537db93d5bf04ec01296667eb5628989e8aad957921715b7e0f89af9f70492ac58068c5de4c47c4c83c3b266761b10f544e9eaf10c7805b2dd0e
SSDEEP 24576:GwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0gnQ/tbw/2Mkjy6I:Q68Qg55nhheWu7PNU3/FQ/lFTjN4
TLSH
T169B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c493e0c9c69ad11cdf26715e3160b3f53953075405918d5a6be1dfc8f606c029
MD5 302d57d4b9d87845430a152c3917045c
SHA1 5fb06e8978dd7d838e9e4f060acd02bd9e2c898d
SHA512 75c7c6f8ff166c0c9c6d2e10e1f4ed2b8168cb4ba3600ffd6c33282f7b8653ffc9e155566593dbf78fc37fcecee3816fb96a09c9907969ebe6cc627ac1e1107e
SSDEEP 49152:Y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99F:Vy5112gYy5azzVvL69nLKnhZ3Lm
TLSH
T1C0167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 42db86e0e2648196831ace98a856a55b55d14325fac3e9dc0c6ce1882e061786
MD5 319cd77d5263d17873cfda1291bfa3ae
SHA1 2b6f8800b266b9e81cfa2cff1c2a29fa9935ecaa
SHA512 1942887b6c6bc5d703de43789171ca76eb5705073015f572940c6cd074eadf1aabdb495f5c3477311d592adadc5d53a5e286d73789492c46f8453eecf02aaa2c
SSDEEP 49152:zB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glHQ/lFTjN4:Fu6JmVxd2dsLm
TLSH
T1E9D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4178c1564886cb3e21f394f2612bfa05d43d36c133785c9227ac44343b256fe9
MD5 2e5eccc507bc02c59d7d6818271131e1
SHA1 9cade8431ac7ae9baee576a97f1da9fe2ae8c57e
SHA512 09ddf70dce831dbb128bd8d22b0f6f2f1e361567ed7379c171030f918ef2fe40f4e88963f3db1578d8502890c1de48770136dc72567d03a48dd17aab1709ffc3
SSDEEP 49152:f1hpsNoJpF1A6UU44CwH7R4xLQ/lFTjN4:fmifPbRxLm
TLSH
T13DB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 56e2d1a8579d680cf562fb4f43ae6cb009a50e9260194e222515884aa6431b63
MD5 13fc92bbf8b45adee4ef351ce79f254c
SHA1 5461cc8c81e2b21579367f7d49a244939c152605
SHA512 d83e44af62464fc51e4303692c77d6a0cd335ca928641a3bffc59cb13bfce7fa83025f199de5d5972c81a27c4280716d21dcf103e136843ba82fe60df1c930e6
SSDEEP 49152:wSuZQIY0Be2KRRVtOnks6NMHqwQ/lFTjN4:q5dKTi61DLm
TLSH
T131C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4b4c64e77163a84942c811199289da85f52fd6e17fc5027c7252a3b1589c824b
MD5 871d2e32a7ddc1545f4e570b3cf9f6e8
SHA1 154fb17fb443aef04a9bd03c85cbaf44f01be666
SHA512 79144315cc64e94d46283b52f7ccac79b2e68098ed64d47c6b2943c38cf3d0a884b8cd4adbe4cb28d36059fdcc79d298189485a8003705ac5d90157cb4a3d0d8
SSDEEP 49152:ehtSn8EApI0figngiDn0AP5wXQ/lFTjN4:/X2iyphlLm
TLSH
T19B95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 873957d0ffad4c94cfba4e380f82e6d5d45a3a7385b3a01806b5909716603c2e
MD5 db0da9070a03ce0a0319a207c066fa23
SHA1 6ed785ac5f2ca58c7489d1a81f55f7ca9bedc8db
SHA512 1ad375ea533b2303a05e55803b7cbc443661020257c176f434d92e337e6b9b45452d51906e80bdb1dafd3e698ab6bcee1dc4e78ef97ca60cfaa39373882a1d32
SSDEEP 12288:gcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:gcnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1575523697964F98BFB1706F18C828182973F0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a25678024a9f4442a26203925114794d0eb450976dbe6fcb152d26bcda0453b9
MD5 879973d4b7850b1793e31e761eb84fc5
SHA1 d5f4d763477dfc7023dd0c19c5f331f137cdf97a
SHA512 84e4f398bd68def2813add0a2d9fd28f78b36720d2f3e271a0423029438535626302e0ef40c71a68232cfdce0f4e2fea6a0519d8d71c825749edd875510e6ed9
SSDEEP 12288:5hGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:5xnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1ED5523797964F98BFA1706F14C828182973B0EC6BFD1A38F7B482129967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 bc25b2ce754826efd10d33975e4ea1895e67e73fa27cb7a640857314ff79cef8
MD5 7772965a45a177cad6dc468cab4c0ff2
SHA1 43d68cc6a6c0981f450ccb0f363612f2a0b51655
SHA512 555ac6ad580381c063fc230c2c7cc9fd4760e8a132bdefeff620db619e82fcefec5ff30968c04138844026b4e82a00f3345ff94716307f130832dd4c22a81614
SSDEEP 12288:UzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:UjnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1BD5523697965F98BFA1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 ad48542826c128fa87cbbe6ba7f9f7a4e4bf9ae818a362a1c83cecb9a18cd4dc
MD5 7aafe58c9ed869dde55bb4304ee0013a
SHA1 f1a1e54fdfba4d40c1802e9bbb1e676b51dae8aa
SHA512 ecae90f5aea021c2687d3930aecb8c1c6018aa58bd0f74c18d4620953ea4b67a613cb1f92201f06184bcb8e229b90aba4eb4db8e359a19fe2072a0ebc4c91efc
SSDEEP 12288:WVGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:9nQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1A75523693A69F4C7F92742B4CC938142E77B3DC5BBA1A3CF6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7687cd3625e52355671fd878f4244c4108e31882b18fd3dff7ae00a6e0788bc0
MD5 624a27a7b76c5a557783fe95ddda17a9
SHA1 81a7c1c0b3c88256e46a6e44b6718c80bb71faaa
SHA512 d3ba15437fb6f7cb11dd06715e44755862699badb94ddbd904c69e26de5042a88c08bce3573e1b4d0aec313cbcd4e4fd5f2bca51f61d051f2f2e8c441c70f23d
SSDEEP 12288:/uGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:/unQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1505523697965F98BFA1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 93839b0523953723a9682d64335c86f6768b9cc27d09bc416b7633d93752930b
MD5 41d85c24626102c8778ef2cca006498f
SHA1 9e436d7cc4a270da8d52ea21937e73898c628de6
SHA512 0b374f852a0a825f0e654718ab9b06d876c3224ee9d48b3de4b1a8e7875c50894f4ed5ed6d8d2407d45f40fb63763828ff8350bdf715fdcc141bfda7574291a2
SSDEEP 12288:HtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:HNnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T15F5523697964F98BFB1706F18C828182973F0EC6BFD1A38F7B481129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 e8b5998f4a6cca3fc1d7dd990a035648c41f697f98d65592f2d4778fd544edf6
MD5 0925fcf8a37f95266d6c18b3c36c6338
SHA1 0e761d28d69de87e3f6eb58a7c2ca1b8209024ae
SHA512 69b29b18dca0465b765682f31580b7c36db2c32cbfee24bbe34b128dfe7ab0c069c792e2893f233cc164e7f5d93e1a7837dd6cf7cc196c7420a2630454de9178
SSDEEP 12288:FJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:FZnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1795523797965F98BFA2706F14C828182973B0EC6BFD1938F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 e89c3bdf93a8d4452108d55e6c3aae47a3f32a284a7142b1c0297ec6debdcdf5
MD5 69a5fd317a5f7ef8ab0b2a3d9a61b503
SHA1 3204a0d8ec7d1f04296cf9af75b782fe3878ef43
SHA512 c5005dcc14722a7010cea11f7c44d3d3e63b40fa0459d099b6540c734f89998c07158c829b0c6dcf65c1540d9654c88a487518d32f737322da495c83128c0625
SSDEEP 12288:OiZwbDzzFEoS2cPvyBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:xZM3zFVSORnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1257501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b75eb478b398c8e8d999cd1295af783b023d2f86ee15aef1488317d7f1881527
MD5 c058548e1304cac4e7f422649e2fa19e
SHA1 27fbdc4ed7e6ef49e8edc35276a9c311b36f800c
SHA512 221a02bd79c8b63d61a70bc9d20c31882e941f6bd4447db8090d1f4a381e347c4ce741dfb267990111421f0034ec04919281735720256975b0b753aff6325ca5
SSDEEP 12288:1gGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:1AnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1BE5523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e7ec25d5aa27eade0a3e3cf594dee3a74040a6f3e2c5b57b82b3c9b7ba6bc5cd
MD5 3c263347ccb4a81bc10f68ace3c486c0
SHA1 409d3bf75257412d9e83b823870600a4cc028edf
SHA512 b6ff7d060bd4b44772f3902f8d74d99373fc36e45bf3dc56730951079dbd0e23276837347c501d4e1433ac7830aa1b5701290d3970eb271adb70bbb986413ce3
SSDEEP 12288:n0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:nUnQ/tbw/2Mkjy6Fr7g0og
TLSH
T16C5523797965F98BFA1706F14C8281869B3F0EC6BFD1A38F7B481129967C39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 3178b1fd3fbba4f9eab93a1fcbcd8845fe7bf945e2b007124237ab93609ddda0
MD5 eaf9ba6195a6ec558f013c5b94dc248e
SHA1 56a289ea3972b7bb8df63ef8597317cdb01c0b52
SHA512 d95a3fb4234252cec00d8aaf04c48842f97b84e25f46893babf58f5bc67fddd0f5dff9ba782d1b1710aa594f740c441cf80af675a6fc0c51f9ff855878c8d14b
SSDEEP 12288:cyPz5L8FGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:FzylnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T19B65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2de46214ef4009d231a9219e6d54111578e4642899c20139bf3e5e58147c167e
MD5 f0cea3f9872151f306d5df5051a3431a
SHA1 4ad92773175105a4a0d37a7c571f035b156f246e
SHA512 1c0e195f4b0e2cb3ff92599f41b39ecedc3468e16a9c131da27e8366055bc59bd8ec22b330e91dba00a768f611baf876b0f97afee15679fc0e4abd9e9ce007b4
SSDEEP 12288:CgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:CAnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1BF5523697964F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 6c13a0b0c3e210eac83e27af4e39672f735b304a4fd52daedc367cc0df9bb7ef
MD5 0b37a2cdf10a2601f2afa0fe3c04776a
SHA1 417fdbd1b4f66454a1245f8f5f671f12a53ef63b
SHA512 de1cd1b8f4a672fa38a30887204f77650310be8f8319a5735672c12d61052e23d290568680ebcc80ab2c735e75d4c1c74cf11a22c109018ec451c5421b3aa415
SSDEEP 12288:ogGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:oAnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1DF5523697964F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 54e1b63cf69b4af79f14d55ad71322c1ab7a747261785ae6d8fc6a4289009edc
MD5 89f0f951c1e5b9044703f054450f153b
SHA1 ce28505ed73475ff0d5fe267f8fc2f4b82e9e6d7
SHA512 290af5a7c703c010ad2abe11a7367cdb6f027eb1db5d0fe4754be824d0afc6293d5f1d6411b9e3b554ac2300c292a11ac857c1eaa17befa99c5504e9e2570365
SSDEEP 12288:QyPz5L8FGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:hzylnQ/tbw/2Mkjy6Fr7g0om
TLSH
T11965021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 ba0699fbd5f850dad666317276913b49081d9b5e05e548830056f2dfd3977fcf
MD5 3b1353577d037c958b47c5a8ff7b383a
SHA1 970a5d6689dffb6a69160c72baa531af45cb63f2
SHA512 fd8d62b679086235b8130c16dc428093817e27bac8476e952bd1fc16a436e69ad98d32a8646e68c0cf1c2a9f218cd272a9d1f81e4d17dc847973cdfe0ea2296a
SSDEEP 24576:5T0aLl3z0zDTnQ/tbw/2Mkjy6Fr7g0oR:5TDLljSQ/lFTjN4
TLSH
T14F7501A4B35068F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 a207d8182c47f780e58375a445739b3c4ecfb1eff5cd059239534c51a4c44630
MD5 15f4d9141f1b30c28b2333c20df1667c
SHA1 f20906595975bfaa9425eb7b54550a887da25e80
SHA512 075459686a5fe4d4ff44ae8550784c93b4a56b96eb879c5de98642a57928e09509d3d11ec691e61a3e3aab99a540b0196150b6f5a88e6ac4b21b446a76d0c177
SSDEEP 24576:r31d9CHKy7GZvnQ/tbw/2Mkjy6Fr7g0oL:L1d9CHKyadQ/lFTjN4
TLSH
T13485CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 14d7236b723776b6fc0d4df8d0c64dc129eb5b2bfb887291a7eeed27cbf19c88
MD5 d8e41bf5eb765d726f35549f97cbe1a0
SHA1 68e02b87b26647fb79ff66f7e31a33d8a1fa4389
SHA512 7531a64af88f489d5ae00b5b6989c5c49c85e25a52a2f4e620bf8774fa10239b3d11fadf05e7f1f40c592dc2c2252d8939c06a53e31edf7ea8e86409f9552a54
SSDEEP 12288:3TGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:3DnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T14E5523697965F98BFA1706F14C838182973B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d1c70dd67ecc15bbcb4d29227cccbf8b64aa86559c7113ed20ecd2cbf8b5cc2a
MD5 1e7632ead094c90f7c1099ddd45e10bb
SHA1 6ae96a44712a33086e011f36918890edb3f98b54
SHA512 436631b92bfbec13d339b6a898290a73a7c68511d858197938cbe91b03ec92a34a1a0ce981548c314540c3cc2d2b5832560c76fc648a577254d935efb9278ec1
SSDEEP 12288:/lGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:/FnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1275523797964F99BFA2B06F14C838182973B0EC6BFD1938F7B481129967D39406DA3C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 bcae66dd8bdebb0889de027d5f147dcead5a44f513c5fc457554c13c057079ff
MD5 2c44a161fbe01d4d4b8eaa682e7d1a06
SHA1 a13c3b9b5a003d627b589307a820f600b88fed38
SHA512 30de11ea2c9ac1c82677710179c254b6c25a736dd50fce68db9df1c4729d8d82261dd1ab70b3a54eac118c7500a63cf78896535bfb88f8747f45f6e89a9f39ac
SSDEEP 12288:I6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:I6nQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1455523797965F98BFA1706F14C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 96fdcdecf065ccc4617240581779bcb39d17f1f3142d8ab9b837a385af390868
MD5 53e0f88b950eb897511d1b1182085437
SHA1 289becf23bc2387d675ad4e7ad9181c1114ab445
SHA512 47da4b990d13ac1398434e5fae9b74075f0c7a7e7ec221ad2e27da204426e79b18445a5b402708f8d7fcd0e2fdc72a761418479b8bc0303b9de102acdcaf6e8c
SSDEEP 12288:NgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:NAnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1EE5523697925F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 79ca8d1b5dc8a1104de4beb2e45caccec55e24f9b5fca0ee9d42a0558b45e65d
MD5 fa50df4c328a560ace61c4aaed0f1fa9
SHA1 cf085858a0e7ac913d27aa05b3d32ced0256f8ad
SHA512 6301ec9da165c7fa2cf3b04cf79eaadb4239e3a06f335ab609f1f1f2903a89267496612ee863e64e6270ccabd3b5f467012d05b36e4787bb9f03d5fa7e717717
SSDEEP 12288:NTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:NDnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1FD5523697925F98BFA1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 6cd0a361104b82303b8e92a2f0510a036eec4981491f4bac3bb38b03a2f1ce05
MD5 b05f34757c3a613bbe95bd47e6c8347e
SHA1 9afc50553dd988d21d336a95ebac0193ad09d3b9
SHA512 8af86bee0fdd909d0d9cb918b33e2dd13fae3ffe29062825d3acbc05edb3a50d12331ce3c711604e3f8ac9974e3f702f08bd4fc5fd145f96327ccebb7df141ad
SSDEEP 12288:0oGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:0onQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1505523797964F98BFB1706F18C8281829B7F0EC6BFD1A38F7B481129967D39405CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 be1cf84e06fc3a46edfbdb1b021f4f7313751289c5ee604fae3b81c09273c43f
MD5 ce6d105e1dc58d00198d40f0c9515c41
SHA1 50eed16c1cbc2e7f2a7c5dbe90d595dc43d254bd
SHA512 63da384b3a47371a0ca3fa4850cfb27cc7d2f0ec87b67bfc053af406555e4921be29caf7d1e29f87099afebf9162b976f6f588b78310520022613a3ff28aadc9
SSDEEP 12288:fuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:funQ/tbw/2Mkjy6Fr7g0o8
TLSH
T18E5523697965F98BFA1706F14C8381829B3B0EC7BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 5c91e4aead1f93399283aa2fa867cb18eadea92f69b1397f468ae1da3efec227
MD5 412cd5cbcc0b81c4b6f359c0077ec8a3
SHA1 dd6faaf47f7fb2f9d0cdc69118e96d625ed87c4f
SHA512 37c94719eb11de6ac55eaadf63998e27a77f9ab20e82d028dd1653403becfdf99f65f19b60ff9db5037445d47041cf48446f9a6f2eef3f3d9eef84ea89ac20da
SSDEEP 24576:Mfwv/k9RX6wkyAIknQ/tbw/2Mkjy6Fr7g0oq:7MnYIkQ/lFTjN4
TLSH
T1C685DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 fb1cd9da7aa8e742e3123273a3118aa763c120f850326a4d508ea3f988e2cae3
MD5 b065f2644e01c178f56a88e8ffb1ccd6
SHA1 dfcac88f189b7c434a02983934d9822d0e0510ca
SHA512 d3c97a7cea3e77140782144ae967a38513622afd43ca815a694015b1ec45fe048866d05ed7d807116a84a638971675978e470b191a15620de6c0e29ff5427903
SSDEEP 49152:6YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK03Q/lFTjN4:UySzPkLm
TLSH
T180066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 73ac2580ad73d3391fbd6d0a2974a30a373282cd17063f1441fff92c6a061c01
MD5 7526fd1fd553885bdd699f90ed107f35
SHA1 dfaeb0ed5ce51469d664fe23b5ad1012f7d44670
SHA512 6974ba11c3748cdbdae4b742f3d04e0d1ef86ff8b1da2a9e44490f75897453c1978bfd38221e40e031614b388798f85d6a0c28dd176e2e4a6a716c03955ec9eb
SSDEEP 24576:p47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYhnQ/tbw/2Mkjy6Fr7g0oc:p47JUQj1irIhCnDHUPfF/HQ/lFTjN4
TLSH
T1B465AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 72bdf783071a817acb2154bd52c2b539fba5723265163031f99100be6c1f5926
MD5 780e639853e4cdfea325a801d3e4c300
SHA1 b3e328f36dfda0b132283e7372cbc8debb859b91
SHA512 c8e8dae08e0748e10c8030de1550590e21d884d7f2fb184b8770276791e04555cc8edb02cfdc58453d789821f6c1a6f932ee76c1972344423877de339f78d741
SSDEEP 12288:nssfQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:rwnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T10A65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 eb52aedcf91aa8368720373738ded688a863c6a4594276f5685f717496d5d453
MD5 6cbb264dfcbdaced69fd4280cfaf03b2
SHA1 c7876401b3cbebfa14f3b27928d4619b7ae4c9e9
SHA512 1271339eaa1ec08cfb73e0712f93ac239949fada9e52db1a412804b6cc2951c7d3222f2fb5cbe1b316da253d00c84501a684b59f684d926992997f5346b4b768
SSDEEP 12288:wj8YCy5zxrGSFTmbIqrrM4RMfezQfGBZi1:wJC8lJTDq/M4RMfecf0g
TLSH
T11A451800766BD75FC6A940325E32D2CCA7707D05EE056F0773C88B3FD576668BAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 f5cf304a1dec1ddca33f0782da41583161d29f51ac2cc6026a22bc59b1aa6766
MD5 b30585d8fc04e243f5f6b2ab07320094
SHA1 7f3b566f95f5d373d7433f66d8dcabb8fddde3fc
SHA512 917c660107ff064e80f5544d0cda3ccc8819be235dc2306d4772504808f62dd35df4c842c45f28d5895db1d61f5b156125862fcef5cfdfbf48fdc8f973425e5c
SSDEEP 6144:tIRI+M+3FUJ4NI29F7FDsNiaiHzKDexH4HSW/hNaq6DPHqN4WzKDexHa3AjVz5DV:KmIF7FJYg3k147EYG
TLSH
T1D365E8819537E38FD1FB6031072A9F4CA764EC16B7096F26B7C8053AD82A715B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 63664f2a2fdba150f4047d07d529defa9a3f0609639b186af76f8e70b9627aa6
MD5 1877366b791d21bc15c829be2549d74a
SHA1 83f8a529991d5b053502d0ffc98108ff11d51cd8
SHA512 af409b1490b8fa90cdc4e6368f224947adeb383a2ecbddad5058631d7f834b414f68ddfca908f73a13e3d55c86e16c8824432673f96798d0170b857d190e20cc
SSDEEP 12288:j67YGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:6YnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1D85523756668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8c5d510872217cfd26c3d5c129553ae70d0ea98efd385208b1053f22f60db2ce
MD5 66fadf45acd3eadb5b35c3cfbc159983
SHA1 4241379e12f6ea6351ce6cafd310efd44a674a4c
SHA512 5fde4e62dbf66fbbc3af448ccfd4de282b7f531f0f0a1d9423fff0f64677797c63f46287096a2af87552c56bbf522a2626cd3f8c971e0688a4f5ebe1db02121a
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYSnQ/tbw/2Mkjy6Fr7g0o0:Mgb4mBIBhGFhQ/lFTjN4
TLSH
T17E65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 aed4007029ca67d9e2b870706256be818030bc5132d6b2ff31c90c104b078ac2
MD5 0bfc64d49f8eca0a4507e683dee9c6dd
SHA1 36e129663c05d454ea043f0988faae8f74d14afe
SHA512 7b9871e0df543f948d20f3ab57c774bf28cb942c2b626ddde5609d1a6aefd1298735db3be9b49783df4157a7c8cce986f4d4062275ca44a7b9131591136d4a73
SSDEEP 24576:9G88u8FpJqH1Qzria7/mRnQ/tbw/2Mkjy6Fr7g0oJ:Q7ZFPqVva7/aQ/lFTjN4
TLSH
T1ED85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 b2f202ce501f8628fe9c08402b3ec884e7fc8ccd164c5cea326532d149681662
MD5 ad621612092e648b316b3ce60a6dec8f
SHA1 9f0ea498b2d0df95a233c72005eb8f3a5ac58fde
SHA512 7626285bbc39c6157920611766815b1481726f7f70480a5ce8c41b987784bcea790028171ed72aa6171daff109502836d5b55debc2cdca213229b5deeb5e60e6
SSDEEP 12288:fHvUrBFrEjwaQ9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:fPUr+NQdnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T10E65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 946404a910869a138a40fd8081db5d2f421978c5e395d836057d079c0b08bd20
MD5 d3c6574f43dd36ec66022268ef3a6038
SHA1 88a23fa4ebe4bf9eeaf8b4bc04aba4b91911f8ab
SHA512 afa6a6e1f02e5e5a7d2f4b5c316ca810c3eeb31a6edd9cdcef5a8f0ede80e8841814c42e3262dbb3d75b6f038e39adc90e38f645c9bfa118403b16439664b5e9
SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjNQ/lFTjN4:mG05lO43bPLm
TLSH
T1B0D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d6c5a3018dc4bb6570ec5c7eb8e6dd8c265135f61ddca2e77899a6d238d1c5b7
MD5 cb3d20cbfedf764acef3938096dcd40c
SHA1 e70e0ba58b64f4fdc98ef44b6027ba3af9e2df67
SHA512 30686756f2cb0b87d69a0fc1c2124af6e42298297b0cd885121e12b85d812f7ed2c4b2adb177df5d5cf30e0d613d8ec1890d7a6c57a4140e24f5b04ce56639f3
SSDEEP 24576:Kfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn3nQ/tbw/2Mkjy6Fr7g0ob:Ca5POZ3+Jt2pasx2+mFQ/lFTjN4
TLSH
T16765AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4b4302b66e7e1a97ea9c2dcf898139a23cf636a9bbe78796d14d5330a7da87b7
MD5 e58673f31b445be829d26f752e59f37a
SHA1 79664da22f85c968ad66b4d5927e0a2734a0d042
SHA512 fc8804a5c7373a7c07b373aafc71a6b0a5067f1cd14b7ff0eb9b6ec3247942b52f4ffe6c79145050d1bc5f8644c04ed6acf5353474886f862a3f1d3a064d119d
SSDEEP 24576:kNcwHdjbyQ4nLC18lb/EOjowL7FkJnQ/tbw/2Mkjy6Fr7g0oJ:kNc/zEOVHF6Q/lFTjN4
TLSH
T1FE858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e94ffff71c99e64c0c2f8ca2310d5c85045e976a9ab8528208c6286fe063730f
MD5 7d37d90410056142972b46eaa23a775d
SHA1 7699579ba6f6c4e967bfb85bdba2e1c4b36249fd
SHA512 2e021b5eb146cf82bea3584eb541a4c66a1f49ea7e63dda8485b2bfcf3cd47505488f1874d598eca15264bf87f9887f28e833035a2952076f8e2a9bcfa3bce5a
SSDEEP 24576:c8kNvNnaFeYhJNtmZBm7nQ/tbw/2Mkjy6Fr7g0oU:c8MwBtOm7Q/lFTjN4
TLSH
T17E55AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 9188e03c9545c81170abe10218c150fe6cff96903684e6938fe52921f37a4b57
MD5 ffb402a81768832a8cf3b86a88cb62d8
SHA1 43929ed025328fdb172e871f2dd345e85a0492f2
SHA512 34fe867db77af4dbe3bd33594ce72eb47ee895d12061aba6de5af2b5d875c84e896440da0b141bc57e1e40e2fc18c2a8b789fbed221073c25a9358980feef9e5
SSDEEP 24576:rD3FHshBIYQgA8nQ/tbw/2Mkjy6Fr7g0oA:rDVHeBIAA8Q/lFTjN4
TLSH
T1B875E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1096-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1096-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1096-90-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1096-329-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1096-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1096-96-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1924-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1924-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1924-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1924-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1924-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2072-79-0x0000000000870000-0x00000000008D6000-memory.dmp

Download

memory/2072-84-0x0000000000870000-0x00000000008D6000-memory.dmp

Download

memory/2072-78-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2072-311-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3064-53-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3064-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3064-40-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3064-41-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3064-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3576-138-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3576-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3576-133-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3576-127-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3576-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4232-17-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4232-24-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4232-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4232-114-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4300-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4300-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4300-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4300-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5172-307-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5172-67-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5172-68-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5172-74-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5264-1-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/5264-0-0x0000000140000000-0x0000000140410000-memory.dmp

Download

memory/5264-7-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/5264-88-0x0000000140000000-0x0000000140410000-memory.dmp

Download

memory/5264-9-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/5456-101-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5456-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5456-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5456-316-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5456-108-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5456-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5712-122-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5712-314-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5712-115-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5712-116-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5796-289-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5796-55-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5796-56-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5796-62-0x0000000000870000-0x00000000008D0000-memory.dmp

Download