26178ddfae3b6a9c5d00a1d6e8de96909f8f68e9016b298f4e305041c1f083a7

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 23:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 3.7MB
Sample260809-3x2l9sda42
SHA256 26178ddfae3b6a9c5d00a1d6e8de96909f8f68e9016b298f4e305041c1f083a7
MD5 70f2dab8147cb8a219d56c800d8c66e0
SHA1 a6beea71526ae620e642a570fca6546eabc4d518
SHA512 03e6c2e46090fd6cbf9abbdcb1d494ecd0ffa7d6f7e8f3729ceaa10aa24c24cc945668bc89e2be0098f1d6a960b29cf2941dfece024d53f872312a3043fa6251
SSDEEP 49152:1zksfrJMv7WyI3kkv6h1oD8eiMv3SmGlO3m17PnKtbtgbscUejuOXk0jdEKBH4SP:yUyhvdYRKuO00j9BH4SVqGsQr
TLSH
T1B206BF0AA3E406BCE0F7C679DED6C553E776780D07B1A68F029098A64F772609E39713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4172	elevation_service.exe
256	elevation_service.exe
5860	maintenanceservice.exe
1124	OSE.EXE
4552	PerceptionSimulationService.exe
3612	perfhost.exe
2264	ReFsDedupSvc.exe
5424	SensorDataService.exe
2000	ssh-agent.exe
4372	AgentService.exe
4668	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\80304530238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b472e5b65a28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd80a0765a28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000522b4c745a28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000009ddfad745a28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f76fb735a28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a15b7f755a28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4172	elevation_service.exe
4172	elevation_service.exe
4172	elevation_service.exe
4172	elevation_service.exe
4172	elevation_service.exe
4172	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	4372	AgentService.exe
Token: SeBackupPrivilege	2264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2264	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2264	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2264	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2264	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2264	ReFsDedupSvc.exe
Token: 33	4668	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4668	SearchIndexer.exe
Token: SeDebugPrivilege	4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4112	2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4172	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 1988	4668	SearchIndexer.exe	100
PID 4668 wrote to memory of 1416	4668	SearchIndexer.exe	101
PID 4668 wrote to memory of 5384	4668	SearchIndexer.exe	102
PID 4668 wrote to memory of 2412	4668	SearchIndexer.exe	103
PID 4668 wrote to memory of 884	4668	SearchIndexer.exe	105
PID 4668 wrote to memory of 3552	4668	SearchIndexer.exe	106
PID 4668 wrote to memory of 5696	4668	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:256

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5860

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1124

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4552

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3612

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2264

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5424

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2000

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4372

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1988
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1416
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5384
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3032 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2412
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:884
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3552
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3032 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a6c98e70d235012bd440b0686fb9a624d0ffd4cd06224e997ecd1e8c36a14fbb
MD5 ec2a75c7dfeedb767509b62884f5ffef
SHA1 26bfc1cab2888ce75407f76bfbec34b6aac39a96
SHA512 971d389bba361e7d0bfada8cfcd64421050e7319cf1381dba6d48dd180b26a38979d6c7801dedbf80e60b35e3878c256aee831b34978556e17f24e7fe821a319
SSDEEP 49152:Gb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn3AQgAT76sQuE:43q6sjBLqGsQr
TLSH
T189D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 d1168abe1a53f7f5c332bcdf29d3442c064a4a5d3a25ce0cd9af571c094e6463
MD5 4aa503c723bf12266a55c1a9c875f032
SHA1 59c17d8024c627f52b5227feb1129812b03fd09f
SHA512 cd43cb1dbe1fb42e9867cfe6d818a59570677df69c3c1fe08c2d18fc8fcca828d815cec62f2c9c7c7089cc15d27754be9ddca76d04fd4887c255046f14bbcf99
SSDEEP 24576:/XYfDtczAWAfYLH8AcevDN0FImbwQuq3Wia7gD:KtcRAQgAT76sQuE
TLSH
T12075F12963D408F9EC67813DCCB28521E673B8954360E7DB03A49A6A1F332D85E7EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 7cf0a6148ca2d1411ad0115382e054703dd57b55e61d281a0961f60eb9fbf0f8
MD5 7e198c947cb72fadc49e3f474cc5e57a
SHA1 125d49c50a22d62049eb86dd32b684df40a781c0
SHA512 47793d013edbd6dfbab77488d3b1eb60d3d7668e9d59ba0e59bca56dddf52792b80b660d533a1a403808a688520a5916d502cb81ba9780f2dfdbfe4860e584d7
SSDEEP 24576:q0Le5ji0hmxxrM/AfYLH8AcevDN0FImbwQuq3Wia7gD:qPji0AjcAQgAT76sQuE
TLSH
T1E285AE16F6748335D073C0B9C5D2A69EEA71308657308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0588ad405c1afd6b7097a994f856958936badee956ab38ccb874161251f34bea
MD5 9d934774dcbb737a54492a0328b78512
SHA1 9ac1bed412cf0b21e38b927c90aa64de7d6e313b
SHA512 4a5e069969e8377dd9acee309b58c13d2ca0625287718efb4f8d64c77d6d947ea17e21fd302dfb2c63b95d3daeee3d4557f30a028fd9f4aacdc1f3de178c8e76
SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWn6q8wyuhAfYLH8AcevDN0FImbwQuq3Wia7gD:r/ezSC6vUzPveHjywAQgAT76sQuE
TLSH
T10F755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 425b5182c216814a19e14596c220dd42cd9f55fc3bba351558d2669cd91a25e2
MD5 5da061f4ae3663332bb53b6409ab150a
SHA1 d300888768d59228d93cf2e97f403dd15dbfb75a
SHA512 f0bc077befa7043145f963ad0cf44791b97e40fbc8be6a2da8a2504826fcb1c74ce3732d5072033a8a53eeeca6cdfdab4423c567beb780c16297de54fee75f0d
SSDEEP 24576:KVbqPb88hv/l+YiAfYLH8AcevDN0FImbwQuq3Wia7gD:KVO88hXl+ZAQgAT76sQuE
TLSH
T1D3559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E676E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 aebe2a5d6f91d207485059aadae037afe2a44658e331c59c8b9d7a2ba77c776b
MD5 f2318234caa4cbe3eac24994cf14cf37
SHA1 42de270f19d6d55333bf640a98598a33d21f6beb
SHA512 fd7b8ccc50f5f419f66ca21af7bcfe245ab3a7c4fa10edd5e86947641800219aadb8ef6f4ab64dbf6f18ff49c2de3035f4c01799ce9333ec49af9016298e39f8
SSDEEP 12288:GL7AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:GL7AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14A552357864C30EAFEFBD1369CBBA5B963D1BCB88245979A04063BCA793D408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 992e9bdc92b5f0f21743d5cde897794fb17b221c1351a790e3aa4e87fa737de2
MD5 7d7a1a0eb779a23dd6ace3d1b584f452
SHA1 c806b17a78bb5c3898ac5f00ecfc8dd8271509ea
SHA512 19c9d1616085c9ca657c10f3d3a5585a8d5381cb99ff6d407817bd7a5b5353a177071c84d552aad37a48edc3efb9b781bcece4d7af6a05755509f9f0bb009eea
SSDEEP 24576:PJIUqAfYLH8AcevDN0FImbwQuq3Wia7gD:PJIUqAQgAT76sQuE
TLSH
T1A875DF3BEE28FCE2C67E8D795A918600D7B278704B51A3CBD165830EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 57b62a7fc54fc723d8323ae53895e7cf05b5ce9d68a3188759c4c097e2291abc
MD5 58d8ab8c02ef010e33ba2b0ed370f468
SHA1 6f9756290e8ed5644b1578d29cb693e4ab69f6bc
SHA512 8c7ac82d3f7fcb52fce94d7cbdeb6d1ab485148eed9ad57e5e10e77f32b8da4a80849baeaf53110c9370388b5ea96003be35b56d78bf0b25235b4217f48080ea
SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THt:YQvGAdlCEL8c/DRNw5C6qGsQr
TLSH
T1C9266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 59ba07ff3b2d12d26c94d1e9819d14afd1155cecf4d03d38267115525365a0d6
MD5 5520f1234fa411e38c43b2eadd111b96
SHA1 cc1d3e4b8f691d34f00d9ab619b8ac0894387670
SHA512 9edeecb83dec16006bb61235a03e5a564a8fc2a3ffc388011d216fccb627758dd5b10d414ab337d9d25bc10aef822deec51d9b61e2f82847abb983468cdce59e
SSDEEP 24576:i0ewsAjsAfYLH8AcevDN0FImbwQuq3Wia7gD:zljsAQgAT76sQuE
TLSH
T12275E031FE74E036C6BF0DB61B36C716146CB9204B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c770291e7fc91e3edc004ed27e10ecadd47a187c48ebfb08bf0e88e3654659fa
MD5 8fc4d53e29dd037b18b1f2d589fe8f8a
SHA1 20dcaeeff989d13d0947810b55f0db7d269cba0d
SHA512 4e1d6b0ab4fec18a09537149f59a11659250db331c7a2b7a623372e83e2142bcf6616a24c1aedf6e1d3698d81f2180f5d6abe2cbd0a4170c32354c531e159786
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHPj:7UEtQevvqc2W1cpV2tI32
TLSH
T1A3474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 891ec25db889e97f51593a11bb14cb94b939c0c2328c27c9b00c5e1db02dbf83
MD5 94f92dc415aad221dafc595d7c1b47e8
SHA1 032cf0b4cc77a6e5434f0a9d61d732076ed6ca39
SHA512 9614283a368d6e519c5e26543a0db4ff15a1c27bd876d5d47f79d63d1d79c715d960be367206cab3b1c9d3ebdede46c934d0561056e941625ad269a537b1f7fc
SSDEEP 49152:FCbRquA/m2yL5zTfFiV+XenmE3/zMAQgAT76sQuE:SoquVjnmuqGsQr
TLSH
T131D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8512de9d5eb0a76fc09895abbee0a4b5b2957ac59a3a1a25703c3b40c3ed7e3d
MD5 09467522c669ea453847f7fb953e36f2
SHA1 2c5f0f3b8f09ce0b3c8a2f046d439248faf490f6
SHA512 60f6952076768be02efa98659b2271a6c19a80693b86054fb3444672922727bd30aa457aaf17674003b5e31c10a71b6e6ec42c9113a8f43e54af70e26822825d
SSDEEP 24576:8AhGL3IFoiwtA5l7S53FAfYLH8AcevDN0FImbwQuq3Wia7gD:8AMUFoiq51AQgAT76sQuE
TLSH
T1B0359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 d2d91d173fd48f79b371546dcab8751887bb1ecfd000d5a9ef5f57356f2e99b0
MD5 b5e905b24d111a688bb75e69e39c7e13
SHA1 ffd0c7069cf606a670547c96762927ac7a221fbe
SHA512 23fffc142ada073bafc56739336d4cdc2a8c0af01a72c6567b57b233eae23f668ecafba11ead270e8b6667a5db7f4937f7a44e72e7d30265fbb82368b246d8d4
SSDEEP 24576:1wu4OWQAfYLH8AcevDN0FImbwQuq3Wia7gD:1wvOJAQgAT76sQuE
TLSH
T13E65F14676A81CF9E9A7813985A7C136F7F2BC152A21D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0f093ee21c6cd841a8868ba9231aace3655624ac17b80847d1b8633ebf41152c
MD5 9f925449c602278176056579dd0c75e6
SHA1 2b1d561e2048df35f126873c92d520cfacc69f59
SHA512 d975299338cc98e165f33c0d76b902441c6567dfe7889df57208bd7a2287dda949f6504f0b082e0c12b2e530be751967b6d93a15154b0be666f4769b62075a9a
SSDEEP 24576:nZuHAfYLH8AcevDN0FImbwQuq3Wia7gD:sAQgAT76sQuE
TLSH
T1EF55129B239830FAE5A7C239CCF25659E3B27866532183CF0115079A2F37AC59D79B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 20471ed6f62552d823425fcb734b979587afa143003c66a1aa98d9cb15f30171
MD5 6a4fdf5a26695e72f68f09fea389b2bb
SHA1 a288f86c6ae363e3975bc5679c1ac713b0525104
SHA512 2a28a11ef1dc52af5265ba195c54d0d02f941471cb76ded55969dac2b06e72ebfc043554df7983e46cf20b55dadc82115a7689a526041bc79b2c422897532300
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UZ:aQRQyi36YOcPbLvw2gAf+PN33qGsQr
TLSH
T1D1667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 48b2c22ded41e10556beb668856d411c96d6dc1647599b4757d828b73c193498
MD5 de6835d1b41edb33e6f861213ee19633
SHA1 cd9fafda6b6079383d6def5dbbf231acc1f273d2
SHA512 cc3accb6269c26e228ecf9b5204f8d1061ee32fa27e8af5e8d9eb6375b43b8864838e738254d35c69918a7f543e332ff49dab7f9d10af7d3ceed1cb376d9bd7d
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UZ:2QRQyi36YOcPbLvw2gAf+PN33qGsQr
TLSH
T1FE667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a8920263acf160b1770d0e3dff41a5a27bd850879bc0ddd120e3a201ff69d614
MD5 e5cf773bafe88ec85539b9bcb3bb8ec9
SHA1 0d467458d1e13f15dc07360ede0e285d474ac31b
SHA512 71dad6ea3c86261b81788a3f2d2c2af1afe29d83ed1eeb451fe95ef6767da0732638be5dbabc606cda7dfd89bbc17414e245321ed44547a22e0fc5570d00cb09
SSDEEP 24576:swvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL03AfYLH8AcevDN0Z:S68Qg55nhceWu7PNU3/cAQgAT76sQuE
TLSH
T138B54933B2F600A9C45DE1769F4A873196D17C758FE0E3DB8505720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 863b75c38a017b66bd12f493c14efc42f58dfe48eedf78f2119fc358e204c1ea
MD5 776d14d854b44404b896f11efc7abdf9
SHA1 dc88f75447482d1b4b7e09dc4ce153d8bd1a0ea1
SHA512 a38691e3573999a9670dba83fc0f5c90a12f7261d593a4df381d4eb3f6f455eeb8b62b0edb25e996cd232e9d24de353c2bf0de858b1e4b8ce2800fa3cb6fa2ea
SSDEEP 49152:H3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99z:qy5112gYy5azzVvt69nLKnhZgqGsQr
TLSH
T15F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d0360bdfa22f05ebc859958b192d6334ca73e7ecb2e73b5cad2c4e9a78ae2c64
MD5 9fb3e50ed295d8e1503c33ddbbf2d234
SHA1 b799c3995a5e163d04f7e98b70701e17ddb20a9e
SHA512 ddf726b80b158ee34d848643094d997c4351750ba0436b92daf3f60d95dc94221a8ce9ed05c51305e84d90fbb9f5feabac3b2c149f6d2ddfa6b292859a2af594
SSDEEP 49152:cB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glGAQgAT76sQuE:2u6Jmdxd2dfqGsQr
TLSH
T162D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4e27703b778cfdefab20a38f55193aa5974a24922957fb29f44da851efb00b5b
MD5 f345d47e9ab655b3f3410b0dcf6ed602
SHA1 af111c75247fae14843b6ba01ba137102ce87dea
SHA512 15fa2a7fa97ce7e90d9d1be65d7012e572f2216c0e5d53e626676eedc07ad50dd3f711d29135fcadb911cd2408c425f7170057f27eba9eb45f4248c7912706f6
SSDEEP 49152:b1hpsNoJpF1A63U44CwH7R4xKAQgAT76sQuE:bmifPWRuqGsQr
TLSH
T155B5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A9077962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 96f952be035e85f142eee787f119d93fe8eadd6f7bf3bd711bfbe1713ba1d95c
MD5 6c239120c5bcc10a7795a68964e50660
SHA1 762fda33847ae7e4acd24f1fc38d0575e0dc05e7
SHA512 543cdee680117a0d02e65f3cfe94809fd10ab169fa7a2541b22c891714aeb6f5f91c3d5e1c215e8a7b222c2f3117ca5d10ef9fd6f0fd3e117520d1e1c736a1db
SSDEEP 49152:GSuZQIY0Be2KcRVtOnks6NMHqHAQgAT76sQuE:I5dKii61MqGsQr
TLSH
T15FC5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 50751e633db6282fb5e10478d9da376598067b862a15d6188757e057e913aba3
MD5 c6f9670ce4c8710d9b4e68f5608f973b
SHA1 960f46cdb4b68c89f2beb1869fdaba48e5500d3b
SHA512 135d23f1636cc231c42060fb97347221c482f2f43d30c8d32abcb914a0e7a6b8e9a6283cd32195fde55d015b3c7b549d32a37ef6df08de3eece1126ff4277c3e
SSDEEP 49152:jhtSn8EApI0fig3giDn0AP5wWAQgAT76sQuE:CX2imphyqGsQr
TLSH
T13895BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a3180b262d03373ea4f8ba142140d67503f09c776662998a8dacdad99e19fc8a
MD5 d43a894c42b63b1c8cc85c9c1a7c7729
SHA1 d16f3ca419fa5ef14d8b3bf007782cacaa198894
SHA512 95392e118d0cc7acd3758e686fa187abe01e5a53f0d90a42bb69a9b0603348952eea1637ce4054e95af4810c349907ff28c46f579a27eb5a5f6518ed8e055496
SSDEEP 12288:CDAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:CDAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18155235B598C30EFFCBAD1368CB791B9A3D07CBD9345539A110A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f7e29a21ca6f991276e4ddcd87c97ce35576df8c925f0c2e990235f1a9f6caed
MD5 268108d1ca913e78ace3102a30047440
SHA1 bb78924ab2b81ea593c414a977f75d2ef5336a99
SHA512 b2c145427d794a7bf0284d8709b6e7df79901d3c7c6f89dad4bdaed029d02a5c60514bc36fdf185263af1dfacc910cb5ee650a1ee85c39edaa5ecb6b992fe980
SSDEEP 12288:UoAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:UoAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1A455235B594C30EFFCBAD1368CB791B8A3D07CBED345939A110A2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ef96bda20838858904ffe3113f001a1674d28886ca9a1bc636cb854d8d0c6a63
MD5 653d496f6bfe0779c1a44fc41d2d349f
SHA1 71af27d37c17b1ac09d31bbe60f47f6968ac262d
SHA512 b807a7667256229751575d6a69ea964907675c62f6f504490a07023a93ceb89098a7979c3d12f858986cbd6f1aa36520cfd7f69b42b5169eed5c8752c27fa38b
SSDEEP 12288:ZSAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ZSAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T12F55235B994C30EFFCBAD1368CB791B8A3D07CBE9345939A150A2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 f90858d7dac78b9b3a6e70e42ebb6f9efd00049f24e4e66e980f7f2dc9db1289
MD5 38d1037bc31db233ab9016f559fc5317
SHA1 ec56d79ba483177899d82fa44c201eec6848cab5
SHA512 4d9f5fc9412f6b9dce0e3182e33cf40d269e63eb7b5ecedb06b729fab9a32567a5877f86abe327baaf1118b44b3166ef1cc01aa96e3693845027c7a4637df294
SSDEEP 12288:HVlAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:TAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T178552357165C20DAECBBD135CCB791B9E3E1BCB9931293DF46011A8A2E3A248D1F4E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 33f52fc05bf775b35b294b02362355d8db5b740d103e8d64737114f3551779fe
MD5 15ffe3c8de24f3b635b5b442b15956aa
SHA1 52e828bcf630100040419c9658071985c5834979
SHA512 675e80036408ff6e6a5a2c122fd1c48b5378ed653ebb7c97cbbe9c6a43ba30914532f4775d92c1bc414f9ed987122854d7b2b7704d819ac12dae423a033722c1
SSDEEP 12288:G9AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:G9AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1E655235B594C30EFFCBAC1368CB791F8A3D07CBE9345939A110A2A897A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 10535d763d139462ec239c863f0d71665b55012ba1449eddaa289e2cf0788637
MD5 fde549dd6d5c139dacebe09c40139942
SHA1 a3b3251c98396cec4b85fedddef2063d374c6872
SHA512 ec5c0a31e027ccc2ba8b92b4a3a68275e1e972b9299ad2656b75b365cf8e2f207f94b93edc8076af091feed5dd1a487a4ceea6c95e20af4847290970ca5a55c7
SSDEEP 12288:1UAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:1UAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1FD55235B594C30EFFCBAD1368CB791B8A3D07CBE9345939A110A2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 63da2d542fcddcb66bc7f97031bdaf85dada9a73a07540c4359434ebb0dd9ad5
MD5 9ff360bc67f775eb57b5a8bc42c7d3a5
SHA1 a885e7699ed1a0e37e1b2f6086594baaff5e2f47
SHA512 d26c045fc28a2dcb6756be3b4be477a3846be08ef53a85783bf01c6d62bcda8373108f49da19b5f0bce26cf218588c333e2701b4114a10dc4e51608837c47fd7
SSDEEP 12288:DAAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:DAAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F355235B994C30EFFCBAC1368C7791B8A3D07CBED345839A150A2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 ff6a14d23af4bddb5dc4e8cef9738884435b3d3150eaa45050b5aa83e247d4a2
MD5 f181e0494a4ea5f5ccb6fcff9affad9f
SHA1 3af8ea218125a19c6d3a8647f808df6f443ae958
SHA512 40afacc05ebfe05c75d3786d969492fa0c129294c34d87751051aaaeaec70d0fd9fe9f17a80df8667d93f5232576b55dc7a944e1a9d92cd1f6fe048d16319455
SSDEEP 24576:JZMRzFVSOIAfYLH8AcevDN0FImbwQuq3Wia7gD:JZMRzfkAQgAT76sQuE
TLSH
T151750195B39018F8EC67813ECC668916D2B27C6A0760C65F03A4366B6F373A15C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 3550ed46194eddec9f69df43c96c79accfc8c26fffe26b6cf9dab9d56ed65b41
MD5 368d6394a6be8b2f2a8983f4406610df
SHA1 c2952d24ac3c1a8760f50266d8c934cf96ba45fe
SHA512 4cd17564cf54e600ce68a507bbfa5167e4f3a66fa92a80f24bbae7038edd77b7fe0c8d1f066a80469a43f2ffa20cee7d515df0360cc29121951916b88cf0bbf6
SSDEEP 12288:+XAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:+XAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1AF55235B554C30EFFCBAC1368CB791B8A3D47CBE9346939A150A2B897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a65467a23ca0cf3912a88f5886659099a9a248ddbdad3163f8e6d0eb4dd37054
MD5 4c570ecfdf0f59f176522c9fe93be33e
SHA1 7ffe21c0bcce0c75cc460dac7546a9c16f0a38a7
SHA512 d6b0d99ed5a7980c71cf11d4a3cd1695f927d614f4a6659760a1dfee3da500cfa1d0c315d7fa253faeb091bb3f796200016013af445204612c3c580612e6b32a
SSDEEP 12288:9LAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:9LAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1BE55235B554C20EFFCBAC1368CB791B8A3D07CBE9346939A150A2B8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 e0602bb3d2df6d95f21fd2a81617d3b648aa28b1ef5b8112b1ae7aadd95fdc09
MD5 cef1daef4ce121dab621d8b576d68575
SHA1 b026765f0b4f6735411d6ef81fa90d4ef38b3c25
SHA512 7638e611549889bf06474eae221af01c00236340eb1a96453e6373f7e8c473ea652444f61c5630c7dd6e1b49a9f880d5b7b6d5950585cc3ea8486c731991050c
SSDEEP 24576:azy8AfYLH8AcevDN0FImbwQuq3Wia7gD:apAQgAT76sQuE
TLSH
T1D665021763A530F9E577C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 466619cae082bf6a89bd78f9fc53182d3e734adbfc71b80abef66558d1a05b61
MD5 6e95958869d376b0330b37c9650f36de
SHA1 f279f0c3cf11b7db64b4f76a889b1dc9da6732da
SHA512 10bec69636be00f86a0cb9b26203f5b6b7bb8c81f5a26a8397e1d8733f0510ac88fc3a583ee506959e671993b3f4ab50b446ecda4fcfd5bbb6ac2c6441965cb2
SSDEEP 12288:YXAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:YXAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13355235B954C30EFFCBAC1368CB791B8A3D47CBE9346939A150A2B897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 380e4f9ddd2b6b83433376c7361b8e1333bf0ccc9875ae02e38b7494d862cc69
MD5 a0f75afdd900276cee9d9ff189bf3e76
SHA1 29311ef2e9a2991b3f772ac8b8961bd08e6f0649
SHA512 5db7154ec8d59d79f10294ce48f2eea54ed28f803f0f5e10158acf218364ec417462b32257a13b9877f6ee086e6770dd47b5f8cb4f0a7d99b7d880641effec44
SSDEEP 12288:8XAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:8XAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B555235B994C30EFFCBAC1368CB791B8A3D47CBE9345939A150A2B897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 0fad967519776726c55eac31f0456f7bcd6754f6d50eeeac788cb482002f8f92
MD5 d76a8b350ce553ee0791edc4df3fc3bf
SHA1 ca418a7747332e427254bffaccca21ec4b489004
SHA512 af24675135c7420b776a60a0f36bc0902426c5a6cd3b053f6554cd26af8ed408f60c1c18d3118da672bc0e73ea62170bd525dd7d32b1dca22e2ba8b3bb156133
SSDEEP 24576:Pzy8AfYLH8AcevDN0FImbwQuq3Wia7gD:PpAQgAT76sQuE
TLSH
T18865021763A530F9E477C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 7f4d4f31efbf348b2d792097f515cab6f1f31aaae55931ba3e711222d6bf483b
MD5 f0a3f4016ea37c84712e1fd85169efe3
SHA1 df9648136059823e6dc0d87071a3d0423c16e6d1
SHA512 1131b2e5b5efe9bd9006c7ce6040326679ea6d32d94add7e4d611be85df7e1ee502d77ca1b68b6bc975f3d406735d0325505ed49cf3c5e0387751389e27532ad
SSDEEP 24576:MTDaLl3z0zDCAfYLH8AcevDN0FImbwQuq3Wia7gD:MTuLljhAQgAT76sQuE
TLSH
T1B67501A5B35018F8EC67813ECC668916D2F27C6A0760C65F03A8366B5F373A05C6DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 8c93db8158432d2ef0efa7af8af24f8db6e4340fcbb4cc6f41a230f1babd401b
MD5 0ff64113fd77ac0aafe971384019ee4f
SHA1 122a323b7fd7979166bf3f5c63e31160c8f455fc
SHA512 0126ff393d5b2e4d5ddfc33fa2a0fc5987e75f1c2dce7589a91aad1e5c9bd9bf5b6ad3f3bfe682b74c481b93980023c5b05b4bfe2a63b102cd16eb2da9b7609c
SSDEEP 24576:s3vd9CHKy7GZeAfYLH8AcevDN0FImbwQuq3Wia7gD:Wvd9CHKyakAQgAT76sQuE
TLSH
T16C85CF91F3E810E8F0B7DA35CD765511DAB67CA91B21DA8F03A4265A1F336D18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 98ddf3b39fbf3e90e67348215bb850b28385dc512d725fc18d14c02ceb05f3f8
MD5 5f78391cb529a887e5b8fb2076739375
SHA1 2651a58382ec9aa5028c3ef8a4b5125deddd77c1
SHA512 559d6860eff5839ce8312064b675003c8cf2217f1f1aaedf8cf75ea1bdce32bdb9b7a3fe3d9dd8b1d7b2bd0740c5bddfacdedd90bf731a65d12949e23aaf68e1
SSDEEP 12288:zyAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:zyAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B555235B994C30EFFCBAD1368C7791F8A3D07CBE934593AA150A2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 1c25cc601b6e2b073d1bcbed81fb5cc70f1737a07772cf5c2e4d646b9e19abe7
MD5 9dfbf862115277c88840bf184cff8646
SHA1 406d957b011b9c36df3e1e8e33b0eb0983a4bca2
SHA512 806a0cc3d5db62025c9f39bc2be0763a48f327070de1c60b34561307195eb0dd53b1e29dfbdf414368bdd463b80409e05f06c5e9a191d957186bc6c203c31681
SSDEEP 12288:jcAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:jcAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F055235B594C30EFFCBAC1368CB795B8A3D07CBDD346839A154A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 be31852dcc3f19a42b3d87b10cfcf1defc29e0a87a2380f287ba7ff626e8f5b9
MD5 eac35b7ce87dde1f774ff5de48499856
SHA1 1c297b1fa276424aa5be191dff25d6427eb91bf6
SHA512 660556401751a0574b83db7b7a9cc7904b36942fbd5c91efa6fdd8b15578dfb74d5b92a7e55f20dd48ffcb6fa77095b5c5dc18831278f2010dddf6d8b83da35e
SSDEEP 12288:15AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:15AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19755235B594C30EFFCBAC1368DB791B8A3D07CBE9346939A150A2B897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 be92f03210ed404db38abcd539b334929dce67d2920d9ae6b9f85b9a449c1990
MD5 ff816966565ae40dec984e23de5a9e04
SHA1 6d1a0fce21e4ac4fbd5a6c3f64289b3ac4abcd5a
SHA512 13c3ed619f58ad404fd170e3ed609470d56761ab449b389d5bbf84ee7f95ddca4754b30df4f8b8f8739f4bfca26e7fefaba808179b0af9cbc7858f2b7e381c44
SSDEEP 12288:IXAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:IXAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18655235B554C30EFFCBAC1368CB791B8A3D07CBE9346939A150A2B897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f8aed739dea7c4fb16a59324f0c679e581b35272555276fcfcee024d9a79aec9
MD5 7bd9977442c9ae96bf0cec70116710b6
SHA1 9614030b0d742a9c99d6e85b8f75aa903095b946
SHA512 3e3c8ff996f165cf3b5b6a65746b53941532d74c79cb0f4d4f78f7de22b0df0a012449c67b2ceb1565c05083fab578ca6778f1bf1f577a73a8614b2b9ed5353a
SSDEEP 12288:6yAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:6yAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F755235B994C30EFFCBAC1368CB791F8A3D07CBE9345939A150A2A897A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 eecb3fc885ee7effc02549b99b98b286a2c40f5e20233638ac79dae18fe9479c
MD5 72ffb094118824da6c335321da9e7f21
SHA1 1328e70d69a7c1ad86e54d1ad620045c9f82c0e3
SHA512 bfdf4fe48c0285151286553907c4a8c24b34227e35a5c68c53fadaf6d7467d8482d34b9489328d45cea3d8892ec67cea39158a829e09a4683f4842c83a97384c
SSDEEP 12288:wvAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:wvAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13255235B594C20EFFCBAC1368CB791B8A3D47CBDD346939A150A2B8A7A3E408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 7d9a1620aea944dc64d36b712984654d26d673efc4335cf3331e49a29cde7960
MD5 50c84d3c8a99aeb5443cad57a368e0a3
SHA1 c3c62479e3e6bc03327a2d771d97aaa59c38b46b
SHA512 8b6e06e2da39ce2221ee47465b29c2db59eacca417e4c034ec6c89c417e860ad8af85efaf0880fa73728dd72a067b890e9bc9ec1422ac2f0a2d40eb76bd79b72
SSDEEP 12288:t9AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:t9AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13B55235B994C30EFFCBAC1368CB791F9A3D07CBE9345939A150A2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 9e6b1736517ea7e2e0c40f0668e82ccada6e7fe02022712b2972ef6e07de478a
MD5 6e6624ca5fa4be7881090ffef824e89d
SHA1 e36ed5eebbfb97511280c1d95cb295f2b789ab80
SHA512 5c7cab8a45118df623a6bd932bb3c9aa58c0896a69c79446de04057795a53e86eeacab484ac17d5a29e2e1f7e49325d4b25a014659799c243cc15b4a63cf2648
SSDEEP 24576:FfwvUk9RX6wkyAIbAfYLH8AcevDN0FImbwQuq3Wia7gD:3MnYIbAQgAT76sQuE
TLSH
T1E885CF2AEBDC44E5E1B7913C89B7460AF6B178691B31C2CF025A53AD0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a68a6729945703e8c971bd2a6dbe4b7f9d69c9f685b716308d757eb4d0748086
MD5 83882cec6b8f372b28e59ca83a44029c
SHA1 61c284802c5c2801a9e68d845ae50af9563ec971
SHA512 9ef3fae0e7d433c992c061432a752448c3d1d2ca32e8171a30427969e6348f859385293fb7d0d5456931109bd67675814086676e7004a61f9ad97c1b44d3b0f1
SSDEEP 49152:mYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02AQgAT76sQuE:lySzPXqGsQr
TLSH
T1EE066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b63ff65847c9e8afa7f8851fadce1a7dc05fcd8b764a66cd1e81acff435a6935
MD5 b178c75a789abfa7297ee5f496c3e9b3
SHA1 046fe334cdcf5bc70f26e5af37728490f20cbb71
SHA512 3e0c4b5073c7d4ab736b59aac4b18945dabe4570149800e850459dd73533c86c43e3a28cc42a8da75b2296543320ff1b6d36b5ce85aa4a76d23d7f266567ae9c
SSDEEP 24576:f47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYYAfYLH8AcevDN0FImbwQuq3Wia7gDz:f47JUQjTirIhCnDHUPfF/GAQgAT76sQn
TLSH
T1B0659D1EA3EC01E5E1BA923885154A5AEA71782D1B31CACF1270437D6F27ED49F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 152d41f291df67c611c3c5df87d0b896f32471ef55b6cffa1f70e2715ef14ce8
MD5 643a1ee0b09a18a30de36ce3aae4c80b
SHA1 3a17422e2c50bdcea6434a901dc82dc9c14ea4e6
SHA512 e6d2643ec3404f0b35636c8a0a90474959e59b43fd0c3b90281535816b863af6dcba47444a77baf5a9437f491d1fc2e62118142549107812ae04079d14688214
SSDEEP 12288:tbsfHAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:IHAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T12B65011AD29811E9D46EA139CB664650F3737C6983E1D3CB12C0F57E2F3A6809DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 9c85b38541146c8cf426e159948bbaef7d88270eacabfae02e3f5d4c5d61e43d
MD5 bb2a31448e40c089e264338f5a7b2e1b
SHA1 a25b21b36595ba4bb1903d34c550dbf5b504ffeb
SHA512 b2aa9071fcf663339909ade64ec6f2eac194e55fb9a68c05de135221f6b3664f45ac9848cab3798b7bee18c2975eba1725625100004bffcee431e0873cdaa0a6
SSDEEP 12288:0j/1Wy5EDb3o2vTTNn+uq9H8zrQh23cYk4KaRMEOV7s8q:0pW53o2vTTNBrQh2TvKaRMEg
TLSH
T1C8452811762BD75FC6A940325E33D1CCAB707D01EE45AB0372C8872FC576668BAF6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 2a2767070b13b585db2be028154e2fe68b8e6654e3d4cdb49760164d6a6ff6a8
MD5 7b8eb699e2a76be832e7a119c5f77253
SHA1 19b221b09c6df3c5378f36de5c42829d5b515f3b
SHA512 50146c9a97c9f429365fcd239acd92e36ddbf0b12144915c91779cf11fd64a3ca8361917a3c98f1273708f6e9565fa6caacf48bec2da5f40cb8d7c3ba394af06
SSDEEP 24576:krCdXRiudg79kqDFeRCIfu0rj5JiozUe80VrG:6UVy
TLSH
T1A155C6416137E3CFD1F76072072AAF4DAB64EC0277096E2673C8057AD86A725A0BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 6a8514929f707aaf2b61ffbce4914bf70c26f39a559616e6d3e59bfe7911857a
MD5 db94f4fd5e52a42593c237e966a116be
SHA1 f9b6a555c9c5ea6cf329239c88e75f67c44989aa
SHA512 8cfb615d62e6db6fa757c1ad3ebc522db0b2b59c2f8024816fb509a0095de8ea9afac28631d517cd0e7e3213cb236356dea051fa6dcb11beafc7f785c7cecdc9
SSDEEP 12288:P07fAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:8fAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1C2552317878C74DAFCBAD135487B91386399BDBC874082DB640627CA793D8C8D9F4E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e4e0b7d32aeb6cfcb51552512dce672f73538c26b164585edf3bff4b05428966
MD5 561b05b6e15b6463f01b5c8d5ca5b55c
SHA1 843dc79d71d87e4720f2e7f4a48d4c5ef6d22718
SHA512 d4b1911242855aedc8c5857f86408888039830a48ea3bf0d4d1b268e5b0f7fd682f32a97fc71c3fd8daa6e4e49c79cb75c8c60bd66e96126eaece8f3863e0e5f
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bYhAfYLH8AcevDN0FImbwQuq3Wia7gD:Hgb4mBIBhGFYAQgAT76sQuE
TLSH
T1AF65AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 471409899941b0f87e78b4222c113653ee2c5c49636545eda81014a76c3fe910
MD5 6e4458e1d5d827e45f8c06cfcbadb6ab
SHA1 021937f7aaf38b803fb32ba17e78d05ff91c2ec6
SHA512 c652a8d0e8426bb6ac0e7e691bd6130723cefdfdfc1416ea9df3ff3c4f476cfe14f6c5c6d810b949a9edc1c4313fff4a3128dbc33820ccd78fb1cad8be3828a6
SSDEEP 24576:gG88u8FpJqH1bzria7/mIAfYLH8AcevDN0FImbwQuq3Wia7gD:z7ZFPqVea7/ZAQgAT76sQuE
TLSH
T17E85016677E401F1D47BD13889924663F6B2B8250364EBDF06A88B551F33AE44B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 7946b9afc6c8f7ca2e38f89338d0c9734441fac357ff0cbb0c129a4cbe2faf47
MD5 7735c07d82b099e4e1d377972f6298c5
SHA1 12cb053d37a39e56af6aa764c80c3e572edd4e20
SHA512 b91d71aaa6d272412742d452dff21cfdd84a30e1425243289330b1da9fc3693cce1ea119505942d4f6ebbc5721cfab05bb21ba8f2cad55815f70b6bd9ec17a39
SSDEEP 24576:bPUr+NQkAfYLH8AcevDN0FImbwQuq3Wia7gD:bJQkAQgAT76sQuE
TLSH
T1F765E12F22AC18E5E67AE13D89968619F771B866031192CF0291817E5F37DD8BD3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 43471bc2ec68b88b0f74c5f9cad24dc5a9a94c827c7c891c0daa2a89b4a33ae5
MD5 3dfa165a269b3e391a58575a3124dede
SHA1 539e83da1eef85c5912e5298b02647691cec0710
SHA512 5c3b648bab98a281b540762cc673e830d5ac58d66a199d2473fcedaac2293602db3998e468f8ab46e5aa9b3b347af1af0fb0577538be2c04c3d0f1c024d9d14f
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjUAQgAT76sQuE:nG05lO43b4qGsQr
TLSH
T15BD5CF6E62EC11F9D0BBD17CD9C64A0BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1d03b3eb0a83570f4ce287a90f3ff0d2af6d33589a45fdbf18a97275e2345c39
MD5 5ad19586e76a49f2a63e7e836e19f919
SHA1 2e5329b203ff18ccc82449a2123aa67c493aeb51
SHA512 987bc01a15cef42e0ec241fb452349b9b154967acf268b04fb7d6aa8b625e4771004b595a60574df01bd9996a37cb2f74558b1350be2100f30b3ed4c9366c58a
SSDEEP 24576:vfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn2AfYLH8AcevDN0FImbwQuq3Wia7E:Xa5POZ3BJt2pasx2+mcAQgAT76sQuE
TLSH
T19A65AF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 69d82e0db955e7ad6354cadf8b86c4a19581d0558693a97128a1a888d7d4f28a
MD5 223a2827a20eb9a8d10817b7278088af
SHA1 3dd603ebc34611f5bf430d87a38d9de6aff3b729
SHA512 d110dcc0d472f78b41fe948581a5b9bd1ae378b0d8a930d60f57905df023c68193c5ed8349aaa9050c5d60b0a4d8f2396fc910997867c350665748fdb60494c6
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7FkwAfYLH8AcevDN0FImbwQuq3Wia7gD:pNc/zEOVHF5AQgAT76sQuE
TLSH
T112857B1623E901E4F5BBE1BE89779546FAB17869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 947537dc4370537fd15f8d6032cb53ed704df1f361f8cf64852c135f749f8e57
MD5 496fd182d86a73c03891e4049b4a14e6
SHA1 758905fc8bca8d3fefd101885f0ad8aeffeefa23
SHA512 a80ac7e99c526a87182d2571402cca1eaa028e0e18f6cb2c7dd4d9ccb79ceee4dec1212b4a9f11b6718628687fe467fd668cce4d7764ad48b3e60517beb9284c
SSDEEP 24576:zTkNvNnaFeYhJNtmZBm6AfYLH8AcevDN0FImbwQuq3Wia7gD:zTMwBtOm6AQgAT76sQuE
TLSH
T1CF55AF6EBAB805E4E1FEC675CD238512E6727861073293CB5290C13F1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 e0c27feb6863b3acf52ae121e3b972a97ba0eecb4a54f72f95931da72581516a
MD5 86ae51eaf44aefe2e18dc0a03e6c7b16
SHA1 a8e402c1c3483249b96103a6d3501e4bb0810ddd
SHA512 fee202475e69656452953781adfb96f7523400b1ffab47237e98f4b8644ca8b61bdee34aa224c962b07679f2707e45b03c27760b128f5eb5d56db499ac8c133b
SSDEEP 24576:0D3FHshBIYQgAjAfYLH8AcevDN0FImbwQuq3Wia7gD:0DVHeBIAAjAQgAT76sQuE
TLSH
T17975E17EE65C04E4E57BD17CCA638606E7B138AD032256DB029481BA1F7BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-119-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/256-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/256-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/256-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/256-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1124-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1124-288-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1124-55-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1124-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2000-107-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2000-307-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2000-109-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2000-115-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2264-305-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2264-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2264-89-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2264-83-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2264-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2264-324-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2412-322-0x0000014DC2710000-0x0000014DC2752000-memory.dmp

Download

memory/2412-392-0x0000014DC2710000-0x0000014DC2752000-memory.dmp

Download

memory/3612-79-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3612-304-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4112-1-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4112-8-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4112-7-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4112-0-0x0000000140000000-0x0000000140410000-memory.dmp

Download

memory/4112-78-0x0000000140000000-0x0000000140410000-memory.dmp

Download

memory/4172-24-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/4172-16-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/4172-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4172-94-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4372-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4372-127-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4372-121-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4372-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4372-132-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4552-303-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4552-74-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4552-68-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4552-66-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4668-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4668-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4668-311-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4668-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5424-102-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5424-96-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5424-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5424-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5424-309-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5424-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5860-51-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5860-47-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5860-40-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5860-53-0x0000000140000000-0x000000014022C000-memory.dmp

Download