36035629cd5186fb88c4f1945399d9d9a8c2c5a8e6c5e2f1b2353c56eee35267

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
Size 3.8MB
Sample260821-mfb3aastht
SHA256 36035629cd5186fb88c4f1945399d9d9a8c2c5a8e6c5e2f1b2353c56eee35267
MD5 a5e5ef4d14e2a6cabdd1c9569eb113db
SHA1 2e41bdfa6a7f81565ff042fcba90434cff52e2f4
SHA512 b53e63eff11f70d86788b5bcf7575895f506d7801550a45b38a496fdb580d638055cdb5583d9bf893485e141afcede8d054f8544ecef4278db3233b89fb1f77e
SSDEEP 49152:bBM3pwcp1gFAZt7JOIILy9ZDrX8YaGFad/ksA8ORlNu0hggJxH0issxj1EVO9yS8:dUpTZR4KRK8UW2hcOj
TLSH
T1D5069E26B35D01E5D0B6E2BCCA8ACD13FB317851433167EB06A182625F671FA5A7FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5976	elevation_service.exe
1296	elevation_service.exe
5560	maintenanceservice.exe
1924	OSE.EXE
3684	PerceptionSimulationService.exe
3740	perfhost.exe
3512	ReFsDedupSvc.exe
3004	SensorDataService.exe
3016	ssh-agent.exe
5872	AgentService.exe
5812	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b66ee7d1e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd1e1e3e5731dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a50b07f5731dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ec32a3f5731dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009fb1fe7f5731dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
5976	elevation_service.exe
5976	elevation_service.exe
5976	elevation_service.exe
5976	elevation_service.exe
5976	elevation_service.exe
5976	elevation_service.exe
5976	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	3512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3512	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5872	AgentService.exe
Token: 33	5812	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5812	SearchIndexer.exe
Token: SeDebugPrivilege	3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	3672	2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5976	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5812 wrote to memory of 3444	5812	SearchIndexer.exe	102
PID 5812 wrote to memory of 992	5812	SearchIndexer.exe	103
PID 5812 wrote to memory of 2092	5812	SearchIndexer.exe	104
PID 5812 wrote to memory of 5736	5812	SearchIndexer.exe	105
PID 5812 wrote to memory of 824	5812	SearchIndexer.exe	107
PID 5812 wrote to memory of 5988	5812	SearchIndexer.exe	108
PID 5812 wrote to memory of 3572	5812	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_a5e5ef4d14e2a6cabdd1c9569eb113db_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3672

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1296

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5560

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1924

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3684

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3740

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3512

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3004

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3016

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5872

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5812
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3444
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:992
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2092
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5736
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:824
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5988
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f4957db9ec70c200f8820b6d5f59cfc38d43baeb7f2c09dcd96586c66e5571ba
MD5 1f803a055cf2ffe47ddd7c272e0fccac
SHA1 b425a95805d591c4397bd1b7bc00d18c50dd74b8
SHA512 092bb094554f1709f8657f14a57a23fde0bdf1925f938fc4df9f3a7720f5ba8e50c827e2a79ed9d8728fa96f8730c10d6856fa462f97c75e825adfda850adde8
SSDEEP 49152:qb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnZfYvBHyO0s+2:c3q60jB/cOj
TLSH
T123D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 e8b2962045eb52baec4ea6fde7ce62c2ddceaebb44cbeb04ea3365be57a262eb
MD5 443482c9e32a7d07da6ed741e6b1e131
SHA1 03655ab498215a51e68bfbcfd6bfb4e8f11a14e7
SHA512 181d8f2ccbb4c50f33945de23c2db184ffd99ec0192292357a870437daeae96213e3691609a33ec30a44964de02aa6038c35ab0c2b6900bf63ec6f262958788e
SSDEEP 12288:41XLsswWkxy2lRq2czAawS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5Mx:+XYfDtczAafHLHUvB60yM/0s+1Krl
TLSH
T19985F12977E408FDED67813CC9A28822EA73BC514760D79B03E49A261F336D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 44ca71aee6cf5c668446018af5479183fdc8515f09679303fe324ad8dd5f8c5b
MD5 45daf8f81fb67b81a3c4eb4ab3f898a1
SHA1 beff6074abb74b0facb32ea5f29ff94199a91db4
SHA512 a091e81ff02345d691b4c2013f259757c8e5ab2b6d87f0566ce37d041caf3ed0fbd456875be280ae437b825eb846e9e086ed6774b3d956e29dfd5c8da12e686c
SSDEEP 24576:D0Le5ji0hmxNrMRfHLHUvB60yM/0s+1Krl:DPji0A7ofYvBHyO0s+2
TLSH
T1B395AE16F6748335D073C0B9C5D2A69AED72308257308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 80bafb9ad087ca25764b5d6303224dc35d0298c124a87f7aa6286834c1bc41f6
MD5 49aa51978581fc9b00e08011dc165841
SHA1 e75bd7d81ed385b5d22fc288e897d4f219218370
SHA512 78fa67b51ae041c3c9a7cec8af8eea516b1498259a5471639156858ea5e352ecf01a4346a41dd0bf68da4df2c04e90e8d6e05f654d9ac23666f44079d16149e0
SSDEEP 24576:Ea7/ezSC6vUyD/aqgrvWr6q8wyujfHLHUvB60yM/0s+1Krl:z/ezSC6vUzPviHjyEfYvBHyO0s+2
TLSH
T1FC756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 14837f04db336eba86877d932f39d6e337e48003cd11dc85ca7663d21e0aa0c3
MD5 dc25419597cc780d335ea0a9c21daaa7
SHA1 4474e561ca990d77731f08256f6365c38525d05e
SHA512 716e68cc18200f0c1b25e3f2e68b26b0f9f6b305dd996bcdf73282f7d3aa44bc036367b92b30471ef2c9693c25bbe228321a15ae92e6bb95ac46391efbeda612
SSDEEP 24576:nVbqPb88hv/l+bufHLHUvB60yM/0s+1Krl:nVO88hXl+CfYvBHyO0s+2
TLSH
T1B7559F66F5748331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 71dd24a44817a86b3977a73866c5a004b25e42ff01df7303026b868bf4d8a405
MD5 cdeefcca8c9313e44fc65ac17f265769
SHA1 bbdf53b8364230b9bc5657ecb47e7dc095b68717
SHA512 20f8af4aa96d40c2d2c2c53baea660cb1d551a29b109f0d548a796aa95f938ae92aa9c6b49b4ddf91017085e4ed6bf5011221b363e4c1245764817d6b6c68fb0
SSDEEP 12288:zjFwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:zjFfHLHUvB60yM/0s+1Krl
TLSH
T13C65234B0764697CFFB6443062A97CF225A78E90C554432B23B43B666D7F8F9E88B305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 9135e6d46c9990142e83847c06fd9aa4e429c154d8aa7143a613cd2ac3db2477
MD5 892f91f73368a0e281425e9e593b2fc6
SHA1 80a269274718c9be66e4702276fc4842cd8cf684
SHA512 75f14500836e9bda74083f73fafcd8fea88c41db7821164deef88bdb6a86db1fd552c03f161962d8ed00d630e1dfe4dcec3037c385df0fc8cf0ed5481d5f7d8c
SSDEEP 12288:peBNUbTVO86UGwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:pJIUGfHLHUvB60yM/0s+1Krl
TLSH
T14785CF3BAE28FCE2C27A8D7857918640E77278704B6293CBE175830EDE235E05D7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0fed5574b68fc6c0762ad1c772a0e4ed8d2b5036d6b8d953dcdbce2e86cef040
MD5 6d48f5526fa0a41e588ef5980abe78f0
SHA1 7eabe332f7a29f8e5826af13c44a6f7c79b13ad1
SHA512 66830666d8934712cb1b80c3f49c4d8128d256ec70f94ab3f790d597050500224e6d5ec84adf9aedcedcc068974c6bbabf6fabd63341b2f06efa8bf4fafe841b
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THd:pQvGAdlCEL8c/RRNw5CIcOj
TLSH
T115266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 b9d0839f6e9311aa32f73d20bc7a14070febfd346ba64cd4d8dee9e5606f7807
MD5 b59d6ea5041865ed98b6293ef16e5904
SHA1 2dae28210eb8c7a5aef4cf0734abc9dfd2b3d4ed
SHA512 1edcb66c755d7baf8652ce6a31c9f922ba33af30012191d844b2f75ed4df858853bc41f1dafa260b62218bb5d9e9d2abb354ff40bacf6a24194094bd690cddab
SSDEEP 12288:zAwSfxL/2Dc3DDLLmt0LDQewsAj4wS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6G:sSewsAj4fHLHUvB60yM/0s+1Krl
TLSH
T1E785E031FF74E436D7BB0DB21B26D726147DAA204B610AC3E3A84E9E59341D22376B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e98c63dbb6db2af9c7ab46149bfcfae3d768bc632bf1c605d7de96e89ffc352f
MD5 393175e66e331f6f9395137c0d010fd9
SHA1 fc2c7f76a37ed6d6ec604a2cd0b637233eb15047
SHA512 fc2f74aaa120eb2cae1c678765acb016bfd434d41072d22d9353e27079dd239fd911452c4267fef62bbadc090bfd18951598ce06ccebff7ddc1e57e3293bcccf
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHB:lUEtQevvqc2W1cpV2RI32B
TLSH
T185474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4c810b7eeb63b43c90b502cca25130a064bd66a752c7b08b06863d2fdfac8bea
MD5 00a9bcad5b1830894e0c032fbfacddb4
SHA1 a55eeb40846572e2245e94f30b07c0cfb1cd6e2e
SHA512 ca085a6fc0827096033c186dac232ec2110a2f716a35ee5e93312ca6330798ce82bf0acd50ed363636b6f6e1c2c4e2734a61424920f565ed184e899cdfdaf321
SSDEEP 49152:mCbRquA/m2yL5zQfFiV+XenmE3/zYfYvBHyO0s+2:LoqtVjnm0cOj
TLSH
T19BD58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ab6177beea878e11c77775c771c59bcc948073ee44a88bc32c959e709c513283
MD5 f2acbcb1a1f77e500be72e5a40ac4a04
SHA1 d688b0e1cfae67c478257eefdbe4eaf228bbfee3
SHA512 f8011571d1d13c156d9bef40a0d2eab8c27d3b25e7f68eb0aca530ec9c14cf472e4b82c28670df5e6fcaed994c0b315b01aa7437c4ffe35e4a74b00669ab1e08
SSDEEP 24576:fAhGL2IFoiwtA5l7S53vfHLHUvB60yM/0s+1Krl:fAM1Foiq5ffYvBHyO0s+2
TLSH
T1E735AE81E7F955D4F5B3AA7899B69471EA76BCA55E30C20F2160C21F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 479d1d6570379567cebf0d585342d516fd4e9e76468496f7b13443edbeed3a8b
MD5 81f3d1f65947e0a8136b0d41c6aea17f
SHA1 d3c1e94e37899bacd98222cdf50282894ebf4bd2
SHA512 4b07338c964c34dbb78cfeb75595e6af44d5be31dfd28bd8fd80db817bb98936155225840583110c08183da3a05ee9aff5a306e89d20be114d1884d314283f17
SSDEEP 12288:5mw5HEjsChNSBFgl0WDm+CDwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUn:UwuXOWkfHLHUvB60yM/0s+1Krl
TLSH
T1CF75E04A37A41CF9E967853886979432F7F2BC112A25C71F1360C75B6F37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 bad63dc2c8dca6601e32b54d76d403fb11bf64514256718c1d97aafb3e8088a0
MD5 5b1fe039442b749e3f15fa71c1025d37
SHA1 798a0174796c716c93cc50c0fc20685c9fac6d1e
SHA512 065850de732fca588e9af28f126b212202f3a4bda3a4ef3ebd251a975e2ec26e6b1c5bf620be36f05da563c051edd26a9d0cc634d6e3e40a04e0620196809353
SSDEEP 12288:b/Z1IyIwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:DZupfHLHUvB60yM/0s+1Krl
TLSH
T12D65124A23E434FDF6A3813889E56962E7B2BC52537543CF226403662F37ED56C3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ca13efc286d6539dc6a574db7e25476c53d46467d9c8c384b276e0b0a2f6d568
MD5 b19d66ca049239f9aa2f1a6de7afcf44
SHA1 e8e80ae13261ca567e872c4f26a028f169a139e4
SHA512 8f671ab9909918b6a214f176c8a9093b6aaa765c50f7ac7541327676f4857b46337cb8de027df0e6d10ead7b1661ad5a4aca3751c7c72e2f4dd6e2d756de33a5
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uh:WQRQyi36YOcPhLvw2gAf+PN3zcOj
TLSH
T18F667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 179d87233f717dccea45e1eb2c26bdfcf2de7d0b4f20007deb3ea0d3da4e6823
MD5 4154031805b2ed275305e306135d6849
SHA1 3a4e34cc9638001bed4f44d0a3520bce612446de
SHA512 911943a1435dde8369e2483986490802bc1991580f5a75f8ee6fa8ae68d6d52faa4c15977d009ef21e28d9f342300032fcdb25147af8e2dbb3e16e6a69f2e569
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uh:uQRQyi36YOcPhLvw2gAf+PN3zcOj
TLSH
T1D6667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9fedf34eb66238a3077542f627f59c8826579befd1ba5d2c8ae301a4c158fbb9
MD5 76b28bec840a65b4f6372712d658fb5f
SHA1 0074690a8f428e9c6a7828031821096432f98b86
SHA512 930445523861ce589812f68d0c837f9c4eab906f29af5a722aa12ace607129ff4138a3b7fe2c1d2027245bccd77be79aba3bf68f5d8aa612070937ba88a12d84
SSDEEP 24576:nwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0ZfHLHUvB60yM/0U:P68Qg55nhceWu7PNU3/ofYvBHyO0s+2
TLSH
T1BDB54933B2F200A9D44DE1769F4A973196D27C758FE0E3DB811172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e6cd1daf019665d6eb29d49b6db11df042e80cd57899af20883a7bd4a09e7871
MD5 eeb2b597e09a454d28546ffd32fc14ca
SHA1 8e117bfab4d7b3ad0e6616cb452c3b5f64c05816
SHA512 308b323a0b951e96fb32fba755b3a6c09aa15906c9039728f5686db5efba2dacdbe9a0ff58ca44cd594e3898b60416fa1052fc26d848fa81cd14a3cd4b04f79f
SSDEEP 49152:I3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99D:ly5112gYy5azzVva69nLKnhZ6cOj
TLSH
T18A168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ebd0f1658e47f381fcc88df2e64c5e96cd9a054c3a348ca10c004dd11f4cf940
MD5 fa8f0cfa4f1700958ea31a9b71d98672
SHA1 0147c76ab14bf118f47a2b8ae8b2836880acb80f
SHA512 b9d0f9ec01d96dbd88e218df55c11c7bc8a4382039be19868dcc1eaebbada62951ca482d9b31fa4c60c27c02580d83e49b23c525b9cfbfcc909dc4f8b70aed8f
SSDEEP 49152:XB+taZ3usBWOBr4tEG20bqx0z+n217aau1glKfYvBHyO0s+2:5u6JmUxd2dLcOj
TLSH
T1F1D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 38feceac2883b51ceca6082efa867ce2d786e07d994990501558a2e08c444fbb
MD5 5677602b6d9640a72d3d2fef582ad7e5
SHA1 4906e1341f0fe76f748e5d2582f9e9173a7d1847
SHA512 bae979f8a2f3d6becceefd94921adc6cb023e16de97a5b78a460befced3ec2c5efe69aa5fc8e0d843bd75e3fdc2495959c9352aada42c19a09c2a5ec32106c8f
SSDEEP 49152:Z1hpsNoJpF1A6BU44CwH7R4xmfYvBHyO0s+2:ZmifPkR0cOj
TLSH
T1D4B5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A9077961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0620ab725bcf4b5e97528e864c7b2838eeb2a8e24bf38a50c1d06fca4e2462f7
MD5 ff4de76adddd88995d2c051c660f1056
SHA1 e2e34eec879bbd4e46c12a7da7080895b4c0caf8
SHA512 8ef168a1733b2d52d0c210a4ebd74f2fa379436f8f7f333e6a37e020d82e2b97f4492c58e5aeb9c75100b6131c38d0e5ef64d901756a261d644273c7070fa4c9
SSDEEP 49152:BSuZQIY0Be2KNRVtOnks6NMHqpfYvBHyO0s+2:P5dKvi61ucOj
TLSH
T1D5C5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1345700d2c6b2712741ceb491bbd433eaff619d7082e6d37fbe913a7097e7bd2
MD5 30bf7a381fea7fea8e9a62188c969ac8
SHA1 9324f5dabadef15636b13d875653f636ca16150d
SHA512 6a7de2ca79d3be9b108b3456e1e3280185eacc73fbba53348d69a54154040bd97425e3655ca75a246853bc0f572c2fe585fb04af9d4e0e6f5b3c60590b667017
SSDEEP 49152:2htSn8EApI0figXgiDn0AP5wafYvBHyO0s+2:XX2iyphQcOj
TLSH
T16395BE13F2D900E8D06ED178C7568632E962BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 31b3e8cd2a8b3e6e7bd5c843ec95f181bb24c372100c4f767937006311bc3596
MD5 28fbaad0c24542fbbc7398da301ca656
SHA1 db83d909281f0748fe04ccc05fda019230d1ddd5
SHA512 248bb6373b820a8c8ff10c99491ef480724f4c8f2055d6601aaf3fb8715704a2d270b973b6e2a1a97c4f1351260c8032906d0212012a2f14ba33e5993075c72a
SSDEEP 12288:r9wS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:r9fHLHUvB60yM/0s+1Krl
TLSH
T18D65230B1BA56D7CFA72847052957CF264A78F95D645036F33A823227E7BCF9248B708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 bf95c82fe287caf69c4ddf4bdf19f158e02dc4690308a059a6d96c9bcd93879b
MD5 c6f7dd64d340cb529b43e12433b055e4
SHA1 0d4300bc725e46bca3bcd69dd156027bee0b8e15
SHA512 f51ccc71d48629a35b42725a7b95a039913d9f4bfc787439a595fe7d623fd367353d0bb2af43548461cbf1b449cc956aa0786393a14f271e09a3dec74c759b16
SSDEEP 12288:HswS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:HsfHLHUvB60yM/0s+1Krl
TLSH
T11F65230B1B656D7CFA32847052957CF264A78F96D655036F33A813227E7BCF9288B708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 a49d0c5272cfdd60718c5c1954bb67905b30409bd27f22637be973a946e7f8e8
MD5 e2e2c37fd402fe52c63f8c28aa118fc3
SHA1 72aa5163a0dd06494ed912636eba339c7cdf16f9
SHA512 178acac68dfbd0d46efd1701b945a1e58f09c199fb3e2818473b117c182423521b84da291fb529586a55507c6704b25194ca4f47607c7e7ac35de5efa6affe64
SSDEEP 12288:4ewS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:4efHLHUvB60yM/0s+1Krl
TLSH
T1AF65230B1B656D7CFA72847052957CF264A78F96D645036F33A923227E7BCF8248B708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 af62f14e88227738931f4751e7d268cea443e05f57b4f03da03783969fce1293
MD5 37323035478d0452fe9de79d4e38d503
SHA1 477f676d0e4cc8c3452e80fc4cfc5ae7b3fa175f
SHA512 352c4de26d65be37c0235b7c3b6e9fbd4fe25ad9fdf045f1acc298bbfee5d98cb9f47c032c145bfde4441d1be98cc953a0bd376bc0caab9dd631e9b1f866b0c3
SSDEEP 12288:oVPwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:efHLHUvB60yM/0s+1Krl
TLSH
T1C365230B27A515ECF972C134C2A668B2A2F7FE91C72143AF735007172E77AF4685AB04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 827713785a3f33f84f664aa2c32f22333601fd93c44de0dc07d28f884df55ecf
MD5 7e82140db21c3cf52a1d08448b71cd8b
SHA1 5ebac7152318f9608b26bf941459541ff214b640
SHA512 35bc365658cf31a6bd31e7b4dfebdc4d8cb8e3ba937b36215e21b9cafb105e33f75c2db0db2f1b43c4b40507d0614aa8ec1eac9baad493c7bb5b48e7a094deaa
SSDEEP 12288:m3wS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:m3fHLHUvB60yM/0s+1Krl
TLSH
T1AA65230B1B656D6CFA61847052957CF264A78F96D655036F33A823227E7BCF8288B708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 97cbd08b371fecfcc775c31b6cbd8923762297b638d73b669187c7a32924d23f
MD5 86c5f59b3577c9ade719b3a924cfc1a4
SHA1 918ed390de3fbd13e70394f72188c3153d6b1763
SHA512 45ceee573cf22dcffc2e305b170ba2cab9a74f28959a2a3f05f5a08a9c963be6950f72591f99fcfc8868bbb69dbadf232804e2e53dfa2be842a370fda9ea9b31
SSDEEP 12288:HQwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:HQfHLHUvB60yM/0s+1Krl
TLSH
T1F265230B1B656D7CFA32847052957CF264A78F96D655036F33A813227E7BCF9288B708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 0379d606fb43a65b64b32f21f2b141038d2fbdfdc34dd58ecb55cfc0b56a9498
MD5 01d01f7571e7202e6c749edd826b3c7f
SHA1 694e7c5a6418ff842d758603d4b0bcc049fb06dc
SHA512 caed3b25741621348ee9c00edb29ded8849ff9ec827a4784579b2c5ca98e1407f878a74afeff23d3e2a7c492fa5f5a0ba158780182cf51d26f6de09d2f17612a
SSDEEP 12288:zUwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:zUfHLHUvB60yM/0s+1Krl
TLSH
T1EB65230B1B616D3CFA72847052957CF264A78F96D655036F33A817227E7BCF9288B708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 0968614b65f69851f810ac63beba234eb00c723feda3a59df986fdb4c1f1cbd3
MD5 0b14667021e00ee1367a084722b9fcd8
SHA1 c9dc1c89dd43a505acc42658c2459b0bb56f4d30
SHA512 d6d5b8b3fcb01c120de5b4c02ba663a840fec92cebe145b746e500636a72f6161018d1b719a28c1c577a492bb98b6bd4c2b16b4b90a77434bdd048dfa200e18a
SSDEEP 12288:XiZwbczzFEoS2cPvyMwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MIt:SZMMzFVSOMfHLHUvB60yM/0s+1Krl
TLSH
T180850199B3901CF8EC67813EC9659852D6B2BC5A4B60C61F13B837275F333A11C2EB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 c67ac62f1e489940b32a48f7e34fb8a7b81e8dd2135cb0e4721174632b105ea6
MD5 420f5c7b579884381d41e075e01d7fec
SHA1 395c7ca151ba65c82ae0c1ae42e36f2b792d0256
SHA512 2902ae52f73f61b4f866fb44569f52990af18f94c655e5ddb7807af546bef0ca1c05e99b82bfa2b598344360bb62121bfaa541fa22ec0202c16ad38ee10c9f16
SSDEEP 12288:55wS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:55fHLHUvB60yM/0s+1Krl
TLSH
T1E965230B1B656D3CFA72847052957CF258A78F96D645036B33AC17227E7BCF9288B708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 efc2e57707c5cfa559f39625546866dc9b606f1a8461844a24d508b1b7051056
MD5 9d47e9d79c3ca4dbb1e871d53af2a63c
SHA1 d37ae48daa0bbe4c7d380467cd67ea1e9ae7edf7
SHA512 bfd16a30dee636853401b84cef0b29f86ade41762e0b1d48be82f2f1b5a4c92a0c2d4f41b2ff2f2780f45c4226ff1945d62bf8237886cacd897f225efb86f6ce
SSDEEP 12288:RVwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:RVfHLHUvB60yM/0s+1Krl
TLSH
T14565230B1BA56D7CFA32847052957CF254A68F96D645036F33AC17227E7BCF9288B708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 b24deb3d47836ae21bb2f8de96eeff735eb000a361391e912de287657dfd0dad
MD5 58a6719e1ff5dffd3d7e823d2de9664c
SHA1 eec37034caddbe2e9ce55732b8d78d1765d8193b
SHA512 96aeb48cca33729a41ba10cc0ce1f8f8850c9e92d2d72c07492f532803d50e0ea4826cf619c1a87b4ffa05a312da2423643f9386444eb636054658247555e77f
SSDEEP 12288:7yPz5L8IwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:2zyIfHLHUvB60yM/0s+1Krl
TLSH
T1B875020777A130FDE576813489A21962F7B2BC76472087AF23A407762E376E15D7EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 efc68c81830c2e2a03adfe0ea8b60ad7a735715dd92eb483b3660ecad9beddd8
MD5 6475989c69a42bb97f787b955cb0ba63
SHA1 d0317948d4eadf0e0fea361fe00244a837d3c9ac
SHA512 26ec9292ce03414ebd7888a75d06a5d23e09cf8d7dedef3b64f4ed44b670bcdcf9c89668ffdbf835b37fd730db6593fe1dcabccea665ceb2103d29dfc1fcd4a9
SSDEEP 12288:q5wS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:q5fHLHUvB60yM/0s+1Krl
TLSH
T1C265230B1B656D3CFA72847052957CF254A78F96D645036B33AC27227E7BCF9288B708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 ea22cc08becdede9092432f080d359384dcc669b3dc66834f0928d2c154b1e21
MD5 0c44b410f74c1976472882f5630b4279
SHA1 9e13998a6737c893442eadd6ac2f0f4fb092835c
SHA512 91bdb8732f1728541fbb6d68b104b50ff6077a6123fc89d4c62ef31d71fc14952a471aa77d193d5625325e481dfc12952e5188a4e7536b6b3e67614d7dd79a19
SSDEEP 12288:Y5wS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:Y5fHLHUvB60yM/0s+1Krl
TLSH
T14265230B1B616D7CFA72847052957CF264A78F96D645036B33AC17227E7BCF9288B708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 9ba86265fae047aa022a634bfe869c3c9a5cfe55568d3da1f46bafac7099807a
MD5 b2aae67a049925fc9137c5ec558d7e3e
SHA1 ca87779e32211e0984c6940f23cf5a03a8f7ffb1
SHA512 5218a3cc1510c264351df08919bf8ffeaa4e3759271f7cd368f45e8efeb486130adccb23ef40ab07c52b3e18a9fb83c3b619dde8491b004900ac5c9bb889816c
SSDEEP 12288:MyPz5L8IwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:VzyIfHLHUvB60yM/0s+1Krl
TLSH
T16775020777A130FDE576813489A21962F772BC7647208BAF23A407762E376E15D7EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 061f681053b68317d2371c2a5dfc3771af94aacce7846753c5e33a24c4c92b8f
MD5 ef53a42f92575a5aa390dffeb9164b52
SHA1 d6328d38338b2b625b2a22d86d2d8fe6ea7defdc
SHA512 61bc69c7b7ffbbbbbc137959468b6373a880f76a17adc7d9295f431cff156cfece9f7af2c7a004021f7d840fe3756acac7524669d14d5ae70f22e92d2b7614a4
SSDEEP 12288:DCd9MWYoaLHF3z0z04PDvhOwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUn:uT9aLl3z0zDOfHLHUvB60yM/0s+1Krl
TLSH
T17A850199B3A01CF8EC67813EC9659852D6B2BC5A4760C61F13A837275F333A11C2EB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 93e4f48e9afad395bbf8fb183cee20a855bf1567b68ba25e6e18ecfadb3865dc
MD5 81a700f87a0a60f28c975b720db32544
SHA1 976c633e0046663560cbfbd1935b03a29944ef1d
SHA512 2b2a9a1ca34d4cff32c543d1901e3c387543aa8d4ef4b0b85d159eef86971e53759051bef790ecb53a8e29c2e1472a144721daac6fe1d23b215842c24dfa561c
SSDEEP 24576:I3td9CHKy7GZyfHLHUvB60yM/0s+1Krl:Std9CHKyagfYvBHyO0s+2
TLSH
T16195CF90F3E414E8F1B7CA35C9765512DAB67C5A5B31CA8F03A4261A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 2e1cddd1198282ab2e452cdcedebc9ed9262c39195a4dd4b56ef3400b81d3d33
MD5 08f255ae98033639d8296c4df9f8384a
SHA1 b536c84ae87f96e96093b62219fd6d9da1ccf709
SHA512 ae62cdaaa456b6f08311e8f2893560024bafa2cce796e6dbd09426c7a69d38328a9c866933683f532cb1d29d612f7b748693942f4c9be255758a25bdf7e177fb
SSDEEP 12288:v+wS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:v+fHLHUvB60yM/0s+1Krl
TLSH
T19065230B1B656D6CFA72847052957CF264A78F96D655036F33AC23227E7BCF8248B708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 c5fe104971f3f452003b259ca8414a001929fd00f5c0b23da183083d00f15412
MD5 a025624e21fa8aea28d731cae067a371
SHA1 a26c122f1c0af4b7c14ffee08422b6ebdf08c2f3
SHA512 c68772d81360bb737fc4c3561e9c3f1e6db7861d0dcde25a8ac9569c459c60eeec1b590b7c856329d79b5989f92e593069df1953f4f8fe77053f624e81b37771
SSDEEP 12288:sowS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:sofHLHUvB60yM/0s+1Krl
TLSH
T1F165230B1B616D7CFA36847052967CF264A78F95C655036B33A817227E7FCF9288B708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 2e3391d8641b04511b67182ffa687ffb4e8c0a4adc1fbbdd8b86a2eacb0e2779
MD5 7de376e534ec6a17399f0b778a3d4136
SHA1 6ce556e0a42a0e0d1199ac6bd67ae9875780504e
SHA512 ef8cead07eead996b7e6c3c769854521907a1af94cf91a0cd79e2de57d146db3dc0c1e3b479c671c7043036b340e5eb0553a17e3e2597fcd65f2bf5423ff73b5
SSDEEP 12288:0LwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:0LfHLHUvB60yM/0s+1Krl
TLSH
T15165230B1B656D3CFA72847052957CF268A68F96D645036B33A917227E7BCF8248F708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 46ec0c402aa71adfcb72da30e30d5e9f63d027f48572775728d94cf1d79ccd83
MD5 96b1d535e4c4aa3277fad632e4b056a9
SHA1 68ed4b7bb9a27528ff02073ffc40f4bbfb623f61
SHA512 530b9603807d4d326e9e5a44d193cdc0f04dfeba1c82f90638b62ec91b599cb4ec86ccebbfec2dea6b3744b99cb2aad3dbafde15175a5ff0951eec15f43af623
SSDEEP 12288:M5wS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:M5fHLHUvB60yM/0s+1Krl
TLSH
T1A765230B1B656D3CFA72847052957CF258A78F96D645036B33AD13227E7BCF9288B708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 0128a843e2c093ac84a54ad9a260f244d4445d82774a0c196ed0102a10b9b954
MD5 856e00c1c0d99f3745f29fe34baa6572
SHA1 7b7b98986c7bcd8ffc4c93bf34fe1ce9ca359281
SHA512 0ad4749f0bd9d6137397c1982a732747e7a98cacb604277068aedeb55ea7adc5a670693b5ab68c26aa8c1f2998df83ad95c0f91cdff886c0c0a2ddbee6c2b932
SSDEEP 12288:2+wS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:2+fHLHUvB60yM/0s+1Krl
TLSH
T11165230B1B656D7CFA71847052957CF264A78F96D645036F33A823227E7BCF8248B708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 20426ec26aca5fdffcb31fa222d4b980897b144a2eb0538d1eb4b8a673c2bf92
MD5 fb623dc07249461dd3a8b9c40adb4ab7
SHA1 84d85a8e417987fad8d9013d28cbc5e2a07c3b50
SHA512 c9ed922838bb7a6f90b924291dcc5c6e70d8237bf17ba4a462321dcfdd8ee319839be4cd7798601ce27a6272847d182af5996c00c573b9283ed7c3b67f92c32a
SSDEEP 12288:eBwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:eBfHLHUvB60yM/0s+1Krl
TLSH
T10465230B1B616D7CFA32847052957CF258A78F95D646036F33A927227E7BCF9248B708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 8a22edb1bced0928d587668953b3680daf3fa08f116c567ba69b484bf398d84c
MD5 54dfb7befe9ba307f4cd3b4f85b7ff41
SHA1 a8efcd8f7696df3bfb9f74f8ecee01f736da4c23
SHA512 83937feb19e3085d2ac6ddcf1497aeb652ea616e9ab94b90916263a3a60967594c46ae5b5a4e79b81571c1f8c7ae9a6054a822bcb900296987f4070088a1421e
SSDEEP 12288:N3wS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:N3fHLHUvB60yM/0s+1Krl
TLSH
T16365230B1B656D3CFA72847052957CF264A78F96D645036F33A923227E7BCF9248B708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 266dc1f4fc2e1f033ac38ce07718f1162ecdb5ee6ea6d80563d19ec96fd8b15a
MD5 9ddf876f7d5308dfaa1d5ccad1241c14
SHA1 1abd0c49f669e24d7f939179c202dfc59b369c41
SHA512 f7af2de2ef68017ba43c2315f6bfe3d58b7c5e7786be187460cf18b32144072dc360c88f8423be69850356339aa879b25f669c410efe39767da12079f70950ad
SSDEEP 24576:efwvok9RX6wkyAIlfHLHUvB60yM/0s+1Krl:KMnYIlfYvBHyO0s+2
TLSH
T1EB95D029EBDC04E5E1B7913C89B7460AF6B178691B31C2CF129A536E0E37ED46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 05b7b87f348f9c5fac9db56cc327560776f603bd2abfe1eb775537a2d9f09e4f
MD5 714510e763bc1e33f9e344ce40d74511
SHA1 af89d3f7250f60fa2a2c04d2de2f79f9fc088632
SHA512 b27e26485f72ead396a933ae4612e010807a02fe31b96fb78b380409e9bf47157b8dec1f310706222c686eb7b7de9b7ad144f79ff7a09ae7f0e29c4bdedc3796
SSDEEP 49152:EYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK06fYvBHyO0s+2:sySzPTcOj
TLSH
T1DC066C56A1A801D9C1B9C1B98B1BCC17FBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 97b3d02fa474e051a5706b5dcac7cc9123f515eb835ed83c55d246d65935aaf9
MD5 2e270cdf4109d23838e3ee1835d1bd53
SHA1 a31a3497ae6c526ebc43b7f103c496052f7e6603
SHA512 d9bf4d9919ba5e6037514b6cbe2e7d0d1970e2b18e0f5ae8fefc8a3c1bd54e551d156abfce5d0e3f52c3424c8b9021943947ca6d8c480150c647759b3b754bf2
SSDEEP 24576:b47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYcfHLHUvB60yM/0s+1Krl:b47JUQj4irIhCnDHUPfF/KfYvBHyO0sd
TLSH
T1D365AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF2270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 5bf11bfa3caabc13e1795cb3b649cf676de991fde6456ea0fb73e5bf41fbb520
MD5 1d8b27be7846589c650a676d7136597e
SHA1 0582e0065b9b31e1809d674364952f52425bdfd8
SHA512 bf5dc7440c6c3b671210dbb3ddb02c41d632c8d06192cf864ffe92a19d6ad58fd61cfd4107dcf1e2fc5ac401aa92ede8380d337deaa08c9d6f67bfa0ec74f058
SSDEEP 12288:fGsfpwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:tpfHLHUvB60yM/0s+1Krl
TLSH
T1FD75F00AD29812E8E06E5175C7565991B3737C6583E183CB23D0F63E1F7A9E06DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 4da1e7f1648ef69245c1779f65631217d9d94f872e177caa9b903d1fe7a27c37
MD5 329e82161995e6dec48ce0f41670e457
SHA1 dd2c752e719f68ae896cd3f5f9987d3d6abe79c3
SHA512 f67a4d411c4cf631c1e5815251b79b59547e3b4dcdfccf4ad91763098c3932f31d20714a51001e71e0e4633385a0cf50c61b2421334937abb4138384d148c3fe
SSDEEP 12288:0B8Yv+SU3fbIPIHxrwWXd9EcfHfYzxPNxYtKwXiQ:0B8sZUPTrj9EcfHAzxl2tpXiQ
TLSH
T147352950766AC75FC6A940325E32C2CCA7707D41FE05AB0372C8873FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 130022821aa3d07d16c4d81d05f3d770faa889c231882cc00a814b12963807e4
MD5 32e736322916df333f9e3ee91b0757f1
SHA1 b16b4e3d1f0d38e1ad1b31211744de984e090556
SHA512 ed84c421fc130da77dfce4a4ab2edf3b1a501a3048928486f88de8bf49ac42e66ff6fc49194e51babb31c5021bea0e1dd985f7089004e8155ade16d4883307ad
SSDEEP 6144:s9DuuI5lgj6FSc526tMxhJ26tMxeChDHDcYpYcJoyI6:sHcsovpYcS56
TLSH
T15B65D8816537E2CFD1F6613207299B4DA764EC07B7056F27B3C8053AD82AB25A0BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 fabc460b4dd8a0de6d4382c5be7552885697abe8862619941ed31ab85bbd9508
MD5 f14467f229839865b06bfbfa15b96d02
SHA1 c0b0152d6196503fa18bbeda48e68b07cd52c013
SHA512 0a9ff82aaa2f6bb53bb7eebad4739c94fe0cc16650ce621201461598a6ac7606a719426c0c717b99c9a0d8efb3ca2287c1c95e0483a2b83b7fa164d6bbfa6439
SSDEEP 12288:wM7xwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:xxfHLHUvB60yM/0s+1Krl
TLSH
T1D465231717A86D2CFD768470129AB872256BDF60CB0083DB735823627D7BCE46CBA709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 899351e307e39707a57019aa448a65c40dbd725d3a16930b3942e01b3b24e59d
MD5 8dc6bddaa1bc7826bf608e8926ead2b7
SHA1 ba9c72216deda4bd8346054f131a7a5b8cb9dbd4
SHA512 3b891fe36982d74b08204088b5c4fbd09a7d586ef0e08055778f9142f6031c4214c32775a6c4d65e6a812ec2aeacb5bf4d2eeb7269b6d2d65ba9694c8f6da9f6
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bYjfHLHUvB60yM/0s+1Krl:Hgb4mBIBhGFcfYvBHyO0s+2
TLSH
T11965AE1E22EC02F5E0FAD2B89DAA4417D6B278164731D2DF1251423D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 301f6b48fb3fbe5cd361d388a9a9189df289593c75fbf8e47713641420ea8af8
MD5 50dcac736845d7277c60b18c6fb7d04e
SHA1 1fd03f886e526034b4438fd680294324a7e528c6
SHA512 36dbfd2d5e9c6cba9345ef89121c2819f82d26a8eda9429c40a519c1b9ab6d1a32f95a9d68a64227267f61f069ba2f8cb782ad4a373eaedb9fe32574dace3c0b
SSDEEP 24576:7G88u8FpJqH1Wzria7/mMfHLHUvB60yM/0s+1Krl:a7ZFPqVha7/rfYvBHyO0s+2
TLSH
T1D695F16577E101F4E477D1388A864663F6B2B8250364EBDF07A88B511F23AE50B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 f52f759468b330064280cb8e42406ec61c3e8fdc16b99f2eaf064e2c11e24db7
MD5 8bd6115eebdf3dc2db04793e1fae2f54
SHA1 307f41c6af964f0e84590ce34564c347a853bedd
SHA512 a53742de64d4f79f86aafa6ec3491be9488d09819ef4a0203e8d36b6205350282aaf5a30f896980ab3c3637b749a7e55797bb065cc389f25b19361cc58362b67
SSDEEP 12288:ZHvUrBFrEjwaQgwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:ZPUr+NQgfHLHUvB60yM/0s+1Krl
TLSH
T15975E11F22A91CE9F676E17D85868619F772B862071192CF02E0417E5E77DE8BC3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 06ef619704594e093fe3ad7f1762064795c790ad741c747d898b1da46027dbbf
MD5 221fdcc9f3f5baf6db920effdf87b7cf
SHA1 ccac353ac01cf7b61ca816b75bec1d3901a9faae
SHA512 db6bf5bebda33576a546f91894ca23df3e0cb5fef05cbccda2aad4557335965257688b40f0d4e55327b12ea9761fb782fce3664f68dba2f0004e3d486c39d05d
SSDEEP 49152:mBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjQfYvBHyO0s+2:JG05lO43bicOj
TLSH
T142D5CF6E62EC11F9D1BBC17CDAC64A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5b0ecfddca2c0ab9386eff43baaa9e8a05e3fb5ac33729fd6f60e0314d0d7330
MD5 9f2a0c08312f4c88d20e4b5a721ce971
SHA1 e417969f933d380993b677a38c2be9189ae6dd78
SHA512 9285493258b2505e860fdfd6d1525e42d7550357b8665e3e5fcdee5439fb703fb3cf6b31566a5e326e16ab03b7fcd365b1ed22056920744b47fbaa9bb7826b50
SSDEEP 24576:bfa5POZ3dpqWVM50JicR2hG0lasx2+47eidn6fHLHUvB60yM/0s+1Krl:Da5POZ39Jt2pasx2+mofYvBHyO0s+2
TLSH
T1F365AF5EA7F801D5E5B9D17CC5834A1AF5B1342153329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 54e20dfcae6623075a1021b7dbad1aa841c46aacf53552cf4cbef1f420a39c6e
MD5 411a9032d88125674c359b9fe18592bb
SHA1 b5263c4a02d98ca33beee30cf8d293d5f1815d50
SHA512 1e923cc442da5de30c4f9232065aab651896b5deed10fdc38bb8ef10a7678edc61156bec802c459dac29610b950b34de9941ed92fdc998cb37294e8a10b5e288
SSDEEP 24576:LNcwHdjbyQ4nLC18lb/EOjowL7FkEfHLHUvB60yM/0s+1Krl:LNc/zEOVHFLfYvBHyO0s+2
TLSH
T1FB858B1623E901E4F5BBE1BE89779946FAB17865533086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0e3ca47a5f14b0f41fa28b758dd9023a39f8a4e8ce6f8721efb623a75dccc62e
MD5 6f18810811d1c3d5cab9849e3a853461
SHA1 a49e8bed342f764a97c5563ff4085d560f9a5974
SHA512 e7d8db9144cd6defecfc9833409e2e70c41a576d36c810ee983a24f8c280f504626de015a650781247270a5d15295a07836a63331c5de0c1aa4bba27ea40a8a7
SSDEEP 24576:6tkNvNnaFeYhJNtmZBmWfHLHUvB60yM/0s+1Krl:6tMwBtOmWfYvBHyO0s+2
TLSH
T1F855AF2EB7B846E4E1FAC6B48D238512E6727861073253CB5390C13F1E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 64c6cd7fa93e6c64aabd738c2a37a382c1aeaffcf103fb2f34e10e4c1c353408
MD5 66ad6611be88316e750a439a08c36866
SHA1 946d85fb241ca53dafa8a4a734a3983df53129c5
SHA512 47b1f455a81da25fd4c0739d9eca0821c15e8e53ebffca7e4c3e43c72378f815dcfa4af807afa28b2891ae67c69c7bea77986171f59ad21811f2517f9f2d4308
SSDEEP 24576:ED3FHshBIYQgAdfHLHUvB60yM/0s+1Krl:EDVHeBIAAdfYvBHyO0s+2
TLSH
T14C85E17EE79C04E4E57BC1BCD6638906E67138A9032256DB12D481B61F6BEE47D3AF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1296-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1296-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1296-30-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1296-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1296-115-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1924-56-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/1924-57-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1924-63-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1924-171-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/3004-104-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3004-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3004-317-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3004-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3004-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3004-110-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3016-316-0x0000000140000000-0x00000001402E7000-memory.dmp

Download

memory/3016-117-0x0000000140000000-0x00000001402E7000-memory.dmp

Download

memory/3016-124-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/3016-118-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/3512-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3512-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3512-92-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3512-98-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3512-335-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3512-337-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3672-79-0x0000000140000000-0x00000001403E3000-memory.dmp

Download

memory/3672-9-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/3672-297-0x00000000035B0000-0x00000000037F1000-memory.dmp

Download

memory/3672-0-0x0000000140000000-0x00000001403E3000-memory.dmp

Download

memory/3672-7-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/3672-1-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/3684-282-0x0000000140000000-0x0000000140274000-memory.dmp

Download

memory/3684-67-0x0000000140000000-0x0000000140274000-memory.dmp

Download

memory/3684-69-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3684-75-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3740-85-0x0000000000A50000-0x0000000000AB6000-memory.dmp

Download

memory/3740-299-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/3740-80-0x0000000000A50000-0x0000000000AB6000-memory.dmp

Download

memory/3740-87-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/5560-48-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Download

memory/5560-52-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Download

memory/5560-41-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/5560-42-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Download

memory/5560-54-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/5812-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5812-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5812-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5812-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5872-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5872-137-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5872-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5872-135-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5976-90-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5976-23-0x00000000007A0000-0x00000000009E1000-memory.dmp

Download

memory/5976-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5976-14-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/5976-20-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download