831caa7c13007725e8751c7db391749aee5c2084a913fe009e22c9736e964edd

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 02:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 3.8MB
Sample260826-c552jsysaz
SHA256 831caa7c13007725e8751c7db391749aee5c2084a913fe009e22c9736e964edd
MD5 f1c22fea7814b495cf21ec520871f1b9
SHA1 326e397ea6c9e62bcd423efa06d0097a1a9f08b9
SHA512 6995d0b35c43e8f6a39ef144089704da586159014ada3791eb6a282833f703d8ddeb4ddffcd26114f864bab2bc8c9b13bcbe9d9701cdcaded4271a6d12a2b8df
SSDEEP 49152:V7JynhJ8EhdVMw7Y9odwfDFqfFFJVgrvqzbut1wOq/eCgfUeT+uXEkjNEEBHLY/r:8soEC9ha+uUkjDBHLY/7wRGpj3
TLSH
T11706AE0AA7E406BCE0F7C679CEC6C553D776B80D07B0669F029099A64F772609F29723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2692	elevation_service.exe
616	elevation_service.exe
2056	maintenanceservice.exe
2776	OSE.EXE
3308	PerceptionSimulationService.exe
1616	perfhost.exe
124	ReFsDedupSvc.exe
5376	SensorDataService.exe
1360	ssh-agent.exe
6012	AgentService.exe
4156	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\caa20de7e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000097626f530435dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000735e91530435dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000360e50530435dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a1b22930435dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ba739500435dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000046a645540435dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000550cde540435dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e47d4530435dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f7d572530435dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2692	elevation_service.exe
2692	elevation_service.exe
2692	elevation_service.exe
2692	elevation_service.exe
2692	elevation_service.exe
2692	elevation_service.exe
2692	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	124	ReFsDedupSvc.exe
Token: SeBackupPrivilege	124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	124	ReFsDedupSvc.exe
Token: SeBackupPrivilege	124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	124	ReFsDedupSvc.exe
Token: SeBackupPrivilege	124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	124	ReFsDedupSvc.exe
Token: SeBackupPrivilege	124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	124	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6012	AgentService.exe
Token: 33	4156	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4156	SearchIndexer.exe
Token: SeDebugPrivilege	2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2552	2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2692	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 1908	4156	SearchIndexer.exe	100
PID 4156 wrote to memory of 4788	4156	SearchIndexer.exe	101
PID 4156 wrote to memory of 2932	4156	SearchIndexer.exe	102
PID 4156 wrote to memory of 4144	4156	SearchIndexer.exe	103
PID 4156 wrote to memory of 4324	4156	SearchIndexer.exe	105
PID 4156 wrote to memory of 3208	4156	SearchIndexer.exe	106
PID 4156 wrote to memory of 2736	4156	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_f1c22fea7814b495cf21ec520871f1b9_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:616

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2056

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2776

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3308

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1616

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:124

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5376

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1360

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6012

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1908
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4788
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 956 2860 2864 940 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2932
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 956 2888 2900 940 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4144
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4324
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 956 2888 2900 940 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3208
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 956 2860 2864 940 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b71a1070cbab72381302d1c13ab6cb43d6620cd1b0e7c5189a153e29006d2d40
MD5 6d926f1d9b255fed346bb56498410ad9
SHA1 13dc8ed44f96b6b06b5717257a787f808fd47a63
SHA512 b1e99efc52befbab98683a548a8ec3931681bec9455542ad423e289b3336ad3cc3eb837d20bccd0f647942011e9dba38521be8f91004c1de8f5970f6241e8e84
SSDEEP 49152:Fb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnKLNiXicJFFRGNzj3:b3q6mjBh7wRGpj3
TLSH
T174D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 1ed7ce55e0d52d3b5621321b423db37889af8360cae85d2b2de5e3fdce749337
MD5 5e3b8c5f1802f0e490ce808ca3e6b6b2
SHA1 e47310140b898d73719a68342373841ba598b168
SHA512 1a33a93e3275770e58ebf72ec0fed63cb9dda0583d6a2142b88d22454700ae18609c203b61f55a55c93137a63a73bda3f5669a7965b765458f76109e978df3d9
SSDEEP 24576:5XYfDtczAF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8tcoLNiXicJFFRGNzj3
TLSH
T13375012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 ae42d1d4c176d31bc9767089d25ab6b55071a7e0b583a9048470de207484469d
MD5 d63a32c0b6d6dfc8cea4e1559052b34b
SHA1 bda53829ef620124f5f66f682665ed6f74877d30
SHA512 000d6c663e0cfbb32d67def0e0d0b6934f60ae800c2c28b5dc0ce4a48d56331958eed8ac362e13cd28cb2d76583e6765140e82bd14800132c2297b8d93e51c4b
SSDEEP 24576:i0Le5ji0hmxhrMi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iPji0AznLNiXicJFFRGNzj3
TLSH
T150859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b10a760da50418ad8fef03b0a0d153fbb7f611f000cf1fcf152cb411fba47740
MD5 8d58ebb59bf0f75291b6324a0736157f
SHA1 9d02c99d10e651bf24e92f94030995db79f96d93
SHA512 1e1dd514feb75aae3aab69de745548b21f5a01a8165194071fc0534abfe115c447d4e20f98761590a6e43d96d3b460fb89a2584ca349db87c60eaf03a3495a7c
SSDEEP 24576:ga7/ezSC6vUyD/aqgrvWj6q8wyu4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:X/ezSC6vUzPv+HjyLLNiXicJFFRGNzj3
TLSH
T123756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6e0af4db9bc510449aaf6d24f93c0076ceaf44ad270a464ec655349d1ce736d8
MD5 67a9b0adf54c3ae27539cf2f56f252a7
SHA1 b810e104cf96d3013e9ebe72fdccef6f28a761ed
SHA512 ca784d8830553ef856c1a36c2bf14d969e93439ff8843a09db50b02eab9ddd36197de4928b6b4cac3c4fadf9feb90c5e148e2e12c1e635d26ad2fe9d992d379d
SSDEEP 24576:RVbqPb88hv/l+Bx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RVO88hXl+HLNiXicJFFRGNzj3
TLSH
T17C559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8d6f6125cacb7c194cbbbb06c3082a71d4f487f2111b976dcd61543e9b0905ab
MD5 50a27c08a10cfd00da076b8117ba9e25
SHA1 515baeefcf2750ab66a2e47c198fb9c514a63972
SHA512 bb9b967fe2e93d71d49f8729eea415e8ab82cc2ba58fedfa1f922cee43ef7b1dc316f9a0e35806e4ff0d31c3b3a02b4f3d8551f4af957c6d65b9e82c0ce3d06b
SSDEEP 24576:mGO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8LNiXicJFFRGNzj3
TLSH
T1D15523D3468865B1FBFD003A867A5828B5845E2C8A555DE3D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 d6b6bbc95317d4969f7a0ce839678b64939e0ca1804ea9eee38f9d98d2ad3081
MD5 9e4779446751e1a38c6dbb74163e5738
SHA1 62f7422cee5b9769838f91331076e56b52a20cff
SHA512 1769f2d4dcb8a6e7a81ac6c3b7e013cbccd039769a6725e9602817d4ee760699747bb1266d8a7a2899d94389bd2f41085b49fe68506084ea13e6d520e50e1d74
SSDEEP 24576:LJIUp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LJIUpLNiXicJFFRGNzj3
TLSH
T1AF75CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 37941554e880f6e113af085d08dbdadda353e35c43649e8de182b06b5b5dda8c
MD5 9b1a2ee29d933da49435c13600d2b8bc
SHA1 a7c25eeaacbf845e734d7c3e9bb3c1fdb79899f7
SHA512 3cb207d81aca85b66fe4a4abc97c65e6e37714aaf6610e101c1afa2f13795752ac9d429a9604475990b34a549a608cd3c7b676a2d365892072d2f625222173fa
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THp:RQvGAdlCEL8c/WRNw5CI7wRGpj3
TLSH
T1F8266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 51362594c0194b8987909669ef44bf672066a37c32adc645ff83aae6ad5cd449
MD5 1ffc704a09912f87ae069b1dd33e3cc8
SHA1 5da3887c45c5a45e42b36d738146fa15a923b6c6
SHA512 f44429a5a0176f25bd808d03e8a082a8d174b4954958029e10ef5f91cf79ca2dcb84bfe6231505fa859cde55c2e255a1a7af9157a374bde07d5f068799db2603
SSDEEP 24576:YfewsAj3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Slj3LNiXicJFFRGNzj3
TLSH
T19F75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c064712cc9e0c9c2322c40cd5ae6d6c84011fa2ea258ba0a4d46501806089128
MD5 1a3ca6613d14ff9fde6e98db801376e1
SHA1 bedcfc2e4ed37d1bd8d4cf43593e1eb00de5b35f
SHA512 f06a544551943ba22d60f56f526ef8ce523b58d638f32d48afb2ba599ab977a86a01042c97885e4051473352c111e86a1831269dc66b4503a9be6091ce69c583
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHDF9:kUEtQevvqc2W1cpV20I32h9
TLSH
T16F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 18eeb32ae2d9a875fd032feef485df28cfaab6a72e0018a91092e279d4a8886d
MD5 10af8b47149730ad5ed288ceb480896d
SHA1 41ca36f858283b3c528efd45d43824c160d722b4
SHA512 bc86601f3bb2d8d39a186e62f7e58554e16bac5bf8160f3926d29a23282557babac236c9231978f54a35b294ff0eaba1ee7b1cae8edb46f12836a66016b8c25f
SSDEEP 49152:ECbRquA/m2yL5zLfFiV+XenmE3/zXLNiXicJFFRGNzj3:Noq2Vjnms7wRGpj3
TLSH
T1D3D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 425352b2c1056f9669d7f6aa60f3169bb1a4d53711de59ba8234ca476bd41c4c
MD5 d56452a59dcfb96d830e72b0627f3bb7
SHA1 f7eb11b02ee414953e19c61924603b732fb22137
SHA512 743b2d646e635af81f7004db85807c1d3c418405a8d2c7374c568388394e245bf5701a5842d8e8ec5e25c18cdc5c7cec67aa59d361a56ebc72768f8c8eaed610
SSDEEP 24576:DAhGL6IFoiwtA5l7S53M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DAM5Foiq58LNiXicJFFRGNzj3
TLSH
T1E4359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 7c62bc6ac946984e956c63a41f84f5108fdb7257bbd15c7e7fa2cb1d7a2580ef
MD5 e95d6587ed2150b0f98da16d559a8a17
SHA1 1a321d531d1b4022cd446f4427c444457d29e6fb
SHA512 76c42e85428f51ade3d680974de2cb7c180ad9fb994b5e950d6e8ef99eca8a3990db2a20d3715930c87a99d034e45614e093a759fd1f6339ebc5bb82afeebe7c
SSDEEP 24576:5wuROWr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5wSOwLNiXicJFFRGNzj3
TLSH
T1AE65F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 6b24328661c8b2113d9c4b08b4546c8b6758b4913d2503b6a8b24a7ebac828ab
MD5 10c09d43cb745b2226f1c4b056544698
SHA1 81de7f78c20b0c686516cb8bf8568fae32064eb9
SHA512 aad299973911ce8892a52da1283d134a500370335783ffae8bd1509a3d15b37a4c407b71aa4a52dfa7a3ed96165fa22d139a6d69f3f28ec416f6629945db576a
SSDEEP 24576:eZua/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mLNiXicJFFRGNzj3
TLSH
T1C555129622C420F5E6BB403DC9F54504E7A17C2A673643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 aae21cd98d37f52e7728500af68f7a875bb7c5b786987a09884ffbd47792a0a6
MD5 783d0d0b4208a0953bdb8e387f5546ca
SHA1 5f4e9c8f98c8428c25f433b5b98474bab354ca43
SHA512 8bc7a90d78eed793b78487d758f8babf6aa00aaba43c4279e6c2784aa488919d6ba319b1ba252d8b414a810f46f3d5c7af057f835451e38a3837f4a003f1c96d
SSDEEP 98304:vQRQyi36YOcPDLvw2gAf+PN3d7wRGpj3:eQyiKanX+PNxF9
TLSH
T1C7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 64ab55b1c7007f1a5887f8c7b1adf78a8387e9e3c2358f0d5c5c3ca363634acb
MD5 099ab4d328256711e980317c42245cd7
SHA1 7fe393722f795e66a2a77805219268e4d78bb3eb
SHA512 d989e058ff49337c3441773ad25251851f378746842124a6539462e25c1f2694d6302c1376c3c7a1452d18770843738ec22ef8ca0564679a8ef5b9bdc96bed30
SSDEEP 98304:xQRQyi36YOcPDLvw2gAf+PN3d7wRGpj3:oQyiKanX+PNxF9
TLSH
T17A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 87e1255e9b22cdd14cd5f1430ccd6404c6576b7c396b8b16481f036d0db0cad3
MD5 cbd160831a6823402b06e7b5135f212e
SHA1 a23ab6f15e21b28c26313e6ffe0209b4381cd998
SHA512 e7581022f36bc70e66fdaa1464b5bf579f10a3796d52c9472a9b79df0ed342197a7d6cf9f26ebbf71387e747d4cd254d0c1a0e7765c73208ae89785f09ffcdd5
SSDEEP 49152:E68Qg55nhkeWu7PNU3/nLNiXicJFFRGNzj3:uthTRc/n7wRGpj3
TLSH
T1F3B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 51905fab96accc1982654b6370aee28df7f4f62d8ca119e07fe6e34a7071dd9c
MD5 f983365d4b9be7c665fcb75f34223a63
SHA1 04436da297094e5d2f16c035994a131f66f15668
SHA512 e25e6927065268082d0184064c7716d311f022f3721a7683c5d8a37c0ef32119449b8eab1939e5c5c1c9f14fdf2affec78f1ca42d9e24a624a25255daa975c73
SSDEEP 98304:Zy5112gYy5azzVvU69nLKnhZO7wRGpj3:0LIHRWhgF9
TLSH
T14C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a85b71546a90d0007a04a7fb294fc7416c215e732978bffc862bf9c855591fab
MD5 c90207e5807e5cbe80a73b660137c92b
SHA1 9d871346d41e55f58175a909a3cfa8dbaca0d14f
SHA512 89b2f1d0bc8643d50b01fa0e9036ae344eb4e7a8c4b198fab2ec6340bdd6a28d98e2e7cd515beb27f9c1697d18fb770bf8181a000763c5524d633bd51240fd34
SSDEEP 49152:2B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl1LNiXicJFFRGNzj3:Eu6JmIxd2d17wRGpj3
TLSH
T15BD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 05cdefd1c3b1b0108945a2f966cbd8ffe34079b46f87ef2a3f55c79971606779
MD5 ccc6fa0874a2c007c0904576464f0bc1
SHA1 1ff9ac8fffa2a59c4b054464b18c8821c76287c2
SHA512 7888ba8eb17523da6aa645ebbf50376ed7b7d5241b778846f1d5dd16b9b4052dc62cc997fbeca4925acbec208555749ab2c6638c479858bb36e5c2d02b5d001c
SSDEEP 49152:l1hpsNoJpF1A67U44CwH7R4xJLNiXicJFFRGNzj3:lmifPqRs7wRGpj3
TLSH
T110B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 48d7397c8eefb79a7ea83a88d4a11b65947fe632136e984981b2b501c0324a3b
MD5 2a918d446eabb54db4c6bc0c48cae74a
SHA1 2393583da14a941113ac8bbeee9adc36fae88449
SHA512 1a13669f2aada25c872d296c3274fbae3eac1f166e80bf41af25c723dbc7dcc96c5cfea741587d9f8ce6664bfd073c5da710ed05941c9224a06f55f15677414d
SSDEEP 49152:VSuZQIY0Be2KkRVtOnks6NMHqaLNiXicJFFRGNzj3:75dKqi61a7wRGpj3
TLSH
T116C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 04092b6a7962a5332cfc2d8e8aac2ac66540c5972f11f0f7ba014ae4220f7657
MD5 4c46f4cc02910eefcf35a0b3d27aa6ff
SHA1 2038f7feb05f41356f82caa3a5d22f3338296360
SHA512 5260d9673deb9be859f446a74d359f44d2ab2867f04804afbfd2dc258b77e491b3bf7e96ae72543f83dd22180c4b42e8659e567063c8e93f780a8ce363f47f4e
SSDEEP 49152:yhtSn8EApI0figjgiDn0AP5wFLNiXicJFFRGNzj3:zX2iWphQ7wRGpj3
TLSH
T14795BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 46085353120d0d7fd8ddc9b91345d87399c10f0944fc69831579fb160d8bf812
MD5 984d471c7e775edfaa38d358d31f4d43
SHA1 cef395372f59fdd2968b455def3fe0b552df742e
SHA512 fb5285c99200b56c6a6e2c32cb04e7de0ea4ec01595fc6c482e50b9d587b1ade6dfffbed2126cfab3da35c02146dd76b7294346d897623266f6caae71d528d05
SSDEEP 12288:A8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:AG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B55523D3558955B1FAFC0039C6765428F5881E2DEB5618E3E3483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7d6dd0a3c608f79dd8c9045577393ca9bc11407cf26f1dd106553bc5ca03a42f
MD5 820ac20a956658607254bffe86f79728
SHA1 7ef7ad6f052bb0f2b018e9a2ed952a6ee8477f8e
SHA512 9e1b85171aa593cfed0f99372de4ed59be8e594896941082b396fc967e0ce4dd4da6ad066f79b33298da9b6a3b0d56b12dfd413a15c2efd51583add62873af09
SSDEEP 12288:XHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Xz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A35523D3558955B1EABC0039C6765428F5881E2DEB5618E3E3483D1EE238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 85f27247747b86b1154f363d570801eb453e06013d49c8b0acf360ad2e4a21b2
MD5 48fdff2601fed8135396bbea1d91965f
SHA1 57a538ec1c184b3137c4aa03c1a3f4c6a436ece9
SHA512 04a105c1ad81eaa2b227492346eafda8fc4402bb7c2b4d1e1d0e4bc7f872fdfd18264cb859ba8ba0bf486164c63daf4d8ed675ea36ad7445c4a8c02bcbda5658
SSDEEP 12288:49iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4h/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CD5523D3558955B1EAFC0039C6765428F5881E2DEB5618E3E3483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 4cca08ce60ad22d594cdbb06a723f7fa7f085b60df2450d5023657fa807ddf28
MD5 ed0c12245c722cfbcabc6de18a3d9ef7
SHA1 f181b1740341f76a78f6c1b82317649580f04e09
SHA512 a53f8a167ea5a46fc717f85e5df628f76175d719f4fb6d328d0d7a4812e7c28b799645e6b6a6f9ebbbf63d83228e823eb2692dbe1ae29bde8323169a7509b5c7
SSDEEP 12288:XVqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:m/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D7552393168901F1E9FD8039C6764424F2A47D6CD7325AEBD3003D0E5A35BDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4bffa853a98d1e6f359a600179c64859554f4f7f21ebd93885022dcbfe7a9ccb
MD5 300a1f3d301cfc537ec07f20193b8e7f
SHA1 9d4f035d9123ab736d388abeefb85d5415fb7d1a
SHA512 55dab9718e3667ff12c23643651b4e21fdd23435a330a3309dc360ded7baebc4171943d726ba85a8dd060e33097a0a6a3e466d5a75eb09e6a1d3588b5c84fd67
SSDEEP 12288:GyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:GU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A35523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 8bd7c00367d7c42855c6d666491037d9b523c0ab5de5c87c2e0717bef1982b36
MD5 53b5df6a27edfd7fd6647d17b7c010cc
SHA1 5dc6b16b8c8ceb5495fd6619e3fd11f5f878aaa7
SHA512 fccaad75553818f806658488fd4073ae7d88cc63ab16c2496b65a3bde87dd8bec2a4b29e54cff12e1763af966c2f3a4d1546769b2e6378e782fabe936be53380
SSDEEP 12288:C7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Cv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1155523D3558955B1EABC0039C6765428F5881E2DEB5618E3E3483D1EE238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 29f9a4818d77f45acdc37a9324251f700b7219132014636b7d190cbf20994210
MD5 4bc03ff0536681ef249d49d07f3d73c4
SHA1 ad4a65eec5d07c70ecbd56c961c65276022a22f4
SHA512 157ec870bf2e5bdd75f9b711028772c2aef02bda6e3233ff18ae1a0474f43d382525e98d374cafeff5010c3d937405e4b5121227d0c1662741fb5c63572bd8f9
SSDEEP 12288:xviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1005523D3558955B1EABC0039C6355428F5882E2DEB5658E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 c64ccb3ed2e91c253c723a45951d8d57579543b035267cae93729bb624dae14b
MD5 9e671e845b8700c5f47b23d009000d8d
SHA1 c025393b3dbcdb46c1a7607fd210294b2e4e8ec3
SHA512 adda63edd80323ee7bf18c8429da7fe312617b2934acc88a23de2227fb92425388c1021857db33ec99997a5b7cd8b47a9fcd439c218df4f51a5387effd008773
SSDEEP 24576:ZZM3zFVSOT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZZM3zf/LNiXicJFFRGNzj3
TLSH
T1DC750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 74f0bb3f894a8a35bacbc803423a3cda9861111dd6305d715667dfd88be15679
MD5 fe123633ba18509895a08f6545a86fae
SHA1 c72c90ce4414cb585c99b085a724d355bdc04bc5
SHA512 15818eea0ddd29ac365eeaaf6ee1d5ab54e477a5124f29c0aee369ca4fde50484455aa197be5cde33075d1a75664172b48cb7921b41e05c209ac12dccb722e59
SSDEEP 12288:/YiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16C5523D3558955B1FAFC0039C6765428F5881E2DEB5618E3E2483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 2ba4da46253a79f60e888ba626177ef0f3b520e1d98dd17f747bc37299f7dc2e
MD5 66afb1b025b3dff0d368eef721e08694
SHA1 03c6460c433f702dddf7e24556f893f161cea498
SHA512 42ad831376dbb9f137643c9014d789d53e27eac38f6125988ac8d6a10bc1e4b51a2f5f70bf34ab63b3beac3c7f885ef346a2262a16c5f0d75cb8e536423e5530
SSDEEP 12288:V0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ve/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15E5523D3558955B1FABC003986765428F5881F2DEB5658E3E3083D1EA238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 d9cea506d69d0362d3a4bc931da60a223e11e89815a6bc90a649eeb5b3a34967
MD5 45711f721be3db99304d212e97c78355
SHA1 0c20cf382ebd69e9e21f4c43a00af545482ad7a2
SHA512 188fbc2a427dfd4c1172af09e7589f6183c706e1a6001425538b91946fef48a89190f1176dae642cac606fd1b993e034d4a2a5e75d96c396774bb25cd8d12f28
SSDEEP 24576:BzyH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BQLNiXicJFFRGNzj3
TLSH
T113650147629530F9E17A8139C9621911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 82e9220ab39aa6eb65525f4fd1345e827ff8d534e6dd248a73368609c4975d77
MD5 2a6c5a9cb7458bd4827a4c3831b06edd
SHA1 ec94e445c98f7905b4d1ac889637fe19cc8b17d6
SHA512 5689c1fef03edf2f0d5e44d535651d8efedf7c048a4d36d070aa50d64f6f72f0ea7639212bda5cfa8ccb5b2357faae3fc59a342ba8ace76a9f27dd25397e6549
SSDEEP 12288:jYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1555523D3558955B1FAFC0039C6765428F5881E2DEB5618E3E2483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 828b11556c200319da1348c0256b5cd38b4f83594d342347d465d8cce0e1cacf
MD5 b271722e6a2559559e8c8ba9161b9fc1
SHA1 38bb6d517771aff343bce9acdd60bdea8f70a118
SHA512 0d10323b2f1b0dae86d9a2c4a791c2bdd9dc897b08f58efc6bd27c723135c3f6207eac40abe2c53f23d27b3313a7ea0d01fce6658882dd5466f1190e7b1cd7d0
SSDEEP 12288:5YiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1265523D3558955B1FAFC0039C6765428F5881E2DEB5618E3E2483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 9ca9d1da0a009da3ac7d43b8ea6aa94e34499ea33cf85ddddc6fc8deedd0dd34
MD5 2501815340deb5b6ffbbfb169336722d
SHA1 7c382cdf5b26eafebf91a191bbff332b132d29eb
SHA512 bf1d060a92ea95a95a01766f651d2753dc35b831e2d50dfbffb202ec9f1354033be0ecca81dd7f8723a39255d0fd2472b3e0af1524a06dc6266f2aeca75a1251
SSDEEP 24576:gzyH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gQLNiXicJFFRGNzj3
TLSH
T1B0650247629530F9E17A4139C9621911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 4bac982257ed0b458e003fa82b59711e642c6d45958713a94a8dd4cfc4adec88
MD5 a1443cda8c9ea1e1b5fd29c433c3299c
SHA1 cde9b6afa4abced5584ce1667645be92313275d6
SHA512 09eef336706061570d8945d2330843af51e39ed0ae85e65bba35d2c04cbcd8805fdc5aeae1220b4e1d935f00d24155d7630bca1cab5fa07d70ebfc2c8ecba79a
SSDEEP 24576:hT8aLl3z0zDR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hT7Llj4LNiXicJFFRGNzj3
TLSH
T1B07502A5B39018F4EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 5e147d01e7ddb85ff9d6d894c032098786613255e30a87c88ccd2e7dd61b3b5e
MD5 5da83ab4cb989a8907bb474a3a66b2d1
SHA1 9e0b828272db21abdd210b349cdd5592847d5a72
SHA512 ec1db1a2e608e0ca2116d90f53e93b26c6984a6a1bd8ad4e64c0f54da8822f10ca9502d6cb9dfd4becf6009808d15c62cb3f06cfaf0e7e16447225137eedeade
SSDEEP 24576:H3rd9CHKy7GZ9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Xrd9CHKya/LNiXicJFFRGNzj3
TLSH
T1B485CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e5b783eca4c03fb041b3ae0e915d594426e6849eef3e833f8ea200a37f0fb938
MD5 d370fd77066eeef357c5ff3859e0e968
SHA1 52c283790097a10d5eb455dc4426502073ceda1b
SHA512 805a3464ef035ea0aef9e522fb409eaf74992ac6894ce822c90fc1c296f06aa6f5a29776dfa0299211155e8a47b84bf7765e793769787a260f1db9c4badbd6ad
SSDEEP 12288:xdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16D5523D3558955B1FAFC0039C6365428F5881E2DEB5618E3E3483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 128023f73c01eddc634815badbf5d244e7947033f636296e28788e011d959ae4
MD5 99c21fc15372a567e25dda2b849e395e
SHA1 028910b295ecf4b639c6dde640cb7eef77f40639
SHA512 7fff2b162171063380f1c63bb2d18d5318bb52eb761203a00ac51586d3e674ce83791b32dcdd24ebbd93cf9743738186f478ea5711d5409a0dc1d1a593135839
SSDEEP 12288:9TiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9n/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F35523D2558955B1FABC003986764428F5882E2DDB6618E3E3443D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 1cef5984b9a478028cb77efddc3cc0d42c913b2470f701b07580866bc505a133
MD5 0611f8cb0cb2bfbe28f59aacebb64708
SHA1 ee0e0485d5bbc313b3fc6b2e04b3d14ed641e541
SHA512 4a795cbc5c200e4db053b7fae477281a9caca3f15bb3ff44ed3ab491f64999e076ffb235831016a39ba59afdd6ea5d2addbf020c2187b15fdc0f80fa1434112a
SSDEEP 12288:fWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CB5523D3558955B1EAFC0039C6764428F5882E1DEB5658E3E3483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 44e3061c3a28d8a74b7df8fa9f6688ee1ed8bbbef20502f229b2b31d2a7b22f7
MD5 25d9133b043f1d2f449e1087f977cf8e
SHA1 728858852900cd2b3c755d8606d9ef28f83e7292
SHA512 918a46351cbb2f0fb0aac5d5b723f4ae53577783940fa5b511e4a63996f28ff95dd6d6c47478e51b0f460a3a87c4fb1001aca48a6558b4003095c6d4b54d6270
SSDEEP 12288:+YiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16E5523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 4f4c0e0a4ab40422b3ac91f6d76d8e1af480be14d5a1a6a73e4ae7c4bae55df8
MD5 768f0a62500f3abdf4498618d786e278
SHA1 4f8ff78fac5765ae9fd8724f63a37726c17f8de8
SHA512 52bc17cf9cced579b3da020cc980b1f205bf0fc557f71228a780e98c78236aff47edefcdd074dfc6d6cd9fe9bea253dbef11ac9b188a933d8a911e10ad5a17e7
SSDEEP 12288:DdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1805523D3558955B1EAFC0039C6765428F5881E2DEB5618E3E3483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 54bac072863f051d8ef1984052148f8add3c8a4b695381c14e98fa05901700c9
MD5 8a41e4879d08b9144c516ce0d4d0f609
SHA1 1b75f3b5c3c3f3a214f8d2b275b95989a485bab0
SHA512 57df1dd2fb84264b9a30036a8b7c991e9ace7099d623bcc35df9d1c728983686feb81aa470572dcf185290a46728b4385e68e228e5818e41441eb3da60d797d2
SSDEEP 12288:yAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1995523D3558955B1EABC0039C6764428F5881E2DEB5619E3E3443D1EE238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 44f8419db86997ebe779071b1d503afffcef22c205257f9182586234915f388a
MD5 b28b409d23be11e04442962de65456d3
SHA1 7d7993354f7c9b0aa23f5132564a8a861fd788e8
SHA512 9d2d916d6c8238c8ca687fc09375c9539f1a24c749ef6fe5340712d7929a64b1b4b12e8473eb4c038b404671a5e391b6e7f8218ec3661e4f8fc5fcfc0f406e0b
SSDEEP 12288:9yiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9U/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AA5523D3558955B1FAFC0039C6765428F5881E2DEB5618E3E3483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 5c12f044741af970a758bc8e1055179343113a065dd712c71231000f434ffbb4
MD5 5a812e300745ec14a0ca881e67700012
SHA1 34ab885a1bdace41afd83cecc8de1256252e026b
SHA512 ec1b3559e8bb45f2079ce842d411d1a31d1994238052b84c80c283d1aa18ca2e334e4485875fa6b23c22836965e6273ae4eac922956d672926b90aaf6e76dcee
SSDEEP 24576:ffwvzk9RX6wkyAIu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6MnYIuLNiXicJFFRGNzj3
TLSH
T1BE85D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2234487bc65bdbf2991fa050eba6ef7fa10747a28c759b501dc9a333456b4217
MD5 95609355e3e984927ebf379bd5c650ee
SHA1 a4d861657cdb1a93b23dd5e6f3283d39dcf73a10
SHA512 c50d94ef3835d01870230498eb7a50f383cfe15fd8dc359c44619eaf6c2fd035f5616ea36c6013cdc702311c11ca155ba8686e83212ffcbf92f8f88a3442461c
SSDEEP 49152:3YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0lLNiXicJFFRGN:aySzP97wRGpj3
TLSH
T128066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5278b973a0141fea5def17262065c6b4a78eb6ef1377820f84d07592553d5486
MD5 cbaff5a85a2f8ca195da9fad0e652c72
SHA1 63ae7d8eb9e0e5425d3551bc9f4f0b980053674c
SHA512 0cfef10a4a7c28b1743af377e32b669d6eec37ae2d356d97256374675088073a9df66d0971c3883dfc3c77fd8ea661f49d786d96f0d4246cd320ab4c3c836a17
SSDEEP 24576:I47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:I47JUQjqirIhCnDHUPfF/1LNiXicJFFS
TLSH
T19465AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 b9933a44f2bc676d555c03fc98a74b6941867a26fd4e964d221896fae40434b9
MD5 b9ffb5110e20f812a042860bf6bd0354
SHA1 a39bf41d9decb0f2a5c5ba0429be2ba845ca7e98
SHA512 adbdfa9d3debde57e0938ab0e947eed8c62da58f1d785ba74d85568a9bbd11bc2dabc0372fdf60139db5c3e1e224b8c2082aa978ae5a68d12e327f44971d5e12
SSDEEP 12288:WpsfoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/a/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AE65F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB53D0F93E1F7AAD59EE9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 904KB
SHA256 6345628ad1a5adbb4a1458d7ce0c5d36b57460417f7abd8df22069fc9b467867
MD5 7012f55759271ba212e5b9a4aef11bac
SHA1 f8ef4961267b3b4f8104c570ecd1255f76db7dff
SHA512 033895d452ff08faeb430ae8ab912e4e31c9c23b32bfeae9736ed6fbcacca4fc867963cefb3cd58f73be749afb42447d81145b202d4d85678595b1871b0955d8
SSDEEP 6144:ZMsBC2na28eW9DKcUAEw22CotMxmtCEU3ftkybDvSaxYVtNIcl+fjQsCqWhnSjaW:Pcr+KU3fTPKaxs4fjzynAJ/vVIhHoq
TLSH
T1A7152810B66BD75FC6A940321E33C2CCAB707D41EE099B0372C9472FD576669BAF2192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 130f75b9577b667bcf877cece83a8054fe62e588e4329a4ae3a495aedd5fcdc9
MD5 1a0cb9d9aa70361d53f7ae06a8fb54eb
SHA1 84dadd908f1ef5379b78dbb9c1e1ca4f56efb5c9
SHA512 df621265786f5a30dbb59f1a1747b48d86f9b40e9aa2580c1c53901e74ae7daa45e99e580bfc9916b9093da94aa4c691e424d5664f3e05d43b54d7c0b7d41dfe
SSDEEP 24576:+m7r4eUfAmEV6bR/EgPog4KbVdBn4B6zqN6T4UX:+I8n3EV6bR/EgPog4KbVdBn4B6zqN6TP
TLSH
T17045A5816437A39BD0FA2172072A5B4CA764EC07B7495F2763C8053AD82BB65B1BC3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 79dd74c78ab39e3cd2160a4ac139378e3f7f04b4ceb50acb889c730620d441e5
MD5 a06fca6d07017bd5a090b3b6e6cd54f5
SHA1 f601f10f4de3ab6814f58a4376448f96328c1870
SHA512 fb3110c864e6cab03d81790947dd3221fe45c0affd7abe228d4693d320b2638cd824cca6fd38811d46f50e1dadac60f4d154b5c85eab06e2a5be474537845f3e
SSDEEP 12288:BF7QiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:PC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E2552393468959B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 dda7d94e5fe209147ebb5bfcf11ca68be4b90c145d9c2025a0bb0fff34f2773d
MD5 c40f25b8bd4bdc167329b3d9c64c2f0a
SHA1 13d65e594fdb274d9ebbb3b9499a13574c26392f
SHA512 645ab9cd8428ecd43ba73dfeacbfbdea6fd5c6683e0e48ee342840d1beacf27d0e7097928656191f2c404aba13b2bda343358578d2192bc00cbe5e1d48234af9
SSDEEP 24576:jgb6bmBIi49WNNFpg1rSvFv7bY4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jgb4mBIBhGFjLNiXicJFFRGNzj3
TLSH
T1C365AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 04a31106e6a395992f5164cb616013454faef2bac1c92e59a5366050e3b528f4
MD5 dbd20a0089928b0463f76b89b9951815
SHA1 77c129dc102017bdc464eea2db854f242921b490
SHA512 ac198b0839cd831a1f4740da42952b339fd76bb8e9191755eb35e7eae3fc4546cd18952aa4bc74552c0d491b12058a25b1a5754fb37ef1feee05ee86acf89305
SSDEEP 24576:DG88u8FpJqH1vzria7/mT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:y7ZFPqVya7/ALNiXicJFFRGNzj3
TLSH
T11585F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 0fe093f861b12ec650e1566e0f62caf629fbafa6697acc360fb4f6ff9e5010aa
MD5 7feecbf11a225c865e1f3ef70f975d60
SHA1 2b242a19d4f8259edadfc7ffd8c35aef3b627402
SHA512 e0dbdec84d2a503cabb7dd8deaedfb2b5693981bb7def99bf5475f49b978378b1497f7ae1978bddba061f25e8bde595d1cf715921d0cfda3ce2f189287079889
SSDEEP 24576:/PUr+NQ//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/JQ/LNiXicJFFRGNzj3
TLSH
T1F465F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 401df242a7f7d217404b3c5e0189deeb769d8a8728f33e9a7f7c1c45080a2601
MD5 50a91668ccd2fe5e75441b2c2ca4b54d
SHA1 220b39bca09eb86ac16b3b7fd0f5b7d021922c48
SHA512 45f52782e1609be4f3b61e4c9c775c8ea5065e9d3fb7d9854c011772d6f906edd8f3a4b409afc7c85493ce9d93ceab92018c944a6b96d240873e87376d825496
SSDEEP 49152:1BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvLNiXicJFFRGNzj3:+G05lO43bW7wRGpj3
TLSH
T1F1D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cecda17d2eaf33b8db977904a399c01a3cef4ca9f89baecab16b9ae83a29b635
MD5 17772d589a766a306c591a5840eaf8d9
SHA1 0065efe6c3c9cfd70d40e3f8d4baa1e970fc7821
SHA512 eda8a119531eee77ffd8a47d52a90b694faab93de32bec54364d2e828a2ce63547808ec66c1b7b120625a47104f15ada93850d1c2d82b09a57f8b0a030268609
SSDEEP 24576:Xfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnl/TwSfVcYG3K/cJHlnFR+IGNe8jg:va5POZ3lJt2pasx2+mnLNiXicJFFRGNf
TLSH
T1ED65BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7583f01a1e3ee2b39038172658f3ca4da618be71e65a5310617bea0306ece6da
MD5 9066db799051aa3b79c47860c7dbec83
SHA1 5385ab6f68a7d64e077b01ce5f04ebf18df237d1
SHA512 69247e1f97a0d98aa4b7eb50c11be6127c10b047d2e071841df9251c51b1fc0ad207f1746c26aa5a3f499c2ba5071857ee3c6f0d19a0d80cce3d084b70158b8e
SSDEEP 24576:aNcwHdjbyQ4nLC18lb/EOjowL7FkL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aNc/zEOVHFgLNiXicJFFRGNzj3
TLSH
T1FC858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0f7f67b2a83da817e5560d04f7c61c23dfef5a2e7c5dfc74e47970ffdbf60f09
MD5 b7249c26a499b21b1a81204b4bf00e7e
SHA1 41796171b73fd8a1b8e7ef10e45ca363e9a59604
SHA512 58d94be25a44807cc09033106cd31beceb752bb938d3f88b64d221ee1ba4fec06b82c1ae8c4a69626ab5f16047807297f9585835d6f9b2db5cfdca53dcf7855b
SSDEEP 24576:YzkNvNnaFeYhJNtmZBm5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YzMwBtOm5LNiXicJFFRGNzj3
TLSH
T10C55AF6EB6E846E4D1FEC675CD238512F6727861073292CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 694a6393f09b410eed9ab000ee46bb5049554219db03b68ccec31da5fa863497
MD5 7f6f97e22eff11c8f02db9cd0bcd7ae6
SHA1 6ed0dc234166185b65c63a833afb3820f639a78b
SHA512 494a07c2afe5c79da29b13eb53d08d98b5a5f8365210587682edc45a881d60d54f2d1df82de1908dd656f69ed5cf5a201af6119d13e2a7a555fecf6ec9f4e08f
SSDEEP 24576:nD3FHshBIYQgAm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nDVHeBIAAmLNiXicJFFRGNzj3
TLSH
T1F675E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-95-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/124-89-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/124-328-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/124-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/124-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/124-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/616-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/616-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/616-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/616-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/616-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1360-312-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1360-120-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1360-121-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1360-114-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1616-309-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1616-77-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1616-78-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/1616-83-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/2056-39-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2056-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2056-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2056-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2056-52-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2552-85-0x0000000140000000-0x0000000140413000-memory.dmp

Download

memory/2552-1-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/2552-7-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/2552-8-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/2552-0-0x0000000140000000-0x0000000140413000-memory.dmp

Download

memory/2692-22-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2692-16-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2692-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2692-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2776-293-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2776-54-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2776-55-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2776-61-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3308-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3308-308-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3308-73-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3308-67-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4144-327-0x00000206F92E0000-0x00000206F935C000-memory.dmp

Download

memory/4156-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4156-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4156-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4156-149-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5376-108-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/5376-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5376-313-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/5376-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5376-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5376-102-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/6012-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6012-128-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/6012-134-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/6012-136-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/6012-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download