135561c46b7503a4fad0037781e0c6a7e980cb9249e5621f945dbd8607bca3c3

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
Size 5.9MB
Sample260907-emsplsck7w
SHA256 135561c46b7503a4fad0037781e0c6a7e980cb9249e5621f945dbd8607bca3c3
MD5 47ba2e67e00261133c997fe8be55f5e9
SHA1 2aad29279d73139dd3915edcd591621dbe3e16b5
SHA512 31fb44e2a2592073b29ffc8e30b365b6dda590374e26212adf1e4b8df56bf66380c22900f6e7bba9a6668c790dc1db92731d346385d94574f832c94c87c1d3b5
SSDEEP 98304:YMxb6VSyo6OBkg2L+kjs1c2oN4+ED2Ej+lXelqE/QEThu7jBYc9vF8U:Y0+Fo3c3RBz
TLSH
T154566A6556E800E7D4A7D17B8D1BF90BD6B17C45F2359A9B0DA0724B0F373630E2A22E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3224	elevation_service.exe
4220	elevation_service.exe
1712	maintenanceservice.exe
5800	OSE.EXE
4232	PerceptionSimulationService.exe
4916	perfhost.exe
1936	ReFsDedupSvc.exe
3536	SensorDataService.exe
3424	ssh-agent.exe
5440	AgentService.exe
4784	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 49 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\F:	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8128d08bc618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 39 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform ID	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardVersion	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\bios	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d135e4317e3edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a1620f37d3edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007cc102f17d3edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a3190d327e3edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bead12327e3edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
3224	elevation_service.exe
3224	elevation_service.exe
3224	elevation_service.exe
3224	elevation_service.exe
3224	elevation_service.exe
3224	elevation_service.exe
3224	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	5440	AgentService.exe
Token: SeBackupPrivilege	1936	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1936	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1936	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1936	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1936	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1936	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1936	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1936	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1936	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1936	ReFsDedupSvc.exe
Token: 33	4784	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeShutdownPrivilege	1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
Token: SeCreatePagefilePrivilege	1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	3224	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
1316	2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 2876	4784	SearchIndexer.exe	100
PID 4784 wrote to memory of 4768	4784	SearchIndexer.exe	101
PID 4784 wrote to memory of 4256	4784	SearchIndexer.exe	104
PID 4784 wrote to memory of 3344	4784	SearchIndexer.exe	105
PID 4784 wrote to memory of 3684	4784	SearchIndexer.exe	110
PID 4784 wrote to memory of 5716	4784	SearchIndexer.exe	111
PID 4784 wrote to memory of 1328	4784	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_47ba2e67e00261133c997fe8be55f5e9_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1316

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4220

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1712

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5800

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4232

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4916

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1936

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3536

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3424

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5440

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2876
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4768
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2804 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3344
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3684
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2804 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5716
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.0MB
SHA256 9ac43f15903f57e3f75211b306a31dff586b2b6be239beaaac799f0b8809990c
MD5 f2136e57cb4de75318b424daa0cb523f
SHA1 0d619593b2f3d205319d9b66a261669785cb9cd4
SHA512 3424a09bed74486fc88926c291b2727a3a6c403ccda1f79f69b55db0575ec5ca18bf65c844f71c4bd98e6362b156c1778f8e23ab7f357b99a5b18c22495c6eb3
SSDEEP 49152:tTfiUEWo6zuEz439S99akTBc4O8b8ITDnlT4NvJZqTds9Z1Fhb:tTfiG/nzl90tp9Z1Ft
TLSH
T1BCE5E526A2C8C1EBE5642070CC59BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ab47c533022d873b7b60c0f123cfb5e49cf2cf5fa75af2b9e6c1ff2cb7a60fef
MD5 80fdc8da109a430df6292f9d3b82b389
SHA1 84ec5d5689cb746162cb2815f2070ff872fedec2
SHA512 7553bac626ecfdda343e15637f19cbbf9c28e95f3922b5609e4a99e19e8fe63305a153530825553792602b86a83d9ead9914496768c94ccfd330c164595aa997
SSDEEP 49152:ob+632BuPkFKRrdE6ohQstBhuXjfS4LWxnIYcAkvF8U9So:C3q6tjBlYc9vF8U
TLSH
T1E6D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 78700aca53ba8ef60092d6f351bb9463b4d3a499c3858c0e7917120ef65741c4
MD5 84755d275f694016f49c7ade7590652d
SHA1 bdbf98466114056021a02740a1cd092502b62801
SHA512 da8c7d21ebbe6ad43d4dc71b9e131da4eab738a5a0a254781e995f0812f13d952066e5348d60f1ecb4b0ef6b39758360f303adef2011dbba66cf71fa1553998d
SSDEEP 12288:G1XLsswWkxy2lRq2czAlAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:kXYfDtczApXETcAtv0WeFvF8U9S6R
TLSH
T19885F12873E504F9ED63823CDCA28515EA3378954760EB8B03B49A295F733D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 0e2f73a1b888715cca0a4eec7dac89a3f541c995ee749065427ffdcec001d5b7
MD5 91725adebb09bd22092a78a1a9550a8d
SHA1 0e23e908ab5b2cc015e642777962bfd35a7aae59
SHA512 fe34d909c4882b8bc51d0df1b91cf18d544ec1e76c908eae07d64f11011073d035d568c5731d2a67ea8b1470137bd61b41c68039b20c8c8ceabdfea87dbce842
SSDEEP 24576:/0Le5ji0hmxMrMQXETcAtv0WeFvF8U9S6R:/Pji0AGfYcAkvF8U9So
TLSH
T1EBA5AD15F6748331D073C0B9C5D2A69EED7230825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4ad7939fa0f9381e0372b0d5a5f2e061d2fe30ec23727a3d456cecc1339f73df
MD5 0fdfc9bd6b8abc77585937672a02cf4e
SHA1 0440f4e689722e00b2eec33d16963583303ff722
SHA512 70a7c05a97774bfc1ababdd18a20766ed356ba6bd34f48e3f5c2ccc916ec1ab0bcd0a5c317dc4016ccfb40d29abd780ec3750c38b8225e87165bd2c8b1d1cd2b
SSDEEP 24576:wa7/ezSC6vUyDZaqgrvWx6q8wyuCXETcAtv0WeFvF8U9S6R:n/ezSC6vURPvMHjyjYcAkvF8U9So
TLSH
T1E3755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 48e54996cda14486a5e786af8404c05dacc83a1f87bccc6e6d02ebedde1fa57c
MD5 895ab7892c0db0adfab264d9d0f5feb9
SHA1 0ad93ec0bf9c830e74c0d6b275008da267e719e8
SHA512 4f72cc378325ec0931d344776d221f1532b68b39789a2ca9e148709fa141632809f09d09e592072658371b16826cdea405b586e425c0b8840ca25af7a87a338e
SSDEEP 24576:sVbqPb88hv/lV7VXETcAtv0WeFvF8U9S6R:sVO88hXlVhYcAkvF8U9So
TLSH
T186559E65F5748331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 72d85df34b7850cd01275cec9a4576dcd56f876771da801e05cc5e960b98b25f
MD5 d8bfbd119372747bbc1883816433712a
SHA1 797c1507ce9ac0fa09af78775150135a52ff8c9b
SHA512 5069d3fe25bf8d98a532b3bd79f10d7b4a7e02510e9dfc374871e70cb09ea5c27ff55ce3ae08ff6e3077ac0c4b6675228590c73a37bb0146128b33f27e8502b6
SSDEEP 12288:CU8AKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:CU8XETcAtv0WeFvF8U9S6R
TLSH
T168652380A66550A1E3830E313D7AB1ADF8217FC6CC54FD5BC3347E5DE5F968AC4098AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 c3532ce251f3627fdf07e0c175b6ad6c8d7b33b37dc64b3e4e8557adb81cae50
MD5 b4cc0d5bc969acacaf7f945e42dd77cf
SHA1 15d3d4e3749fe2cdbba008f454fc158c7adc5350
SHA512 25f2aeb71b7b25284d6fc5bb6f7c7abf3b294a8d1cf10abb06852f5c8a7f61e677506aaecb635d6c2a4dd1ef4586b19973b8466b274efb1d27b8ea74aecf4993
SSDEEP 12288:JeBNUbTVO86URAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:JJIU9XETcAtv0WeFvF8U9S6R
TLSH
T1B085CF3BEE28FCE2C27A4D786A918240E77278714F61A3CBD174820EDE235D55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8930bcebe58cc7c372b5836ebae62c31ed59d2e949a041e974d1fbe2a35e9761
MD5 5eb1ccbc1ec3e0aff8842985872c6a0d
SHA1 5ecde49c29a4ae297fb4d6b0e209a04e2f8187b2
SHA512 ff1372ffe8ea22d5b8f2d4a377e7a359bfc46c2957b5118dbacf342e6b0af00b06ec05d854fd8fd2b4ed7935fcc4793c28a869c5bec28d971b7c89a81d268e36
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THR:SQvGAdlCEL8c/pRNw5CyYc9vF8U
TLSH
T1D5267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 e8c85f139abf422743a1002387514508d4e707478d8a0a4435e144fe66a14a44
MD5 b5c1f9f12a0bd727d255fbf71949aacc
SHA1 cde585219bce06a91e8b4d8fd21471de04d3f041
SHA512 043a081cc94fc17ac023349f9ab9470a58883dcc4cd9c3944e32e278d0b65da6904d347dd88c3ecaee2890ade72cff0e7e35fc93013466c5e162a7c98c176f86
SSDEEP 12288:vAwSfxL/2Dc3TDLLmt0LDQewsAjDAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9V:4mewsAjPXETcAtv0WeFvF8U9S6R
TLSH
T18585E030FA74E032C3BB0DB62B36D71A643C7A604F5129C3E3A85E9D59742D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 295f97a7faeef4ba018d94eae4e8158a86aabc36aaed7adca61f7a3605c5fdd7
MD5 87dc497f0b37306ecd3d5dcd6be76b19
SHA1 ad8a378e65d01ff92d4216ce89a3e1b0ca9ae02f
SHA512 2e3e2ffc9f8792ff3326adca87c3dd9a07278823e8b16a54420b6dde7836b65616f8bab094294859190643bba312dab9470d7ee71a65dac08812025bcc23f079
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHnBz:rUEtQevvqc2W1cpV29I32B
TLSH
T1D7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 efceaa62ed0126dadd03ded7863b195c856a2bb7c12fe4a3f2a96430c35c7902
MD5 f2afdf69833b0727856c79d0a4799446
SHA1 b6edd736e9d54db5f45f2b1f29f1795efc74c5f7
SHA512 dedb3e087d963871c7f35781b8b091033ba98375cacae79d6954b3895e557109f49dda50616c0cb9a5e692e8f2a49d3a3c589acf3d7c23b30b5cfff8d8907c91
SSDEEP 49152:4CbRquA/m2yL5zLfFiV+XenmE3/zvYcAkvF8U9So:xoq2Vjnm2Yc9vF8U
TLSH
T1B7D58D0976B8C1E4D1F6C77896A2C647F37178154B30ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6358c0073c2d0b5d25a3011dcb6cee2e905d8b2fd22361b6d6f0858ee4fd9407
MD5 448222f86a5ff5779bdb64c23060d3a3
SHA1 bc0f34c77a86a4437c82255a5c04baa7594c32a4
SHA512 7ba1e8282cba344205955a094ca40d8e825a49a20771f6fcaae173f80c310e2071e4c35acd9291700adc7d6c512c52f76adbee77aa56f89644e2ce002b2547d5
SSDEEP 24576:WAhGLmIFoiwtA5l7S53WXETcAtv0WeFvF8U9S6R:WAM1Foiq5mYcAkvF8U9So
TLSH
T18335AD80E7F951D4F5B3AA78A9B69171EA76BCA65E31D20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 3374a0bb4ddb10decf1e731de6fa7a558c9444a8e35c469f9237347a6e26d70f
MD5 7b569f931a29d68a25cbe1dad2ae33fd
SHA1 3f6800b2a61f64b8bbb03faed06946cf9e4aa990
SHA512 ead9f422c0534e29a1c409b2bafc42b1363bc41b9ed875819c10922988b496ce90783f8a24116f84b9295309e2a6d458ea85dc616295d312c591a8146b23d4bb
SSDEEP 12288:0mw5HEjsChNgBFgl0WDm+CiAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:xwu1OWDXETcAtv0WeFvF8U9S6R
TLSH
T19985F14573A408F9E6A386388957D136F7B2BC422A21DB1F4370C65B6F77361AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 5acdd6bd9d7109d9a453106b60f484554f20c63e5416375f91224f07b00b6ae8
MD5 d6bb6a9c3780b47967bff892f6119d4a
SHA1 0e1e0c59a3503ed4e5d305ac7d3c1cd1e848c1a9
SHA512 de5ed72bd75c7d708681605f3ace16f8598743f08898d5f8693805bb8511ed8f6ed75b7f0ec58a743548e0e27f87a253a51a5338be637c40f636471d05fa75c8
SSDEEP 12288:AtZ1IyzAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:2Zu4XETcAtv0WeFvF8U9S6R
TLSH
T19D75128833E420F5E2934638ACF5A649E73178978B3197CF423456696FB3AC64D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 203149e57466d626ad9a8a0136f379d6c2979160d643547b9c7a082a02f66abe
MD5 11432dd86cd1f6e5c99f21d1efce4066
SHA1 aa9d1bec59bb87d23cd5877b4f63272d6e8b59d9
SHA512 6c36ada72c0a5e0508b06644007e42e98796f3562e47cbcf9319dc185cbc1a8ce8e5e045763a5b19b31fe114a58bb5f0f0fbad12aa5d4f910d7f108aa2c97f2b
SSDEEP 98304:NQRQyi36YOcPuLvw2gAf+PN3xYc9vF8U:kQyiKakX+PNBBz
TLSH
T1D1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 64189f3f73a53a1516fdebcf70d7c56adb7b6ab57edc4b21947faaebcdc11898
MD5 c7d6d42e2bf12dba5da6ea6178d2a318
SHA1 e110fb088537c96738d2711a39d362d492ea4f2a
SHA512 984e1b8206c552ec2cb0b4528efb5bba134c4a5bf647e8561f0e72adb83ceb24356820b90909e675d2c3118c181cf7396177c3e886880da255b8491f6d554c92
SSDEEP 98304:KQRQyi36YOcPuLvw2gAf+PN3xYc9vF8U:hQyiKakX+PNBBz
TLSH
T1B4667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f2942debc33ebbada7eb272404a6b9b86184994bb28ba09ab498088e71441963
MD5 4eab36d47160be0bb3dc3740381c2f15
SHA1 f6bc7a3693867835eb2c5135e20e3cab8655dcc4
SHA512 b6775ac82f95dd0a33fac3b5878b42d0933a0e92138c0401d72ab72e08b7e3633d211fdc9c7ee1e8609d28680b085088520d3563c94e5567389329e0f0f0d428
SSDEEP 24576:GwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0IXETcAtv0WeFvFB:Q68Qg55nhxeWu7PNU3/fYcAkvF8U9So
TLSH
T10CB54933B2F200A9C04DE1769F4A973196D17C758FE0E7DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3f123a6f2799626aa6cb1532bef275add662ceadbeff4b009707f879b780d9ba
MD5 0e081ab09a3c7d24017d337511537f93
SHA1 b5584be4f1b7a270068a5296d806ff63a19d3e3d
SHA512 42e8bd06a953f0e09784229f9eba11cb0c9962bc6669ebd3bd0727ec630cf6ef35c80d04989a5d148eb540f6606dbcf4171b8f3823caed6e30b687d0d6ac34b8
SSDEEP 98304:Iy5112gYy5azzVvD69nLKnhZ8Yc9vF8U:hLIH+WhOBz
TLSH
T1DE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 44627b9e86aff59f96e0ea8d65671201a3fd83030a1ace5a226ba8a9bb001dc2
MD5 efd3540f5ae7f618d4843a9e942d190a
SHA1 c2d9d18be53e9fb12ba94643372687242eb6b473
SHA512 e95fca79ebe7086f98d7b8293bf81bab08c020d0cc07cdebcaefd673c04c7eda7ee3c947d050c7fbdb57a2eca813fd999ac6ae14449503cd64e508a3aa789915
SSDEEP 49152:BB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl5YcAkvF8U9So:Xu6JmQxd2d5Yc9vF8U
TLSH
T16AD59D13F1DA01E8D06AD478974A9233F962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4b50e3213f22d208579961ece50d52a19ac769ace870985953bf869f68025f85
MD5 651d2fded27248fd7726d9e3c18e7ad3
SHA1 f5e445dae39ee74b8d17c2f3f1f4e7a34e2a3ff0
SHA512 013182c8af86c1b968f4f7454b4afa41e16bd2946c37b9a32e18bdc5306df6a913dc6d869ebc5c2a7184d883aaaa612d7b307d9ede96f8da2928f2cbc1d381c9
SSDEEP 49152:h1hpsNoJpF1A6yU44CwH7R4xdYcAkvF8U9So:hmifPVR2Yc9vF8U
TLSH
T18AB5BE13F2D900E8D05ED17897569232EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a2a2d29d5a4f6be8f79dfce0a5e62a38f758f66e7053b01fa1db36b59ad19905
MD5 71904515ebf57225aac591817ac92e4b
SHA1 cd30aed1e63ec95256e17c18307a37298c372dcf
SHA512 2afb1cb722438724194a7fd3f75e95494fc2a4a620ed917cbf0a231f9bde04137730d58de3243bdac2106e717966b41fa38690617d16d6802d2ba6a78d701065
SSDEEP 49152:SSuZQIY0Be2KIRVtOnks6NMHq4YcAkvF8U9So:M5dKOi614Yc9vF8U
TLSH
T111C5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e2dbc8fc40592df4045714cb60a7d57f66dcee701a69583a25a31ce6c329012f
MD5 889cd944581f4ff1a21dc8d4e2d400a4
SHA1 5f5c539d781d856b776f6a59bfed94d5a7ffbe40
SHA512 078296ad3ef2478a0a53ff74ffa3f1d0cbd241c0f09e71494939ae25c6078d52da97410b2bc3d677467d1b8df3ac6ce00a96238e051e9b85591a9147063789b5
SSDEEP 49152:DhtSn8EApI0figGgiDn0AP5wpYcAkvF8U9So:iX2i/phqYc9vF8U
TLSH
T13095BE13F2D900E8D05AD178C7568632E962BC160B35BAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 9e9c29ff78b8a440571b0d902c9c3ca380cd22b3ba04097a4d1053217b4dfebe
MD5 07ae918a2d15254bf9cc66413de61ba6
SHA1 b331c31ec7197496885d58805a2ee2ced103861a
SHA512 48cac4e2b80b3f6abc704e81d5d8e87afa4ad694f90f7bd4060c4ed8a4922c8dde70f16fbd5dceca96a534e3abd2f5c67d1f90a8d73431261e84c06aa7391b81
SSDEEP 12288:10AKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:1kXETcAtv0WeFvF8U9S6R
TLSH
T167652384B5A64061E3424E717D75B2DDF8207FCBCC15B99FD3387A19E6F668A41088EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 615006bd97c06849cd9226bfe20a1413d65ae25268fe31a0530b8baa0e2c745d
MD5 8f151d25e81c5763447edc6beeac22ef
SHA1 95b9392c241f4688201d0a58c90ac3f3150ac552
SHA512 9f7b7232b9fe02c08c1bceb5b1e5683e96562f50eb15fc5cde1a9d66a9537885c8fd91b603ac5376268f591552dd529815864aa442c3dfc9d194003c8cb5c6b8
SSDEEP 12288:9HAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:9bXETcAtv0WeFvF8U9S6R
TLSH
T10E652384B5A64061D3424E717D65B2EDF8207FCBCC15B99FD3387A19E6F668E41088F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 a3e6b8747c46a4893eb53465b1acb511f614e988a54427ef204a7257ee025e3e
MD5 37d4faded8e74eee11b75146a89187ba
SHA1 5eca95d1b5e9cdb795eeac6e77aa237ff84c73ca
SHA512 cba3e17018d58069d86beb8dc6b80b932f9641e262c5cf2f53aa6a14bbfa338b943d8a45695378571f549e87686e23f01ace6fdef92da54a6b5296fe66c2d276
SSDEEP 12288:YJAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:YlXETcAtv0WeFvF8U9S6R
TLSH
T1FC652384B6A64061D3420E757D66B2EDF8207FCBCC15B99FD3387919E6F668E41088EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 703ece17f97c581e62d505b745e23386d429faeec995095dd832456317932537
MD5 868648c224fc09828d1ab1b22a99071a
SHA1 77e209857ebae139c9c88ac0d5fc148f40c1a19e
SHA512 cac46f18fc10af8e00e3be6f27522029d567158e19da35701a508a0ddea6f36362c937ce34bd031630258cc24623e4de520e2c62e5a5e780dcade8f45b32654b
SSDEEP 12288:8VOAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:pXETcAtv0WeFvF8U9S6R
TLSH
T17665234477A600E1D2538B74BD76A1ADF4307EC6CE21FADFD3242A1D5AF27C99424CA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 217a8ff201909c911528f1c0c03124db4ada225a470892652fca9d61d841b603
MD5 0bf3a5b08b512403c837917294485ebc
SHA1 cc9a378218cbe3631c00fd76821f6bbdd5e4ff38
SHA512 eaa480568130c94c3676c99d894d993ffc758bce89f08a904a1498dbb747e1f63600f17dfa82cda59e0d58f61ff85a6e34c3f593a398a082f3b5ccc472e2f4c5
SSDEEP 12288:AWAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:AuXETcAtv0WeFvF8U9S6R
TLSH
T1E8652384B5664061D3420E717D66B2EDF8207FCBCC15B99FD3387A19E6F668E45088F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 26aa5b51a27e3c330be5a3ab785180dc314c24dc715dabe27ca1d742287f46df
MD5 337d9394b539c4ef0007389a91611262
SHA1 cc8693cdf428674ce2bbdf1433d5c3221c50f8c2
SHA512 6d6653669a6e3dc427ec45a1e38d71aa46de38a2d4c32a55816e1868d25641ba1205d727da7fedf4cef01bc24177c4c944b601a6604e021c81bef77e139eb26c
SSDEEP 12288:FbAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:FXXETcAtv0WeFvF8U9S6R
TLSH
T15C652384B5A64061D3424E717D65B2EDF8207FCBCC15B99FD3387A19E6F668A41088FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 a7a2315d746fd9a1cfc703da8a909e7244012cf013b081ed10b386ef8518b1dd
MD5 11162e9fa5413672e965b17f2d3c65f6
SHA1 01ad91471dcde9769852919e217fc4c6d99ae174
SHA512 f2d82184bd27335d4da57746521746d1fca393d78e7d6175bbb184b361e14afccf85fdfcb1bb526e333b96ca83aa4979f14d618c106fc4f36ede425c796a5149
SSDEEP 12288:XPAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:XTXETcAtv0WeFvF8U9S6R
TLSH
T1FD652384B5A64061D3424E717D65B2EDF8207FCBCC15F99FD3387A19E2FA69A40088F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 82729a052872e72da598b7cb79fcbcb87a0903f815191e40d12e96cc8f424156
MD5 ab6a8da2d872e7d4b2067cba4fb19653
SHA1 dcec4de4dd039afd69c205d8194c674ef413f3ee
SHA512 c27d8dfc0d59ec6c92e7f2971003f3251d0440f426d8262f33c5da70598020939e95323f0bfe2ee160283796c3402328f2e0cc027dcee62d1e7b45f13018d6bd
SSDEEP 12288:kiZwbfzzFEoS2cPvynAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:HZMLzFVSO7XETcAtv0WeFvF8U9S6R
TLSH
T1EE850194B39018F4ED63863ECD25991AE5B27C5A4B60CA1F03B4362A5F733911C2DFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 0cc9f7361bacc262de06863ca47d90215dc71d9fc580c2318b40d13a775a2dc1
MD5 3fbe4493b4f4fc9841b08f1c8ed132eb
SHA1 d86d52312622a22d0ce680794a67f925f0319f0e
SHA512 6d3ef6d857b795282c8dd1e159d6aed458f0da22964a6079ef2ba06d672744d9f6fa499e6f389857ef8e92b1e6f2f3dfc27e754331d023d850364fba9744bf17
SSDEEP 12288:+QAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:+oXETcAtv0WeFvF8U9S6R
TLSH
T1F0652384B5664061D3420E757D66B2EDF8207FCBCC11B99FD3387A19E6FA68E41088EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 89820df6209cff9957a2128302cc0e8c8be09c8ff7c7767724f11b0632c1e39b
MD5 707423810b41f224ad18ee9586cfff2b
SHA1 382fdf099503e7f08f8621e58a651ea5f42ae4d6
SHA512 5268e3ecb8f336ebd617f8d9c5b047c56c992023f17529bd1ca001905513fdf445ec9a7bc216e5c13daffe97449961fe33612dec902fdc66a6cfc0feb5ebe8b1
SSDEEP 12288:HsAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:HsXETcAtv0WeFvF8U9S6R
TLSH
T1B8652384B5A64061D3420E757D65B2EDF8207FCBCC11B99FD3387A19E6FA68E41088F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 3ba60c122166abe96ede5c241954ebb73465e908915982d46cc8c4e279e43823
MD5 193e3807146dad6003c3e2d4cc1d9130
SHA1 352dbc92b5a0abc7e3ea81c93ca7a3d2eab49da1
SHA512 d1df974fe9a308c9e000455f450a5ddda5ca3849186b24edea31bc88e3288d54289640143fdf7d9c69cafe3d69d60d70937d3c5aba290d69528e2afb151d2b55
SSDEEP 12288:lyPz5L8zAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:szy/XETcAtv0WeFvF8U9S6R
TLSH
T1D775124773A130F9D263823898A21A46F73178764B209EAF5364073A6F776D19D3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 839619187117c415cb7c66539f1e592f443ffefff00f603a9a65b449fd16b3bb
MD5 6d0176e937629600f29c3fa00263de99
SHA1 654be58a45bad971d3c62f17e60c17eecf867e52
SHA512 350d2d1b07143cd176a29193dafb652295e14beb8e89c1337edf9034b51063d832ad0850e81f0e5c2975ec1c5807f2f30fa84128f21755df8332ac006c7770cb
SSDEEP 12288:1QAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:1oXETcAtv0WeFvF8U9S6R
TLSH
T126652384B5664061D3420E757D66B2EDF8207FCBCC15B99FD3387A19E6FA68E41088F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 84608ce7cff91895eafb2a9bad4ec1f193af119b47cb25600381b6e7a88df93d
MD5 3c48b8dd300d193ebde59116bf057226
SHA1 0b179f3979c7a43bb7267b7c046a73baf6a25050
SHA512 74b6f39f0a4e72ad51cb45d1960f0069cf6c8c674a297692bcef2727fc893c4591e0177824fcda3db19afe44876db8c4f60148e42e8b5c52586b763716212712
SSDEEP 12288:rQAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:roXETcAtv0WeFvF8U9S6R
TLSH
T177652384B5A64061D3420E757D65B2EDF8207FCBCC15B99FD3387A19E6FA68E41088E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 f5d23f0c2f4e5928a489efaef38f5ef305eb28086ba4e00f8a5f93004ba73b37
MD5 f14c94ac27726ced1dac363bab002e58
SHA1 ba0f32aa2783b16290cad158f8ca5cfad55c73f1
SHA512 dfeb7619caa3a70435b162c05d3fd5c906e4910ce6ca77b0f62fcb0426427fa0100e408aeb726f6acf212abd275731dfd4bebd89bf7dd7eda6cec490319ff973
SSDEEP 12288:3yPz5L8zAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:6zy/XETcAtv0WeFvF8U9S6R
TLSH
T1CF75124773A130F9D263823898A21A46F73178764B209EAF5364073A6F776D19D3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 193fc79dc27ed5e701cbc8c1a1e41fcb70c4140c16b849513c38e47492569644
MD5 94dbede72f5f718fc084d3dffd7128a9
SHA1 70277eb4783a476b8d0e18ec6539dc8e5d74bb42
SHA512 767d4ceb212b9603bdf197416eb2cc7ac21a8b83d5c4deea1aa6682b519bef879dc38d1da883f5e7b684ad3abbf3f9357d18fe5146a52b07ab4646a3bce4d9de
SSDEEP 12288:YCd9RWYoaLHF3z0z04PDvhZAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:BTAaLl3z0zD1XETcAtv0WeFvF8U9S6R
TLSH
T172850294B39018F4ED63863ECC65991AD5B27C5A4B70CA1F03B8362A5F733911C2DFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 ff45eacbb0befffd5f5e934d4220372f0458e764b06e10e184e38ed321ac6281
MD5 9fa6546baecb49c5cfd183b2d8908811
SHA1 c86e0536fcef804d28887f0915d417e401213f0b
SHA512 017042843cb7eb27c002b84d41015386701221e102ab66d4a5d6041dea1f284326820c86706ac8ac84293f6d423adfce90db7c796ca3f769af25010a9ad48d93
SSDEEP 24576:Z3Pd9CHKy7GZRXETcAtv0WeFvF8U9S6R:pPd9CHKyaHYcAkvF8U9So
TLSH
T1C195CE90F3E410E4F1B38A359D769511DA767C9A5B21DE8F03A8261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 c33ee4fb46f5f1a3b6961e3c73d821446e444475012d33c406a51204b7d42ae5
MD5 85f6c438d7d4e369381cd96afb88abfa
SHA1 8e584af1d6cee486ffa9bd762954eba5e9037e1d
SHA512 b22a34a8f39625312da54c5aa75e72cf23ffa60099e5ae7b522114a7405e79aceae49070160088f2abc69fd55239837e03fa6dbefc2326a2ade2338b8ed7831d
SSDEEP 12288:QpAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:QFXETcAtv0WeFvF8U9S6R
TLSH
T1C2652384B5664061D3420E757D66B2EDF8207FCBCC15B99FD3387A19E6FA68E41088F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 6b77eeea4026150d5c7ce800ab1e397ff67c84690e674b2c0fbf620afa0b4194
MD5 8c03ededecd37a1402350c0d72986ee6
SHA1 002e9fda75731d9cb3ba566c3c29abbcd85f6354
SHA512 7d27520865a4e609aa16173d16add4d6ef22f580bb05c1dc31fe2a0d360169b4fe7fb918a7a5992db9938b7a50dc7ea1c0d739339dbfbff01f8576e02ccdec67
SSDEEP 12288:LTAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:LfXETcAtv0WeFvF8U9S6R
TLSH
T13E65238476A640B1E3420E713D76A2DDF8207FCBCC11B99FD3387919E6FA68E44048B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 97793c4ee6e0e800c9db5415b1bda6ec59943dc3bd55ac26c634085f6febc72b
MD5 2d4dd9bb6267cb50d30a796efd135201
SHA1 4a3bb8b5fd9b06a1fe6a8c0bb8fefa9786fbcc1f
SHA512 33c422a7776ac0651703821e51ee2c497cd5f8f4b561803fb2a8e0ba54a23e2f511bd33c534b46b3f7da1e5a931c0585e4e62f301b52eca703ee517ce56b225d
SSDEEP 12288:LqAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:LaXETcAtv0WeFvF8U9S6R
TLSH
T128652384B5664061D3420E757D66B2EDF8207FCBCC55B99FD3387A18E6FA68E41088EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 a515e9922d6be5da107705121d4f5804fd221636e78453eeaf485a9d0c9e5d39
MD5 f7ca32b8c0cee42acd659c2d2c42992d
SHA1 80d7542b02537ca390dcd4403da2d838deebbbbc
SHA512 083c394273baf1323ef785711e8647c30df19d51a171f60c0c072c355f9cde18c7828708571c25955ec2a4ecf394bdf9cc81459b99e1649f31a15df71340a72f
SSDEEP 12288:4QAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:4oXETcAtv0WeFvF8U9S6R
TLSH
T1E2652384B5664061D3420E757D66B2EDF8207FCBCC15B99FD3387A18E6FA68E41088EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 7dcd66d51dd748778adf3b8c0ff4bc93285076f6ede127d4f2eab738398e1c92
MD5 bd4c611b4337eab74c8087235113a6a8
SHA1 6a0f9b9558403d2f883f5df5abd23e3b0bdc16f1
SHA512 5f8e2f21e5cda7c0cb21949abfa45573c11ea4ec5616cdf0717349cd2cce63bd9ba5a0fe48f0509a5018b85701f13ac7bb476066377e5ade30be6e1819b3085e
SSDEEP 12288:PpAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:PFXETcAtv0WeFvF8U9S6R
TLSH
T1DB652384B5664061D3420E757D66B2EDF8207FCBCC15B99FD3387A19E6FA68E41088EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 e92cde4ec6c1aa2d07b5171c1bac15f22208f116e3a05c3d09a116914e182b50
MD5 65ddf4cb8b512b40772a948ae2bee3e5
SHA1 52627e29a235f16d5b64092ca676861a18d7b4db
SHA512 072180db3b4e97d3a6cb72c7c80b5b08fe5a6999316465aea996fa9297783179c51b9f70e51b22cf9f7fc4a68b9edf99391a8b026f023b44ceb3dde44b46f41b
SSDEEP 12288:N4AKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:NgXETcAtv0WeFvF8U9S6R
TLSH
T199652384756640A1D3424E717D65B2EDF8247FCBCC15B99FD3387A19E6FA68E40088BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 b7e9bf3b2e9bc8a55d994efe04851b2d57d09300c4548a06cb9b568a1cf03eda
MD5 c80fb1a44919d498c88123c0bfd94fa0
SHA1 5926161baf7e0964a8bc921f8d0ca3dbd3586fa7
SHA512 62e480eba78795629b92c39f0e260953c097518c8be2b5817ccf6dda1869a8df888381b722efad42f182bc1c91b3bcfdc622c9ddc13a3e4719017b6b45818af7
SSDEEP 12288:CWAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:CuXETcAtv0WeFvF8U9S6R
TLSH
T103652384B5664061D3424E717D66B2EDF8207FCBCC15B99FD3387A19E6FA68E41088EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 976877102c56e9b073fada7182db81b20d6d6d65c0fdbadd00b17e6bbe9da343
MD5 4b85dd0ec0aea77cb67552da97266f05
SHA1 dddaff96b04a95d1576f707648eed9f795132620
SHA512 e809c030e091a0442e26bd76186b23828d720f68efba1056f1740271c7203aac23bb8eadab19d80c848f00839f7e442279bd7a3042a75bf9ea889222818f67e5
SSDEEP 24576:xfwvLk9RX6wkyAIcXETcAtv0WeFvF8U9S6R:kMnYIcYcAkvF8U9So
TLSH
T10F95DF29EBD844E1E1B7923C9DB7460AF6B178590B31C6CF02AA536D0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6704b8a878c053b96d31f2cb746430c601cbee6e02cd0e881ac435e0e42fd725
MD5 af6be956a9954a281a6c4ac7ccd43614
SHA1 72ab60c00e71e3d7e5bd9ad83497dce088849393
SHA512 4cbc7730175a085d49a17d4a5aa0adea506a20c130ed53c4a00632d577ba2f68b19c5dfdb4799bf0a292967c326de1609b0b7a81f6d49d93c1c04e2541969d07
SSDEEP 49152:tYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0JYcAkvF8U9So:jySzPRYc9vF8U
TLSH
T150067C96A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8926da4997dba5de44e7038fa0f9bae0f86e5be6ed70438a951fe9fa37e5a660
MD5 f58e3bc38b2311b70fca979e7aaf4553
SHA1 037d79d7367ee230a1e3de01f30fa923a3fcbfb3
SHA512 9f51d4b09880a763afd8f63b57019fefb0c647938ef7f88b9b0fc0893cd6d1495464322dfffd66eb3db760c7c2250ba15cb4102ebe32cbf98146f5c35e105041
SSDEEP 24576:w47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYrXETcAtv0WeFvF8U9S6R:w47JUQjairIhCnDHUPfF/5YcAkvF8U97
TLSH
T16465AE1DA3EC01E5E1BA827885154A5AEA71782E5F31CACF1270837D6F63ED44F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 c7457d34a34c57e5ee57b93f48d895ea688765337d334488d639722959d04c83
MD5 19cb707a8d07dd260590537d80fc5afc
SHA1 c84a3a2a4443e9dd13b5b597f38e5eb35512d0ea
SHA512 def9e7af6c836a8cf14c4138a0f89491e32d059447294bf9ac3b6e73f6e28a40919f22d6784f47da65ca88ab44ff4d535ab644b17efdc485fbdae32d15e0150f
SSDEEP 12288:HasfgAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:h4XETcAtv0WeFvF8U9S6R
TLSH
T1CA750108E29801E4C16E5235DB569644F3333C668BE1E3CB53E0F93E1FB66849DE9A53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 916KB
SHA256 d49bae0c1df0bc8c48c9105159cc910dff9cac47b0255456d158d2294018a85b
MD5 9f4932ee0810d65cdbe10530cffe44be
SHA1 51cba14b0447777479b341fd8b665da45dc79dff
SHA512 3c93a2def7f3247806fc1b3fa26d3f2c37c95340fe56c69dcd7ed00a76bca4b464a5121c1379d96ea99eae55576fa54b0967d2e9ac38e1b1cbb63057dfbdd407
SSDEEP 6144:l0sBC2nauW+KEFa5BRZotMxZBKaU3fpklTAXV/rcVnoP7gI8pikq/UncNgu3L10g:l9yzHU3flrcVnoPo7cWu3p0CJd9
TLSH
T1E9151750762AD75FC6AD40321E33C6CCAB70BD45EE059B0372C8472FC576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 5fc91f7e8b59ad3a300e70de470eb189e4949101308cdebef836cfd0309d640a
MD5 c7bcc821be32df0448dbae1b5a5da97c
SHA1 f0e64072990427542a0b6e6275ef02de82b3bcbf
SHA512 e7eaa6b019cf8b1753f31206f08ea4339cdcca7f882e47eb4dd26d33057880cf99177779ad5fa376cf2e8b217239dcc69c03911c76f21c90beba34d42ea9fcf5
SSDEEP 6144:0ojDucbWeWvJ/4movAIufIcekxNrcVNfPWlh8O+UWwonqnQWU3aRPtMxLRPtMx09:0ojqxNrcVNfu3GXNYWT
TLSH
T1C555B4815037A3CBD5FB3071076A5F4CA764EC06B3495F26A3C8453AD82BB66B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 d522b9e9388dd44f6a62383755233aa26779322b62849353af6772ae435d71e8
MD5 0ec4601cedd9a5480ded9c038b2ee5a6
SHA1 9b921fe5c653f04222f5fdfba93740a46b16392d
SHA512 b4287215bbbe5306392436d5daeb2320625d17be196ee3c23b75197d6d5798979f275cb216179cb2553581b43a4492f34057524e21231a516218f1f66fd750e8
SSDEEP 12288:R77IAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:NwXETcAtv0WeFvF8U9S6R
TLSH
T170652340B7A95061E2620E70387AE17CB4257FDACF00E8DBE2247A5DE5F5AC98D3486D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 853bb0ba90ff45b475f2d572d1965f6d5eae6ceddaf12e512b7786d37373d640
MD5 62657625ee3752dd7adf4e95147ff86f
SHA1 c2f575d16eb699b4e94c62e3b3d36a447e0471c4
SHA512 9f4df32ec0abe5ead7878aa5165d58eb0f485c511372a4548d4b5556c6a43a7f3b29751dbe912307de2dbdac359af14af1a7de278940ca5b4a2141d79c4dfb13
SSDEEP 24576:Egb6bmBIi49WNNFpg1rSvFv7bYCXETcAtv0WeFvF8U9S6R:Egb4mBIBhGFrYcAkvF8U9So
TLSH
T13265AE1E22EC02F5E1F6D2B89DAA4417D6B278160731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 75d8840f38a5041b82b00a8addfc11f6bcace87fd6d51834195e5c54f9f50035
MD5 c1b13371bd883f597f8624a2aa235b7e
SHA1 f516e295ba7cbf86106caedd681a69eee7a7715c
SHA512 6be20689def2409a6c0547776f208463ce3f87fc270bac3e527ca376b7ab34faa4c28c5edf0ac5c9ab1349f472624b2962973700811018f4886141d24391bcf7
SSDEEP 24576:kG88u8FpJqH1Zzria7/m7XETcAtv0WeFvF8U9S6R:X7ZFPqVQa7/6YcAkvF8U9So
TLSH
T14DA5F16577E101F0D077D138898646A7F6B2B8260364EFDF07A88B551F23AE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 a3907dfdab3c36c9e2cf6cabee98d627cd5e926446b15519a0e408335fe7dd07
MD5 46de85be29a2429b9c020de47926c5f1
SHA1 7ece4d9e1930916bcb57df9742c9077ff979814a
SHA512 52a9db70d67390c8af317b9fdcc824c5a6a8ae7285b462ccd5d97050d8928c89f2ca3cb51730633f692f2b9ed57b0d749b7ded934a5c3e1b8b49112a00a742e7
SSDEEP 12288:1HvUrBFrEjwaQLAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:1PUr+NQHXETcAtv0WeFvF8U9S6R
TLSH
T16C85F11E32ED18E5E676A17C9982871DF77178520712E6CF02E0817E5F67ED8AC3DA20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 0fe7b28cd99864e32fb0c601fdd8831acbba6cc4d1e46168151ac926457581e1
MD5 bbed1fe1b65677a155f69ac4c1eef023
SHA1 066d48b54b82b65f9166c27d396627446e62b0e9
SHA512 fc266b3f8c91dd585db8d2d90f18113a154960c096d7083905e4a167abebdb50befaca1bf462c83c9ab282b1bdea697321e68034db8561b4c2f27ca8374eeeed
SSDEEP 49152:qBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjXYcAkvF8U9So:VG05lO43bUYc9vF8U
TLSH
T131D5CF6A62EC11F9D1BBC17CDAC6860BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a5ef441e87592947827c6eb5af1340aaeef0e539850ce23e2ca85ebb8141ef1c
MD5 f97210e7ef235f858061bda08c5daeda
SHA1 341aa187e1751df8098c5ef5852421519bee2e38
SHA512 98979208a41d3025d386101cf08b9be6166a7396036fb2fb724b97967234012b68e8c755fab447bf55d6718e33ceec17f4fdb18cb269ec9884d12062e075e9ac
SSDEEP 24576:Jfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnJXETcAtv0WeFvF8U9S6R:Za5POZ3hJt2pasx2+mfYcAkvF8U9So
TLSH
T13765AE5DA6F800D5D1B9D17DC583861AF5B1346653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b7bb3f2f856b83092ed16e61bf9035eca6eb51c83429a10c2e0500a09840dac2
MD5 c95429fa6bfffbb1780bfa432252129b
SHA1 7f5527efa4a44f3b879cb35f1213c57921fbcfb1
SHA512 755f2a1fc54411ebdf5f67a14a6433f5cc225d3ae8321d7720681ca56ee28428e075e1164ef1917a61b35792c0f4d76e6f36871c10e39514034d3ed8641867d6
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7FkjXETcAtv0WeFvF8U9S6R:SNc/zEOVHFaYcAkvF8U9So
TLSH
T160858B1623E901E4E1BBE1BE89779546FA71786957308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 37c0df276504beb2b101debf23955fd9e5934b7387171f6c811e8d5b042f30f2
MD5 9831db8c949cfcbe47ee0b71de5ef712
SHA1 478016933476f154b59c56628ae721b99e2e830d
SHA512 01fc82e8244e44d02e55c2ef13967a07a1d001d9ae4a5aad8112d6ae2d09d302917dbbbf481f4652efc3433dd9e3a561469440cbb83d14cce6f944faaf5b1a76
SSDEEP 24576:z3kNvNnaFeYhJNtmZBmtXETcAtv0WeFvF8U9S6R:z3MwBtOmtYcAkvF8U9So
TLSH
T16855AF6EB6F805E4D1FAC6B49D238512FA727861073293CB9390C13E4E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 6bdb80799bd4c52b49ffa6f77031ffc96b3e7bd1e028d312f963dc37259da1b7
MD5 e852aea4327f73101457b4bd8fed1e4c
SHA1 d133af5a70535c685d02e93423ffc260d9a21aec
SHA512 3809814e38977c575713ae30351f85f8aeb42fe50dfb1da2c2a8ca6221dc53c463a3926ee0871cd2a885977cdd7e665a431bcf7dccb967e2d4fa3513db2acf30
SSDEEP 24576:RD3FHshBIYQgAEXETcAtv0WeFvF8U9S6R:RDVHeBIAAEYcAkvF8U9So
TLSH
T1F895F17DE79C00E4E577C1BCDA638606E67138A9072269CB02D481BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1316-340-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Download

memory/1316-9-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/1316-2-0x0000000140000000-0x00000001405F0000-memory.dmp

Download

memory/1316-329-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Download

memory/1316-331-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Download

memory/1316-83-0x0000000140000000-0x00000001405F0000-memory.dmp

Download

memory/1316-339-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Download

memory/1316-336-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Download

memory/1316-338-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Download

memory/1316-337-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Download

memory/1316-335-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Download

memory/1316-0-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/1712-61-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/1712-38-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/1712-57-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/1712-39-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/1712-45-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/1936-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1936-393-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1936-391-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1936-94-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1936-88-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1936-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3224-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3224-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3224-21-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3224-14-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3344-377-0x0000025564CB0000-0x0000025564DAC000-memory.dmp

Download

memory/3344-378-0x0000025564EF0000-0x00000255650BA000-memory.dmp

Download

memory/3424-311-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3424-114-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3424-120-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3424-112-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3536-101-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3536-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3536-312-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3536-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3536-314-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/3536-107-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3536-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4220-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4220-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4220-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4220-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4232-72-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4232-306-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4232-64-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4232-66-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4784-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4784-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4784-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4784-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4916-308-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/4916-76-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/4916-81-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/4916-84-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/5440-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5440-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5440-133-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5440-131-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5440-125-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5800-50-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/5800-51-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5800-59-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5800-292-0x0000000140000000-0x00000001401B2000-memory.dmp

Download