2a5084c669f84d01fc5e5bbc9fba8004b878fe5986a357e08b9a9cacdb6fed0c

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 08:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 3.7MB
Sample260910-kktf1sttgs
SHA256 2a5084c669f84d01fc5e5bbc9fba8004b878fe5986a357e08b9a9cacdb6fed0c
MD5 f7e7704687b06ebb74dbabacd5f69ed5
SHA1 c1c6e3ee85d1a20c33338bfca3b1acf5d18d4e06
SHA512 2bf38746b653c3dda1984452f43d87c1098a88e2146fb313ad619ea1282ca24c6877e10c9bc1968d5fa4d2030cb442055701789a256e6da765cb76a54d62fb60
SSDEEP 49152:A7JynhJ8EhdVMw7Y9odwfDFqfFFJVgrvqzbut1wOq/ejgXUeT+uXEkjNEEBHLu1B:zsoEC9ia+uUkjDBHLu1U023W
TLSH
T19A06BF1AA7E406ACE0F7C679CED6C553D776B80D07B0A64F029098A64F772609F39723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1580	elevation_service.exe
3396	elevation_service.exe
4396	maintenanceservice.exe
3628	OSE.EXE
4892	PerceptionSimulationService.exe
2124	perfhost.exe
1164	ReFsDedupSvc.exe
5356	SensorDataService.exe
4380	ssh-agent.exe
2360	AgentService.exe
3372	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\86f0d6975387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000046589f460041dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000020c9e3030041dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f5aca460041dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b24438030041dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000160664040041dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c2a895060041dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000169dc460041dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1580	elevation_service.exe
1580	elevation_service.exe
1580	elevation_service.exe
1580	elevation_service.exe
1580	elevation_service.exe
1580	elevation_service.exe
1580	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	2360	AgentService.exe
Token: SeBackupPrivilege	1164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1164	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1164	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1164	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1164	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1164	ReFsDedupSvc.exe
Token: 33	3372	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeDebugPrivilege	5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5156	2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1580	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 1908	3372	SearchIndexer.exe	100
PID 3372 wrote to memory of 4776	3372	SearchIndexer.exe	101
PID 3372 wrote to memory of 1532	3372	SearchIndexer.exe	102
PID 3372 wrote to memory of 5544	3372	SearchIndexer.exe	103
PID 3372 wrote to memory of 5804	3372	SearchIndexer.exe	107
PID 3372 wrote to memory of 4384	3372	SearchIndexer.exe	108
PID 3372 wrote to memory of 1780	3372	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5156

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3396

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4396

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3628

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4892

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2124

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1164

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5356

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4380

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2360

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1908
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4776
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3044 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5544
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5804
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3044 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4384
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d97566f7ad0371b164512ef3f8a126ff2a7577b5754c6bcbf95d8e4935a35320
MD5 cd44db3b7b6cdde142926186838f21d8
SHA1 96f5cd0f2d06b7813b5652dae254d670d251cecd
SHA512 7841bd16c366daea083b5c1e2a55272808af2d5135c3de6898789488f544d0b77d1a96b5c73257f7d647113f281287990213e7bf3eb76d4a6710bec12c12237f
SSDEEP 49152:7b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnehe30jaNf1TWbdz:J3q6sjBnU023W
TLSH
T184D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 2ab956325885b03718ed321639886a3cc5b74d8d835a6bebb6340d2c5420c831
MD5 027b2a7fc24b001b7013962f010f6ba5
SHA1 8817812aeb575ec08e4ca4f697521e652a37f5e3
SHA512 32e6066209d06c773040c264e6c1f3992a339f2580d971721c92fd1a3b58a638286fab55692b8c32b9db4afa67c8f7dabe873760a466e32489ff7cd93091f6b1
SSDEEP 24576:qXYfDtczAdugXe4i7ojhsP5Lgrk1TWb4AN5:xtcUhe30jaNf1TWbdz
TLSH
T1D405F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 0ba0d750ade14d42b65d578537ed74432e7dbeaaecb32da593b4415f1154a573
MD5 5cde54a4618f6e0ce5eda6f7bef8fda0
SHA1 73904f6004cec1bf94bd916c175d6f7023b347aa
SHA512 85e7a24de8fb77758469647a2d824012974ada4b98e6a4e625a671abf431b24211ec97cc9d2f0059bc82296019f0123aff8e0b1bab699421222d19c4d6178baa
SSDEEP 24576:U0Le5ji0hmxxrMWugXe4i7ojhsP5Lgrk1TWb4AN5:UPji0Ajnhe30jaNf1TWbdz
TLSH
T18F35AE26F6748735D073C0B9C5D2A68AED71308257308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4b13338f73e42c7e912565b12378cd0d3de3d43a753d29b35dafe7a5087860af
MD5 67b110e727ad993a815d81390e825d92
SHA1 6461bd8ccd6c851fd12eb4983b36a7f169c3ec74
SHA512 bd0827cd10ba40c9240cc432d5f5002de0ae1f28b2a9d0db604b9400f80e7ce1c8108f8ac967be422d148b4d1836c41eee383f468ca676367771cea666feaaae
SSDEEP 24576:ga7/ezSC6vUyD/aqgrvWn6q8wyukugXe4i7ojhsP5Lgrk1TWb4AN5:X/ezSC6vUzPveHjyrhe30jaNf1TWbdz
TLSH
T192756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 23b3510cd2a2f11f49f48a4c7248816015427098d0316ea7a4288098075fd0a3
MD5 7fd040bf261d6a8c9d1b2ad4f34d33b7
SHA1 410cf526e04091ea64177f15918f35f59dfe75b2
SHA512 3c4a993e29c035fd73cd89e61e1b6ee3ec7a203794c984732ac7c7e2efadde8bc8abc274283d218f9f9a2781ae77c832e7314d40526ec5244c816892e92ebef0
SSDEEP 24576:cVbqPb88hv/l+YpugXe4i7ojhsP5Lgrk1TWb4AN5:cVO88hXl+she30jaNf1TWbdz
TLSH
T1DF559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 7c6be6d7bf208fab73fedee72b04e14c865a178a0b5fb7a83ee9b4302e0f1979
MD5 58127625cfb557beecbfc4930f8bb1b2
SHA1 870f899db5aba0f2b5b783a0fdfc802f9185fb6f
SHA512 73e026f5f5ecb735cb0e11f401d4e46b868c3d477f048fa2bc1c8b4ba8e1efe7016d696a4a57924bd51d65b51d3eddabab7168e37514d4acfaed68eab905dbc8
SSDEEP 12288:uLCB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:uLCugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T199C423929F5409C6F38FC3F4A0F7CBD1E9E11EC061448D6B47E0BA9358BC899DAD4469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 3557bb860acaf6a77607f7d2823bc3df0a8bfd8a761c407a07ffe6dc463f896e
MD5 e47121e723685c8df0b8aadaffd0936e
SHA1 ad49ac461fc622c73c98e0afd75b33c826c9aa3f
SHA512 aa1ec679565038ab9535eb4557be74d1eeb87915b8c01091670c71fafc9dc17dd58f031481c809751892cfcf7e8a5df4519e1bf92473707738846c5501fc1f0e
SSDEEP 12288:XeBNUbTVO86UhB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:XJIUhugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10405CF3BEE28FCD2C27E8DB85691C740E7B278704B5293CBD164820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 64c67a1fceb202d549230bcfafb7fd8ccb7714023b06379f9243031f1bd78a1b
MD5 426dd2b2f757d2d57abbd7dae733f90f
SHA1 b7279322ab53b3e85e016679a74e4d936f8e9298
SHA512 a2dd5bf2ecfd4c0bdfbf59bf7cbcf34fe137b23e6946a1b7fc9803503fda04ad275114ff5c77629bb516c1c47c2298a0a738381f17c8c9cd8ec9bda0c239d74e
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THh:2QvGAdlCEL8c/DRNw5C0U023W
TLSH
T1DC267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 efb3b0b77fe5eda272d55c8ebae022a5862ed3af5686350457ba6147b1cd7290
MD5 0f7684f18004269ec5abaf1a128e1983
SHA1 b8f7bdc5c30531e10405651958644f389b157e7c
SHA512 01a6d181a17d8b26fa1e3f3a64334c6681af1ce523a00e1d73f1d166da016639ce6290019335d2662282b8006fcfc0094c04ee9944fde7c64a4c41ef78525b26
SSDEEP 24576:a0ewsAj3ugXe4i7ojhsP5Lgrk1TWb4AN5:7lj3he30jaNf1TWbdz
TLSH
T1D615E031FE74E032C3BF0DB21B76C716586C6A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 eb7644cc2c6f7014d7b0d74c315ee4c52daaa3c50595a0c1974bf829c78960c9
MD5 df8ac97f793d7464a06519c5383214ad
SHA1 fe40885e524225c0433e302249d30e8301bdf359
SHA512 41f5bddaa5bf4233871ddd07ba941b139112011230323e7637382f1a41e394bef20dd8fe7159947a514e7669fc90096ff0113efd65397d5ed65c802a8ea53d74
SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH5p4W:UUEtQevvqc2W1cpV2tI32r4W
TLSH
T1C1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 02e123fc22af8d43920c769e0382d0e26a0925cda60a889d545a4d6f6499c865
MD5 93c94a6958f78b5d9a399f93e5121aec
SHA1 62fc9f13825c8847ee52f651b1f73fa4b2a1dbbc
SHA512 277924b0b667f574f80eb9374de85825535d1f8f80cf9f4d7a6b3d41ab78e1f4dd7a298ba48d916dc1b3679f863a43b57739a6edbf7bf58844362086ca7b66b8
SSDEEP 49152:dCbRquA/m2yL5zTfFiV+XenmE3/zXhe30jaNf1TWbdz:aoquVjnmYU023W
TLSH
T1FAD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7d498821c0dedb48e50b615516a47cb9a4d0bd1d7dc419cbb5ae9cc38a6eb4d4
MD5 a45040cef06db56b00bec33b39a58c96
SHA1 ad019abcda63e652e9698411fcb54fdabb73ab7f
SHA512 32c5a25b82d76172052d690d3aa4de4b47b75966b3172c3e686b72a408bd8808b93db85270545a3335a2d2d5d16ab39871d2be6cae427ba2917e2e4e45113cfc
SSDEEP 24576:DAhGL3IFoiwtA5l7S53IugXe4i7ojhsP5Lgrk1TWb4AN5:DAMUFoiq54he30jaNf1TWbdz
TLSH
T18F359E81EBF945D4F5B3AAB899B68571EA76BCA65E31C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 679a4b243f2e0c205756da542d70bef3808b6d8b72ef2409a69ec3e6c2d94c53
MD5 18fb48b8a68c8004d634d967f72893c8
SHA1 8c66f0fff6b3698c9d60d2b7535d736affa45341
SHA512 831a4772ef92101a0bc301b565a56092ba1bd46861e979e10f94e137dd8152cbcc21b33170deec2fcc00617bfa902e01a6ba6b80f997b65695aa8332fdcb2ac4
SSDEEP 24576:pwu4OWLugXe4i7ojhsP5Lgrk1TWb4AN5:pwvOche30jaNf1TWbdz
TLSH
T13305E14677A40CE9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 d1a9347ec28a192f6ded70de053423d80b61578c0778326ce868ea43d7ec625b
MD5 a120d5c9c701d84370e7e955d9798add
SHA1 55c6ec515c654a539a1df1f50440369b7b3be7de
SHA512 c0559292bcdce225a5a8bfa71c1d23903f7df018c0d13df8e8bd94179fe2a70e741caa1500cbb26b2540b6502543efeb927f4649a7683d3fc5f2e565196a7bc9
SSDEEP 12288:seZ1IyHB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:1ZuuugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T149E4129637D420FAE2978278D4F68741E7B23892233147CF02A096A71F76ED65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bd514eccaa8cae6bb7b1ab1b9e55de67f69b322df79556c84615101bdc956109
MD5 fbe20962f4c4ed612361d8e609940554
SHA1 c9ba40b61fc69d5c47e62ae20644eb871a111d63
SHA512 ae27c724d49a8511921cb55a9f4030906268095020080c4b970ecb1e434fc68aa75fd1d749e8eabc470efc593d7d92041f04ceecffdd63ce70f64a4bb3cfb0a5
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U9:cQRQyi36YOcPbLvw2gAf+PN3zU023W
TLSH
T1EA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0cc19e72e5b155c2d44ff85d9f67129547beabb7c8a1ca31256d9e5dca691a06
MD5 0384afed640c7dcc2893c94061c4e1b9
SHA1 1a7e98f86e25c6c10af4c9892707ab1f54b8cbbf
SHA512 26c0460ea8135e92068abbb2187079d3c41af0d88645e423c700b1c98b09f896becb574a5aa6579dde463f120f4f96d6920cc4339e9b894d65b4fc69b23f2fbe
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U9:OQRQyi36YOcPbLvw2gAf+PN3zU023W
TLSH
T1B7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 10dd78f597934b7378e73e655cbcc9b8a9711fb54c64801f1f5e2da4fce579c9
MD5 1421dc748c0f5472ac0d690b1957e270
SHA1 0396972c68827e37c3bf04733391d9ec6738d1c0
SHA512 b2f878046442ece1791f85acc4c96499c58d93b00d6939b8ccc926d2cefa35b08f70781b9fb2d026d5f1e1dad1372935039f6612186b135f4c0ee5cbf05cdc6f
SSDEEP 49152:+68Qg55nhceWu7PNU3/nhe30jaNf1TWbdz:MthLRc/hU023W
TLSH
T112B55933B2F60099C04DE1769F4A873196E27C758FE0E7DB855172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d8bbc924660bca9d96463e3e9b3fd6989f955ad2c50b4664450beada1d90f628
MD5 1a25015c0c79fd1f7a1f5a922572b8b6
SHA1 1cee5c06b76d4188978a0a65b6a1e866e61f3dce
SHA512 246353ebe5a67f8bb965a6dfa0f110790bc4c34b9358b3c114f0d65594206899672762de4f04ea4a5f636b102025210d61c60de8cddaafe1c8ca319fe1257941
SSDEEP 49152:23aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99L:ny5112gYy5azzVvt69nLKnhZmU023W
TLSH
T1FE168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fc7b5bc89344ac6bcc8e943d4c68c92de3bbf54eba1ecff1867f3a0a3f7bb513
MD5 7fef7c5ea55dd4d88ff16c9378bcfbe2
SHA1 8f009d616fb44950cbaef59192b4dcebc428a4a0
SHA512 a209e74853a1b96e0a643ca8a557825e1190062321c1db6d1b6a834f0d94ae37c3b0441375300d81872a0940efbc4f927435dab0cdb3aafa070498293b4adf7f
SSDEEP 49152:kB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glNhe30jaNf1TWbdz:+u6Jmdxd2drU023W
TLSH
T131D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bbdf88883a2a410ca8982f5a118d231877a0560a282de686a0dd80b355c5103a
MD5 6345cea331f13293ca0f410fa42b9d37
SHA1 9e75e47f3d643fe031279fa093b0c687d30b65f2
SHA512 1878dc430b6defa7daf01a598f286405d18e93cb577fd2399d07d5204ec63a1367ade9eac222fe07563c29158abc06f35929b593110d97e7725ff54fec10a25d
SSDEEP 49152:m1hpsNoJpF1A63U44CwH7R4xBhe30jaNf1TWbdz:mmifPWRYU023W
TLSH
T1C9B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bef4fda9ca017a2e209fe72bfdec234cd013c378ace9b43c9e4b9b2013fcbd48
MD5 59d4dc486f5cf9c6b1c49ea0b741c170
SHA1 d269ea14e3443634e8a12b4fd37d74bc4262b02e
SHA512 932c188afbe96f4ea36b4614517e74c3576fc2f13e2b1f389a1149cf8f6752ab0ba205c79c5056969628db00d4d254a9927ec9491b8b99aad26c3a5ab210b869
SSDEEP 49152:LSuZQIY0Be2KcRVtOnks6NMHquhe30jaNf1TWbdz:Z5dKii61SU023W
TLSH
T1C7C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d385453c6117d8a4612b8654a0c839f7825563b1ae2e3859dbbb53823ed66969
MD5 4170f6766d56a21c6596b65f3a58ee76
SHA1 a52d8964221cff162cd8256c5ca2f68feb26522d
SHA512 1c23dd22c50da946d90d831f4e8a9bfa66e99c6179d87864d2fd763c16b968e5cb2c51cc91543597f7ce7b95a285d57a8cb098693aa747a9445aefbdcd27064d
SSDEEP 49152:XhtSn8EApI0fig3giDn0AP5wdhe30jaNf1TWbdz:GX2imphcU023W
TLSH
T1E895BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 f534150d72a1c23c0aabac1004aa48730125665dbe5cc74e80feae183b27a1e0
MD5 c10d29e21be4d08acd796b4ec2074c3c
SHA1 3881262724f57f0aed086890d9f6d0b4a463c5b3
SHA512 7e2358d94f43ed5fb628a8bf0bb79fad72fb55a6e9e6f54017a7edfd49d54fa2673f5ffaae69370cbe30c4cd0cc7f42b07033d08493e4dd1da63d6bc342e7655
SSDEEP 12288:j6B0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:j6ugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T175C423A19E550ACAE34FC3F0D0F787D1E9E01EC672404D6B57E0B5631ABCCDA6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 418a0f988dc804653cbb867782ecd321eb4ce02e7e14b82cbffc55c3cdea715e
MD5 cb0ac3ec88353ca3ed7d5277476b2608
SHA1 fe3c865ea1de6b80564a3141e2c125396f797880
SHA512 8559474e740c2c3d8849dfdbaab26b87b1af29e87a970ce95a142a624f8bb90362aecabc98bcf0ee6af88245588f63edd1814bfe88cfe130639247e193b16293
SSDEEP 12288:ETB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ETugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BEC423A1AE5509CAE34FC3F0D0F787D1E9A01FC672404E6B57E0F95319BCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 7df681df9b9ec08b46bc83e777aa1ab9a5e78d064dd7f17ea7184fe001187182
MD5 f01144523a9a7e8fc89711563602f5e1
SHA1 7dc80f350ef066206ecafbf2677b577852b53a61
SHA512 e9f5254e61e17b095fc4bfb6b7cb4a6f19e024fb46ce5654995e51e1d67879337c23871be86f65698c1654086b54307a10c0d766aa232b208696576d0fb9ae10
SSDEEP 12288:ZZB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ZZugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F5C423A19E5509CAE34FC3F0D0F787D1E9E01EC672404E6B57E0B95319BCCDA6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 0900414655d3d2334ccd773d4814bbf93c54aecf5dcfbb3bf431f909e79974c9
MD5 8ab8bc149212d7135c8177927ced28b0
SHA1 ab3b870b11e89a9ea6b6be28b08dcfe184022b79
SHA512 2e5fce1ef2baaa0e1a5900dc869bfdc35894575902cc3788d0d7004fd93c76c275632727c120347059a82234314202ad03e79e5e247c8cf486733a26e90fe18a
SSDEEP 12288:DVoB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:2ugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T111D423926F5905C6E18BC3F4C0F38791E6F13DC173118BAF47D069530EB8AD96EA4A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 fab076cff2ed259b218ff1ba313dfbe1a7e0ab6021e909877e20121704a82083
MD5 af181cb047b28b344caa97d146d58408
SHA1 413c3be1511fe472dd07de7e16676e82324b2cf2
SHA512 9b3a3d0990dad700caf57b21a8b1b7a58e7baf8e7d5b7c1a5f9ecc931952b4418ca8f2d2f07be71c568085ef4262bb6bf219c146a5a1fa541da8a382637262b4
SSDEEP 12288:kwB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:kwugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E7C42391AE5509CAE24FC3F0D0F787D1E9E01FC672404E6B57E0B9531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 83d88d1797d2ae0d01a6a1aa7c9201476bd5d459eedda5d3377343370273405a
MD5 5b31eebf83eaa0d2086935764ba1ec56
SHA1 82d62a3900c131efcd12dd45f143333fb88a8133
SHA512 6d28c4821c9a39fa7eba24c8de571774d3ce0f1633654c7717f67159606b695babbeb2941665ca95e79b300721dce3e8ebd1a9ea4d779025abc3c6e3a04a8c82
SSDEEP 12288:OvB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:OvugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B3C423A1AE5509CAE34FC3F0D0F787D1E9A01FC672404A6B57E0F95319BCC9A6AD846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 7082c6937b22fd499f84240672581c278568bb60bcb07de1ec784abb71500ca4
MD5 8fff0ee60fad3486975b7e93a9a045b2
SHA1 2979761b2d99cf7a230963a90cf3a2a74d2ccd48
SHA512 ea14817f767c39a810037bfba9f845628228c0aa1df88a3bb05dfeb87b0af06325ade13ecb166470102942fcf3d29ec740bd60aa95b5f3d304a8c62eed937d7f
SSDEEP 12288:P7B0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:P7ugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T104C423A19E5509CAE34FC3F0D0F787D1E9E01FC672444E6B57E0F9531ABCC9A6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 55c634dae5873fde664ac08fae4ac07737412471df1aab15ec60d5e0235dc5cc
MD5 09f986f76daa267bde705b389dbc4af6
SHA1 699681f8a837978a5ec30935741c04878b275fec
SHA512 5f79adf59f94d9f0850d1f68bf8e2da2c1dbde473b1bbb3b700d544a73496ae785514d108ab33cfa6d22c3afd6362ec596038b35ddcaa9522cf08bad89cd8424
SSDEEP 24576:EZMRzFVSOzugXe4i7ojhsP5Lgrk1TWb4AN5:EZMRzf/he30jaNf1TWbdz
TLSH
T188050295B3900CF8ED67827DC8A68A02D6B27C561760CA1F03E436671F773A11D3DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 428f0d6685d98cd8d2ca5027871f957096c13bf414124760251129048fa93258
MD5 008a599abb0d8705b5b5cb6ced90e7d4
SHA1 63fa172d8791f4827a7a80b58ea00496762cf383
SHA512 3485672277117bca1db35d29599b48159a08ea255e723a95f48c569cdb25110b9c00396f5a6e93df91808ced8419c10de04e18054e6d6e9dbbea55021b19f659
SSDEEP 12288:Q+B0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Q+ugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T106C42392AE5509CAE34FC3F0D0F787D1E9E01FC672404E6B57E0B95319BCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 b5aa734318853e28efbc9b28d47f5b5601689da65bd8dd87773306bc1cb1abe7
MD5 2c250b5f6f90e7046059872f9d73bd09
SHA1 d3407727ddc92bd440fde4f824ae816f78b6d172
SHA512 65bc60700a3b1530a999db7d1cf2f385e7dfb66d598650bb55af6ff6dedb2f16f41bf593078d433d0947b490121300d2d7b3e1867f6288f0bab8fd764f209541
SSDEEP 12288:xSB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:xSugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12AC42392AE5509CAE34FC3F4D0F787D1E9A01FC672404E6B57E0F95319BCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 5c4cc6f489e54d0b912423207beb95fce1739290d6227b03dc4a11a618c598dd
MD5 b3b365a99493af3e33a0089da65e6f22
SHA1 fb9ccef7b9eccd002b6e50a684cc6e8e14149dd6
SHA512 f44ed6cc4e855d1c01d211071cdfc49c202c9d65331b53019029776641cc989be5291f22f415227fa8256f1f9a2263a1af45f60b459dc3a2cfd9266a70fca8a0
SSDEEP 12288:0yPz5L8HB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:tzyHugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E1F4025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 d654eda6392e22c6b9f944dc046e38d4fe876894b09048a04c9d67460b5bb60c
MD5 ddaff24a89365194aa57c50b38a6a38d
SHA1 a7704933d467d9037637e2a196635b4f3cbd15fa
SHA512 d4347679be406d9d85f2f7de994a290805739a81dcd5aab95f42c28f4fa77a2c4a8a6debb456ecd1c7229329d092d2f5b1c90eaccd11fb7da8ad3f4fd10d151a
SSDEEP 12288:b+B0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:b+ugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T174C42392AE5509CAE34FC3F4D0F787D1E8E01FC672404E6B57E0B95319BCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 0e4d1c6e9c1cd3d0d138a047790e8e3b8a035865fde624aacdfbfcaab89521ee
MD5 8b51680b4fded56cf8c4e5ad8b812079
SHA1 690c5dab88726bcea6a2276178be203a49456ac5
SHA512 862990aa4173cb781eee8713c424bc9c4b372053b17a1b65002f55d92e784abac05a5ef71b90ca4e9cf1c5a015142710af4f0a3dd6496f5f0650fe0f17f0d3b8
SSDEEP 12288:v+B0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:v+ugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T113C423A1AE5509CAE34FC3F4D0E787D1E8E01FC672404E6B57E0B9531DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 4db68726d904558e07f4dc4a2607b1850ebefb2f4b8e2920bd66709ca2185f6f
MD5 652fd43d2abc34cfd8a7526436df33a0
SHA1 d2db8624fd3273df4d0203ec64fb738dbafcbf2b
SHA512 3c0a1d8617b5d67fa5461f6fd3cc596f714ece77fed9c4ec3392888757e53e8f4d62d1a80f1abada9029d044ca238ff93a01099f6e7329c50c43009cdc53a430
SSDEEP 12288:+yPz5L8HB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:jzyHugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19CF4025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 67803756d7d81713745e9adad62eaa95d24947ee685abb8cdcda75a1743083b9
MD5 beb5793f9d2e7e6f30dd1a9280570c8a
SHA1 bd38afcacc1c430729b73c134127a36f395b2b6b
SHA512 6e35d991fce181f91c5add6c8cc15cb5c80c3fb5d441e9a67cf5efffefe903091251b3e91e08a88e0353757c1078d19b815a91ef5e7c97e9fe10af223eb972ff
SSDEEP 24576:xTDaLl3z0zDJugXe4i7ojhsP5Lgrk1TWb4AN5:xTuLljkhe30jaNf1TWbdz
TLSH
T1660502A5B3500CF8ED67827EC8A68A02D6F27C560760CA1F03E436675F773A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 3534c7af738379700f25fc221bd077c54b28fd43727aa74ed2fcb51ab8665ebf
MD5 140a129a2d33f29ad63e714e659f95fd
SHA1 3f4d60d126fe7542c0422e86d50150f33bd98a68
SHA512 535ff62cbfdd05aab893ead4629b8133c4ddf18fc546b7ac5c7b2b0e485b4adb670611c1913db20ac09c17885ea4527a6eee42b3cff244de49a5a8827ac72d71
SSDEEP 24576:V3vd9CHKy7GZVugXe4i7ojhsP5Lgrk1TWb4AN5:1vd9CHKya/he30jaNf1TWbdz
TLSH
T1CF25CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 72b6396036b85d5cd2ac78d674c0d9323e32495c1af23fa4e9223bb9f61c058c
MD5 1f5027f5fd3d02efbeefa57895906f79
SHA1 58c951563ebc5ed61d883f8789fa9a32570ed16a
SHA512 b450210617ee230f994d3a48d56bc7b60916c92b7c48c77caf840fae7a94ec8f3ab921e8479c9c96aa9cddf56c9e4b8f503b1a9ecd5a68ce151fe43811a1a477
SSDEEP 12288:E5B0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:E5ugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F1C423A1AE5509CAE34FC3F0D0F787D1E9E01EC672404D6B57E0B95319BCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 39383e3aa1ba29e78c1b2ae601f077349ab5460d9903851ec903a033c61f2fc2
MD5 43ce811608e3d1a89e5edfa9920ee5c6
SHA1 7cd147003a38d70c6b9eced82113226308526715
SHA512 9f719cf1c63a3f28ea99e541a0ed7cf3aa7df7d91ac527533a2cd93b3087cda885114aae8f83412712607f4cf9fcb79dde1f59ca3c46dfd9b7df3be3826edea0
SSDEEP 12288:YnB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:YnugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T118C423A1AE5509CAE24FC3F0D0F787D1E9E01FC672404E6B57E0B95319BCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 86a7a016a489b93ae09d4bec3e42ef18490d67aa7dc976a8ea311a7b8b8c1f67
MD5 26404e8bc8aaf03f8fb35c481b70e7e6
SHA1 377edeb88fecd0e7f4e2bf72b91e1040018f1ea1
SHA512 f58a590665cb9c28b0cdc90fc8792eb40950395269c9e3a2d0ab3fc63b72e38823126840e797e4971b6ac9e1d494e677aa4adf4be3976515fe130351bda4a763
SSDEEP 12288:cMB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:cMugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C9C423A1AE5509CAE24FC3F4D0E787D1E8E01FC672404E6B57E0B9531DBCC9A6AD846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 3a93731ceaff67445f307755c3db98ea9d2451017ef221984a98642ae5b7951e
MD5 9ba3161ec474da99bf2edd8bd3bbdfde
SHA1 d6a54be8e0cefe78e90f1185a32f7826341a72b4
SHA512 d5e9321612d47493a7b28d14ce6095fe54ee6fcf2389d23a21cec7e32934789a109b6407c8c5d54c6212fbd8986e31138d46ebb5798bd0cbfae2d0bb69d8c01a
SSDEEP 12288:1+B0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:1+ugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13EC423A1AE5509CAE34FC3F0D0E787D1E9E01FC672404E6B57E0B9531DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 15191a82b756bc6ade89cd9ba6f8aad10b980ef7ab112cc69a1fe3948a1f11ab
MD5 1725b33d0ee200287908954400456b28
SHA1 3bff102c06fac1f69b505ca053e6fb9f0d79f87e
SHA512 e42e3c03a43850a33f31b4983f863ba5cf4768cdbef213555c80f515e9424a85f6d790e92c808e7a421699c71e19c10c11c4a23939449ce10e93e43774d38c43
SSDEEP 12288:d5B0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:d5ugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T168C423A1AE5509CAE24FC3F0D0F787D1E9E01EC672404E6B57E0B5531DBCC9A6AD84AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 29e515efad1358f1bd37bf4af6657d65ec315a88690e5bb04dc892fabe524c09
MD5 ae4c2a92b2a627ec39e9ca3b7ad7c51c
SHA1 b0c4984f5609449ee0f30ac68df833a13e2db5b6
SHA512 7fbe02d75ba124b4637e34c989a61a4259fe269f80c0363539181eff3ff8e7035dc07f8eac98469f9f21993d41125aed039279312f73e819ce451587951adff8
SSDEEP 12288:9GB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:9GugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17CC423919E5509CAE34FC3F0D0E787D1E9E01FC672414E6B57E0B9531ABCC9A5AC846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 7eb9ef5d0b95a6310ee75449382a773a43e35971e92c30f5cef166a6bd8008d2
MD5 df0305f285697f87eb6dc39b51ae925a
SHA1 3d9bea29254f0e608f57c7fe61c38f25e38045c5
SHA512 41ccbe997dd516acf5ac99b0c76d793dcbf9e2e8c005984bb9c6145a214969f5a4085e4123de06d6c5d976205abf6705b4d151f8e95dd63c2cfa348423b4bb6c
SSDEEP 12288:IwB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:IwugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F8C423A1AE5509CAE24FC3F0D0F787D1E9E01EC672404E6F57E0B5531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 eeb135d8dc24c31c0a11b91eac819c891d7e3846a5db1ffc8d948922377c78a8
MD5 bdf8b9436ef504748bb631310da41704
SHA1 3de62edbfc5dd14478c057bc4cb63d12e2906b09
SHA512 f975f808dc814ce1e61376955bc1f58cc02edbec76831eed147915b4e8472da21a61e42542424fc567cdcb0a61747b6207bf209a9b22dd31d22e10747f23aa48
SSDEEP 24576:4fwvUk9RX6wkyAIiugXe4i7ojhsP5Lgrk1TWb4AN5:sMnYIihe30jaNf1TWbdz
TLSH
T1EB35DF29EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 202a8598a40acd22ef2801587573d1056ac47c08f509feac7b17a79556d22ebb
MD5 b941479466d29b45c0463d195f612737
SHA1 c27715fe7c78a340b8b57135f3655b726e24725c
SHA512 a2b78d01c5aa05740cd042a39b8b6b53499f1a6b75cb40626031782ac11179f6e0918866a648545dbdf4a81905d4b4ae9223e92cb4ea46240950e5e32a1a1854
SSDEEP 49152:gYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK09he30jaNf1TWF:nySzPTU023W
TLSH
T1AF067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a41a772e08001f11a34a32b0422c57aa9aa3b1690e233072cd89119132f7dfc9
MD5 9aac181b300b1e8039b1a675ce843d0d
SHA1 e219c474f4346f77356c786b23514a95170937ad
SHA512 2fb550b41017d0f581e94a639e707b4ef7a7f5960a207ebed2721fdc37c4efb8ede5ba38bd790c2ffe8255bb7c3289c90e113c2cee9597718c1b151049a64808
SSDEEP 24576:N47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYDugXe4i7ojhsP5Lgrk1TWb4AN5:N47JUQjTirIhCnDHUPfF/Nhe30jaNf1q
TLSH
T1CF65AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 90c74a95c0d4d3462962f70ee5506b3713c98226a5a8263df562883c5ac8bae7
MD5 e9812fe25a54d0c8d11016a00822af18
SHA1 b160cb5cd6ce20228a8bf2b8cd8cea0686ed62f3
SHA512 1202e589d39452c5992b8db47d258a240fa201db238c2f1a6c12b0b0096e0fd7ade0561392e1ee12b89282aa50e8ac1ae81dfb60207f429fcd219e34c102a724
SSDEEP 12288:6bsfuB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:RuugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T186E4F15AD29802D8D05E92B5C3968A81F3733C5193E1C7CB13D0F93E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 7e94e62195d4b4b5a643a07756c1524b9ac71164a8d25699d4677ff99fec4897
MD5 a43fb213640c2350012f1e2b20d7734a
SHA1 7ff7ddddfa2edaf56feb392be47a273f7eb57e61
SHA512 0cbe2acfd278b0b5de03eb466adda48727b01945c121d28fcce97f233757a8a93d36dc2b974d716cdc7c7f8b6ab5a90bd415a18b79ee1c109b79eda7679d0275
SSDEEP 12288:VYcPCU3fZj2g4K4HMzT2wSAQ/VvG64Tn2OzXc7Et17a/10z2:VYcaUPlmcQ/VP4b2sXc7m1aiz2
TLSH
T123450740762BD78FC6A940325E36D6CCA7707D01EE05AF0773C9873F9476668BAE5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 c8503c31ff255cabf01f6e8066c13bd028617cec025777e91f14813c7ac88186
MD5 3532e3d18284a6c829d59d4a5b833fe3
SHA1 d355b5242a29c1888ff52f80b2e7371058eee5f9
SHA512 2fd46572c3c6b3b6590791810d12e592f64e9403748f918ed2ecb99839c6ef37cb91385415291774506467cfe53b847e123355163c02e7c57a23de89fbc20d0f
SSDEEP 12288:FqEmAeGhf6gotxhu4duRZ1w2aGQK4HMzy3Y47I2vE9webqUfm81V:FqEm5ISXLzOG3lRM5JV
TLSH
T1CC552A4069A7E35FC9BD90374232868DBBB45C02BB453F0573448A3C9867A7EB5E63D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 15c5babfee006dd4a4fa90407944a3ebfafdcc06d888ffa6530a8e86c1743dda
MD5 2ec02c8450efeb1def4a0ec8f64d45e0
SHA1 0c004f4f17c35596575a84d50beca9064d23db7c
SHA512 b6c37202946e0e099770ed2ff75e1af75b0acdca2b897e6e9abbe673ae6ab7f8ee21c54c7d7bac9f3957f59a22180bbad93e91f6c9fbf58d2d4fd5fff6653e82
SSDEEP 12288:s072B0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:R2ugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C5D423629B580DC6F29FC3F090FBC760F5653EC1270089EB96D0B69319B8CD99EB4519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 265f2627278980e6f4d0699cbd1af1ee9c02af7da2976934a38ec30f6c68dc7d
MD5 25d45f40430ea27535ea0926365ea51d
SHA1 5e429a965b7839cf2f139c0844de423eda2f2134
SHA512 be4832a86b1cab2820d89b2277e72cf0ad904e9f3430d1034854fe348787e6a565e04175d4b8f008fdd1286956b8153572537f64cc5634014fcd2e711ece3621
SSDEEP 24576:ogb6bmBIi49WNNFpg1rSvFv7bYkugXe4i7ojhsP5Lgrk1TWb4AN5:ogb4mBIBhGFDhe30jaNf1TWbdz
TLSH
T1A565AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 29e553b8947190debf4c023779c48f76903c2e49d2f5574122013d52e92f057d
MD5 8db162128e5eba52215c3e3167c9faf5
SHA1 454bec91754f53eb1ae0b353003a9be8077b298d
SHA512 4ba0dc4b1867c000256acb36576bb81b6b2f11714196059fcab03f3a32cd46dc504c915416c61e205b2570727653d9a9e5a94b3cb560698525ac7acbafa0b1b4
SSDEEP 24576:wG88u8FpJqH1bzria7/mzugXe4i7ojhsP5Lgrk1TWb4AN5:j7ZFPqVea7/she30jaNf1TWbdz
TLSH
T1A135F16577E101F1D07BD138898246A3F6B2B8151364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 0bcc572b48b42a55fac339a6c9c03051a79ee1776bafdb05f2a8366e65b5ceea
MD5 5db1ed992ea53aad016476e21aba5a42
SHA1 078b1d7673c0a9a573b6d66734e7946d0170d0f2
SHA512 7b9a92feca32f578f2d71e1c1b50e2824b9ef6f27dcde142e345cb3557abbf7a973624ada4163db754d446b79ce00c690ee7709c2566e85bd601943478bae24f
SSDEEP 49152:9BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvhe30jaNf1TWbdz:GG05lO43buU023W
TLSH
T172D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 250cbcd750dcbe939c9a7cc5ddc4d36075b1471c15e98061ac5cc9a3aca396ca
MD5 348956d76eba90388c6d54b3260d805a
SHA1 8893c1afbf546a95837daae1addb29a5f98df64b
SHA512 31038787310f99096a929760274def7f7c75fd6c68967b46c679f0e9648bc36358fbed7578756095f8922e5ea502432ce3ef8b34361640a5e963e7bbfe72e2f8
SSDEEP 24576:6fa5POZ3dpuWVM50JicR2hG0lasx2+47eidn9ugXe4i7ojhsP5Lgrk1TWb4AN5:Sa5POZ3BJt2pasx2+mnhe30jaNf1TWbp
TLSH
T1FB65AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 cb967e9f90ae4592006eef294a553fc609e943e11e9a835891d390b740709297
MD5 12ab3d97f465e46c281dfaf483f3348a
SHA1 82e119c6c5fd41d23dbab6e7eb7f305746050b37
SHA512 04b0d23e5149cfb3266bcfd6da9513ca501792a6f90ce72f588c59ea943fe5320a77b26da342c3c1852ed67cd5d4e34430b7bb32241837dbee96a1e662777919
SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7FkrugXe4i7ojhsP5Lgrk1TWb4AN5:NNc/zEOVHFMhe30jaNf1TWbdz
TLSH
T114858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 129dfea8b6ab19f888dd76f25fe62c342e61a74064c07ef1237fc135a5eaaeb5
MD5 c0908e34bfbb0b1f7996263c25a5312a
SHA1 ea9efbd327317b7e0aa8862b8db8a14c4c61f315
SHA512 af9cacecee5b24f490f1ec588c7050f2c97710e12475fa40d391870e1993aa8205db4769ceb8b2a90c38231d17501dc46a9db1dff464496a0e4d49872a388129
SSDEEP 24576:iTkNvNnaFeYhJNtmZBmxugXe4i7ojhsP5Lgrk1TWb4AN5:iTMwBtOmxhe30jaNf1TWbdz
TLSH
T14455AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 5f4e4960e843d13624a3eb461419552f2621b413e469ea3943e639d243c97f46
MD5 5852236e4a3cbfad4a8aa94e02a61d15
SHA1 7f94349645525b5d290dbc1ef7410f8924483374
SHA512 3454a9aaf7138762eafc98b3ae9ffccffd507fb6f191770eed431afc998f836763eeac6ae86b370a5da6b46146d6d91994ea3656f59b18a3eaa968ddc1bef875
SSDEEP 24576:/PUr+NQ/ugXe4i7ojhsP5Lgrk1TWb4AN5:/JQ/he30jaNf1TWbdz
TLSH
T10B05E12F66A818E5E27AE17C85828719F7717852131196DF02E0817E4F77EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 b48ec500e767056aac93c40632fc187dc9bdf52f149694e00f83f6986b734797
MD5 9eaa95e5e8ec03bca17b6dd49d4e2206
SHA1 e11c4177cb86275d0077e04b335c302734525302
SHA512 40187913f748ef2a3381aecd5a8a94c85d96a0281b3252cccd796795d70a4cc2106a89b2c6961803f6663009f320f599ce8c34c9b12a89860811819067b4247c
SSDEEP 24576:5D3FHshBIYQgAaugXe4i7ojhsP5Lgrk1TWb4AN5:5DVHeBIAAahe30jaNf1TWbdz
TLSH
T12025E17DEA5C04E4E57BC2BCD6A38A06E77138A9032156DB02D0D1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1164-88-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1164-323-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1164-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1164-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1164-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1164-82-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1580-306-0x0000000000770000-0x00000000009B1000-memory.dmp

Download

memory/1580-117-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1580-24-0x0000000000AF0000-0x0000000000B50000-memory.dmp

Download

memory/1580-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1580-16-0x0000000000AF0000-0x0000000000B50000-memory.dmp

Download

memory/2124-302-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2124-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2360-130-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2360-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2360-125-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2360-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2360-119-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3372-141-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3372-135-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3372-134-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3372-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3396-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3396-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3396-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3396-159-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3628-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3628-61-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3628-55-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3628-270-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4380-305-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4380-106-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4380-116-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4380-112-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4396-40-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/4396-46-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/4396-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4396-50-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/4396-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4892-67-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4892-73-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4892-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4892-287-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5156-9-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5156-0-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5156-8-0x0000000140000000-0x0000000140410000-memory.dmp

Download

memory/5156-80-0x0000000140000000-0x0000000140410000-memory.dmp

Download

memory/5356-100-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5356-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5356-307-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5356-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5356-94-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5356-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download