6b4aa840c445d86e08c9db53b9f10345c261a2009b738668a5c5998fe9e6d1cd

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 3.8MB
Sample260920-xtbc1szzax
SHA256 6b4aa840c445d86e08c9db53b9f10345c261a2009b738668a5c5998fe9e6d1cd
MD5 797204c8ab2b199184fcf06b60b5626d
SHA1 d961a5bdc3bfcae55135004b26f8aa92e7116f43
SHA512 7e2d19aff183a551c3a1477fa21488d247f1596416942ae7ccb3f41640f177472e493723ce147823114e6ac02d22bcedc2659ffd3824e986e60cbfbfe9c00d8f
SSDEEP 49152:c1g15A610nCjvLEt9sVZVGB9D2Of4HQOYnOKZUmvnMGAv+e/WI9yxUeT+uXEkjNL:cNUA0ZunZhrqa+uUkjDBHLp6D527BWG
TLSH
T1B406AE1A97E806ACE0F7C279CED5C553EB76780D07B0A69F06909CA64F732608E79713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5984	elevation_service.exe
5544	elevation_service.exe
5100	maintenanceservice.exe
1208	OSE.EXE
4632	PerceptionSimulationService.exe
6100	perfhost.exe
820	ReFsDedupSvc.exe
2124	SensorDataService.exe
704	ssh-agent.exe
1952	AgentService.exe
1772	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d64ac0ceb68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4a37e723349dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074cdb0b23349dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f68a1b23349dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007410de703349dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf5f13723349dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b833ff713349dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008575b7723349dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	1952	AgentService.exe
Token: SeBackupPrivilege	820	ReFsDedupSvc.exe
Token: SeRestorePrivilege	820	ReFsDedupSvc.exe
Token: SeBackupPrivilege	820	ReFsDedupSvc.exe
Token: SeRestorePrivilege	820	ReFsDedupSvc.exe
Token: SeBackupPrivilege	820	ReFsDedupSvc.exe
Token: SeRestorePrivilege	820	ReFsDedupSvc.exe
Token: SeBackupPrivilege	820	ReFsDedupSvc.exe
Token: SeRestorePrivilege	820	ReFsDedupSvc.exe
Token: SeBackupPrivilege	820	ReFsDedupSvc.exe
Token: SeRestorePrivilege	820	ReFsDedupSvc.exe
Token: 33	1772	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1772	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1772	SearchIndexer.exe
Token: SeDebugPrivilege	4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4920	2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5984	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 5024	1772	SearchIndexer.exe	103
PID 1772 wrote to memory of 5624	1772	SearchIndexer.exe	104
PID 1772 wrote to memory of 4348	1772	SearchIndexer.exe	106
PID 1772 wrote to memory of 4464	1772	SearchIndexer.exe	107
PID 1772 wrote to memory of 2600	1772	SearchIndexer.exe	109
PID 1772 wrote to memory of 1416	1772	SearchIndexer.exe	110
PID 1772 wrote to memory of 3688	1772	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-20_797204c8ab2b199184fcf06b60b5626d_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4920

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5544

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5100

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1208

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4632

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6100

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:820

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2124

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:704

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1952

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5024
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5624
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2748 2760 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4348
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4464
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2600
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2748 2760 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1416
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bedb9e03c43a0e7fb4bd35ff5a18c434c6d47d4f3031136283ab8cb4d01855ca
MD5 b3f0234f7e8907df00dd7c14ff848fcc
SHA1 3d14afc473d4fdce9e18b56f71404a04944fd24a
SHA512 554fe4b9983258eacf14c55ffec041bfdc32daec749246cea61568b19e06446451c267180541accd972e4d64a452815e5227df26829d5c905796a86e787cadcd
SSDEEP 49152:ob+632BuPkFKRrdE6ohmstBhuXjfS4LWxnJDmg27RnWGj:C3q6HjByD527BWG
TLSH
T17CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 7dda18c022e729fa13f8f5847631f3f793ecdb4a0c8f637c0656c4581ef158a9
MD5 7ce71a5341c5ee941058c0eced31ac80
SHA1 8d32530f5b1210ff793430b2cda70d4c212912c6
SHA512 55c8ab895b254ac4443590fee5f55316ce8c018a779e485cf01623f9a7160db638f63bb74d54c95d0625e88f463ef1121f1ddc0bad96fed271210feeb8d16e4a
SSDEEP 24576:sXYfDtczASsqjnhMgeiCl7G0nehbGZpbD:LtczDmg27RnWGj
TLSH
T175650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 c11fe80f190ef25b351d879aaf3ea5ff6bef2b3a1cd039970dafd36383d817f2
MD5 94d5559cb57cd5ea5a2581f560495a95
SHA1 775ba273c4d26e606c2b19bbd5a9ac5be495b88f
SHA512 0866158478f090e2797a9c955775e3c18c3032b7daab65d4aae7eaa6e98dc2fe9a6180464ca2aba574c3b4375302338fd155bdf43d22bd5c24b38c1ab47ae6f9
SSDEEP 24576:40Le5ji0hmxirM9sqjnhMgeiCl7G0nehbGZpbD:4Pji0Ac0Dmg27RnWGj
TLSH
T12C859E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9f62e48686e3b351a2a141e05cf1c9a712b9b58232e05ddd27d665abfc095b05
MD5 3c527c088d941af8f11b6e471222da05
SHA1 de964b966ad60cb959299a659bedf1a1b8931e7d
SHA512 4c9185487d074c722eded72a9f9681d973451d76397d128f071073d048fa3f4dba03b47026772f2ab972214e082b1c5cbd56fdbd536c699dfba43b4d3634746d
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWE6q8wyufsqjnhMgeiCl7G0nehbGZpbD:+/ezSC6vUzPvxHjyYDmg27RnWGj
TLSH
T1DB755C25F5788323D0B2D0BAC5D6BA9AFD7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 84ddafd3ab7a8fc9fad62239ec7389542736b2ce377541dd3992016b4df47061
MD5 e7f458d303259630b9062cf0f9da925d
SHA1 801c0b39f8f7f0f418769721dcb2633b92005cfc
SHA512 f2a0a6558307bcc139b12e4f6fa6b9e9738c35d8284bd1f6d4ac7bcc1ccc056ebca17bbf5872593a1893c5d47314ef1257d88b3161dbfa5cb4a949553fbe6f23
SSDEEP 24576:0VbqPb88hv/l+6usqjnhMgeiCl7G0nehbGZpbD:0VO88hXl+FDmg27RnWGj
TLSH
T130559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8bd0c4007aade82a4f547257c7733e1e41f0299572c4141005fe9e000b2476aa
MD5 1c6e28734e2f44cd4d8c9818a099b0df
SHA1 69f41f8cdf5435476860b130fc197ad4a147809c
SHA512 5b40b7087999e902d29623663785abbdf438b226e4bc0c0a00a7295fb373e08a0e211f902e491ac189b801b91556d5f801aa917fee34062cdc1c34d4a3228b13
SSDEEP 12288:nRpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nRpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BD4523BE834C10CAEB7749B5C3E9F15EAC177D66982008426A637DFEE6B5454CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 1b3942984bfb4a2e4385a6a1a6a48a3ad8dc6208ff9a298be832514ee06f67f5
MD5 f809d0be66021b562e9b12adf30722c4
SHA1 5c35573cbb838cef82cf6d7122c3d7866509b0db
SHA512 bad32faf07173d95c5c65e84fbb4d33debb5ba978d14cc1bca932a3c9a676f8e5907e06a20588ac94b96a1d3d2e40114c9061f4e9bb8a13fff0b26e7e5b7ad6f
SSDEEP 12288:zeBNUbTVO86U2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:zJIU2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E765CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 474f59b38cf18ea3a000cf0d0ad23961786b7dc372091b50a29d1796c3a8c2d2
MD5 09c0229141826209a021e01953adbc9c
SHA1 4f4c3b5f71c01e67e83ccb0d18d16c3db3d92f5d
SHA512 cd17fbdf7c990df0d7116e984393d61ba2da24ab1b862cb7796d3b36ea1f39f2dfaad516a75d23c4be92d1d54cf014eec5dd5f737f6a1d50a5d7d2cf8a7293fc
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THx:rQvGAdlCEL8c/yRNw5CTD527BWG
TLSH
T156266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 eab4d2b9082cfa1d00d86994e5ad0fd5eae2c96e0bbf9d48986b3b8a696717d1
MD5 6035a672e1afadd574bfe24bfd6b14dc
SHA1 b5c020a372ba6234f3ae9fbb0540f84ca73c93c6
SHA512 f0c05a100f66a1954e7982720dd659034ef45398d0123eaa85629b44a3508bd66c62faee629ca82c5521ddcb241bc9baec2640115f8ab4edb1862fe86fc4dba9
SSDEEP 12288:pAwSfxL/2Dc34DLLmt0LDQewsAjYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:adewsAjYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E175E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2781f98df74c68f111356f73bd5a65dd8a0cdedf1dc00485e7c3ad534f43d5f0
MD5 5040f222e30e3ed4df9416ccf5a23b03
SHA1 6aa81b0420cac2468ab7e8dbf01382cf2e4c0be8
SHA512 2eade770bd0ee4320ad57d7a8b133fa0c9c89d98b7f1e3c73e077e59fd3d59e4d84b17c6a4b6a89526814cee557a48da67c3a094f23d097b553bd46ba4700359
SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHMVQBWG:zUEtQevvqc2W1cpV2EI32TB
TLSH
T1E1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9ced8e4fdf0b9c6eb3af0c2df8b30bbffc7e6e5ec69fecd9ddc692fc2fc0d1bb
MD5 d6bce1997a97adf082bcfccb59fa6b9b
SHA1 98dc00df77bbc6941e3a07e4433b2fa259dee6bd
SHA512 484f64e7fd708239da1bb098e4941e86115f32a7c97ba16f34d4e1ebd9dd375d89399b392edd7a3c834271eea10bb6aeb4753fd5fbef2a4d8f2a7b6ac29de75f
SSDEEP 49152:KCbRquA/m2yL5zQfFiV+XenmE3/zkDmg27RnWGj:/oqtVjnmHD527BWG
TLSH
T110D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3e013b466e15975781c8ae2bf6fe60ba4753d55a28ec5c94e3a4ec8e1e2fc78a
MD5 7991a7fd45b4d739b74a4ab9f3a93a9f
SHA1 a6f7f7420f8c9bfbe49cdf9cb58e63d99f163875
SHA512 2ed23f96888fc04e7583ae03b9919a137204068f628b3bb6d8e3de80173e2b85a1631c7c046d21ab2e115e5e00a9d0fe85eab07fae2408162293f2490951fa77
SSDEEP 24576:+AhGLJIFoiwtA5l7S53jsqjnhMgeiCl7G0nehbGZpbD:+AMyFoiq5XDmg27RnWGj
TLSH
T1AD359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 9ea4bc90d007c7715adef62d8d6f461a04981255b93d64ee10278d254339ea64
MD5 63f0bcdab0ae09120bb985fb9fb934fd
SHA1 7d36d0e412b74413b76d93d9cdaf98359d2ac440
SHA512 caab3df7efbaf1f3bc76d1d276d72a85c4821e8b2538afff54ce94e3bd3da345885312af233de19ec8bf513dc1b6b12910a92b498ca779270ef46d135f3c6533
SSDEEP 12288:Bmw5HEjsChNVBFgl0WDm+C/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:cwuoOWMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16D65F15A72A80CF9E9674539C697D136F7B3BC122A20DB1F1760C65B6F33250AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b5c79342c1395426e84caf8555665edb61c052d83c54478507f975acbc1c4e2d
MD5 dac54316265b4de071bcb6f62e25419d
SHA1 6002b65376d319a1ece163f2dd2726f52dc1b1a1
SHA512 572502e9b3b3e5f02b8b59bdc995f5c435a044beb39d92cdcded84c9fb62222fed171f2655a25e8076d6319d41eec1c471709080a68cea5ea70947b7b7575941
SSDEEP 12288:8BZ1IyoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KZulsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D75512AE239820FAE167417CC6E5D609E7337C62673003CF166656AA6F739C44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0fdfe9c5c088ab425b0488e8220e8ae18c70771e70e09911aedb68ef65e8974d
MD5 333bc77326f846d308dbf8f128cc151a
SHA1 d001637e42daab3f15d1b30fb274ea3d9816fb7c
SHA512 216bf9bdb4b42ba210a4378dc9015cfd1e3176145242b76b5aad6835a84f1d9a2f3f984fe10febb5689e686aa85e93608bd2183681ae4bb5312d1a53f905432a
SSDEEP 98304:3QRQyi36YOcPQLvw2gAf+PN3OD527BWG:mQyiKayX+PN+VQBWG
TLSH
T1AD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0dac57e1c9beeb5d071e5da28483dee5eb425af15e5c3476378ab8e2046c2974
MD5 824713a08610231ca9d730233a8f44e3
SHA1 b0553a844831f843a271956d02a3070857f00754
SHA512 69943eeaacbca353c67d3c5d06cc5fc3b478cdad8baa7ff452ad917f0a7cf528190a4475d549ca04291bf9e287c5f87fc56982850ffc7dd4ddcf58683f1e15d0
SSDEEP 98304:qQRQyi36YOcPQLvw2gAf+PN3OD527BWG:BQyiKayX+PN+VQBWG
TLSH
T16C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9731a3d7bba4e1f672064618c46cb1adbc0596cad802a4ddeb2da3d0b222b358
MD5 6aa511665b7c4bd2442c383a52df8cc4
SHA1 bb4eec37736366948df416d8758e3b5c4c54604d
SHA512 59190952c5d0b34b994bbb91361d7b0276f3e7be53cf1c7ac4ad095b1858fca1fe14d52eb1f8749a7a20fcf81cd86898947c5c22629d7eb24ae9ffa6d50dabd9
SSDEEP 24576:owvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0VsqjnhMgeiCl7Ge:u68Qg55nhheWu7PNU3/0Dmg27RnWGj
TLSH
T140B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 081af88be08aa0bb1b19ac3273edf46a5d1c9b0583f9b5a2b37018801fd70e41
MD5 5c610e37e74aaeffdd7868c456e1f4bf
SHA1 8d71da60e2427d3cdf0915acca265a2212b945a2
SHA512 a90233549dcff42b9e3305c0dba585a793bd05c6ecf2da9c907afe8e5c0fd09e2e742363dae3db30c89dc4eee7ce590dbad328040e3ea45ed5815dd4af5c9770
SSDEEP 98304:Jy5112gYy5azzVvL69nLKnhZtD527BWG:kLIHmWhPVQBWG
TLSH
T176167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f8c06bb32897ed376af603482417cc2e87414b90eff056aa8d5460d9ef1a4013
MD5 656cdd4d186567489058f85a311b2e3b
SHA1 45ad63a0f68709fb3e6e98ff4ae27e1d3d4cce86
SHA512 5a3032ac286cb6eb123547455b18dfcf8affea7b04fa5e642d67248db0ed7a79ab906b463b59a57fd44450e4e6f27fbfd6fe48a803c9ec22b4580dca7f676972
SSDEEP 49152:rB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glGDmg27RnWGj:9u6JmVxd2dGD527BWG
TLSH
T1FCD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3072fd84e1c16f3f8afde0e75647b43fed4f3f23880e68e0f89c1dd5a53eb51c
MD5 e75631caa7206e05220bb9b63d327129
SHA1 1b5a58a7b900a8c0f279a6d97545e42377538789
SHA512 bb62d24b93e038cbc8734b14f894fa292adc298c98bb7704165618eae862c3843c60206816a4f5e8e872c703dbb51a78fa08c7ab1f8159bd194a29626176806c
SSDEEP 49152:u1hpsNoJpF1A6UU44CwH7R4xaDmg27RnWGj:umifPbRHD527BWG
TLSH
T11EB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 eedf4b5b09141f3bd58cdc6cf0b7e803a6901a0e53ab1b38fd633f30bfd9671e
MD5 921d153aecae95992ae13e5ce21d665c
SHA1 382fb8df27dea961de99ad19a69ffb96dd0fdc56
SHA512 1cc0ef789dcefc19c4258882659587ebdbe3796ec6282ddb18d133e8233cd983f3eae0e9b051c8abf11ffe04bf415aea922c31e93013a4bbeb3a272e3e233fe1
SSDEEP 49152:QSuZQIY0Be2KRRVtOnks6NMHqZDmg27RnWGj:K5dKTi61ZD527BWG
TLSH
T117C5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 265e340e8c15a24da041f23b62bc12d9915d5e0c9d878ff6796a274b5c481c30
MD5 0db8f90b9c5129036f2b9eea9c55cbb6
SHA1 189b759e62a5d3a234d8f8229810c25fae38a50f
SHA512 19791018312b9db8d67c07012bb0a3726ed20b5ff818d44809dcad5c4075194023356c21d39a2d33e8791a9f4368a11a68bc7f5a315598f6fa51c11703f9775f
SSDEEP 49152:BhtSn8EApI0figngiDn0AP5wWDmg27RnWGj:QX2iyphbD527BWG
TLSH
T18095BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 96756317d7fc465cd1e6d9124a0a28123c34a3484bd2f482a67784ab7838538d
MD5 efcef8d2693595c805e7c32c8f8ad184
SHA1 aeca430c70e08bd65df8510f111d12e527c4a0a6
SHA512 102908a43a6ec82804419d9d1062c27c7f0a9818dcc0f8a4a1a0008cb57132da916b9568f4005d9ce3d16f5c435097e94f5f627327b65747f627b4429ecfeab3
SSDEEP 12288:nxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F34523BE964C01CFE52649B5C3E5F14DAC073E6BE92004937A5B78BEF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 60da237098eac199615edd3d3ba70e51ef7690d48bc81eea4f51be03d66beda6
MD5 5018d18d4f7a7dd23d77edf72ee6ca80
SHA1 961f7435ac2d22fe7012324ef848bc58e239d3a3
SHA512 e68455ecd93f99461b6cac30478b4794f13e8c73fb4b57a2d8f4ca69cc57f7745c732cbbdd6dc967fd58e1a170f0cae56dfb6822fe704cf89442f1f51a80f48d
SSDEEP 12288:9kXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9ksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FC4523BE964C01CBE52644B5C3E5F15DAC073E6BE92004937A9B78BEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 0852b11c7bfe3d1eb46d2ce89a6a98181d24b469aa81737b789ee4ab9cbe0771
MD5 0f244240f9730cf69a2996ce3da13be1
SHA1 f79abd10c2e96a982970cfaf4c4e0850bcc22ced
SHA512 960be017dbd5fe68edf11693906785b52767f67f6c805bd2ed2dc1aeddf6b2a0526068a1bd9409a8ca89009e38a4b6c6321e11bdc77d0ae7747005e1b1d93c09
SSDEEP 12288:KeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C44523BE964C01CBE52648B5C3E5F14DAC073E5BE9200493BA9778BEF7B18584B3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 e783ddaf884d1d8e632ba291d66d33cee68af3795c521e00dd942724ef003e3e
MD5 8de9f4670335c47fad3b8f83bf9664af
SHA1 6da95cd8f2c543d1f96a49f1cc5e48be5ce5e1c6
SHA512 1f37fb610727819b8c913dbdc5edd84192f4b73c11c4f4e1dcae6e500cbbe3c94d15f903aa9d67405b76da94490728d1ab61e144b7ceda30d9c4b8c3186409df
SSDEEP 12288:6VDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ksqjnhMgeiCl7G0nehbGZpbD
TLSH
T13A45236E535C00CAD83685B4C2F5E11DE8277D96DB30059B6B5328BEAFB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 34cce41e30e51f6443a114228dfacf9b8407e01cf2197879b6d803a4610aaa6a
MD5 ad89573783bb778f3a79cd512c088332
SHA1 021cc3d7020666648bd2d1801bf4937f98a107bf
SHA512 599984332f876a587d43de5b026ea69744955871da9ff010479b5427d9af28efc7ea180850b010afcddf094a1cb9a6dbdfe8bde46d13a73a668de74b051acfd1
SSDEEP 12288:r7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:r7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1584523BE964C01CBE52648B5C3E5F14DAC073E5BE92004937A9B78BDF7B18584B3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 bbeed63a58f101872a0c012c58701c10f6663c8ff3ada6bd39cc0c3a065e52bd
MD5 ce42bd57e32d4f879d6fb58be763a31e
SHA1 c2b60237aaaf9c44477e98ba424e42aec0d76727
SHA512 be667803e49a3d17c79426c94e0b2c77bd03b90a1b5220c3d9d3b5ecec5443676ed7f74398209ad801f3aeb6cd00c5d1775b250fdab56b7eefc79f093bd4346a
SSDEEP 12288:jgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1844523BE964C01CBE52645B5C3E5F14DAC073E6BE92004937A9B78BEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a35ca1e3afcd0d50f52fa0727f584e23aa27aa0bca6e21a4942ca1eefc163bfc
MD5 a21898b004ce59781b16b9bb445be95f
SHA1 1b31396318a6a2dcd160af727340f454a2850049
SHA512 3fa58b34740ac7806c8beba0eb69bd69c2ccae1c8924b267bff1c3799f2eb244af2ebe9c7dcd3dc1e4d3e8947adb7eb8428d5e931f381c02b75bc72ead3a33c1
SSDEEP 12288:h8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:h8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D94523BE964C01CBE52644B5C3E5F15DAC073E6BE9200493BA5B78FEF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 051a6ce0c127ddfaddf8788c3a789a29957b7e3cb29cb6fa101a7ecd27663136
MD5 9d0d929d7cc05b68963234fb2dd7c864
SHA1 d9d78948b41dd9507f9697e05d4ee3595986d6af
SHA512 fcbc60081154037d05995ffdc44d32c6aefcf2ae03fd3868f96c34a04a15174cce35ed5c046ed513089b060ad80d0f6ad861fadd43aa7d40550a0361e7b6b7c5
SSDEEP 24576:+ZMSzFVSOEsqjnhMgeiCl7G0nehbGZpbD:+ZMSzfsDmg27RnWGj
TLSH
T1C86501A9B39018F8EC67813EC965D90AD5B27C1A0B70C61F13A5366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e91fbd0c5755912c6fda09c03b447a0e01d6ebbc0450bf8a953836d50b12744a
MD5 606e75324c774558203e29e681735858
SHA1 7292fadfde1bc6842dd6ded46a89433a20e32df0
SHA512 b814430b3ee942243abd6a6e8cfc168b5ff499ad4781b8dbce6940643b6440b3dd235bd89c626b2673771efb7e0f341235c0791d1f60eb7e0119ba5d7f43c05f
SSDEEP 12288:j1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:j1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1504523BE964C01CBE52644B5C3E5F15DAC073E6BE9200483BA9B78BDF7B18584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 5a645a3f9381016a9e246fd44387d6d188f0029ea39759b4165c40f86715636c
MD5 71e9e9b0f2332b0dd89b7dc65e0364ba
SHA1 acae0488c063c3570e0f6d129c3d7a5583200c5c
SHA512 8f782c54f6410c10434cedceced0719180fac7da30c4b8bf603e236aab0ee5b37b30862f76e637847d2e1e796e68c05a968b0ffa115ecee4211a7373e06b378c
SSDEEP 12288:D5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:D5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B84523BE964C01CBE52644B5C3E5F15DAC073E6BE9200493BA5B78BEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f49e3b7b32331174fdddea3e034728dbc931859aaa297cb5cabf4b0f0ec1b5f4
MD5 edf77b327c32881b039527ec6664f6ef
SHA1 1cde742cf57f2c7af6076864bbba816dbae6576c
SHA512 c72503a4afa873cbab076fc4f7924c1b8d2436b5a0e0fd6d4deeaef4acc6339765d713afafbff646c2256992d54191355b6242caaae53b2271f522fcb5a5184a
SSDEEP 12288:fyPz5L8oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SzyosqjnhMgeiCl7G0nehbGZpbD
TLSH
T12955025B73A530F9D1378138C5A29A06F7327C3647204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 462356f8de060e26114157a3467d1d0237fe11a5a4263f7e949ea8af9e795e5e
MD5 87d1ec7a842b88fbc683df43d9a2f426
SHA1 97b9fee7936f23f84105b647827e3f6136ce0f2d
SHA512 b717a5e84b956c3b6ed3ce5e4e4aa91a38d24ce9cb8c48f28dec40f52c54ad426e0bc2bc1b4ccd5f19a777830de163c1669a42b164f12ca2f442640f768c4ce8
SSDEEP 12288:I1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:I1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A54523BE964C01CBE52644B5C3E5F15DAC073E6BE9200483BA9B78BDF7B18584B3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 79ca39a1ef98815ebe0e07e3e977a028f88f63f8c68a5caf7731a412f19347c7
MD5 d4bdca887ac6b90880b7ef72182dc94e
SHA1 9efa236a6b02c9ec736b443d7cfd44e8cffa3c4b
SHA512 24c0c14a7e309d21d27ca4f21275ab9742dc4dc8fa0c0204d41b20cca3d76db58fc92475396f017c1e593699d43665db8d42c6791115b3e4b43a03f4648f6635
SSDEEP 12288:41Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:41sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA4523BE964C01CBE52644B5C3E5F15DAC073E6BE9200483BA5B78BDF7B18584B3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 066fc4b22beb3361be7d9a6e2b8e0f059b12797b6f43ec73efcd40834ab272bd
MD5 d358d87e05a5fa7103bb4c29df585eed
SHA1 cb7eb6c0050a58054a797f56f1a31fcefbfa241d
SHA512 f3bf48431532d4287d1742a60936921cc7c04a3b717686f1994de8c6b3c9880d869a5b8440168c396d368194b9e2849af7ec5f3f6b081840e7a2ee438aa49e64
SSDEEP 12288:SyPz5L8oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PzyosqjnhMgeiCl7G0nehbGZpbD
TLSH
T12055025B73A530F9D1378138C5A29A06F7327C3647204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 0d4073f3db31f69dc47821b4d58bf91004c91790cbda0f54cba7aba611959d34
MD5 0e0a9e07bb9cc59ead2a824a5ef13d54
SHA1 20d39f9bc1ad4ebdb3c3c16fd6f52cfba7fa7a73
SHA512 bd5cdcfcf9d76bb1d8aac28a35ef4dc3562465022b22477250a404dac0520164342b1bddb7e872302afa537b42dfd2b0087895ec196425ff446934960b2eb809
SSDEEP 24576:iTHaLl3z0zDOsqjnhMgeiCl7G0nehbGZpbD:iT6LljDDmg27RnWGj
TLSH
T11C6501A9B39018F8EC67813EC965D90AD5B27C5A0B70C61F13A5366B5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 8f19e5c0faaffbe36835bb9a4345ae458e6591760c94f1f903f5430ee498321f
MD5 9720877d94d53f40881c4a83a6e00ee2
SHA1 9f542c828233b13b6c55079f77928dce1bbaf43a
SHA512 597a862b93da00901ea56d9509dda5e02d9246df643623f9c86a2b111fb793d7f3ea019b2cce72ba886e70b5da88a3854a2f206be5e705dbafea9a661f45425f
SSDEEP 24576:r37d9CHKy7GZasqjnhMgeiCl7G0nehbGZpbD:L7d9CHKyasDmg27RnWGj
TLSH
T11E75CF90F3E810E8F0B79A35C9769511D9767C5A5B30DE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 f07a12e3d3eddf9451b598885cf544f13e984c47c48448878451dc1099f9b3d0
MD5 1c17ae8aecf60c2167c44c18803cbcd2
SHA1 0b5379854560582011d29c0a0d8d8ce71c4a78e1
SHA512 309b9dd4102c20dbceca0e5969d610f07d7babdabab1193317b8bbd5a69a6bc0c1f2d4d544ec323b9e825d26a66586dc030deaacb259007bb1da4e556958dfd0
SSDEEP 12288:G+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:G+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A84523BED64C01CBE52648B5C3E5F14DAC073E67E9200493BA9B78BDF7B18584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e13d0281737bf7cc42c70125016b1a05984565f0602bf65ebc8e009dcdad6eae
MD5 eea75377f4f57630caf3aef40bf261f7
SHA1 66256d2a91462cb12b1f95f834f8270e922e8d86
SHA512 c0af707c09746f61bc548e290bbd907563e6ccd01f7aa0cb394fd783dd4e69293b7e1ee2949893e1881054cfa0dc2d9af129142b5771595c1ef74dfc61580c13
SSDEEP 12288:xIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D04523BE965C01CBE52644B5C3E9F14DAC073E67E9200493BA9778BEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ef2bba5df482c3c0fed2b982a82cc1a47f790c2d52f3c26bf9cae0a5e0c8aca6
MD5 2b9f6cba2452c4a41605b6e7ebe1dd98
SHA1 57ddad99fdacfc8bc81a62bab2055258f8ce4ff8
SHA512 8af0657c045b4cb550a475351a71ba33156c2193d03079dfb0dfdd0cd8ced692b2f06a35851e790f32f88db4309e8ea351caf9d30403949265b5d5ba02d30a15
SSDEEP 12288:7XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7XsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D34523BE924C01CBE52644B5C3E5F15DAC073E5BE9200493BA9B78BDFBB18584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 8d3880549e6659b15f6f9f508b265df658fb82b8b8253805d47d42a44a511240
MD5 09ffedd817f024f47ddee6ee4120f486
SHA1 4514561eeedfd8ac67f651efd1c7485ce36d8dcc
SHA512 59b55754ae93cd064e373442f1c0445ac97baf73e20b08bbc3545a26d0af61af5db986405e2910328a41237afbd0ec5ef81dc1b9cd8eb7a14410f57937f17749
SSDEEP 12288:v1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:v1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15E4523BE964C01CBE52649B5C3E5F15DAC073E5BE9200483BA9B78BDF7B18584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 ebb71ec55f0c436d6188753c80566a6d39298b2dd086876ead897454c06f76ab
MD5 4ca46ea54eda4dbdd029b59a3c61dfad
SHA1 0138bc97b5e0e8b11ab0c338cc186644f2ff944c
SHA512 d80d41e190361c2a1e79f566c32527ae00f352b4df7bf3e44587e49fdf119a60fb4e1a5d9dd7ecab2dbbd2c26d1c8fa199888dee4676ef42751af8d4b4bf5f10
SSDEEP 12288:L+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEM:L+sqjnhMgeiCl7G0nehbGZpbDW
TLSH
T18D4523BE924C01CBE52648B5C3E5F14DAC073E6BE9200493BA9B78BDF7B14584B3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f91aebb6d04b3a002f354cb716cb82791eb3c8764e31023b0a685c8bc10a966c
MD5 3105bfec43d7a10c8f7fcc8371870ba5
SHA1 ce9045c3423adb5d333c50949daa88cfb20dd3a7
SHA512 3f3c38f1f8cf07863bd07816e786ead79e34822dc37525e34fd8c325292972d3e52aa213100d93530ef690c24b44ebb4f22617c6cbc3178982c1ed7e8701982c
SSDEEP 12288:PtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A24523BE964C01CAE52648F5C3E5F15DAC0B3E6BE9200493BA5778BEF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c5b04fe1a9f4a5c41cd58582ea0802a702b6d5f38cac2858f7eb1c4904221274
MD5 73f17d98e627fc90bc3b88cf774e5e09
SHA1 717799c10efef76ea6d27a3475dbddb39907bab3
SHA512 8d57a2cff79c700698b80b2decd84d4c8f7f31080f81cfd7da5b328da473514655b1c317894b52b288e7b870e3f33c4d9048f08eda273abbe0957e98e9e4dacd
SSDEEP 12288:E7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEM:E7sqjnhMgeiCl7G0nehbGZpbDW
TLSH
T1714523BE924C01CBE52648B5C3E5F14DAC073E6BE9200483BA9B78BDF7B14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 382dd0a53c86d2aed372730f8e5191805f07e2614343e693f97a85b3d1a6ee91
MD5 10475b5d6b6ed57edf1619f4cf45c523
SHA1 81db8cd740859dd095886c0eab7c7dd20aa275de
SHA512 128d30239a42ed0a09541f169d44cdb3428e1cda92f792e6e9736c34a8443022fa6cc9fab377b47cd5e0f5521a894247a9032bbbbbf530f2dafe8545b4d03486
SSDEEP 24576:Pfwvok9RX6wkyAIJsqjnhMgeiCl7G0nehbGZpbD:pMnYINDmg27RnWGj
TLSH
T16A85DF29EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c2a1b594a5cdc7e368778787f4e0ec77c5713e0eb00a0d3b43fed81493449277
MD5 5030f020d045123c42935aad2596a5e7
SHA1 f96f654c56aaf193bcbf75a7666de13cf66fc7c1
SHA512 c9846c54d16c5c179a5b5b72c4c75a5c07e0e318b6d04c86490030577830fdd70dc3636c0351951d6ad8799ffe2087f89c3e7a9ac6a8ea266f19f974f487a574
SSDEEP 49152:0YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02Dmg27RnWGj:6ySzPuD527BWG
TLSH
T12D066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b37eab7ba6e41a8071e97696b6024e4b3a29f1c33c9deed5697d25d4477f7485
MD5 a42b70a50bc9dea718915d7b91488984
SHA1 8af8012df800e109d8fc37aa87b8cd5435647cd6
SHA512 754f33a38c2ff73ef52db188f0da68b058d5d87e2110b2bef892fa66d1498b12f54aee5fb82c374ba8075a9098aca184976bad98c93fbfdc7ea14f9950dbadeb
SSDEEP 24576:m47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYUsqjnhMgeiCl7G0nehbGZpbD:m47JUQj1irIhCnDHUPfF/GDmg27RnWGj
TLSH
T12D65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 b430f5f0eab632ea051eb1f88050036a52d827435acdfcac4390b712d0ea2425
MD5 9a752c2bb7e2b1e6db2f208a0f835637
SHA1 f7fac56a4e96ffe258f90f9c905d23ba67edc11c
SHA512 a22325316d54312bf7efbee5039d8f1758ece8aa8fe9a6df8ac2ccb6ab8f711d5b3f1ad50f17cf8312e29eef60364c5ecc09f002a378551cfb59a7ce9308049c
SSDEEP 12288:+NsflXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BF55015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 c25e949d29850b60e1a96aa554b23dda07e63906820dbf4bb39b3f7aeab47de5
MD5 fc0a6337dba94d082662b75cd8159bb6
SHA1 440dc723adda7cf3a82f890c97ecd2f48e63515e
SHA512 b0c5034b90d2decfb053e2e8fdaac8b2e423730bb26c7f9ed708c8bd8035f0727578d2e265fa4fa88a4547c3e60486751bd5ec7f0a31cb376dd3ca01be5085b7
SSDEEP 12288:tmWDZg6bnFi17KYUrAIRuBvD8BfywnVGmAglM4I:tXK641eYUrRuBvwBfyGGmtM/
TLSH
T15E3518007666CB8FC66980321E36D1CCAB707D11EE456F0773CA8B3FD576659BAE2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 5791b7c3bd42e3ae5bb7e3168456446f17d84e64d710b0427329542cf360b1d2
MD5 b24893388017093bd19f9cb4e0852596
SHA1 25a3d5b3ace61dc6d7ad5c1a61fe739ad6eb37a5
SHA512 a7bdd3e92bc4e9c9165df61158b89e213d8340fcd12988d82cf81271d4ac785122a62a3faa341169eef245bbd9e79b8b4fde1521b07e8fabc0d67327f0845f92
SSDEEP 6144:cVaQBQHyhhyMyoxE4CDk+pJYcvdeiyZg1Q1MVtMxAaVtMxAW93dClJdfSx8NLwjY:cV1x9+pJ9ug1QxSGNsjY
TLSH
T1CB65F9815137D7CFD1BB5032072A5B8C6B64EC03B7096F26B38A453AD86BB51A0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 9c9b8bc9408dfbc6e23c67a251eea998b78cc06dfaa63480892a82f212f901c9
MD5 ef2c6109d2525b526c440cb08ab138e4
SHA1 faa1470aed9eac105a9de23798646c06e25c8e79
SHA512 1128ddf41e5414092a7d9592957c05827a77f8e18a38d08db77b1a256c033c49151d4b85790c4c7728e0de96c09ba8b19b0a801ed1f76710810f9c563b6a9c24
SSDEEP 12288:UM7dXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA45237A834C118AF93A59B482E9E12D780B7E669F1044C3B94779FEF6B18C48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 836d84f64832a0464ea9265c9c4c724a3ed687d09e98456717620872e1b31dbc
MD5 142279f08f6dec8ed64fee5c9429cb19
SHA1 8cb87cc68a1bd9bd4cd3edff2ad3970e9319e723
SHA512 2b104de473dee7cd7ab5efb9b96a7b659d07fa3c75459de09efe7bcdbd9b5450979fd3951dc8ca85f02ada823781579c0519a48d1982e4bf595b98e926b968d6
SSDEEP 24576:6gb6bmBIi49WNNFpg1rSvFv7bYfsqjnhMgeiCl7G0nehbGZpbD:6gb4mBIBhGFwDmg27RnWGj
TLSH
T15B659E1E22EC02E5E0FAD2B8CDAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 ada18d90140d3378f2a616d3ebb639f2cf82b700829d463910ebe72a3c5cd9cd
MD5 7ae1c61c08f2448b1c65aaf01e282c34
SHA1 93149ec60fddae8bb9c720aa2f72f78f9dce535f
SHA512 d16cbaf59470bd76bfb91045c0675b8a62d03be76314fa4a9e29b0ac9143db41c666300b460c3bcfbd84188aec483aafe24da7e485504528fa31dbc660598ac5
SSDEEP 24576:9G88u8FpJqH1bzria7/mEsqjnhMgeiCl7G0nehbGZpbD:Q7ZFPqVea7/LDmg27RnWGj
TLSH
T13685016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 fd94d6b33b0440df5a319c1b732f20c8dd9dcf5b0196822bbc7c200ff48d01c8
MD5 28ebf60bb2c3d78335e6def86807570d
SHA1 2b28dc65c26309949b1f8ff481f55d54afc50c16
SHA512 5386fbc2bfca643a2a849c5b6fa83d7414e0c500b8c260bad2cc404e2b1e38f7fea8d6ac44990d339ea51f1cd973ef442afce83c9aeed51ae4abb0a09a85ff9d
SSDEEP 12288:mHvUrBFrEjwaQwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:mPUr+NQwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B965F12F62AC18E5E676E17D8682C70DF6727862071192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a04969ffe6cf0b6f13696d4168ddf4cfafd5ed106a0100bed553dc2b9c77f66e
MD5 f75e8826830bd9e83d91a2c709d5071b
SHA1 6f1a6c89ff32f3078b47595a481154cf97ff281e
SHA512 9088c45f25e02403100cbfa8410d9254b0ca53d93ace903b722bf85d2bda588b07e87a2b61ced3357329a5ce9efaaf7ad12f8f919516714bf8793c24c04b5751
SSDEEP 49152:PBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjcDmg27RnWGj:AG05lO43bVD527BWG
TLSH
T1AED5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7500378959389336e66f684d149258c6cd08cd1f86793b617b42fcbd77a4b2e4
MD5 e68f98e1c95162a3d3493e235e80e93c
SHA1 d2191db1272b4701e2cacfd505c232b833dffe69
SHA512 9e721d18a9afcf8f08d113789a112ee4244738203593cbf03adb75881ff11dce43025b0ae420d0375af3f486de155b6bc6dd9df062a310c610b6ff4dc1e6f287
SSDEEP 24576:ifa5POZ3dpFWVM50JicR2hG0lasx2+47eidnysqjnhMgeiCl7G0nehbGZpbD:qa5POZ3+Jt2pasx2+m0Dmg27RnWGj
TLSH
T1FF65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a7027237ab7a3ce57e1b1ffe763380a8f039c393653af0250334826410de310f
MD5 a3bd20da287c3d49ef008a325349fda7
SHA1 55abb1e3eed665bf06210d074749c1fe4afd88d3
SHA512 1271d31a052bd0f6724b1b0bc1b2e18b218bea7457ac4f914ad9318a340689c56376edd2a2befb80236167c2890917535344001848095e65ea386b1b30f518b5
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7FkssqjnhMgeiCl7G0nehbGZpbD:TNc/zEOVHFrDmg27RnWGj
TLSH
T19A857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 dd354d23a4b0d917bd22bbf2e05f0a527951daa3259d88c6f0836d9ac69c1da0
MD5 098f8db3b324fe280bc526af0d681514
SHA1 131c3d7381a348318ba9cd2ade042a72d3f03535
SHA512 aff697edb6d381c7d5c9c1717f3ebac18508ead8fe976149c8ee3339df0ec49009793baa416c73e7859a500be0b8e02f00664f2522654ff6182cba42987dee43
SSDEEP 24576:G8kNvNnaFeYhJNtmZBmGsqjnhMgeiCl7G0nehbGZpbD:G8MwBtOmKDmg27RnWGj
TLSH
T16755AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 ce2680a833535b4351e2f5acecfc6155322cb795004a8dc08814bd5aadeda033
MD5 8a4d63023dd97114c008495719db9f52
SHA1 594dfb80bb1f252232f6b1ef92b7dddaec0c69a9
SHA512 7bb5d433816cc17c171d48636599e7ebe18b04ca404fab4f3cf99e785d288591d032eeb53b82afdaa422512adfa71d97215503e857fc7b9d543e8cecc71711e8
SSDEEP 24576:AD3FHshBIYQgARsqjnhMgeiCl7G0nehbGZpbD:ADVHeBIAAlDmg27RnWGj
TLSH
T14575E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/704-122-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/704-114-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/704-116-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/704-312-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/820-111-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/820-327-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/820-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/820-93-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/820-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/820-87-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1208-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1208-294-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1208-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1208-55-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1416-395-0x0000017417460000-0x000001741768D000-memory.dmp

Download

memory/1772-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1772-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1772-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1772-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1952-134-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1952-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1952-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1952-139-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1952-128-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2124-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2124-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2124-314-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2124-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2124-98-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2124-104-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4632-309-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4632-74-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4632-68-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4632-66-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4920-108-0x0000000140000000-0x000000014040E000-memory.dmp

Download

memory/4920-6-0x0000000140000000-0x000000014040E000-memory.dmp

Download

memory/4920-8-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/4920-7-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/4920-0-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/5100-53-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5100-40-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5100-41-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/5100-51-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/5100-47-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/5544-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5544-29-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5544-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5544-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5544-170-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5984-22-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/5984-23-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/5984-16-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/5984-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5984-126-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6100-78-0x0000000000A80000-0x0000000000AE7000-memory.dmp

Download

memory/6100-83-0x0000000000A80000-0x0000000000AE7000-memory.dmp

Download

memory/6100-109-0x0000000000400000-0x00000000005D6000-memory.dmp

Download