5bb5204a4651812d68da19f918661cf0da6551462373b3afc551b95bc8aeeed5

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
Size 3.5MB
Sample261018-tkf1cs1zc1
SHA256 5bb5204a4651812d68da19f918661cf0da6551462373b3afc551b95bc8aeeed5
MD5 32ef080b58191a8e61a166f1e1497111
SHA1 4217dc88533aefb4c57871bf2d04b5e0cb8410bc
SHA512 97de575560f9c2ccc77fb4462a0ff317db4443797e14646a9d05158e4a884e7aa8e76780232a988e6f380a6088ab482745bc8cf8550a41a4cdfceae51eb9afbf
SSDEEP 49152:Vph2lwOsns6h+92ZbI1DGpRw5wF3vXNDmnarSj8RoTCC+rqwH6Pcy0uhSjWUC:V9JbI1OlDeJTMcUDuhSjW
TLSH
T1DBF5D007ABA412E8E1B3D17DC9574A46EBB2BC151331D7CF02A446D61F272F14EBA722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
4336	elevation_service.exe
2648	elevation_service.exe
2996	maintenanceservice.exe
5404	OSE.EXE
5816	PerceptionSimulationService.exe
5964	perfhost.exe
4688	ReFsDedupSvc.exe
4432	SensorDataService.exe
4924	ssh-agent.exe
4192	AgentService.exe
712	SearchIndexer.exe
2908	unst1792339617446-copied.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	unst1792339617446-copied.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	unst1792339617446-copied.exe
File opened for modification	C:\Windows\System32\msdtc.exe	unst1792339617446-copied.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	unst1792339617446-copied.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	unst1792339617446-copied.exe
File opened for modification	C:\Windows\system32\AgentService.exe	unst1792339617446-copied.exe
File opened for modification	C:\Windows\System32\vds.exe	unst1792339617446-copied.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	unst1792339617446-copied.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	unst1792339617446-copied.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\864e6291612dd39a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	unst1792339617446-copied.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	unst1792339617446-copied.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	unst1792339617446-copied.exe
File opened for modification	C:\Windows\system32\wbengine.exe	unst1792339617446-copied.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	unst1792339617446-copied.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	unst1792339617446-copied.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2284-0-0x0000000140000000-0x000000014037C000-memory.dmp	upx
behavioral2/memory/2284-265-0x0000000140000000-0x000000014037C000-memory.dmp	upx
behavioral2/files/0x000100000000931d-246.dat	upx
behavioral2/memory/2908-241-0x0000000140000000-0x000000014037C000-memory.dmp	upx
behavioral2/files/0x000c00000001c5d6-238.dat	upx
behavioral2/memory/2284-74-0x0000000140000000-0x000000014037C000-memory.dmp	upx
behavioral2/memory/2908-408-0x0000000140000000-0x000000014037C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	unst1792339617446-copied.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	unst1792339617446-copied.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\SuspendOpen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	unst1792339617446-copied.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	unst1792339617446-copied.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	unst1792339617446-copied.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\java.exe	unst1792339617446-copied.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	unst1792339617446-copied.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	unst1792339617446-copied.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	unst1792339617446-copied.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	unst1792339617446-copied.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	unst1792339617446-copied.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	unst1792339617446-copied.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	unst1792339617446-copied.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	unst1792339617446-copied.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	unst1792339617446-copied.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	unst1792339617446-copied.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	unst1792339617446-copied.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	unst1792339617446-copied.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	unst1792339617446-copied.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	unst1792339617446-copied.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	unst1792339617446-copied.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	unst1792339617446-copied.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	unst1792339617446-copied.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	unst1792339617446-copied.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6656dc41a5fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000feaedfb1a5fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005d3de2c41a5fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b9708cf1a5fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2908	unst1792339617446-copied.exe
2648	elevation_service.exe
2648	elevation_service.exe
2648	elevation_service.exe
2648	elevation_service.exe
2648	elevation_service.exe
2648	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2284	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	4192	AgentService.exe
Token: 33	712	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	712	SearchIndexer.exe
Token: SeBackupPrivilege	4688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4688	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4688	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4688	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4688	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4688	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4336	elevation_service.exe
Token: SeDebugPrivilege	2908	unst1792339617446-copied.exe
Token: SeDebugPrivilege	2908	unst1792339617446-copied.exe
Token: SeDebugPrivilege	2908	unst1792339617446-copied.exe
Token: SeDebugPrivilege	2908	unst1792339617446-copied.exe
Token: SeDebugPrivilege	2648	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2908	2284	2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe	100
PID 712 wrote to memory of 2092	712	SearchIndexer.exe	101
PID 712 wrote to memory of 2776	712	SearchIndexer.exe	102
PID 712 wrote to memory of 5388	712	SearchIndexer.exe	104
PID 712 wrote to memory of 5864	712	SearchIndexer.exe	105
PID 712 wrote to memory of 4468	712	SearchIndexer.exe	107
PID 712 wrote to memory of 3580	712	SearchIndexer.exe	108
PID 712 wrote to memory of 3192	712	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Users\Admin\AppData\Local\Temp\unst1792339617446-copied.exe
  "C:\Users\Admin\AppData\Local\Temp\unst1792339617446-copied.exe" --source_path="C:\Users\Admin\AppData\Local\Temp\2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2908

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2648

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2996

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5404

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5816

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5964

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4688

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4432

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4924

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4192

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:712
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2092
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2776
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5388
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2944 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5864
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3580
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2944 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f246baa480635108c0d2fb850f05ef40907fa8bfcfbdfe35271fd8d17bba27dd
MD5 ee1f0e891c6268f7deebc68ce8e1e467
SHA1 18dd42f10217289ee28b721e628f250458d064e8
SHA512 01010078d7f21f152066c43a995c098f9b6b85396da68a4590a5e5ec12be7eef48c327281bf681d7e97993e4fc5de682e87968d2532babcb3cdee2c66d8ca0d3
SSDEEP 49152:Rb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnyrqwH6Pcy0uhSjWUC:X3q6HjBLcUDuhSjW
TLSH
T1AED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 567c407e3e26e63ef4738cf6c9e9c4f642832f8d88106cfa4d046865aae21d07
MD5 1777cd20134d3da01aebe1f9cad44f2a
SHA1 c2dac74de52e1e7f7c93257453664b5324795619
SHA512 bf09a805e8d248fd1433b317c8eeb988a1071f63c4119724defde5cae538d74be2fc565b1de79b774df0330390787193f10ea2913344b6e1f3e81a59558dd12f
SSDEEP 24576:NXYfDtczAIQFLnqwH6EOFce0yM5uyFzmBSjWUC:YtcorqwH6Pcy0uhSjWUC
TLSH
T1A105F129B3E108F9ED678279C9A2C501E6337C4587A1E7CB03A495251F333D89E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 09adbb59c96ef35c2b81c798c8ba78f41a619dd8ca8efc7b4713ff517929e7c1
MD5 faf28bfc25b2c8677627d4f432567284
SHA1 a316fc7e663d03f0d131b3f2ec3aeda85d5949e0
SHA512 f91616f815a4a89c4afaa048f01036e9aaf39951fdd83c54eea4f1c5b2d83437f85fad7c1f44e8dac18c0d72fa430e306dace675681d416bdec555763289f5cb
SSDEEP 24576:S0Le5ji0hmxirMRQFLnqwH6EOFce0yM5uyFzmBSjWUC:SPji0AclrqwH6Pcy0uhSjWUC
TLSH
T125359E16F6748335D073C0B9C5D2A68AE97130865B308ACB4286D77C7F676E6CA3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 127f1d2e6c81c55cbc8243477b2641e0487cde88e1916793414aaa73fef3dc95
MD5 d83134ccd1c4d5f103e6303d54a5f565
SHA1 991719a3606f7b72f5684883846c528f5426b09d
SHA512 84a73fb7b1aa9dc3b1973a0ef99e6724ad93076753d9c784eaea6733aa364a1b0c3d0a525caac665d491d999e48165a32f0d830735c819bf6a84385a7a461967
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWE6q8wyuDQFLnqwH6EOFce0yM5uyFzmBSjWUC:E/ezSC6vUzPvxHjy5rqwH6Pcy0uhSjWb
TLSH
T114755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7ea165885b78b9f739ccca13d0c6a43d092e6e0802b13bed67904bc4a6ca8835
MD5 4c2c415a42dfb16896b216c8ca669f01
SHA1 7f1554104fdb79e7ed8e607d076591f86add3f29
SHA512 618d1179221aa57bf482def8dd1208d29262a75c4494a439ac153f5e61df25416c0e13e14be1d2ccf51a4d69aaa62e3d15466f8f1f5abb84797d3e8d145f1bc8
SSDEEP 24576:kVbqPb88hv/l+6MQFLnqwH6EOFce0yM5uyFzmBSjWUC:kVO88hXl++rqwH6Pcy0uhSjWUC
TLSH
T150559E66F5748331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 97fbb9fa92d146efa08b35ffd6ec2c006f866ef15de21ec147e5ecf5894a2397
MD5 b2f2880f2fa7bf7314d1ba697fc5447d
SHA1 cd740ea3d943ac0423efdefae11f803e265baff0
SHA512 1b2612e2dc594b9e1cefe375325b372ff0ecf2772e71f8010dc74e95f2ba300d2b7043744ac773003a1d7236b6f139134f915489b0855bfaf1ce6560333ceb76
SSDEEP 12288:QR1QFe3eng3wH6EO3liucRkU9bhEM5uMr4U3zzqBSVxWUT2:QR1QFLnqwH6EOFce0yM5uyFzmBSjWUC
TLSH
T129C423A69392A8DBF3DB45B1B283D901D22D5F08CEC3B6D2E12970496BF5113EC0F5A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 0ce45f841b301761c7db1b034d60fffba991b2b6bbf1fe93bb734d40d043f29e
MD5 0af89668e272d371b7ee2a0919bb4534
SHA1 4168a4bc461e6615c40f08e568dc3c0bbd478fb4
SHA512 80ec3c59d11774e3fa4c238edca33d96f642ff49cbf686c51555312f16a8fcdf3d4287683f36efdff3dae0262a8270601ff1dea95a52b35488731d86f229b672
SSDEEP 24576:xJIU0QFLnqwH6EOFce0yM5uyFzmBSjWUC:xJIUfrqwH6Pcy0uhSjWUC
TLSH
T15A05CF7BEE28FCD2C27A8DB95691C600D77278304F52A3CBD165820EDE235E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1d86f86a2f42e8ad7df99cc6578ba6f0bf083aa516b28d7259d2f32284c6a5b0
MD5 4841608383ec85a7df0295a2aafb2f25
SHA1 a5bba28f41ba303ff8d4adf7f73b0d30904bde5f
SHA512 867ced83665b08da3165ecac8d9b9616db56cbca40b0ec99fa407ababb6c9e90f4b351bee64a22071a156b541b3106f69ecadeb44b3eaf13e9374e3f8ee3e9b0
SSDEEP 49152:fQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THi:fQvGAdlCEL8c/yRNw5C2cUDuhSjW
TLSH
T1A3266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 25f8090a1069b9b914f1dbcc02848c4120e29fc41603ac9b3027f7398c9d1fda
MD5 06202a1da3e61160acbd4f7dea4d6d8e
SHA1 3faf9cae5f03171f9e01308d94f9365edcd99c00
SHA512 367b7cefd526ae775a53ee395d4b572e54e0e5d776b80bb99fb48f862a4baa4f3b80757e86e6da86fde464d2d234fc3b6cb5b79b3fcdc530c00007475ba696f1
SSDEEP 24576:wdewsAjuQFLnqwH6EOFce0yM5uyFzmBSjWUC:AljVrqwH6Pcy0uhSjWUC
TLSH
T16715E031FA75E436C3BF0DB22B26C716543C7A204F921AC3E3A8998D59702D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c226a269c38d8b84608da5c5696727d6f5f10d04f6683c2e622e94c6ece43429
MD5 9edc2fa234d7571f690ce890ce2c7b61
SHA1 5ab3c5db68cab10d378924a839a255c860c88f4c
SHA512 d897526408954339b06c052f7c4e1b5b68784a6c8f58387eb84c5b3826d42a3b25d819ccacdf6be7b159d27eef34a12cc0a259855490f81ee51a3cfb1740c997
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHeU:PUEtQevvqc2W1cpV2EI32P
TLSH
T13C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 26aa957fd6bdbd1ac1d5d4c6de6d1f960126f927a4c7422d533633edbaf81207
MD5 c69ec34376250ffd9bcd3d04c8344348
SHA1 51e54597074c97a01bac7234a66b9b1691a04803
SHA512 165b3d369ccd23351a3a4acd83bc24075500ed8f1f460058b616bff4568061b63caf41eb48f1d0e385751da2579097dca607597cf5c098f7dbc1ba3352a61807
SSDEEP 49152:zCbRquA/m2yL5zifFiV+XenmE3/z1rqwH6Pcy0uhSjWUC:MoqHVjnmqcUDuhSjW
TLSH
T1BBD58D0976B8C1E4D1F6C77896A2C647F37178154B31A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 382efa1085d97f9c5811dfe5328b2954177eb18f5f19c5e76ac52164959c2d50
MD5 ff5df0e6cad563689c04c22961644b67
SHA1 2d393a0182a9828cc9ee8de096759b2517c50b5b
SHA512 c79b5389976bd49a7ca8d394126fa679fa2f3a446ba524ea2dedef43d2ba54b8e5ea14197442b17681ebf1c55936f7263cd9ec8c6684d2b7fa01975d8c3e6a94
SSDEEP 24576:9AhGLJIFoiwtA5l7S53/QFLnqwH6EOFce0yM5uyFzmBSjWUC:9AMyFoiq58rqwH6Pcy0uhSjWUC
TLSH
T151359D81E7F955D4F5B3AAB8A9B68171EA76BCA55E31D20F2160D10F0E33A40DD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 ef499bfe8323f0ca53afb53d7bfceae2347ff7659af6472e0caed293a59953a0
MD5 f06ab86a9a5f335d06d705a0526ac9d4
SHA1 cff20efe117ee06c6ea2b43560588c9575ab5b19
SHA512 a2f6b23ad748c88b7d90f4a10147e5d71f09f11bb55cf934f9c1bc751250738752e9acb4de5e4d6d4de36ab7ecb5ee33c2c283a2053aec413cfa618b47ea4772
SSDEEP 24576:jwuoOWKQFLnqwH6EOFce0yM5uyFzmBSjWUC:jwDOgrqwH6Pcy0uhSjWUC
TLSH
T1F805F14673A51CF9E5A782398647C536F7B2BC012A62D71F5360C65B6F33321AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 b8eae6acc254618f513d2324b287af2b9fb075ce992616f3bf0f80809a1030b1
MD5 a16bb9110e942ddff0ea4f6964974131
SHA1 f6b4955a7747a0ac074895cd7fd87239d63e99f2
SHA512 0be06239f324c071d5686fce6285d5c6ba2833e9879ff18d48c028848c4aaa8a5049282de2438301a669187a1263b307026dbfce6e23f46c63c566184b29b3c6
SSDEEP 12288:8BZ1IyeQFe3eng3wH6EO3liucRkU9bhEM5uMr4U3zzqBSVxWUT2:KZu5QFLnqwH6EOFce0yM5uyFzmBSjWUC
TLSH
T151E4129A23E070FAE2A74278E5D28605D3357C069BB353CF5224515A2F73AC2AD3E731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 912884987b0e4d849ab972223e7bc9dea897771caa2433b0344c7ec66622a21e
MD5 aeed53b8f34b089c0e210c4a53231e8b
SHA1 c29f1d39bacfd53c030b24b5b08f98daaae2658b
SHA512 9f019ac113274243ac0f2027da716256f56c0511a050985c38e2ff86320068966432a9a247a61cfbe33b93a3139144e3c6acada68dc02abc2dbe428174d73572
SSDEEP 98304:EQRQyi36YOcPQLvw2gAf+PN3ncUDuhSjW:LQyiKayX+PNsU
TLSH
T1F9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 00ca7aef2c48d5f8bbb4350f5f13c3b3325f2f4a1d31ee679b1ae751a152fdb8
MD5 f9176868d30ab76a5c7468f83e400db3
SHA1 86b952b0379e59089930c02b871d30736b1050cf
SHA512 117e78c94d9c82f616dc58d8766b1405f87115f7af92f0ad80303904ce03d6e02d4c57e9fef068f397acc99f33df00837bf43e2b2c95edf1c9b1cb92fafcf652
SSDEEP 98304:QQRQyi36YOcPQLvw2gAf+PN3ncUDuhSjW:HQyiKayX+PNsU
TLSH
T17A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 388d785b1e1f669ffc2ab7876dc7557ae5cf471e4ee71b4c0d7ea10fdf1b074a
MD5 bd16f8db3719dfdb78c7ba9fde55980d
SHA1 25f3e009a06340a74c6a64904048d0e2ccfc8130
SHA512 1eb917c8ef88f5fae672e2885caa5fce782aaae4bfd168a52e5b6d93900b2d6c951c8e2f4eb6362278a70612995a7b68a4b43153827b530162a50f2f37a39157
SSDEEP 49152:768Qg55nhheWu7PNU3/lrqwH6Pcy0uhSjWUC:FthWRc/lcUDuhSjW
TLSH
T150B55933B2F200A9C44DE1769F4A872196D17C75CFE1E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4b2f4a227322c1eb395ea6e7890e27ff8ac54cffd031eb549bca31614578170e
MD5 80132a3062fb8f00adbdf91844e1099c
SHA1 f9fad7f617e33cbafb82da05748e52dcf349cfac
SHA512 dd969063ee2f4799477b0cec6e6be4127a05b8579e2fadb4a2a560f8b51e90da448d2e05cd4452a35c93bf7a489c8218f4accc8c01baa309b15bb4128f2d4501
SSDEEP 98304:yy5112gYy5azzVvL69nLKnhZ4cUDuhSjW:7LIHmWhvU
TLSH
T1AA167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6f5c9c663ec48b0c1c72de9878e842e03a6cff4647298ec83f47d2118e2d25c8
MD5 5a85c25f9981d942567c534042a02bcf
SHA1 8466309578481c83a1bc6d5a83480b2874fc9b1e
SHA512 841fa1cbd5b09730e87ed19221646403e5f5047edf3355140137c9aba2e3dfa94e1c81be55f39318eba279e7f380cd3e8365e033f34a12b7eeb6006db38b2e9b
SSDEEP 49152:PB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glbrqwH6Pcy0uhSjWUC:xu6JmVxd2d/cUDuhSjW
TLSH
T17CD59D13F1DA01E8D05ED478974A9233EA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 570e22b8ba56caf3185e9e678e0faa24eebef4cae35bc0efcdda906156750e46
MD5 02b4dda50eee6624abad40fcf8fc9149
SHA1 2dd91f110b0f4104b560656e70c79d94a58e5bab
SHA512 a36d42e74d15f0dd9485c9c71b9b3a29f9ca6ddea5b3c07dcb1ce653133554598ac8adcb8d70e424cbb95879a87938682b6a8aec678bef0d3efb0968851cdbf4
SSDEEP 49152:A1hpsNoJpF1A6UU44CwH7R4x/rqwH6Pcy0uhSjWUC:AmifPbRqcUDuhSjW
TLSH
T1E6B5BE13F2D900E8D05ED17887569232EA62BC460B35B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8cf3abade5882c8f9a53d767b80587363da6c808e544f30427726301d4f4873b
MD5 fea4416823060b1f172b3cb3beb1de60
SHA1 4e037cda15c6c56828321044b277ccbd17265556
SHA512 c171e43c616441c0592d1778c9f13080ba605d22809818f6463cbed5a4264ec5757eb886f80ecbfa2f73b5018efeff687edff7d58a6a287bb22a3d210835e32d
SSDEEP 49152:oSuZQIY0Be2KRRVtOnks6NMHqirqwH6Pcy0uhSjWUC:y5dKTi61kcUDuhSjW
TLSH
T1E1C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c6299749e163c1665ea2f8fa6ef1951fbdbe6cb21ebc15799e36e46735bff31c
MD5 25691528bff64393c2fccd4bee82b249
SHA1 dc8cd80d394be85c65b3f04ffd8a1ddd4292eec4
SHA512 6be254a6017160a9f70cdc4f19e874c96617045117c7a6270a4cb0f2359260e2a03941c4e6e6236916a5ea0ab38e31522cdeb6d311173fd03253b4c0515f4fde
SSDEEP 49152:VhtSn8EApI0figngiDn0AP5wLrqwH6Pcy0uhSjWUC:kX2iyphecUDuhSjW
TLSH
T1DC95BE13F2D900E8D05ED178C7468632EA62BC150B35BAEF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 6da1a9f8b2dde0f5a0979213ddd990b54b583683f3c1c40531241ad1106e8f86
MD5 7af481fa3607c7d055d9e628ab7b0dea
SHA1 57152bbb649e5b0268ce158c4deed7c31b9c6b00
SHA512 a7063417861651e96226c229707a968f597e310c23bbce61c8c393cafb0fee7277cdb58a3a975629269a362ffb178284bed062b02a4182e60bb6fad651c161b5
SSDEEP 12288:cdQFe3eng3wH6EO3liucRkU9bhEM5uMr4U3zzqBSVxWUT2:cdQFLnqwH6EOFce0yM5uyFzmBSjWUC
TLSH
T150C423969693A8DFF28782B1B242D605D52C6F09DFC362D2F62D70056BF1653EC0E8E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 a5a12c038e7b498fec50f3a09080c08ed659f141951006ad47d7d84de5c75d19
MD5 957d74938233b4b51397c6e7f56a3755
SHA1 e18b6923fff4336c880aa5a396e2971cdfb1f265
SHA512 65d66a07ced1bcc27917c5fcc9f98e035d7dddd7887fbd0f9b04c4e5b4e6dea69d1fdebd4468796244f160b911682433aa6c6d1b7980f760743b09f22b0a177f
SSDEEP 12288:piQFe3eng3wH6EO3liucRkU9bhEM5uMr4U3zzqBSVxWUT2:piQFLnqwH6EOFce0yM5uyFzmBSjWUC
TLSH
T10EC423A69693A8DFF28781B1B242D605D52C6F09DFC362D2F62D70056BF1653EC0E8E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 032067a0bf6b5e7ac6b177902be201eadf0ccd7752525ed8e8d870faa709e43d
MD5 57e35ad55b35c780ecafa88fcc415ee3
SHA1 9c9d7e9e4137ab2e018793571e8d305fcac76cb2
SHA512 e0628448178b9835b1a7ed673d60a4abd8dce4abf31ad70fc1c9668a772c31b8bbeefe8a2514c504751a18bbc9a7648f331a9f41fd034371e74ff5ecc99f78e0
SSDEEP 12288:scQFe3eng3wH6EO3liucRkU9bhEM5uMr4U3zzqBSVxWUT2:scQFLnqwH6EOFce0yM5uyFzmBSjWUC
TLSH
T137C423969693A8DFF28A81B1B243D605D52C6F09DFC362D2F62D70056BF1653EC0E8E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 4e9d2be195c440b91de3ce321f7e9bc78ca8381d4ed802fdc2def3baab6edbe7
MD5 94e09564446f02e4c2550cfd5d2dc051
SHA1 0e0f893c1291b4bf664d4282a4d0285cb742de3a
SHA512 a76c198d7a572facb2408bc7fe2fe724bd2ee8a16c6972fae8e1f352bcde2da780f5b841d9ecf8fdf7617e2285784dacc8ae9bd1d3ec1a3fa0663d35d98c80f9
SSDEEP 12288:VVfQFe3eng3wH6EO3liucRkU9bhEM5uMr4U3zzqBSVxWUT2:PQFLnqwH6EOFce0yM5uyFzmBSjWUC
TLSH
T1D9D4239663A754DBF197D2B5E243D601E2387E49CF93A3D7E61420091FF1352EC29EA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 a48e7df464617f95182d2e18c01d5fc2935abc923e0794ad65f47a124acd04f6
MD5 0c25fc56036dc1bed8b5f58e17862ee7
SHA1 7447822fea09dabd2d7a6d3aab44bf98bcb0411d
SHA512 b3c5fdb8caf93ff5277ec65bbe843c448047f057a99c03d4b70b1e298d90d4ef42490f3ba3b5858b38aa09a911d22020eac73c07f6509e80c87facbea6f9c1f2
SSDEEP 12288:RXQFe3eng3wH6EO3liucRkU9bhEM5uMr4U3zzqBSVxWUT2:RXQFLnqwH6EOFce0yM5uyFzmBSjWUC
TLSH
T152C423969693A8DFF28A81B1B243D605D52C6F09DFC362D2F62D70056BF5253EC0E8E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 b784e911be4d017fec56600c54cae81167dcaf6a99a8de51ea4f15e1fce8ab60
MD5 0ca7444ea5e7a68821851a91eb5e50d7
SHA1 7732d3038bdee7ae26b6ddd4eea29a45c164d00e
SHA512 597e3fe03ce7dbdadee9bfe46a4a4396e9988fe4fb6a6654f6c90f29d0ec21d44ba36fdaa76e89b9878b89a300df7d0370529347aae0740d7ebb63d9aa0cc608
SSDEEP 12288:fWQFe3eng3wH6EO3liucRkU9bhEM5uMr4U3zzqBSVxWUT2:fWQFLnqwH6EOFce0yM5uyFzmBSjWUC
TLSH
T164C423969693A8DFF28B81B1B242D605D52C6F09DFC362D2F62D70056BF1653EC0E8E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 7949646690afef00f0e55ad70206ad642839edd3cdea01e128d0c27156dba2d4
MD5 be5fbb18c7bbb72f4e6a608b43e42591
SHA1 0663aa77503be9f7872718c3139998c84bc07148
SHA512 ace2bf718a05704f7e0c9fd9ba24e582e472f25e3207f49a139446f34e0c6c46a47c68192663cf8acbecc393617d36931985d4ac9862a585dbabfccabce68799
SSDEEP 12288:QaQFe3eng3wH6EO3liucRkU9bhEM5uMr4U3zzqBSVxWUT2:QaQFLnqwH6EOFce0yM5uyFzmBSjWUC
TLSH
T1F3C423969693A8DFF28741B1B242D605D52C6F09DFC362D2F62DB0056BF5253EC0E8E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 6a82b2f5eef98df8128f85d544a8e617bf7d96ece9088d2c052ed9a97828ebc3
MD5 bd2b72c0f84391c2e8634c4a3885f6eb
SHA1 6da13608e555ffa8edd68c0fdf6647ba86a9c9df
SHA512 f2e271802b17b432642830b38134cf6f29bf0101d74269909e6149144822953b382bea7265843132a76b292c12d8a245aa327aed8ffb92030f4dff40a3ec3aaa
SSDEEP 24576:VZMSzFVSOCQFLnqwH6EOFce0yM5uyFzmBSjWUC:VZMSzftrqwH6Pcy0uhSjWUC
TLSH
T1FC050295B3901CF9EC67813EC9568906D2B27C1A4BA0C65F13B8321B5F733A15C2EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 a7fbd20a3d650bd962cc82e600c582601db3661b50d1a960e06145436acd9bf1
MD5 d42d6fb35940c09cb7f84eedcc60d70b
SHA1 eeaacaaff12b2213085bc613709f5145d4e6af06
SHA512 5b6b1f7446a81334e3935bc369b11ab46e8cf19875e1c24ac48f322e2b8aee23c95e61fe46df5378332aa823747c56412e5969c0d0237d964025141782aa256c
SSDEEP 12288:NpQFe3eng3wH6EO3liucRkU9bhEM5uMr4U3zzqBSVxWUT2:NpQFLnqwH6EOFce0yM5uyFzmBSjWUC
TLSH
T136C423969293A8DFF28B41B1B242D605D52C6F09DFC362D2F62D70096BF5653EC0E8E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 bd631fe745e7033a6680fd212cf85912e8f6fa66a5cb8086f6a9e4890c168be5
MD5 4f15ed3c4704ebe3445489ec1fbaa5d4
SHA1 73e1b63a1d8ae7cce3839d11b7ce6277c5ff9e58
SHA512 30155143c4a822670188ac3f8588edc9cc943c3306e81682c9abe0f02b866ceda274c894771057bb7348446da3ec6b5267ecc0186862671b52edaae1f700f84d
SSDEEP 12288:/lQFe3eng3wH6EO3liucRkU9bhEM5uMr4U3zzqBSVxWUT2:/lQFLnqwH6EOFce0yM5uyFzmBSjWUC
TLSH
T11DC42396A293A8DFF28B41B1B242D605D52C6F09DFC362D2F62D70056BF5253EC0E8E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 fcefc3f967026313fb06eb4c2b63a9abe794609c95b3dc4c97b47c4be35cf5ff
MD5 94cc4dc98702a73138c75a7a80ba883b
SHA1 ed1d3ea1169cbe7da7aa1f896e1d171ecabc4109
SHA512 cd9c713f873f971720e052351b5e8a02120d45fd09bc70025c33425ba77a15001b0f97f8dba2715f55b55f6442c13fd2e96b4ad9ce50aa813c3baf5863a3f531
SSDEEP 12288:pyPz5L8eQFe3eng3wH6EO3liucRkU9bhEM5uMr4U3zzqBSVxWUT2:IzyeQFLnqwH6EOFce0yM5uyFzmBSjWUC
TLSH
T1E0F4125773A230FDE1678234D9925A02F335BC364B619AEF536402762F73291AD3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 e03ac212ab2e0e7a9ad3f477dc2c5d3692fbd2a6011d1049c5946eaaeabe1872
MD5 9d1895a81f8abc910257814df41b66fc
SHA1 91d110fdc9527c3e5e9c5bc7b9cb94068bee7608
SHA512 8950115ee55f3d64fde3471805447cfcbc80145337731a2c4d288fc1e7db287ae40577ed0fc0b0da4553d5638ffa5d9dcc7617ad82f403859dbc9055230dfae9
SSDEEP 12288:jpQFe3eng3wH6EO3liucRkU9bhEM5uMr4U3zzqBSVxWUT2:jpQFLnqwH6EOFce0yM5uyFzmBSjWUC
TLSH
T1EBC423969293A8DFF28B41B1B242D605D52C6F09DFC362D2F62D70096BF5653EC0E8E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 54e3c325d9640d3e48908d248490ecc7688d7d60145832e76ce22dcfbe8b7f9c
MD5 683341c8c3ccd2bbf255c4a0ab1d555a
SHA1 a9e29e1f41dc6d535a48c0a5dbea958c86dbb385
SHA512 d2e580059cbfdc3a6fcb238f5974c195df10a15fcc9f20e507ceb422bdc5511b4986155276dbfb6c4a85130105f8a7c5785cd7c78c3d8d2b362b6d84d19b12b7
SSDEEP 12288:zpQFe3eng3wH6EO3liucRkU9bhEM5uMr4U3zzqBSVxWUT2:zpQFLnqwH6EOFce0yM5uyFzmBSjWUC
TLSH
T121C42396A293A8DFF28B41B1B242D605D52C6F09DFC362D2F52D70096BF5653EC0E8E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 6d6e7468235e2358065269b56149d816aa955cd82094b42b8765f4ccab2ac983
MD5 68b6ced8367666a06ecc0c9f5365bfd4
SHA1 b8a7f76499b60e6ae85cf1fb3be55f58e19d01a1
SHA512 e30a4dd4e4b131b3ebcbbeee25322770732bb86b0ce4b2b404718d1f39b86babd6800cb15e35e1a44f433ec4ef655b7f6e499bb7d0f677b47d187e326e3a5d48
SSDEEP 12288:ByPz5L8eQFe3eng3wH6EO3liucRkU9bhEM5uMr4U3zzqBSVxWUT2:QzyeQFLnqwH6EOFce0yM5uyFzmBSjWUC
TLSH
T139F4125773A230FDE1678234D9925A02F335BC364B619AEF536402762F73291AD3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 c9704deac3dd4bd7a3cd69a63840184c58707330c6634ab8d4ab2531a996780b
MD5 ed9b77831f843e479832ad434d12c2c0
SHA1 1c5235eb377858b8582b93d0c1ee6adbcfc5d7b1
SHA512 dfaf9b43232ff4c2964359c7836e9a6c769cee6e3e567cf773855a3adf815decbab98a0d4571178363ece124f4bc2684d4c7ec78fd0dd73687174df6a6466b52
SSDEEP 24576:NTHaLl3z0zDsQFLnqwH6EOFce0yM5uyFzmBSjWUC:NT6LljYrqwH6Pcy0uhSjWUC
TLSH
T18B0502A5B3901CF9EC67813EC9528906D2B27C1A4BA0C65F13B8361B5F733A15C2EF95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 17d5f1e601dc7154061405233e3f6bcb71731a117313efe603566c7c6a166e0f
MD5 cb2c5311f3f9b7245d566dc5b215f51a
SHA1 05aa240983fec5fc0cc065d6218a972d12027298
SHA512 635dff53ac6a9ac6735655155cb77efb8333c81ae14906890b08f2e053b8bd9cd8780c9fdec87def34290ae1b77a8a749ac6f7d1506802032d9a8fe005ca9a71
SSDEEP 24576:237d9CHKy7GZQQFLnqwH6EOFce0yM5uyFzmBSjWUC:Y7d9CHKyatrqwH6Pcy0uhSjWUC
TLSH
T1E125CF90F3E414E8F0B79A35C9728512DA767C5A5B61DE8F03A8251A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 b071c9f9a996ec83cbacb41df70112afad90a3b6ab829c7e7aacd5db873d691c
MD5 ce35c660ab9f85690d5c2e6d82acee4f
SHA1 a26da851aa11117bd263e0c0a545b95d41d25cd8
SHA512 c68db57a7c1ed68bfbcccbb15e95c0ab4ac5b3d975d02601f92f04b6fecfba652f92514ebd4b1a47fec7f5b613475d7e679b68fe5715c383585bbf9f81368ef1
SSDEEP 12288:c8QFe3eng3wH6EO3liucRkU9bhEM5uMr4U3zzqBSVxWUT2:c8QFLnqwH6EOFce0yM5uyFzmBSjWUC
TLSH
T122C423969693A8DFF28A41B1B243D601D52C6F09DFC362D2F62D70056BF5653EC0E8E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 b08195784bfa34ad614fbdc0151566a68aa9849d0247992c749d95dfb60327ec
MD5 8f6defceddb9681c28979a04c53dd3e0
SHA1 21f3afdaba0430a099091d5d5cdf6487da289f2f
SHA512 834ef3a2fbd96204b4edfcc0b1391d524cec0491389aa00b9c5e0c4051d16baea24c76986291aeb70861b5727ad6c1a6fc3606fefc415d9fb4051eabfa767e01
SSDEEP 12288:l+QFe3eng3wH6EO3liucRkU9bhEM5uMr4U3zzqBSVxWUT2:l+QFLnqwH6EOFce0yM5uyFzmBSjWUC
TLSH
T138C423A69693A8EFF28B41F1B242D601D52C6F09DFC362D2F62D70056BF5553EC0E8A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 7b1bb789ed7b8dadfd7743916794cfd4f4a0825adb4c6ef414832976df5954d3
MD5 12f2642d50045a77ee7e715fef8f0e76
SHA1 bddcd4281f4ca38598ccd788783ddfbe4372a792
SHA512 cb4835e9f75e79d9d3d84523238e400b454eccccac2dc40db82ebdebaa904a782e287bc2fc5a16966098bcc43d7a3c00eceb3f3515d4decbc5905b5f807e201c
SSDEEP 12288:AbQFe3eng3wH6EO3liucRkU9bhEM5uMr4U3zzqBSVxWUT2:AbQFLnqwH6EOFce0yM5uyFzmBSjWUC
TLSH
T188C42396A293A8DFF28A41B1B242D605D52C6F09DFC362D3F62D70056BF5653EC0E8E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 733a3b52528fe147552fe0ba49df9466deba9ae07170a1b228b742f0fecff4ee
MD5 d8fe7ca9f99103caa06ac5e53653fa8c
SHA1 93fbcafdc6d5600004f5c2c6355d2ef6a6c7bc87
SHA512 acd971b95ab19fbee540503e176cc0ebde4ca552d71e495e0a2ce10ae55f0cd35922b85bb86e60a2ce64dd9c0df57c1c0e139188051e1b65d85bf2fa8af6a952
SSDEEP 12288:kpQFe3eng3wH6EO3liucRkU9bhEM5uMr4U3zzqBSVxWUT2:kpQFLnqwH6EOFce0yM5uyFzmBSjWUC
TLSH
T1E5C42396A293A8DFF28B41B1B242D605D52C6F09DFC362D2F52D70096BF5653EC0E8E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 6286dc679732236b5bc9b29a6a4ce9a4e929e98f06908eeb7e166c70b3d11ddf
MD5 74709327c6e68f87ca202636d3d5d8ff
SHA1 7d23a6929831a4c94ed64c581ab3b2ec4e96a7f5
SHA512 336ae876e030c307ea0913971ea5cea47a6709a4f53b50f8520e3b7595cc888e591252228c500430bd57317436b048d65be4f29c4d09eee1351d82d24061e7ce
SSDEEP 12288:s8QFe3eng3wH6EO3liucRkU9bhEM5uMr4U3zzqBSVxWUT2:s8QFLnqwH6EOFce0yM5uyFzmBSjWUC
TLSH
T1E5C42396A693A8DFF28A41B1B243D605D52C6F09DFC362D2F62D70056BF1653EC0E8E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 fa1be492b56d2c5a93a2d21875cd4e20160ac28b45000cd09c24031d23eb4769
MD5 3bfc639b46c853d3bca178bf0839fa89
SHA1 6900b905178b1a02985d4a07bd01bbd86e404fa1
SHA512 f711fe73c7fcd605abad32e78907e496414f85679d09f382778eddb42966f650487d840f8a4721f7d0fc2c416d8e83f6b64563a30485fb0b059134d4cb2b301a
SSDEEP 12288:JhQFe3eng3wH6EO3liucRkU9bhEM5uMr4U3zzqBSVxWUT2:JhQFLnqwH6EOFce0yM5uyFzmBSjWUC
TLSH
T1A3C423969693A8DFF28B81F1B242D601D52C6F09DFC362D2F62D70056BF5653EC0E8A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 ea7c0c6fd0dcce1efe14534643e96eb25de003db954fa540d1d76e066f0c0121
MD5 4f50cad29f605fbbca667ead1589b394
SHA1 863310ac5c0a8aaca45834c20bb0100e2516c19c
SHA512 8881ab7227911fb3db4d2bbc02330cffbf8d165d3565c83e713732588ea9f5334da476c000bed4f1051396ca8d6e6a72c4dc83800ded3568b0a7c59360a92a4d
SSDEEP 24576:efwvok9RX6wkyAIVQFLnqwH6EOFce0yM5uyFzmBSjWUC:iMnYI2rqwH6Pcy0uhSjWUC
TLSH
T17135D029EBDC44E5E1B7923C99B3460AF6B178595B32C2CF125A536D0E33ED09D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3b7b8f4ed357c30c476c5ea5698b33bcc2ea87841603495033792594702a9371
MD5 30871fcd1ab68704251784293cbf5dae
SHA1 f7d333cc021b5d066eed39799160c4d851f35faa
SHA512 f80dd127d09217b148b0dff09b17cd4f2927e25fb77097caef253b2562f090acb4afd4ec7c0af804c43cc458d253ce46fd1bfddbad472fd0fa7ee7b28387f36c
SSDEEP 49152:PYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0rrqwH6Pcy0uhF:LySzPHcUDuhSjW
TLSH
T1CB066C96A1A841D5C1B9C1B98B0BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b33f16c48947c7da0803691fa5867c3183b4e1019eaf197f17e8021a97e53c2f
MD5 68f72e0467b4c145ca3d07179cdd4ade
SHA1 096fc3368e7af4b67199b3dd4d4a78085b814468
SHA512 a8fb721955ecd9bdd2feaa54e29053098a719350697cbf3527a09b55ee818462ff883b268d2d843d0b86be0a8ccd54f21fea7c08273c11f5fbaba87de245120d
SSDEEP 24576:n47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYyQFLnqwH6EOFce0yM5uyFzmBSjWUC:n47JUQj1irIhCnDHUPfF/brqwH6Pcy0E
TLSH
T12065AE1EA3EC01E5E1BA827885154A1AEA71782D5F32CACF1270437D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 73b08a99931e0c3e65c0c5a50318e5babad38894ecb31d64fa9970e761530bc8
MD5 79e164fcaebcd98f73b95f290de86473
SHA1 4f22ac38db5481b98853f7578d90ade3316746e9
SHA512 364df2436a77ebd376af65d119529874013739f594091ffff2f2a23c96d5833879b44e117dd0600729833eeb7b918c67fba878ceaa58923a47fe765a030db1f6
SSDEEP 12288:iNsf5QFe3eng3wH6EO3liucRkU9bhEM5uMr4U3zzqBSVxWUT2:75QFLnqwH6EOFce0yM5uyFzmBSjWUC
TLSH
T1BDE4015AD29411E9D06E6275D7428A01F3373C2587E2E3CB62D0F03E1F76691ADEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 493ddbc2d920cf3884990b6b4f625a0fdfdc6262d0acbe2e84fe8c8b52bffd4a
MD5 f4ba2eef5a8ceaa4646412ee7bd30fb5
SHA1 c9bee2945e89da088855844bc348443437f6430a
SHA512 411c0162568fc8fca2b8bb42604a42a3d627eeb5e9dd2b063f71947cda4c161893555cdefae467a34083782cd299283d822560334767ca0fdd2d884fe19c717b
SSDEEP 12288:PF9dz5wU3fTg9/n9Xvou1mBdoeVl2dacK0B:PvFOUPTW9Qu18doev2dzVB
TLSH
T1283519017666CB4FC66940326E73C1CCAB707D41EE44AF0773C9873F9576A58BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 c41a98f99e2bb9e46642bb7793bff79695ac82b1f1909bef1b14e512024697e0
MD5 7d2958c43b9bbfd6c87eb9e93edb8e81
SHA1 39b6c1d022d25aa91bd8c5fe41b5fd0910610a8e
SHA512 e4c0063bfd32faa3a2f661c4ff597da1df4e45ac7ed460c9ea717fb68fb6d09742b2c09134a781b9673756774e86f23424c429e35b72bc9f37f0334b52eff677
SSDEEP 6144:K3gJnYz5Vrx+VlpVBx5rn/ypX/dznW8kwniov9xUnWtMxBnWtMxhsu0md92ohuuT:u+2UxxpBkiB2omftiN+O
TLSH
T17B75FA40A137A68FC5BB503203369B4C67B4EC0AB7496F1277C9493ED86BB41B1B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unst1792339617446-copied.exe

Path C:\Users\Admin\AppData\Local\Temp\unst1792339617446-copied.exe
Size 3.5MB
SHA256 5bb5204a4651812d68da19f918661cf0da6551462373b3afc551b95bc8aeeed5
MD5 32ef080b58191a8e61a166f1e1497111
SHA1 4217dc88533aefb4c57871bf2d04b5e0cb8410bc
SHA512 97de575560f9c2ccc77fb4462a0ff317db4443797e14646a9d05158e4a884e7aa8e76780232a988e6f380a6088ab482745bc8cf8550a41a4cdfceae51eb9afbf
SSDEEP 49152:Vph2lwOsns6h+92ZbI1DGpRw5wF3vXNDmnarSj8RoTCC+rqwH6Pcy0uhSjWUC:V9JbI1OlDeJTMcUDuhSjW
TLSH
T1DBF5D007ABA412E8E1B3D17DC9574A46EBB2BC151331D7CF02A446D61F272F14EBA722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

864e6291612dd39a.bin

Path C:\Users\Admin\AppData\Roaming\864e6291612dd39a.bin
Size 12KB
SHA256 7a3300b57343bce966e66c1dc405da1880d9fe5993eb5cc69c7e58651ce3acc2
MD5 9ad1b4b519ac7d54634704db8a8fc504
SHA1 fe1ccaf942f9a727e6d0ba62d13bfd45d075a0ea
SHA512 b9098022e6ba3d933c926b86c257034bf3bb91b2618d3a0883d8766527fcda1f804a8f72eb537dd16a8aae1992524a71dd4279aadb46e87a47613fa3dde680bb
SSDEEP 384:N4zMZnoQTC9dHVF5bUb/l1FllXSw8+zeHUO/:N4VCC9vFMfF7XSMzeHH/
TLSH
T1E142BEB78D848F22138C419B9E4CE25235EE2B81A2EC743A97D35AE7894E77CB154681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 68faedac45719174bc9e8a0c8ccb7abdce5d7e5b7de8b333fe1d9b68687d2482
MD5 63165d8aafd91ac52ce7e21b6b4f9ea2
SHA1 fa9d97979fba82d25b74e8d9cea768913025f4ee
SHA512 ffb600272a30f91c24955a6457300bd17855987729f2a5de03eed2125c85e95baccdb05a5f252d343a125f4bf349dd7e6948651c0779704ff04179c44bd9e70f
SSDEEP 12288:8z7xQFe3eng3wH6EO3liucRkU9bhEM5uMr4U3zzqBSVxWUT2:KxQFLnqwH6EOFce0yM5uyFzmBSjWUC
TLSH
T1EED423629396AC9FF1AB51B0B247D611A22D7F08CFC3A1C3F11870496BB16C2EC3E955
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 18e7131759dd0fe3cf9f4edc06f36b5d087d365f1203353b5a1fb44b645a2e0f
MD5 66b60767ce1144669c0cc174338c0130
SHA1 5ece3156068f13b92531b0b3ce8bff0351b3ab41
SHA512 4175edbf2a86357b6a34600b7f95f3cf93b71cc0d963fcd4a993d9a3bf830f61026208d71fc6f39aea5747bdcc96d801f8c0c83ea7a72144990eff9fd3a0978b
SSDEEP 24576:zgb6bmBIi49WNNFpg1rSvFv7bYDQFLnqwH6EOFce0yM5uyFzmBSjWUC:zgb4mBIBhGFhrqwH6Pcy0uhSjWUC
TLSH
T1D565AE1E22EC02F5E0FAD2B8DDA64417D6B278164732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 1.3MB
SHA256 46c0d44909140f4f8e2cfd0e81559d367ebb0220a95a90be2b2e7cb2173159f3
MD5 1da2a629f6e2e3b3fae30f3bc9911970
SHA1 11ced03b321e7197f32f1628f6c3dcab0c3cefef
SHA512 de55e4e0ff765bc1a5ced42628c7b82094414fba7280f4b5f4c9454f3d6b394681243ea889cd5582183998dfb3a93f5b024f2c7f00ead895ebc229566ed0e4a1
SSDEEP 24576:i8kNvNnaFeYhJNtmZBmkQFLnqwH6EOFce0yM5uyFzmBSjWUC:i8MwBtOmPrqwH6Pcy0uhSjWUC
TLSH
T17955AF6EB6F845E4D1FEC6B4DD238512E6727861073293CB9290C13E0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 a6344fdcb3eb08a7c63c46b1ac97a8cf9c01b3de7445e79441b1e1bcc04d4ca3
MD5 d602f7ee10440cd831c17f88eec4d5e6
SHA1 be6a087706427dabcd534e99e152903cd448dc5c
SHA512 860df6fab1a999fdc88f4b99ff486e29bfbf5743072a0cbaba12441a9e11f26a9549a41db85b410ec5e84216c591e972e92451a7e223e662c71de1b0090f73c3
SSDEEP 24576:BG88u8FpJqH1bzria7/mCQFLnqwH6EOFce0yM5uyFzmBSjWUC:E7ZFPqVea7/QrqwH6Pcy0uhSjWUC
TLSH
T1D635F16577E101F5D47BD1388A824663F6B2B8250361EBDF07AC8A551F23AE14F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 4fd2f98c8ec8767ce1bd6716125cfb5c6e9cdd081f89f563c82e2a703ae2d137
MD5 522af3f9efc0ad2238d5ff1f28dccd8c
SHA1 1b1c61495368ea84c77772cec9fb16743ab774fc
SHA512 5df71fa7cc949de24a37c6a8d1fb09bb4f4c0375795186d7816625c3df934b282bd3a6570321a199ebed270ef2b46ffbfede484adc019b40353a7e53a80f59e4
SSDEEP 24576:jPUr+NQGQFLnqwH6EOFce0yM5uyFzmBSjWUC:jJQtrqwH6Pcy0uhSjWUC
TLSH
T10605E12F62E918E5E676E17D95828709F77178520752E2CF02A0817E5F63ED8BC3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 61456de147243d36aa69c3ff3257cbe9adaec12c4a760bcad70aa95d62f86e4b
MD5 48c8908dde54ecb5bb0bd4534f9da1d9
SHA1 eda61153e40bc6910ec3fe69ab0d0988e4004326
SHA512 b654aa34262e9331a6f3cdd968a9c6d4e2da3856d96cb080f0c338dd840ef0d62f134e559137af99254b857f2fcfb5089e1729bae85bad96151c752484d8f533
SSDEEP 49152:pBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj9rqwH6Pcy0uhSjWUC:KG05lO43bAcUDuhSjW
TLSH
T12ED5C06E62EC11F9D1BBC17CDAC6460BEBB23815033556CB02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1b85f16784e96007afa8ec04f7d0292910c65b37ec23cc7761f90809aad38707
MD5 4a5bc2c54d3b44e85f9774a293c64b53
SHA1 39b843c008fd786d20fcee730b911dccf76c86ad
SHA512 264246c05dd4b1e91dd760463661bafdba98d62e912df806c41aa2cb78fd35db410cb1b016688e61f5cdda1544d2e4922a72b18c5fb387806fdf64ba773b148a
SSDEEP 24576:sfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnoQFLnqwH6EOFce0yM5uyFzmBSjWb:0a5POZ3+Jt2pasx2+mlrqwH6Pcy0uhSs
TLSH
T12E65BF5EA7F800D5E1B9D17DC583861AF5B1342553329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 19569d8160c09314c17b41f5a8f479a981e0008e8f8dbaec1a63aad74237af81
MD5 cd482db756778c1f542f1c5ed41ac39f
SHA1 7a9c0b9c3ed0f564b062cae65e1ee98a550b26a0
SHA512 5c5b3b12c07958b5c3a3807444b16bdd8a1f3d98283730c976dff0615e96b5e6d6ab02251720599612487aa79b8fb36a45ebaa2120ce017d1d17fb4970694a5c
SSDEEP 24576:4NcwHdjbyQ4nLC18lb/EOjowL7FkqQFLnqwH6EOFce0yM5uyFzmBSjWUC:4Nc/zEOVHFwrqwH6Pcy0uhSjWUC
TLSH
T1DD858C2623E901E4F1BBE1BE89679546FA717869573086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 2190501d9f55f19523a46b97605b203aa88af416638f2d7a05bfd6aceb5090a8
MD5 2146045310e6c4c2282e637137d5ebe2
SHA1 dfaa6d344d8a6346d3fc1ed10df5749edc9e23cb
SHA512 ef6c2ff1bd3ddb413842c21f24031372fb21a5f53876776440c518b2bcf57616f162df43be4b086937750073b79f637b7431633fa04c6602265f35f2f6cfa6cf
SSDEEP 24576:26DInaKngL2jdshRTdG1YxITqvfPkbIcbjLm:26DInarSj8RoTCCW
TLSH
T1CF25126D63AA01F4D06BE13D96934506E5B2B27487074ACF4AE4C5BD4EA3FD8B93CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 18d724f721db19ef2f78625ddcbd5e57980d9379bcaf2c615713e7d4e86ef10b
MD5 a3f9f055209be2fb6dcf48d25b98d173
SHA1 b4d6c2f015b0716dcc21e10a6a424ff10f2903f5
SHA512 fcae4e86acee568f8a8fa1897cff0bb6fc6113861cc9d659de6f69b6f1f5d172edbe642f2b80d02e199bbfda13a2c1cd763051f3366efd615928a6670c41b39f
SSDEEP 24576:bD3FHshBIYQgA9QFLnqwH6EOFce0yM5uyFzmBSjWUC:bDVHeBIAAerqwH6Pcy0uhSjWUC
TLSH
T10725E17EE69D04E4E57BC1BCD6538A06E77138A9032266CB029481B91F6BEE47D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/712-152-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/712-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/712-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/712-407-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2284-8-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/2284-16-0x0000000002950000-0x00000000029D3000-memory.dmp

Download

memory/2284-10-0x0000000002950000-0x00000000029D3000-memory.dmp

Download

memory/2284-7-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/2284-74-0x0000000140000000-0x000000014037C000-memory.dmp

Download

memory/2284-0-0x0000000140000000-0x000000014037C000-memory.dmp

Download

memory/2284-265-0x0000000140000000-0x000000014037C000-memory.dmp

Download

memory/2284-1-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/2284-242-0x0000000002950000-0x00000000029D3000-memory.dmp

Download

memory/2284-244-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/2648-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2648-135-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2648-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2648-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2648-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2908-256-0x0000000002860000-0x00000000028E3000-memory.dmp

Download

memory/2908-248-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/2908-262-0x0000000002860000-0x00000000028E3000-memory.dmp

Download

memory/2908-408-0x0000000140000000-0x000000014037C000-memory.dmp

Download

memory/2908-241-0x0000000140000000-0x000000014037C000-memory.dmp

Download

memory/2908-254-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/2996-61-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2996-56-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2996-47-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2996-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2996-59-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4192-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4192-137-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4192-145-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4192-148-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4192-143-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4336-23-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4336-109-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4336-29-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4336-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4336-31-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4432-117-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4432-111-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4432-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4432-405-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4432-403-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4688-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4688-98-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4688-390-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4688-411-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4688-413-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4688-104-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4924-122-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4924-124-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4924-130-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4924-406-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5404-63-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5404-70-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5404-64-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5404-266-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5816-77-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5816-75-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5816-83-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5816-372-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5964-388-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5964-87-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5964-93-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/5964-88-0x00000000008C0000-0x0000000000927000-memory.dmp

Download