ac1aed7a49241601dd82a73436dc8a21cd8e598cb249a7914b8713489023ec47

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 12:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 3.7MB
Sample261027-p1cknade89
SHA256 ac1aed7a49241601dd82a73436dc8a21cd8e598cb249a7914b8713489023ec47
MD5 86fc1efe115ebc79270f665599903350
SHA1 e3d6d98871fc168df2360b8fe472b3a1ae5179d3
SHA512 d85a82530579fb74cb30d62fc2b2158ddbe8ddf411082a9b6991f7d0239ecbde105462d5c8ca6ee1394f0e79514c06715e219733a49c18eaa32e79b4c7f05f33
SSDEEP 49152:67JynhJ8EhdVMw7Y9odwfDFqfFFJVgrvqzbut1wOq/ejgXUeT+uXEkjNEEBHLuda:tsoEC9ia+uUkjDBHLuDw7mLQuw
TLSH
T1F906BE0AA3E406ACE0F7D679CED6C553D776B80D07B1A68F029098A64F772609F39713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5944	elevation_service.exe
2876	elevation_service.exe
2716	maintenanceservice.exe
3568	OSE.EXE
1232	PerceptionSimulationService.exe
2112	perfhost.exe
944	ReFsDedupSvc.exe
1068	SensorDataService.exe
3332	ssh-agent.exe
3492	AgentService.exe
3512	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\561546b0c17a6531.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104140\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048e80a9c1166dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b36f29b1166dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f7effd5b1166dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008112b89b1166dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc58ba591166dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a8714e5b1166dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa87765b1166dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5944	elevation_service.exe
5944	elevation_service.exe
5944	elevation_service.exe
5944	elevation_service.exe
5944	elevation_service.exe
5944	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	944	ReFsDedupSvc.exe
Token: SeBackupPrivilege	944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	944	ReFsDedupSvc.exe
Token: SeBackupPrivilege	944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	944	ReFsDedupSvc.exe
Token: SeBackupPrivilege	944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	944	ReFsDedupSvc.exe
Token: SeBackupPrivilege	944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	944	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3492	AgentService.exe
Token: 33	3512	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeDebugPrivilege	1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1004	2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5944	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 1524	3512	SearchIndexer.exe	100
PID 3512 wrote to memory of 5848	3512	SearchIndexer.exe	101
PID 3512 wrote to memory of 5496	3512	SearchIndexer.exe	102
PID 3512 wrote to memory of 4360	3512	SearchIndexer.exe	103
PID 3512 wrote to memory of 2904	3512	SearchIndexer.exe	111
PID 3512 wrote to memory of 2788	3512	SearchIndexer.exe	112
PID 3512 wrote to memory of 4228	3512	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_86fc1efe115ebc79270f665599903350_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2876

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2716

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3568

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1232

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2112

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:944

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1068

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3332

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3492

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1524
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5848
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5496
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2848 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4360
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2904
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2848 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2788
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9fe36027d7260172231e09baca21c67d3e3e5434b6bcb647940e656f3a90142f
MD5 5ea86dc0072ce83e3bd4b1b2ff0a1ab5
SHA1 261e702a6618f74c8a5456dc155461ad435f12bf
SHA512 ccbc4739702c0a2e7c8ab183ec9d805f06820aa654b6f3aefa5937d22ffedfd2cc42c41de70182dc980abe199b14ef6bbbba7edff116cd0d0a42f103b63877f0
SSDEEP 49152:Ob+632BuPkFKRrdE6ohvstBhuXjfS4LWxnOtDU42mLsZFQw:Q3q6sjBhw7mLQuw
TLSH
T125D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 ab06a2d238647b4a8b6af93e171b1d04c3ba4a461f01866cf1d42a7e1576b868
MD5 e79c6d691af6128c161b195e417875f3
SHA1 410a3408c1d7debfbe9ecc4040694427d31dcea6
SHA512 6b2f2388964a969e59b195943d7ec40b47f7a0bef37ce405934131d5ca972867251c51e826baade3e25d8f5592e150a9526f72078b1beec32458c98b720e379d
SSDEEP 24576:xXYfDtczAnnAUz5DFs1jsLqmVNPEZ+OQw:UtcYtDU42mLsZFQw
TLSH
T14105F12873A004F9ED67817CC9A2D505E672BC854760E79B03E49A3A0F377D46E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 cd6bbf0c24bb88ad30fe9c8c6e9c54e98440948810ac6299d09a600875b1bd8b
MD5 7cea898b4309ac4bbf05237254ae9f1c
SHA1 d84afe95939acb6dc2e347a8bb38a9db3d304168
SHA512 e380bffe264d3ab9d5a378e77a887b7f9f41fbfd74064a2def90e62aa2b6e42f031aac8fe31cccf3c31704b3274f9971c14f3654607d6289b2c13287985c56ed
SSDEEP 24576:40Le5ji0hmxxrMMnAUz5DFs1jsLqmVNPEZ+OQw:4Pji0AjltDU42mLsZFQw
TLSH
T105359E16F6748335D073C0B9C5D2A68EE97130865B308ACB4296D77C2F6BBE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fe98596d6e86a123400551648f20afeb330dd031e5f3832e35a68f2aea6986a2
MD5 992c464a7c660f3d443d1527d3d663d3
SHA1 a57b228c4cc7e7f3b21fb30685334c6d4491bc84
SHA512 0d4c15ac537392f08a9b42a6b81a51b344cd3b84ca7d06a26deba3058c59a3a620a75102d4cd065a7616f9017fceb411d6a348c6110da42a9ab2aacf04166187
SSDEEP 24576:qa7/ezSC6vUyD/aqgrvWn6q8wyuCnAUz5DFs1jsLqmVNPEZ+OQw:d/ezSC6vUzPveHjyhtDU42mLsZFQw
TLSH
T152755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d5b23da80bc9e935c4f3d53d034cba6f203c194f5a447429565d98a53d95a6f1
MD5 804abd9ef110fab47c3f611c5df45547
SHA1 96854186615ab2c72c7f85800360100e9c67a1ba
SHA512 d3278bae4ba202419f4e304b682665be4e9af667443bc732e774fe54a86eb23389b082cccd8bfa33b901b729cfb84f387a39cec33753d520ac1b776056a85823
SSDEEP 24576:BVbqPb88hv/l+YTnAUz5DFs1jsLqmVNPEZ+OQw:BVO88hXl+wtDU42mLsZFQw
TLSH
T173559E66F6748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 913f462aeea88d27101545682cf94591c3b6627dafb2945ad459176d86ed28c7
MD5 419a919f48b3a31e5d6943d7f7b82e02
SHA1 a9dc08993cfa2572404c717f1c45106a97dc8597
SHA512 13f3bc292023646dd1471cf68f0e4f6e317b788eac50050a307194fa75a056b13257251fc2a0664ff9515c292844b8d69526bc97b28264e6c93ad5a44be2157d
SSDEEP 12288:BLYjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:BLYnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T17CC42386A330A056D3572D75EAA6F94930B0EDCD6D21EA1B0DE2373F05BCAD2F456243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 ee3ad15ce8419c7cfae28f8d2594c68083514fbb11ed89ca897df8e6f11cc685
MD5 c97c5deffb9f9c330fd95293ae5786e4
SHA1 307e1e62242b0922f6d3ad84ea3e8c70472a9795
SHA512 97555c749095707515fc0e8ac455c7bdffe57598627a76358188cab3cc849a942670c28afd92c475691eb1f0c1ba23e28f7568f53ef33c36281c4b6f8194fc3e
SSDEEP 12288:oeBNUbTVO86UrjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGr:oJIUrnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1C105CF3BEE28FCD2C27A4DB85A91C600A77278704F62A3CBD175830E9E275E15D7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 dc60ac2fb33d69e69189563bded2a65df001b1546fa1330e7ae48ce50bc09f8e
MD5 4519089c0eafe9b9dff56f2e3ec2657c
SHA1 caf07a41d55d36fee64ac8a18f2d5241a9d50200
SHA512 dc0f9345139db929bf6d6f4a05f2af1cd14dd90c237db46b1fa2a7e82a8cf087aa03e14693e79d7934e74a6d6c46d15b24d58af0b023d37d20cd6a503bb2974a
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THO:NQvGAdlCEL8c/DRNw5COw7mLQuw
TLSH
T179267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 0ed294df16f59ff3e9027b6d48faa98cfb875e293af414c6b0e6ad00eaf7cf98
MD5 c129fc9281b724d94342c093e37d96e4
SHA1 37a9ba9f1b5470679d6dbb98a0ae6992cdcfae81
SHA512 3e2314807ec90ae1b0b2aa9726d28b461742356b585fe290b3825abacc0f3c26460c8948c9d86b6e9e02fbdf99a8aaefee7fdece3500c940e6a0761e08e051d3
SSDEEP 12288:jAwSfxL/2Dc3RDLLmt0LDQewsAjRjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcL:c0ewsAjRnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T18A15E031FB74E036C37B0DB21B36D716247CB9604B621AC3E3E85A9E49742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ffd4b3cdc765a5fb12e0afd8559ef7bf5e2cd31d718ae976b1f53a71268dd660
MD5 30547d0dd82510b4452bb0da162b2b8a
SHA1 12623726686b4f5d447e7c32e4e345c66a38fd54
SHA512 9d3ac18f77161efc210b2f224e3e6c5a1fa6397282205e696c5f6c2475e07a3e796c831dc0f41ee364fd415862f4ddbdd14e442adcf80a3b7ca9770c623a78a2
SSDEEP 196608:pUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHnLQu:pUEtQevvqc2W1cpV2tI32D
TLSH
T1B1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ce16e0ab9293311479178362513dd34d091cec80cf2b655bc35ac77e83490b36
MD5 43d91f8cd978c7db0879d343a1d74cc0
SHA1 5b97d75b491f3f824b3b3f2001b6f848e520004d
SHA512 85c0f41d698c166efe5bebe7b4395721992432373068bd5941b59a733f38353985324b5d7705bfd76fa981662a3370430eb795a6edc028c25ef869134c97234b
SSDEEP 49152:pCbRquA/m2yL5zTfFiV+XenmE3/z1tDU42mLsZFQw:moquVjnm6w7mLQuw
TLSH
T1A7D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 869d40f0d0650e832af87c9af039485cc75e8b1a6aef18fc0bb12b4c8a008e07
MD5 ddf7208f4367d71287e916dec27e9c48
SHA1 506b8b584215e51bcbdfdd5fdb508f7eae8af58e
SHA512 fd8c27534e5ec9dca23d069b6f13a909484747ce8a33b8922888198b93f2033d97a8d2c7047e3cb0ec40c26957ea1afc69ed4790ae30fedb11ced752ec5caedb
SSDEEP 24576:DAhGL3IFoiwtA5l7S532nAUz5DFs1jsLqmVNPEZ+OQw:DAMUFoiq5UtDU42mLsZFQw
TLSH
T16B35AE81E7F951D4F5B3AA7899B69170EA76BCAA5E31C20F2160D21F0E37E409D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 1fd9151419c9878661083dd574263803ef709b67bf179152b401aeda91e73c0a
MD5 1b22d13ce9dd354433188e27fdea5204
SHA1 fe25f76ca75d994461434d28a781e7aaf4cd5d0a
SHA512 e284ca104a16e5f9260aab12883c844fe35fcf158f589dc2b65718704029e0360596037b05b41566ed1f8632f76229a9424057940a7d1b3d2237fe2d139b12ec
SSDEEP 12288:amw5HEjsChNVBFgl0WDm+CijvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHn:zwu4OW1nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1CD05F04673A418F9E56755388697D136F7F2BC062A21DB1F07A0C72B1F3B261BD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 2cefaebc570300bdd779288b7eab801e019fade1ad866f58c59e758e98343626
MD5 973a68879acab4ae1f33296095ed5b6f
SHA1 0fad53d439573dfac5607851e55f3c9a030701be
SHA512 131a9961cc61999a039972305d3948c0c756797c0e9ac6808e51fafa64c74a0b1b31f2a4b6631157c17d00a90c6c50b0c79fca4b5d1b392bd61bbda4ea22a680
SSDEEP 12288:ceZ1IyhjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:FZuEnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1A0E4128A33A470F9D263557CD9E1A605E3B1B886673283CF0665136B1F7BAC26D39313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1c8150acec6e5ddc819631e023d690bea44e7d237afddb328d53aab716a88513
MD5 38904251f1a1d4ab0dc806f41015d527
SHA1 90699b0ef156490dc1884504d338b917b47f66f5
SHA512 9c564cc3199deb51ab11dec2fed9d6634b32cf023740b88438f9e1aeea75939eabfdd915282477cacc3327302198d3c999aa6a78a7f12880edf6b9dc2580684a
SSDEEP 98304:aQRQyi36YOcPbLvw2gAf+PN3Vw7mLQuw:RQyiKa/X+PNBLQu
TLSH
T15E667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8851b0c95a8eb2114aea2b36fc69c301aac3f43d5e976dbc6309d80f8aa6fb3d
MD5 232815dae2272bbb452853616f11e274
SHA1 3be6fe239e8c16d8fbb9e1c4c8c12700028f0a5c
SHA512 b5534dc8cd06b04eef7ffe3af63e348bff1901e8112d84cd0dbecc3ca94062f1718be43b4ee220731a4f50c831d5345bd2c67be7164002ab6dbc43849c6b1d63
SSDEEP 98304:oQRQyi36YOcPbLvw2gAf+PN3Vw7mLQuw:/QyiKa/X+PNBLQu
TLSH
T1FD667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ab6c8b0e4e742f27d662dfa830f0ea8c637585c073c9ef4ab5e871ed8dbd772e
MD5 b1d0eda2bc16d58e97d8417d2829a07f
SHA1 24ed20f452310f19a5d224478b248670c649c35e
SHA512 f7c39b1be6fbd8a51178ca76cb73970c0c5c57946c9958907ad2abc31010291d17efeb8c025a47116941bab0769ea2d1e390668496019c82b455c4fce7b90db3
SSDEEP 49152:y68Qg55nhceWu7PNU3/ltDU42mLsZFQw:wthLRc/7w7mLQuw
TLSH
T11BB55A33B2F20099C44DE1769F4A972196E17C758FE0E3DB8511721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3e2ee46bf4db3e8c2cd614e88d8e0224b6d03e3f6d678d96443a14410643f01c
MD5 0629865133af5bf2a5b84732dccedfa0
SHA1 28cfb69781de22bf9b47593b5deef1ea99250806
SHA512 3449542907c9ec6ec94842c104e35e84268bd7eb4340d6f4117a17252c44b80c2a34151ce697afc61a103dcf37abbbd60c5c252b5244a07b21a8c168d65f83c1
SSDEEP 98304:ly5112gYy5azzVvt69nLKnhZow7mLQuw:ILIHEWh4LQu
TLSH
T190167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e41fa90953b8038bc21471d56aa0e0cb79e4a03cab0becd322ff65557335cd69
MD5 109b34b6dfb24e2693cb49096795437e
SHA1 3fc50bc5c4991f7525e044bbbcce88c269a0831b
SHA512 a787668683430b23c6b81530f08aba81c178eb5bf59f5646735f7474cdef8199d77337648286242ce81f6c027c58382c8580b8703bf8d41dbe616a72858455f5
SSDEEP 49152:uB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl3tDU42mLsZFQw:8u6Jmdxd2d9w7mLQuw
TLSH
T146D59D13F2DA01E8D06ED478974A9233E962BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4fb26a7deeb2ee7e0a817abe96080b593afbcf81706358967ba7cc0eef727f93
MD5 ef960fc1a80b7a0373eea427cad9669c
SHA1 e1f4f6d7093f6f29b94bc929ca2d68882582d384
SHA512 29af3679d2f803e915de32648479980358bebed45b2dc37c04e388f7d53ce5a7c31d28d3e8abbad4321ff40c1cccecf64c543d9e8a295429cf08f8ab37eb68c7
SSDEEP 49152:m1hpsNoJpF1A63U44CwH7R4xTtDU42mLsZFQw:mmifPWR6w7mLQuw
TLSH
T198B5BE13F29900E8D05ED17887569232EA72BC460B34B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8ab6a2531a4648eeaab50672af7bdcd5bf0be3f18aa4dff403fc486061e05bdd
MD5 b1305b43008c62f751136e0543a6ff94
SHA1 5a038ce7838b146bd5ae9bf769ffc6eda6d4cf67
SHA512 0e339de6bd767899489f46c884d78087cfb432f232d998a8067a12a15ddc4ef254a244bebf7f54e5cf2b91a49d25e85317907dc3b856e45695df42daacaf8497
SSDEEP 49152:YSuZQIY0Be2KcRVtOnks6NMHq+tDU42mLsZFQw:C5dKii618w7mLQuw
TLSH
T14CC5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c8c99553f4e4424226e2cccf9c105c05772d01207bf38485aaa4aded595dd701
MD5 bc86ddcbcb81d5f935c32a27251f5ee5
SHA1 dd69c0bbac1f4e1097b183049e23dc4a21c016ca
SHA512 d8424aa7fc54aacec3eb75322d8f45805cde269f112e374029150031774bec52f4eedd257cc5bd57070cb97dffe0054cd2ff7bd0e58f017d5f9ef083d07f0030
SSDEEP 49152:nhtSn8EApI0fig3giDn0AP5wntDU42mLsZFQw:2X2imphmw7mLQuw
TLSH
T1C095BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 247448a456de3aab05c4084c12ccdec2fc9fbf1c8bfb00a915051a9f19c53143
MD5 56993bd5d5cbf13c6e9092d70b214e7b
SHA1 9e0e9fe12667b7dc04ccbb3cfb85805bd83204c6
SHA512 e3d730474fdf5312a15b8cb005c0c9d19060686c7c363bd897ab9d701101da83ecd11832a08d4adc7f571f047146fd75281cb842e78bcd941bbc063567127449
SSDEEP 12288:DQjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:DQnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T18FC4238673319056C3061DB5DAA5F54930F4EDCEBA22952B1EE7333B07BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 a3247062043d22efb20a278c2e543ca5dd60906951faf66dbda21d5c69c608de
MD5 36c018d6cc5b218246b749a73e2f494d
SHA1 4068a076db2b83c6a91f3d052d8134d56eb1f64f
SHA512 ce07caec96aef6a8faa70cf2bfe475271d26b7dd1bad5b534ecbcb30bbc072c124d8c7ba756ac593916a24cb697271148d8294b86c583750c3eb9d31b7407360
SSDEEP 12288:Y9jvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:Y9nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1A3C4238673315056C3061DB5D6A5F54970B0EE8FBA22962B1EE7333B07BCAD2B856183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 3255acf303b5f84f09247a873a1871d90774c37f71f6b7127ae9847af02b5d39
MD5 94ca0a8aee78f086507ac29ff2321750
SHA1 6d16435027884f99b1c9a1d97ff55f61e298671f
SHA512 3043cd9c3f65707981b624127c648eb94b8d020bb02050689788e404763fc940d5e68204769029fca2a606d2fe1be6bb0197344c59fad50ec87033815c90e386
SSDEEP 12288:2DjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:2DnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T15FC4238673319056C3061DB5D6A6F54970F0EDCFBA22952B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 d1940fdcbe715b1d7721f6b27c27256c4152b817f6702073d73c71826c13b1f6
MD5 e70a0b42f12d81e5210c7c9d3700539b
SHA1 cccab6d5fc048e817757a54acc14e7521398de2a
SHA512 0411ec553d6fbabe9768115f10007807d2e4856f62d6bbaeaf8dad413f0a87d45756c0602ace1a3e703ab9cc3f3d827e121c205edf1fd1dc8c5fb96e971e870c
SSDEEP 12288:6VWjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:9nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T14FD4234633355096C2629975CAA2F505B1F0FD8EAB32976F0E92272B0EBD7D1B835343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 77ad6e5df1c0d84224b80ce3e057c3d3f88c8b116cce2319f725e8946276d6db
MD5 cd9800941916a3afffa8a9f240e21183
SHA1 37bfeaac150679e0562b776b18dfd236db31554f
SHA512 6f37f7ac89ccabfd95e31baac7e09cdf8971c93c78ba46a5e11e3aecb120f0cca458d5d43fc08a756b8789d00e0611ad4db685aaafcaa23357dcb9c4da4bd56d
SSDEEP 12288:sejvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:senAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T19BC4238673319056C3061DB5D6A6F54970F0EDCFBA22952B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 863a28c02ea9120a8ea0bc13b2d1a2d21b4d80b3fe3630673fc781cf8709b6db
MD5 8a52d033f463003cd41feeb1e887dfd0
SHA1 08d93cf7a446018dc75ac65d72da2c69ea08c039
SHA512 cd46cac25023896175fc4dde7964d143446c657743c28b91aa976b3f679351065bc8cd4a87b5930d4e9436752b423fb1a798d4ae40e6872f284c39d954977821
SSDEEP 12288:9pjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:9pnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T139C4238673315056C3061DB5DAA5F54870B0EECFBA22962B1EE7333B07BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 831938922e538c19b9f5c910d22396f7944d35fadcef86878539943f162ea585
MD5 063403ccdc52336801b18a080b1d615f
SHA1 7074b51eec58c715694c0370ed91734b9bab0b96
SHA512 5ff9c8d04bb04c5e4888b623a23af635b0fa56389279229610471e62db3a12ef1e0c3cfcb22397b9ee9649bfd79b4f14800dc53ce4e25a1810f12693bfa62ea8
SSDEEP 12288:oljvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:olnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T108C4238673315056C31619B5DAA5F54870B4EECFBA22D62B1EE7333B07BCAD2B416183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 3009e769045f4bee721e803a9fdc786b4f76e2227c08682c99d61ffd6d2ec59b
MD5 7cd9a83fcc36e8ab317b474a492ffa94
SHA1 54417f7e8a689f97fedef8c735105bb646bf5733
SHA512 28165f21a7297f7dd298a938303dcf625bdf6c08bccb645a6702848824ebf875ac5bde6c0ec4d8e5aa964525989653c32cf66c169f3a5dafe99a3030aa055f8f
SSDEEP 24576:3ZMRzFVSOdnAUz5DFs1jsLqmVNPEZ+OQw:3ZMRzf9tDU42mLsZFQw
TLSH
T118050195B36018F8DD67813EC9659906E2B2BC5A0B70C61F07E4362B1F773A11C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 f99439380c18a06e10c7b6fd8352d22ad2140c1939b731124de18bfd470166d1
MD5 db7a3330ea073d150d3ed48367af4546
SHA1 4962273fed553122d23026bbfdf1b5b297fc121c
SHA512 561e82eb92310304aaffb13db718f30c6c271e0dd4d4106d8e7c1d974c8812788bf67c6df02e7b68806b258688a86d94244a50b3eacebf12c6086589ddfacb15
SSDEEP 12288:eUjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:eUnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T151C4238673315056C3061DB5D6A6F54870F4EDCFBA22A51B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 f01a7a53cd5bc3bb3cacb17b40a7edd34cd62a1d816781b57375fb13dd9b590d
MD5 22db5f2ec0c09606eff1a6ecb1e8d670
SHA1 43fa7f0170dda08fd1bcf196311f041cc2d3b75f
SHA512 b3b40add7b5ff523cfb82145aeebc95f390f6832744c564e19baca7847503bdba29ee4bde9d9e475db156c79a0e3075928640bb1eeb77ef18c46f48bc6df7b1d
SSDEEP 12288:VojvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:VonAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T18FC4238673315056C30619B5D6A5F54830B4EECFBA22E61B1EEB333B07BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 aa4447b236aeffa6d56b6809922f35a38915284dc13404776e066401efb71ee0
MD5 d50249bf4c22bdaf61ddf8df4a2bbe6a
SHA1 a74b6f1efd2aed9c9b30a37b277f6101a3ef9514
SHA512 065ecf3b0cb044a817d14b132d5469c65d7761e5067ddb3f1c3769336c4ea783266632cf019170c4596eb27f31ef5e11b2dab525e23df0f6576fce7166efb7b9
SSDEEP 12288:2yPz5L8hjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:LzyhnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T106F41247736130F9D1279138C9A26A05F3B1BC765B208AAF17A4133B1F3B6D1AD3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 6cf2c0c40387477ea5f7f58ad1b773ae011694168ac21a90f882f45c0c5ae07d
MD5 a60c01b6614c010a417ec50d322e6131
SHA1 9361e3d493dbc6ffa881969d7c7ebe0500e3210a
SHA512 bbf2155459721e57578006470364933cd611d7999641202fe7973d8803cb3fb586e2ba63543411057f7b252ef7a1747b54a350b00accecc400faf18c58829343
SSDEEP 12288:WUjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:WUnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T13CC4238673315056C3061DB5D6A5F54870F4EECFBA22A61B1EEB333B06BCAD2B416183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 358e6060b8c811696c77247f45233d3d34ff8b5ef1fa856097c0a6de20cb535c
MD5 d0723d5b71b804d84c4cb83215463ec5
SHA1 b541a935c66497e15a115d94a1696b21395c6d89
SHA512 edd5cb02ccb64728b7ec6a775628d5e41763eadb0d539e8b48290d436aa8080bf7c7857bacea54152eafd765b65e362e1bb101ee88558f9734337652340dc87f
SSDEEP 12288:oUjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:oUnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T144C4238673315056C3161DB5D6A5F54830F4EECFBA22A61B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 ec58279084e8b913c2670d245042ae168cd20935e1ce831b08532d494be56304
MD5 48f5be70bb9709a17f28b30eb261e137
SHA1 6c2c9c5a6cc88b28847f4986ff1389c655dca59b
SHA512 bba0a96b6999db56acde578b29b0458ca29c47634d89e72cfb57251f98bd8fb87ef3d905e58b4d42548599bed66ec7e1500b0b71b76b3e77a58d54187ad7b771
SSDEEP 12288:2yPz5L8hjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:LzyhnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T193F41247736130F9D1279138C9A26A05F3B1BC761B208AAF17A4133B1F3B6D1AD3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 84e5258bfe422f062a729bb484b4ec3aa0dc4e6b40d632d48336e18f21640763
MD5 423982c4567422bbf7de4ab5f2610b77
SHA1 947fbe3c6110b7f654cfd928990f7d8062b16dc9
SHA512 b72d3a0f930afcd4386a443c18020de31a32da6dcd073f344422f3b53556dd778e3f1bfe81ad9cb6459b0f8a4686630c486a306c4bb7112d8e303c63f3c059de
SSDEEP 24576:RTDaLl3z0zDznAUz5DFs1jsLqmVNPEZ+OQw:RTuLljItDU42mLsZFQw
TLSH
T16D050195B36018F8DD67813EC9659906D2B2BC5A0B70C61F07E4372B1F373A16C2EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 e3b82dcac6c7cf1155623c7e2ff69c6e0e35126c044c87bafc761e38aa2bd354
MD5 8805a3785c99e4683bc1af95a860b6c9
SHA1 27c0d318b8986620bb0cc4b0fb35d73b563c4d1a
SHA512 1665299f7e811e6c2e2133096903f64a04dce255050029a0c73ea4ddad0d6ccd0d7d8515e0ee238cb45cd22d69c1eae4580578e103b2fc91ebe019699c78325d
SSDEEP 24576:n3vd9CHKy7GZfnAUz5DFs1jsLqmVNPEZ+OQw:3vd9CHKya9tDU42mLsZFQw
TLSH
T1CE25CF90F3E410E8F1B79A35C9769501DAB67C5A1B31DA8F03A4261A1F33BD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 7a9defde5b0eeb44d8abb5dd7b20b638e64d489a182e8041ff7c65a1351f459e
MD5 d33c7eb21e8c0d58cc715fc31d964640
SHA1 031ee7d40e3bbcbed4c215f4e81228765c6f42e0
SHA512 ed6d5bf803af82e98389492b2caca67e5515bedd00ab307324d824c659fb3bf42b03c82d66751802ebf247281998666eb294f01faaddd4d587ea112601c3148b
SSDEEP 12288:kjjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:kjnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T150C4238673319056C3061DB5D6A6F54970F0EDCFBA22952B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 4f9d6a84b7a56a07ca17ced6e82981a8cc577e5313605a9377d894d70abf326d
MD5 65dbad4f5c76ee1f75dad6ceaa0ae54c
SHA1 e8f37903c0a94e606d4ae118cd02422e6765f97a
SHA512 b03bda44d8e9889df810da22e507a42567aebe84ad127b90ff5da65b736665ebf09d80186bffc108bf7b11cba8818e45ff1e5ec7b74eb1bfa5738982c57b4c8e
SSDEEP 12288:/BjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:/BnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1C8C4238673315056D3161DB5D6A6F54830F0EE8EBA22D62B1EE7333B07BCAD2B456143
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 16939a2d8c39731b6218d74cb9023ea16c02fb1e9ab88c7d6cfb92e7ed82a9ac
MD5 2e7512e7c9429e5f63a11efbf7a6dc1d
SHA1 ffcccccdb2e22fa3164bb35309a3f1b04a2cbce4
SHA512 2608629e2dcf1d73194b70a0104fe8d6a44a689005b98d767df783b496f5adfb51f46f6c6ad7f83c24ab1a24429e0ce5d9043eb9b287a8affc602642b31b6165
SSDEEP 12288:KKjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:KKnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1D7C4238673315056C3061DB5D6A6F54874F0EECFBA22A61B1EE7333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 77707cf5b9ea90ed626f2c2a52b69ef2d311a6aabdfb766b24834cb7a6fde78a
MD5 77ab130808307882edbbd4e854090f9a
SHA1 84796402ef8ff28873091b4c83c0798e9bfb4272
SHA512 dc8e0a46d263446f772d9636b3ac0dba272941cbb64be348e5e1bca759cc039020b263e9b5bc1bcb1617b12cc88fa7a7c83aae8bc5529a13f21036d6d68f59d9
SSDEEP 12288:BUjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:BUnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1EEC4238673315056C3061DB5D6A5F54870F4EDCFBA22A61B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 fd6c8a10783fe0b7cb568619566d878e7612245e93529513585da9017e24f012
MD5 3fc092ded761323a1396bb3c764bed01
SHA1 9b858cbd143b98f2bb64190873bcff1c946c03f1
SHA512 20211c8fa2724d950fd47563be6eff6e32f29d2c4313d300409fe7f2dacb3d86ef138fe6b01d3e0ea48d4567798c1ad64e3bc8b05e2a6a3a5cfff9154c830d9e
SSDEEP 12288:UjjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:UjnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1CCC4238673319056C3061DB5D6A6F54970F0EDCFBA22952B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 782ba508d191c79e0453a6cd57629e757936ad62d483f3e570b588a8d7ca5db2
MD5 affe2566195b6986498e0e8d25436b0d
SHA1 940ca49ad1e07f0efdc767c4884cbdff11344a22
SHA512 70f931d439b80aa99d673467dc340c7f445b78e3a614d6f4aa06eb811b943bc3aa557e2638394daa866317f8b57c7e5993be843e73694507369046cfb354443f
SSDEEP 12288:R8jvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:R8nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1A2C4238673315056C3061DB5DAA6F54824F4EECEBA23962B1EE7333B07BCAD2B416143
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 c7173e3dde1ed933d572e9618bd77ae24c2762aea9429664241492bcac303396
MD5 db76dfbe8e72707fcb1c285f5ae541aa
SHA1 083a1568bcbaa144c4c4fe319fdc54e81e4fa220
SHA512 4f64b8e08c0cf3c3d587430b24a7bcf892108e30fb83229d6d56efab8b4c9eda79b3bd53771bf86f5ac555ba1c87fefad4e50a3bb3d712b655025b3710fc4be7
SSDEEP 12288:qejvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:qenAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1A8C4238673319056C3061DB5D6A6F54970F0EDCFBA22962B1EE7333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 aad6ecf42764be2527accd48b758dfc58503f6c25a1129565744f3a37e77dd6f
MD5 b22b7a4fe84a4ecce8a98bd591db9c49
SHA1 56d971ed096b5a50a0debb77015e2539fdf176b3
SHA512 67c482aa97c3a2aec5600236b8d44cc97e687a428e0fe108d81e1313e3dca905d38ab108c0f61a6b6f20352257b9028866561985d9240ba5f861ba603f4e9c35
SSDEEP 24576:ZfwvUk9RX6wkyAI4nAUz5DFs1jsLqmVNPEZ+OQw:zMnYIKtDU42mLsZFQw
TLSH
T12B35D029EBDC44E5E177913C99B3860AF2B178591B31C6CF029A536E0E37ED0AD3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2aebaed1b822ee290bd910821008ec6e6a0d67a323b86222ff25986e545975a3
MD5 d79293e702802240e22e46ace474927a
SHA1 90fa8992f6736e15c434ba773574cc7d82755ba3
SHA512 d26dacb61463a3cada95d273fd4c14ac6e53bc65793eaef4e7d13dfba775b61e3394b40c3c70fba6cb8b9be4c86260e925bb93432afbf959ab366158f37f809f
SSDEEP 49152:PYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0HtDU42mLsZFQw:aySzP1w7mLQuw
TLSH
T17A066C56A16801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 457d0e1624373c204158e7cb516d4de80905210e1ad530c3478acd81100f0f52
MD5 18346bbcb7e6d43b6c4c78c38277e002
SHA1 d8baa78bedd5b5757eb3781df8859eaa4797dd0c
SHA512 c1d95df826c5d42dcd0f83bc68a797f1378744969d755c35bd1732cb6ff637cba6c619bb908d62bbb5a35da03bcdbdfd0834752bd6c0955696ea24ce0e5e1064
SSDEEP 24576:V47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYtnAUz5DFs1jsLqmVNPEZ+OQw:V47JUQjTirIhCnDHUPfF/3tDU42mLsZl
TLSH
T13F65AE1EA3EC01E5E1BA927885158A1AEA71782E1F31CACF1270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 70b8fb0e1a57f14a4027523c105df6e92df24b1fb799a29e5a0414bafecd833e
MD5 317894a67e3e014007da00632ab7efd6
SHA1 56d5d00050c9503770427261f8efd027e15e10fc
SHA512 d3033ff5f3cf36c4164418377d0097421bdf1e8ec456d807ef09f720e440fc291de39a8ee85a5aae1c2bbfbdbba284d4463ecca81f240925b80569b8398c908e
SSDEEP 12288:1bsfEjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:QEnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T141E4F00AE36401E8C06E6175C756AA41B373BC5997E1D3CB16D0F63E0F7A690ADEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 be4799f1a8d984f673d80c8c283e47e4b5d1be3ec579890dde712f92b483a734
MD5 f2a6ebd9b4eb5fb92f4c736afdd2f46d
SHA1 233686e90f20eaec2ade4ff71ae4b440ddc37e23
SHA512 d3c2c7b0626b7a702647b110bd4f0a846b50bea7e6c3bebe1d2c899cd4ea3633fc3bc9a0f80e768afa508b15f1d4e04af12a9e6ed440dc5c92c73f0b8b5f93bc
SSDEEP 12288:GNCFU3fAGlHJk+Zag89GPMS0rK72N9FY7+0il:GNeUPdJX0gg9rq2NHY7+0il
TLSH
T16E4549407666CA4FC6A940321E33D1CCAB707D11EE44AF0373C99B3F9577659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 861c0529fffe17b6784d7749a027b81e99205b79defae9dfcb3ae742e5e94571
MD5 53d8073fa2ac8be1fb6e174e1180d15c
SHA1 cf7f1574ecb17f36272d9a12c35db096ab1df5af
SHA512 abf889b1c0a55fa8ed94cf5b6528e8812dd8b137144f0e4c51209927e36c52930b330f4a756eb7820242dc1c5f20259074b5c097cb137bc06f65bf1573272d87
SSDEEP 6144:hMzd3KOcEEx2/Q06NFiMxrEY51y+tMxkaY4zEHwp8MzB4z+HwwW5ixZw8Wy+tMxO:K4fFbxr5NaY4zEHwp8MzB4z+Hwn1Qfc
TLSH
T11565F980A436E68FC1BA503207375B8D6764EC17B7456F23B3C9493AD867A15B0FA3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 c7dde821211bdc30881b741c76e76aa21371200066708006b08c432f1e82ec8c
MD5 558977457b521a6594c6bac494d5451b
SHA1 ebae24564cb5167496d6866263063027bbc56947
SHA512 c93ef401319c1555c36eb6547bd0e7464b3fd1db223e5ac795a4f484b1fc10171183d1e85ec0210ccf56861cb3118d002c8f6b809b251d798159196015470e28
SSDEEP 12288:d07sjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:WsnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T160D42342A334A016D27629B095AAF1143079FE8D6F21D5DB6D96333F06BCAC2FC76247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 70fc85973748349a1e5de2a77c6581671689d0e363882b786766372f704d514c
MD5 b1612ee3aa00bcbc63c1ca177cd56fbb
SHA1 d317a405598785a727f580f696a254b19edb2b5f
SHA512 93f340e5f2b6d1dae66fd3a056c739edcb55a16c016e3759aa987a2f114288033f1764a266f641c62a7747f026800ee0a1e63c27cd18a550bd062fbdbe60b355
SSDEEP 24576:5gb6bmBIi49WNNFpg1rSvFv7bYCnAUz5DFs1jsLqmVNPEZ+OQw:5gb4mBIBhGFZtDU42mLsZFQw
TLSH
T11765AE1E22E802F5E0FAD2B8DDAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 51daa65abff20c3a895fd87212b95a22ae643194c7ebd6167dddbc5e2dd18303
MD5 64e35b6ff32df9061d768b5310aa74cf
SHA1 481d6973ab39b78d1570062f751c50b8361d5ef6
SHA512 3288a8df619b8726998d97fd49b42071919948dd894e5c5a9ab5ed2761198e53bb19ec5bab9f60ceeb55af07efb8bb76247947e7f9e0d0815e616c62b25604b3
SSDEEP 24576:mG88u8FpJqH1bzria7/mdnAUz5DFs1jsLqmVNPEZ+OQw:t7ZFPqVea7/wtDU42mLsZFQw
TLSH
T10535F16577E101F1D47BD1388A828663F6B1B8151324EFDF0BA88B561F23AE14B7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 edc4f23e701c1dcc2f32ec31bd9b03c5e66a4807c51c641a854761a1f0d8a59f
MD5 beeef74df36de43311a808c3d6c8beef
SHA1 3c7ce46edea7ad1501ecc6d9f0c176c01c284772
SHA512 f46445516ab407b68703aa4afd40002bad8229ab7cb7bad460b3e0cd11e7e2e058f0605872ae8528777711045f31d05af9fe3281ffbe1ec86361360e975cfa08
SSDEEP 49152:fBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjNtDU42mLsZFQw:QG05lO43bgw7mLQuw
TLSH
T169D5C06A62EC11F9D1BBD07CD9C6860BEBB23815033556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 443a5353313e768bb7798daaacb766116e3bbf6e5fec25d15c63fc41e8349b97
MD5 155b262de2eab9d00e653be2bc826f49
SHA1 5c9597b00e0d9102359d66cb49072c60938c1a63
SHA512 d89abb11fd74b2cfd6ee5e42fec4dd39a4eaf5d47f61954fa7c0e0b2ac257d428355691155a6bab2bedea51d45564a7bbf19e39eacbcac0a12a08c00d1b17afb
SSDEEP 24576:Ifa5POZ3dpuWVM50JicR2hG0lasx2+47eidnHnAUz5DFs1jsLqmVNPEZ+OQw:wa5POZ3BJt2pasx2+mltDU42mLsZFQw
TLSH
T1D965AF5EA7F801D5D179D17DC583861AF5B1342653329BCB022182BE3F2BEE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 802717e85d2ea5202b28c60983d8283984b63107100702e822b456a5213902f7
MD5 ed8f0097f641fc59951a4d8480ab44bf
SHA1 6f840cb46d117fbdc2d9baadcff3b9d5af53fd1e
SHA512 3a92e571d6672e2e74c16eb94157ddcde42876a720ed44d3a34034dc0265e04f3ca347b07173c9744a8ed2f2d7e4f2141f049acb1e339f84fbb9724cd40f0ea9
SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7FkVnAUz5DFs1jsLqmVNPEZ+OQw:RNc/zEOVHFQtDU42mLsZFQw
TLSH
T190857C1623E901E4E1BBE1BE89779546FA717869173086CF0291811F1E77BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 58c782e1d5d704279264a3448dd0d562ba2a257b2f84f3ca94faf89a9e284fe8
MD5 228b571d0f8012c631c544453daa64e6
SHA1 8444f9b6ea6457b56c7f0aa099e3ea6e0f72cf4f
SHA512 f652d220cd44fbf806f0b454fa78bae0377c383077e5e1edf0a411c5133144c420e424981ae924fc65624a2ff2b24c55e47295bf016f369d86c2bebba721d774
SSDEEP 24576:GTkNvNnaFeYhJNtmZBm7nAUz5DFs1jsLqmVNPEZ+OQw:GTMwBtOmjtDU42mLsZFQw
TLSH
T14155AF6EB7B846E4D1FAC6B4CD238512E6727861173293CB5290C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 47db19943b7c2d91feee61d2ba19a27f2442d2284ec034387bbe7bd4930411ba
MD5 55de7b2ed81e35761483919a86ddf8d0
SHA1 2a714055ce3e9b195e2fff7cab545fc930a8a021
SHA512 d6f6af1441739f956405530b21b470871e7bb7901c4f6913b8ec907cf0f47926db2145d08aa09d08f6a499ecc11c876856d546851f0fbcb051d614dd1a3d4398
SSDEEP 12288:tHvUrBFrEjwaQ5jvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhg:tPUr+NQ5nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T15D05E11F23A818E5E676A17D89829609F771B8561712D2CF02E1817F0F67EE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 52faf8ac71d398b3d9d62fc19c3eb09389cc63af05e61d160921695536ffe357
MD5 0625bdfb6a8ff78f136065d9b0e0c7ee
SHA1 6370b87781df4e1b4deec58eb05d015e870ae294
SHA512 1095ba23394ef53804c4373c6d56fbb249f1e642b7d50b47ce87e59fd4b493fb3aa459fe913793d98b4d05a39516a7a5c5756f792d546a8de41b817099ef637e
SSDEEP 24576:aD3FHshBIYQgAwnAUz5DFs1jsLqmVNPEZ+OQw:aDVHeBIAAitDU42mLsZFQw
TLSH
T1AD25E17DE75C00E4D57BD1BCDA639A06E67138AD032266CB06D481BA1F6BEE47D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/944-81-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/944-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/944-89-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/944-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/944-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/944-322-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1004-0-0x0000000140000000-0x0000000140410000-memory.dmp

Download

memory/1004-9-0x00000000021B0000-0x0000000002210000-memory.dmp

Download

memory/1004-87-0x0000000140000000-0x0000000140410000-memory.dmp

Download

memory/1004-1-0x00000000021B0000-0x0000000002210000-memory.dmp

Download

memory/1068-307-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1068-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1068-101-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1068-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1068-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1068-95-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1232-302-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1232-74-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1232-66-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1232-68-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2112-303-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2112-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2716-47-0x0000000002370000-0x00000000023D0000-memory.dmp

Download

memory/2716-54-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2716-40-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2716-51-0x0000000002370000-0x00000000023D0000-memory.dmp

Download

memory/2716-41-0x0000000002370000-0x00000000023D0000-memory.dmp

Download

memory/2876-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2876-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2876-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2876-119-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3332-108-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3332-109-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3332-115-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3332-306-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3492-121-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3492-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3492-127-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3492-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3492-132-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3512-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3512-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3512-138-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3512-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3568-55-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3568-56-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3568-62-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3568-287-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5944-107-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5944-24-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5944-16-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5944-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download