9df3901f82c9be56a4e20411f45efe937fa492d12f5766cadc5de944d0f3ac53

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 4.5MB
Sample261102-2qbxlaxtgx
SHA256 9df3901f82c9be56a4e20411f45efe937fa492d12f5766cadc5de944d0f3ac53
MD5 ca1d5e5a7dbc8d876ce794da63f57912
SHA1 0f8616286f0d4d7110babadff5ca418a792bb867
SHA512 c3ea6f8a022c870c17c0d9f2ae86874ca72ef24e440834295815db00964956c537d836df04059cd298c3048ed56a66e03f822f6a23406a72242be6c341a2e11a
SSDEEP 49152:BWJynhJV4on+Mw7Y9odwfDFqfFFJVgrvqzbut1wOq/eigXUeT+uXEkjNEEBHLuQ:IsoEC95a+uUkjDBHLuQ4gV4Rwl5Lm
TLSH
T1F526CF1AA3E406ACE0F7C679CED6C553D776B80D07B1A64F029098A64F772609F39723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery macro spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 3 IoCs

Office document equipped with macros.

macro

resource
behavioral2/files/0x000e00000001c21f-378.dat
behavioral2/files/0x001000000001c200-379.dat
behavioral2/files/0x000e00000001c4ff-380.dat

Executes dropped EXE 11 IoCs

pid	Process
2240	elevation_service.exe
2592	elevation_service.exe
2324	maintenanceservice.exe
4168	OSE.EXE
4068	PerceptionSimulationService.exe
5316	perfhost.exe
1096	ReFsDedupSvc.exe
1596	SensorDataService.exe
3844	ssh-agent.exe
5116	AgentService.exe
4160	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c94a6acee4fea11e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000100000000ba33-210.dat	upx
behavioral2/files/0x0001000000009329-392.dat	upx
behavioral2/files/0x00010000000093b6-393.dat	upx
behavioral2/files/0x000100000000a0ce-403.dat	upx
behavioral2/files/0x000100000000a2c1-406.dat	upx
behavioral2/files/0x0001000000006279-411.dat	upx
behavioral2/files/0x000100000000bd43-410.dat	upx
behavioral2/files/0x0001000000006222-409.dat	upx
behavioral2/files/0x000100000000a319-408.dat	upx
behavioral2/files/0x000100000000a304-407.dat	upx
behavioral2/files/0x0001000000009359-405.dat	upx
behavioral2/files/0x000100000000a1d4-404.dat	upx
behavioral2/files/0x0001000000006214-400.dat	upx
behavioral2/files/0x0001000000009b92-399.dat	upx
behavioral2/files/0x0001000000009cfe-397.dat	upx
behavioral2/files/0x0001000000009cd6-396.dat	upx
behavioral2/files/0x000100000001b98a-395.dat	upx
behavioral2/files/0x0001000000009952-394.dat	upx
behavioral2/files/0x000100000001b98e-736.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009145825c1c6bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000088891a1f1c6bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e66281e1c6bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aab4f45c1c6bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c64c53201c6bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000668e46201c6bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 63 IoCs

pid	Process
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
2240	elevation_service.exe
2240	elevation_service.exe
2240	elevation_service.exe
2240	elevation_service.exe
2240	elevation_service.exe
2240	elevation_service.exe
2240	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	5116	AgentService.exe
Token: SeBackupPrivilege	1096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1096	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1096	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1096	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1096	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1096	ReFsDedupSvc.exe
Token: 33	4160	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4160	SearchIndexer.exe
Token: SeDebugPrivilege	4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4436	2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2240	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 5232	4160	SearchIndexer.exe	101
PID 4160 wrote to memory of 1460	4160	SearchIndexer.exe	102
PID 4160 wrote to memory of 764	4160	SearchIndexer.exe	103
PID 4160 wrote to memory of 3068	4160	SearchIndexer.exe	104
PID 4160 wrote to memory of 6128	4160	SearchIndexer.exe	107
PID 4160 wrote to memory of 2432	4160	SearchIndexer.exe	108
PID 4160 wrote to memory of 3544	4160	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_ca1d5e5a7dbc8d876ce794da63f57912_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4436

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2592

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2324

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4168

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4068

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5316

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1096

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1596

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3844

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5116

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5232
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1460
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:764
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 2928 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3068
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 2928 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ad0e4af5aa09da354d8cd3be5a5731b9ddbe1fde4fa1a691b48c6e134c592db0
MD5 4559951f809b8a2aa20052bf990fcf9b
SHA1 df9bf88cb6a6e75ed3269b2b3d088cbc610b4f37
SHA512 2ed9f2d1439711cddf32d82e140bcab842a4baa281a699839881e8ef5390175fa732e3c232af58f47b5a9c877523fd71c7ae6def7464be19f86f35fcb7ea2717
SSDEEP 49152:Hb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnpQ/lFTjN4:13q6HjBpLm
TLSH
T1CDD58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
Size 820KB
SHA256 53b0ed9a8a0f37b48e61a8e6c523e081b2a59b1255616848d2f4ccf10aa50e3c
MD5 ca57b0a6d2746fc14682c9ba9e5bd6ae
SHA1 00efd38a92218734c354687e7f0ca68d57371aa9
SHA512 fa6a3a3442e7b0325305f022bb84ae6ef692ddce95e9e4e57df95e08d5525fd13a1aa46c0d54d1582ce8b55f9b66ebe097c7b52bd94153257a1efc5137e22c95
SSDEEP 24576:5TWfqUOJ+Z0iggNF2GOeJU3HWXY1TmBMjHoCdC09U:5TkTgCFVJcHWXYZmBMDoCdC09U
TLSH
T1EA052302BAC0EEC6E4471734A93B2F62E6D69C3D94C14FC747A8384CFD72692492971B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.2MB
SHA256 af29911e98b66ac0314b0ca12b3f9f5cbf7716b23f0a0180695344882463b47c
MD5 715450c660e5ada32092a9e52c8d58e6
SHA1 eb863f34ab47944dd10c2f34598a8a104500b026
SHA512 ab30d87405890cd195c7995ee8546618d6917e8e034377020ce3fa0894ec471001b69fbe3ef1b6ebbff919f77e14d6fff95fdeadcf3919db212f0945975cb414
SSDEEP 24576:5XYfDtczASnQ/tbw/2Mkjy6Fr7g0oKRBqGVvVJqtWAGKRgRs2HFw6yCx2ipDol:8tc3Q/lFTjN4U4EvV0WDKRSjlfA
TLSH
T18CB5122867A449F9ED6B4279CCA2C501EB3378425B60E79B139889365F373C81E3FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.2MB
SHA256 2b4d1fbece3274f854336264524b7ba18d559ecda714abcfa39cf176e7db03b7
MD5 c4e23aca13a040b8b5f337d3ccbf583f
SHA1 0f518d6b67507e0af2aba7da8e74f40bb8c4de8e
SHA512 01d8080b28ee359a2f0506f683986853119f3fe7a278900350e84d297a2fa52efcf15a2f8feb624605c1b0a87cd5f4c9d589e74195fe682362e9d1274645f3c7
SSDEEP 24576:TXYdutczASnQ/tbw/2Mkjy6Fr7g0oKRBqGVvVJqtWAGKRgRs2HFw6yCx2ipDol:9tc3Q/lFTjN4U4EvV0WDKRSjlfA
TLSH
T127B5122867A449F9ED6B4279CCA2C501EB3378425B60E79B139889365F373C81E3FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 dc8a782205f514576d18c049325ede4abecdf5fde87fa799395c93987e6a3258
MD5 5ae2b62492a2e61cf737e25983e5b177
SHA1 908331f11a03ab3e0b32c0ea60e042006b0cb04a
SHA512 984d7e77fbed4c55b865e0828fb1461cdade25fa199e368cad1c0ac15b72076af3a2dd970f96e2f3b22d5de3f579c8e4030a724c16dbe8a02dac634b12910dee
SSDEEP 12288:j1XLsswWkxy2lRq2czASGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:5XYfDtczASnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T13865F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 e607c468828dfd15f64f66585742b5cf0c4c2794277d08bd8465b1f8fe9fd936
MD5 82a4f23cb0bc8f941d41cd829e50a5a9
SHA1 b6c404f4865a55be9a7e322516d213843afc6d4d
SHA512 86ceadf6f0351dd3c0d2e93d0c2c666d8e208f8fa2ebd7729ed9f6b81cda856f04ee3a47879b876fda2175442465935b590a83597c5ef120281f78bfbbf5d699
SSDEEP 12288:Omw5HEjsChN2BFgl0WDm+CnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMF:HwuHOWYnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1BE65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8c6cc434ee67fb1ca182ad02ae58f4e3d536c61c434942db9c2cb431974298b9
MD5 55eae219df5e1b2b45aaa21eb014f286
SHA1 fe98130e8b6188c10e0aa90823dd2aa0db88f2f2
SHA512 ae5831a47887d7c9286db208100a22efb3ccaa36d4196a1a3eebb3e8751937df232f7b555839d965e333e59949cd6b7a3472eadb0d8fd72a7260c0e082aa9875
SSDEEP 49152:lB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gliQ/lFTjN4:Lu6JmVxd2dtLm
TLSH
T14ED59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.4MB
SHA256 303ffe6828503c5349ce7791becbd45b2d76fa30aab09621aef68538b1abc7f3
MD5 46b0ff735bdeefe2849facf0e1df1691
SHA1 f39d859095ad04b9d345c7b1e1630520fa8d75f1
SHA512 b1719ff4eb9d0e70ccdc0ce164f48dda788ede17025ad54e786f400a2467b428cbc07738812a23946fb9744cdf988158acc41a131981984d32c833e225227f39
SSDEEP 24576:xrwv/k9RX6wkyAI9nQ/tbw/2Mkjy6Fr7g0osfBqGVvVJqtWAGKRgRs2HFw6yCx2J:sMnYI9Q/lFTjN4Q4EvV0WDKRSjlfA
TLSH
T16EC5F129EBDC44E5E07B923999B3860AF7B178592B31C2CF1259436E0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e720b6118373b8d6b9cc64c0db746cb1d75aa83c7751f42378eac6bdd8c11f8e
MD5 0aa06cc6d338c119711c0373a6143179
SHA1 1658ca9b389614faa02cafbe60419d74580ba2d0
SHA512 6a950155b0e39300b14846860fb8b2734db6dfb99d849a8a054369c14bfe3dc8c97b7e4e40c6de9e157ea9ac0c62ab5b85db5e66f0d1b1385a96f22c506b90da
SSDEEP 49152:PYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0yQ/lFTjN4:LySzPFLm
TLSH
T15D066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 6db5a705580f03eee7f3850a7f2538942f59e54f636e4d58f5a2ee44ea9dbdf3
MD5 55de1046b7c5755a7c408b35b3e71dbc
SHA1 b3865efc2dde3e98d473d029cad839fff5f7f763
SHA512 8d4f4db87b44339da553c502076ac35b2dd0f5fde04cfbb1dd456d48e1458e9260aa5af2630ab04f99580b734332c6524134cf3178ac5f7bdb8ab40ca364c2ea
SSDEEP 49152:LYZ2Npsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0yQ/lFTjN4S4EI:3ySzPFLmS4gV4RwlI
TLSH
T1EF269D56A1A841D9C1B9C1B98F1BCC1BFB7134090335ABEB02E546935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 95301af054fb9ceb898ab81c7b5374bd855bd75f1663558e82ce8305544acc2f
MD5 30f6c1e865e18b5d9331402f864e8f2e
SHA1 81270d785f5496b8c67250930df0d1203cee3981
SHA512 a69c5d19469a640b280e432f04d70cb05592d18e990fbb8a8d3b56aec9548646c06169fe7b305cd1e920a773ec55f70e737cb82accaaa0a6382245750aa2732f
SSDEEP 24576:k47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYQnQ/tbw/2Mkjy6Fr7g0on:k47JUQj1irIhCnDHUPfF/iQ/lFTjN4
TLSH
T1C765AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 834a2758da778782b9bb3b0edaf985d3c322bb9488b079299e58f9c8691ac7ab
MD5 7c4519f2bc391a154b2b4c4d49220bd1
SHA1 0fde057404d27fc79ee5d222f35b0df4fb67e2b8
SHA512 b023266b660fd36e425b00c486f607541b01bc4c38d4794a1fb5a5cc676e6e1f0437b9f20d1d01cbb45b21c36ca4ff652332ce9ee35fb45ff622ea619a770281
SSDEEP 49152:jQ7JUQj7irIhCnDHUPfF/iQ/lFTjN4N4EvV0WDKRSjlfA:YJ5glD0P7LmN4gV4RwlI
TLSH
T149B5D01DA3EC02E5E17A927885158A5AEA71742E2F31C6CF2270437D6F23ED45F36B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 039c278dc73cf976ce5aa13145c7fc4c0ed497d9bed566b5ac6e11a43690c06e
MD5 047850cb750504304ea41c6c23b48a6b
SHA1 b6934f369b9999174227c3cd0c12be484150a517
SHA512 42aef62cc2af71f01e89c228f500edd4948713fd9b8b38daf73c5436051ba9c6d44f633b2a1e1d7a51b48188c2c9eb21adcb20cca572516e5daacc6672a10b6b
SSDEEP 24576:ApbhMUPu+lcPmR6cLlF6BDLySAxKuDIkXYJgB:WMUG+lcPmR6cLj6ZLsxKeIuYJgB
TLSH
T16F552741722ACB4FC66940325E36D6CCA7707D45FE486F0773C9873F947A658BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 726d1c2803a1155f52398abe9ba41c68c51f3db5bd068854b7d44b8404d43f59
MD5 2a492f64c34a10819f108a4aafdb435f
SHA1 1bf911dc07d4ccb71ea9149c9a99d46470ffe62c
SHA512 651136e66c98d816afaaadacee242cabe2b9a41d849b96db0477d76880465efdd09b0c32167ebcbeaa8710eddbf698873674a91c742b407dccbfbd7bde109841
SSDEEP 3:OlH/ltBBcLOx5lgOQuqZTt5l3y9Gxtg3mCllltGlslslslslslsl6C//:KvcLe7gOQfTRQK0mCtEEEEEEEL/
TLSH
T180819228ABC10621CA2BA03909ACC7D88323C592A0D0DFDF0992214E0CB25E44C52669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 64f3918beeff43e03c39c294cb550472e66909b4b165f8861fb5d2b8620f12a5
MD5 43f957dec93ee60b9f4da83bec1ea8c6
SHA1 5f6c51cb78be421e1b5bc75e7e09e36073fcecf5
SHA512 d1f8d3ea9dce4028cbb12b0f9a4fe60b93ef5d29eab351f11ff690870478d995cc465a03645cff0efd58ba72b1224bddf4eb29edb2aee08fece4e37fd03da7d3
SSDEEP 24576:1kB/FuOAWMZ/pJxhmR6Cxi2R60xW2R6WSUSLQU6J7OJ5Yr1:CjuOAWMZ/pJxhmR6Cxi2R60xW2R6WSUT
TLSH
T15C551A0195A7EB4FC96E9037033286CDBB745C07BB892F057345893C986B96EB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisconnectStop.docm

Path C:\Users\Admin\Desktop\DisconnectStop.docm
Size 778KB
SHA256 7a836e29c0b3178893b3a64a21d35a535925f8122d668222f88091c2e6eb2f12
MD5 a0ebc5af74e43f7907f1fb268285b374
SHA1 ce4c9e0b832719c16f806a131bf3885e5d38e552
SHA512 9b015010ee741d96ec623ec197cca1767d4521397cbbbcce5cec15f97beed2d7e3bbca0acf884523da4a357eb2280c9b40904da24c667e6968949766503c1615
SSDEEP 24576:1aBRwqeNt9CH6UvK5HkJR/XnNgeQ1EbZ6myE/:1aBR8LVUWHkLfnNs46mH/
TLSH
T18E052362D8CADBF4FA131A77119258B1CC8E145BB2FFB88218C2346ADEF68515C27774
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GrantConvertTo.docm

Path C:\Users\Admin\Desktop\GrantConvertTo.docm
Size 772KB
SHA256 97c1ac6b9e4317d36cefa5e5066d972d0678211d3b57660341aa337b6062ab5a
MD5 ee95b52b9d3faca13053f080a98d4392
SHA1 e324143e26e9de43be4b76ddf7800e1541d16158
SHA512 762e6a597a367c2949452ded508541d505c7c5f5b40a78807fe31702b5e1edd0a87a5063a8468ac8d8d6b06a9f8a3de5a562e01b4b292e9345463876c49d87b9
SSDEEP 24576:lDDofmyMcQ6Fmq2F7e6UvK5HDca2uynSBzJ9nJ:l/Y2cVFmhXUWHDca2jStJ9J
TLSH
T194F4233C6CA408F9DF8995B6CCDB1C596C83351E3B13EB8315DAF9006C4B61E249BDA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OutRestart.docm

Path C:\Users\Admin\Desktop\OutRestart.docm
Size 771KB
SHA256 0107d59945ea5119a6b6bb49f43f14d7829b6fc8bc0a410a604791240b47b213
MD5 987415c5e3f5a907ae122bd9240de706
SHA1 70e881c5e18d88296a0570dd3933f9775e779b06
SHA512 48a34b2a5d24b0dfb8161f972d41687438d9a71de4f810d0e335adf0b04e21b42ba5e35936757dd1a2444acbbb74b9fb37dc760fbd128af37bce48dc7fe1c196
SSDEEP 24576:yWWgk9NBbzTpSBago0aY8sUSuQnSCZuPXzUl:yWWxhzTpSBVo3YUSuCNgXzU
TLSH
T1BEF4338D25CA63F0F9F64F3AE4A352E395EC124F9219D292155627CC2EDF63D1207A88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 980a9f171d3ae2285cf26988156ce0b4a145cc098ffa274652464faa3a788327
MD5 a9a4b3f4f05cc9f5cbd1d7a776448956
SHA1 5036984fabd46014b5691b7b3d79ee7ea04b670f
SHA512 edf66dd26b03500a555656bf4c5b25d23703e4d0752828dcd8587655fb2321806514004b3e4894da6de80ef7cfcfbd8d098ef248a56bbda99d083999bf855680
SSDEEP 12288:f67xGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:2BnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T16B5523756668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5f90b3524387d60cff87b38400e2565699a9921ef1b4ffeaf4d6ab3e2d52a56e
MD5 14c6e9d80b0a8314a6050e6f077c58bd
SHA1 3b178bae919d68687e2aa92cc81eb51fcc79b16b
SHA512 2c5563d62793e4e7770fd33c85e308d18625807dc84f739218534f2612e0229a3d30db1b70a55dd829ab9596b1f5a592537ab5d409efb7faf1e4f90894fe42ec
SSDEEP 24576:Bgb6bmBIi49WNNFpg1rSvFv7bYnnQ/tbw/2Mkjy6Fr7g0oa:Bgb4mBIBhGFQQ/lFTjN4
TLSH
T10465AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 2.1MB
SHA256 735b4d4063af4830973b13b8a54ed72c105bebe3f66b061530b29e0dca536cec
MD5 2f376c8da4a6888e7c4d5642436993ac
SHA1 ef01cde2bbc51ae0a5008fc8050554363cfc0a73
SHA512 fdf4067dbb3fd4258c7753c11537fc5637315515213b90aa1a69b65e3e14e0d0b5c0532c89fdc6684f1ac91583a3f57cdbd5216ab1f80899eb49b1660cbb0778
SSDEEP 49152:Bgb4mBIBhGFQQ/lFTjN4/4EvV0WDKRSjlfA:Bt0Lm/4gV4RwlI
TLSH
T1A3A5D01E22EC02F5E0FAD2B8DDA64417D6B278161732D2DF1151422D2F3BEE85D3AB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 2.0MB
SHA256 f4914cdcb49689431eed4a4b502c0dd657bccba26db11c39ea2b0e02091ca1a6
MD5 be8fae3f885e63ef488419ffc574ae4c
SHA1 3ac3ad28ede9b8239b91a93e3492172314e48831
SHA512 12968aff854294e222b7b58c7c6a7a1fe74e357544a735391ec32cf3243c8175de60d29f523488e504cb7b17d13dabe2ec5c047913c45570b3f4aa9ef973f27b
SSDEEP 24576:U8kNvNnaFeYhJNtmZBmmnQ/tbw/2Mkjy6Fr7g0ozbBqGVvVJqtWAGKRgRs2HFw6U:U8MwBtOmmQ/lFTjN4n4EvV0WDKRSjlfA
TLSH
T1C1A5E12E7BB846E4E1BEC6B5CD238512EA727451173293CB5290C13F0E279D85E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 89ff072a4cc2f1437d948bf9ee92e980bfefd59c10a7f096113cbfa3296bdb28
MD5 bda15710b40c3b4250d44934c7e2565c
SHA1 22dbd2fb43f4edac3e00412590c9d1ea5853331c
SHA512 6fa32d1d110e54dea5ed28979f7410d6d8ac62794af6a80c2c352d105078db8559c926af6e74f494f1f8f9c68fec1f578fcc7ab0c4b265283aa7751d65fbd9f6
SSDEEP 24576:5GeBqGVvVJqtWAGKRgRs2HFw6yCx2ipDol:5Ge4EvV0WDKRSjlfA
TLSH
T1E005222C27B922ACD03E9676E976E6122B30B0127F3551FF50988977AF568C0273FE51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 8a7efe9f31e5ec014ac0d668e09983fd76ba26014e0edc5e659ba0348293ce01
MD5 64ce31cdeefb9b19c8be3e89b882501e
SHA1 ccd7c87912e1646b050ffbbae21a7fd12086bc73
SHA512 77cbaa98163cb8486e2ebcae14f79ad1c88a2e1696ab7c28987bc1ee0281720fd054297a1f07beb016df611a133364c08d1afc3091a9456d3accf098f368368b
SSDEEP 24576:xG88u8FpJqH1Qzria7/mgnQ/tbw/2Mkjy6Fr7g0o/:U7ZFPqVva7/PQ/lFTjN4
TLSH
T18C85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 1af6699ffcd624dd00cbf36bbbfd5bbd0c61b823a49ed96d0d188b0132c41898
MD5 fb19101e061f8d057dd95476d003571e
SHA1 bc30919352f8f4074bd841cfea9fc56230a1b43c
SHA512 d0125a3f983469bf07f7d6f6be47999bf91da58131043167881abc2034788a8de2baaa564a78f246d6eb2c6a4814fc4f0c678dc0f846dc86f43783907476f31b
SSDEEP 12288:fHvUrBFrEjwaQsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:fPUr+NQsnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1F465E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 809d17078656915dcb4d9e997186bb59340c91e457b247d46e2e71cd78916398
MD5 656e2ea2c4f72b95da41354e77f7cb15
SHA1 ea2af4c6afa92433a061c01a912b631bf3b953ca
SHA512 b60a3b92ae3771bdd3f59f9032d2f84a9e08d2ffa9cced664f658d2717515f92026645b8ea6d5a5dba08fb08fa099fedd8b88576e05df2e628b87867cbeee241
SSDEEP 49152:kBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj8Q/lFTjN4:HG05lO43bKLm
TLSH
T136D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 06de42386f246491c816b03dce0933ed62c0f51267f3c4bacf4a33f789eed9a6
MD5 45f0b61bbed94c54bcb347bca508cc68
SHA1 ed2ec78223874d663fcddd9ccfa38baec979bfd1
SHA512 37151d199cedbe4857f0bb8bf490efb0c6e0b9a497318ba9cff7c632b3b2a7ce73b957178b8fb1e0c51d495163401765cfbe72d4688de5fe2745f575a3138717
SSDEEP 24576:Gfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnynQ/tbw/2Mkjy6Fr7g0o1:ea5POZ3+Jt2pasx2+mUQ/lFTjN4
TLSH
T11B65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 98e941d9ddf43b30211ab24ef1afd7f309d8a5cd783a2497a558380be3ed71f0
MD5 0a5bc60f0a30742f031e569c4e6b1d8a
SHA1 134805e0f3ae4a8fe20475f8ccc7c181e9801d5f
SHA512 8db67b9d0085f5876d3c19bbe47fced9a280e3d15b09deed263ec02e16ffa2617242b1aca17a2d58c8c67be2a693c9072125a65fd7024cb84dce296b4fd541e0
SSDEEP 24576:LNcwHdjbyQ4nLC18lb/EOjowL7Fk4nQ/tbw/2Mkjy6Fr7g0om:LNc/zEOVHFvQ/lFTjN4
TLSH
T15C858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\System32\Sgrm\SgrmBroker.exe
Size 2.4MB
SHA256 8ac8e6be084b0a823cfe0895903aa7b67db18ed8bb0869018c0dc6c21f524212
MD5 5df19f92bd8b7eaadb9a437e58d0ac4c
SHA1 9b9f2b94ccd34c42db30d1541b0782366ab9067a
SHA512 a7b48ddedd07095e7177fe103804cbeb7fa7c73fc2c9b7a9e28458402a16eadb55baa6b47cdd5bc4a42b5656309e4b52f3fe00841c6495be6e14fbdf934ad394
SSDEEP 49152:cDVHeBIAAVQ/lFTjN4o4EvV0WDKRSjlfA:HLmo4gV4RwlI
TLSH
T159B5023DEB6C04E4E47BC1BCDA638606E7713899073256DB129481BA5F7BED42D3AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 e045201f8bc9bd0992e6b02f69500bda7757e1dfd3757858909225c3831bca29
MD5 edbb4aea9bdefd9ffceb0749537b60c2
SHA1 7b0116c10459703e86b16f944165eefe19afa3f7
SHA512 e10d2c85a66983f9dfcebbde995da5f19275cee2000af6dd07c801af2039f90085f1d2412d553a162bc02997a970e1baa8b040559ad6c2674c3ec0b2218724ab
SSDEEP 24576:A6DIvBqGVvVJqtWAGKRgRs2HFw6yCx2ipDol:A6DIv4EvV0WDKRSjlfA
TLSH
T14A25021C237A11F9D07BD03ED6938601D272B0629B2255DF1698C5BA9FA3EC8793EF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 ce58b657449e5fc6ffc26ffb3b6a853a15f9c39cc3215c69d63f96d57e190943
MD5 cf9cb1fd9d2e287f5ae0c3cd9b369a8a
SHA1 54dcbe7ef23502120aeca1a5bfa88c6ab2c4e578
SHA512 37bdd78a2d60b3b2b616ff8079d2fb965d273d66000a9a3b4cb0103e80c78b82ff8c994b08a305a79a19edb93d93819fcd3a4b16a934f7d17d8fdc6c65e63366
SSDEEP 24576:WtyEBqGVvVJqtWAGKRgRs2HFw6yCx2ipDol:Wtl4EvV0WDKRSjlfA
TLSH
T13815230453A852D8E47E1675EA73D2504F34B8127F3292EF61949A3F7F36AC06A37B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 800KB
SHA256 c16e4938bb4473b508ae1e8021466b54d40dfdb286c7d997600d00c65f912554
MD5 a5422a596cd1b930a244831fddb598d9
SHA1 a01a0913f02a0e4395ca0346c2e38e59c5395c4c
SHA512 80a1128167cfa3fe6375b5185c346ba17145d573bd890128da8c9afa7b01921d8808dbffebb27b9f14c7ba99eeb32e1e9b21d5aabf2b35f41d66cff15c1fc7f3
SSDEEP 24576:3hBqGVvVJqtWAGKRgRs2HFw6yCx2ipDol:3h4EvV0WDKRSjlfA
TLSH
T1DD05235C0779539CE46E6A77EA76F7110724B0137F3291EBA0884A77AF628C0163BB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 dafb7c92dde12382ab0f4a456d529929befbf75e1a348f7bb700689594ffee17
MD5 77d699abbe377caf4b8f8628d0872c04
SHA1 165af7d179913207248718858b3794b269cae914
SHA512 da5e6ac4e6c8c8d7af0f3c06f71557485eabec3da8677193be9009f4ba93987870fc95f93c9f7b2fe40273d3c19cfb39bb59d86318fa776cd9119c27bc0b3ac7
SSDEEP 24576:J3gILoTfaidZuBqGVvVJqtWAGKRgRs2HFw6yCx2ipDol:xgHTrZu4EvV0WDKRSjlfA
TLSH
T1E365AD1D63EA06CAE2B2D235D8725493D633B4315772C6DF2448C03A4DABED8AE75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 de94559b92f96f393aa54340c0119292a5cd7545e6206648331fdb1ec6b728de
MD5 570614bbec6f5d548b0f33373732ef6c
SHA1 c5d68a1d1bb40ff8c901d931a97a861f550fa43a
SHA512 318d95006db00a58eb0ff9588131367e354828fc3deeb7d0aeae03a507b2bcab7f9ecabbdb3c76e29c4316ecb41de5f600e78f041d104277a518efeb9d20bab0
SSDEEP 49152:rgb4mBIBhGFQQ/lFTjN4/4EvV0WDKRSjlfA:rt0Lm/4gV4RwlI
TLSH
T195A5D01E22EC02F5E0FAD2B8DDA64417D6B278161732D2DF1151422D2F3BEE85D3AB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 d598ca825a72e8d45950c9f271924e179339ce22d5450496729da52f11446f1f
MD5 021f63b4b70c10d4eccf7f4d363d8f7f
SHA1 1b5814d82c89d97b897bd20b4380e71951949028
SHA512 c73a14e306535b446fe409ef2a161b06a5a84d265d798df136c76eea4db49fe9c8a5fc96c52ceaf09f86e1e807fa7886146b7a89059fde93af808de2b1734673
SSDEEP 24576:bDkNvNnaFeYhJNtmZBmmnQ/tbw/2Mkjy6Fr7g0ozbBqGVvVJqtWAGKRgRs2HFw6U:bDMwBtOmmQ/lFTjN4n4EvV0WDKRSjlfA
TLSH
T1F5A5E12E7BB846E4E1BEC6B5CD238512EA727451173293CB5290C13F0E279D85E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 8536b65d1b2e0d685016dc825ff91e42b0cf7ea288464eb21204aa69308266e0
MD5 c9bda3eac5eb96c05e48bbd1e62c05d9
SHA1 9e4951ddf7c9266fd013b1bccbc21f42665e5e20
SHA512 ba789dbf29be0e9797bbd7b2f393b644ffb434b079058a8007e1f8e749ef2781aff720a3e466a05e54717fea168354e464cf28e52dcbc718b7d99731b83c9a0a
SSDEEP 24576:xJnJPbzB4SdBqGVvVJqtWAGKRgRs2HFw6yCx2ipDol:xJnJv6Sd4EvV0WDKRSjlfA
TLSH
T19935E13CD2A810E8E4B7C2B4815A6759FF31346D2F2269C765B8D5353F12ED0AA3AF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 986519fa9bbccb87a6e1671975ad873a0f2e4cb4e27c145b080edcc0e295c65e
MD5 a48b27ea9bb203c8b807700d7921d65a
SHA1 32a9e9e16a717b55fd5c3ce786831f6d7458f048
SHA512 f609bcbfda151cdc8c4e78122db57f52adad291b474cb2cb20fffd813920a7ecca55ae8ba0737eb23e91fe14cd8cbfd676c270fc136185097b9e521434a8677e
SSDEEP 24576:KQBqGVvVJqtWAGKRgRs2HFw6yCx2ipDol:KQ4EvV0WDKRSjlfA
TLSH
T1780523580B79879CE07E6A73EA77F7150B14B0037F3691EBB0480A67BE568C4163B762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 4d8290bc132f2978338e9b53936e8e40f87300ad559376bda446f78a10b41b5d
MD5 bc25713c17e663621ab287d9ec895fee
SHA1 beb0e065d85daad9e744f7293e11b2eb83b2c16f
SHA512 65575a6e80514b8931d3a0b85a4db67b98c814bb692d14289da3f55d794b8dab77107261094e0c500e0e3883cd12b2a89b15d7ab0a5f5060c833c0b5d5fa1b7a
SSDEEP 24576:D6UqjpSOBqGVvVJqtWAGKRgRs2HFw6yCx2ipDol:D6UhO4EvV0WDKRSjlfA
TLSH
T10E15125C17E855E8E07E5630EA76D2254630B8232B3691EF71C88A7B9F32DC4563FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.1MB
SHA256 ea4f584c41e62b2b945dc768cfe9b9d250279a7472277de0ad48667d4acfdc10
MD5 fd718f36fcf395cdd5a2aebc154fcfea
SHA1 a4e9545a765ffa77e4688cf6feee38e1b7919d06
SHA512 eca5853e0e8a0b44b76033ad7adb48e155889cfbe4c460fe38ee4b57a8e8e895881c10d4a0688641978f316ec92a768450cb03deccfc1bc88455b03f059b6c1f
SSDEEP 49152:ECLHGeeV5ijCmlDWDk44EvV0WDKRSjlfA:/S4gV4RwlI
TLSH
T175A57C05A7EB4184E8F3CAF5CA2694169B327C549B34F7EF4A80C96A1E32FD0D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 960KB
SHA256 d202f7f3667c0dd21460ca484d668a869c2deac117caf3110e89c1efc9bf0a62
MD5 79661a42977828cc1c3a86a3a7e7cace
SHA1 97f13723328d0b2cb7e349db904b5b14541763e2
SHA512 5baa75d9236f066e1fdfbee687320c1e09e877f0c7b917dbb6a1a21470f03e65c7d32bddd841273903ec263322000acb46861916051bb67dc5986d1497548261
SSDEEP 24576:zrcmRPBqGVvVJqtWAGKRgRs2HFw6yCx2ipDol:PcmRP4EvV0WDKRSjlfA
TLSH
T18625010DB3BE00A9E0BB813CC9928615E773B031672253DF51A4877E5E579D83E3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 6e152393ae228fc535e6a663855ce919ae93b150c1a3bf1af8891db956177db2
MD5 d4169cc3cefa5310d7544cac22cf6259
SHA1 86e352dc7862b8e35f7e548535b2c93184506711
SHA512 3baa22048c8788635b1bd7e45cdd095538b3713856bd491dc1f84b91a45a0e054bbcac39d14b5054c513b1e16a9c38019294e566fe2f94d6b32d074559a8550b
SSDEEP 49152:xDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3o4EvV0WDKRSjlfA:C3Upow8sBb4gV4RwlI
TLSH
T193B59C3DA2E800A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BDF19A39F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1096-104-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1096-110-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1096-103-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1096-349-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1096-366-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1096-368-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1596-115-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1596-351-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1596-116-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1596-122-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1596-352-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2240-24-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2240-102-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2240-32-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2240-31-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2240-30-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2324-49-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2324-56-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2324-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2324-62-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2324-60-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2592-46-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2592-37-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2592-147-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2592-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3844-356-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3844-140-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3844-127-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4068-80-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4068-88-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4068-344-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4068-82-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4160-363-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4160-171-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4160-164-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4160-165-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4168-65-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4168-332-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4168-66-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4168-72-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4436-64-0x0000000140000000-0x00000001404CD000-memory.dmp

Download

memory/4436-6-0x0000000140000000-0x00000001404CD000-memory.dmp

Download

memory/4436-10-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/4436-12-0x0000000002C10000-0x0000000002C93000-memory.dmp

Download

memory/4436-19-0x0000000002C10000-0x0000000002C93000-memory.dmp

Download

memory/4436-9-0x0000000002850000-0x0000000002969000-memory.dmp

Download

memory/4436-0-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/5116-160-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5116-148-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5116-155-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5116-162-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5116-149-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5316-92-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5316-93-0x0000000000930000-0x0000000000996000-memory.dmp

Download

memory/5316-98-0x0000000000930000-0x0000000000996000-memory.dmp

Download

memory/5316-348-0x0000000000400000-0x0000000000542000-memory.dmp

Download