Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/07/2026, 22:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 3.8MB
- Sample260704-2wp2eaax2r
- SHA256 bf8f206f49768119ff75451cce0b9a45fed5f2c641f9238c13ebdfbb216a2bfc
- MD5 38c9a611332018ae0600e06bf5242d10
- SHA1 019b56a1437c59fb75da7950b6c8d4889a3a1b96
- SHA512 35931d20b64e6052785f0ebfc797a6f497bf99b0369f51c6bcf6da0b6695495c66e5331fd426137e54bd3142b486d82b44a5455bc707ec1509e3fe6d09858c03
- SSDEEP 49152:8zksfrJMv7WyI3kkv6h1oD8eiMv3SmGlO3m17PnKtbt/bs/UeT+uXEkjNEEBHLYo:JUyhvdvca+uUkjDBHLY+7wRGpj3
- TLSH T17806AE0AA7E406BCE0F7C679DEC6C553D776B80D07B0669F029098A64F772608F29723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 4932 alg.exe 5544 DiagnosticsHub.StandardCollector.Service.exe 3332 fxssvc.exe 648 elevation_service.exe 1260 elevation_service.exe 5280 maintenanceservice.exe 3024 msdtc.exe 3504 OSE.EXE 2812 PerceptionSimulationService.exe 5624 perfhost.exe 5748 locator.exe 5740 SensorDataService.exe 5732 snmptrap.exe 4912 spectrum.exe 1756 ssh-agent.exe 5592 TieringEngineService.exe 728 AgentService.exe 3772 vds.exe 3972 vssvc.exe 748 wbengine.exe 4112 WmiApSrv.exe 4300 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\7122912d5a3b5d25.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000099244e56080cdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc6c3255080cdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f20ed354080cdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004daf9254080cdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000acadb154080cdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ce9cb54080cdd01 SearchProtocolHost.exe - Modifies registry class 28 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "Archiwum WinRARa" 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "Archiwum WinRARa (ZIP)" 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0" 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0" 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV" 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rev 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "Wolumin naprawczy RARa" 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,1" 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe 5544 DiagnosticsHub.StandardCollector.Service.exe 5544 DiagnosticsHub.StandardCollector.Service.exe 5544 DiagnosticsHub.StandardCollector.Service.exe 5544 DiagnosticsHub.StandardCollector.Service.exe 5544 DiagnosticsHub.StandardCollector.Service.exe 5544 DiagnosticsHub.StandardCollector.Service.exe 5544 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeAuditPrivilege 3332 fxssvc.exe Token: SeRestorePrivilege 5592 TieringEngineService.exe Token: SeManageVolumePrivilege 5592 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 728 AgentService.exe Token: SeBackupPrivilege 3972 vssvc.exe Token: SeRestorePrivilege 3972 vssvc.exe Token: SeAuditPrivilege 3972 vssvc.exe Token: SeBackupPrivilege 748 wbengine.exe Token: SeRestorePrivilege 748 wbengine.exe Token: SeSecurityPrivilege 748 wbengine.exe Token: 33 4300 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeDebugPrivilege 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 4568 2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 5544 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4300 wrote to memory of 4136 4300 SearchIndexer.exe 111 PID 4300 wrote to memory of 5548 4300 SearchIndexer.exe 112 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-04_38c9a611332018ae0600e06bf5242d10_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4568
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:4932
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5544
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:5776
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3332
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:648
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1260
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5280
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3024
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3504
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2812
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5624
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:5748
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5740
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:5732
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4912
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1756
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:3812
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5592
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:728
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3772
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3972
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:748
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4112
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4136
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:5548
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 2597a22295310bf9081c2e61879ca4f53df715d1724a5666bde705c6163afb98
- MD5 b298f27e47daee5c89792c11bc3f0ef0
- SHA1 1876396a582a3a6cf0b2b7d8d72088ef5fc9aa3b
- SHA512 64c98bb0986f6dfdc1c7e74274d07bf28e3b1062e64bdec1974740e673872c5f78f90d96b3ef54e8e0e6f65cc8ee637d1d600ab9ffa2899727e1ea1b8a00ac91
- SSDEEP 49152:Pb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnSLNiXicJFFRGNzj3:N3q6mjBd7wRGpj3
- TLSH T1CDD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 2bf142e09371d1c4dd3ac8241272b8827dabfc66ccac4361737a26c06ddf0389
- MD5 7d2d707e70e7584feaef3571293beb5b
- SHA1 4241f80b0ccb0e72e5e7b1f12ae9669064389d38
- SHA512 c59d2fe69d2aa672306fe92556f47eb4a687d25036e8fc937aca7b362ce6a16e1a3a59bb4625bff746beece57d80c3d6442efc9c0868d48555466c5c9b13af4b
- SSDEEP 24576:xXYfDtczAR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Utc8LNiXicJFFRGNzj3
- TLSH T1DA75012963D408F9EDBB813CC8A28411E6737C554760E7DB03A4A92A5F337D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 33884ec927db836e08cde31367bdd893ccf960360eb0a27ab6254ed71c9d9519
- MD5 a761ab5ce65e5493491cbb0b1c631a9b
- SHA1 e0b1fc9d6108f13ec7e74b832cc3dfe349e5dcc2
- SHA512 ff5c76ee4f491cd6363f2a32eb70ca815d4cb6e9ed4d56810c20cdfd1cfddc6422c3545c03a6d2d80b837583bab8824824e8d49030762fffe6963dfa109408b4
- SSDEEP 24576:i0Le5ji0hmxhrMK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iPji0AzfLNiXicJFFRGNzj3
- TLSH T1B5859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 4e766815b23e8cb29c3581bff329bbb7ea9109b82d988099a93276eb26ead4ac
- MD5 01d14dea638fdc1283c061fc9265d609
- SHA1 3c8ebcdb8f24b8425748175323e6bd635252a62c
- SHA512 c39fde4c5cd87863b64e4d1bbcd61d8ad51e9d0a3ef19ec2a18179c06ec1eb773aba9c6efd06ac70b575f31b00467b3a0d494cf3f83f776e8e5187a4c622069d
- SSDEEP 24576:Da7/ezSC6vUyD/aqgrvWj6q8wyuM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:u/ezSC6vUzPv+HjyTLNiXicJFFRGNzj3
- TLSH T17F756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 899e3c163d99814504a362fd7acc430e4424cb1bdd3bc43f75cfd4cdea758714
- MD5 6f3b6b9fe0c4707a711e0bf47c806b65
- SHA1 9c60aabb8cff8cc9f74acec27686dacc22aa3740
- SHA512 1ba2b99cc3868b14aa10610b46d63e0713edba8b74d80937465325b1b2c902deeb98be6cd4853e8c197e4a1c6aade2e55a07e4cc61cf5fc120139edd4c900281
- SSDEEP 24576:yVbqPb88hv/l+Bt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yVO88hXl+/LNiXicJFFRGNzj3
- TLSH T192559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 5ba26eb44d8a2a95b3a12b6f112b7fa8c828aea56ff6e991b276c14b035bf9cb
- MD5 761a42a987a23888c2c7c30b00df98c2
- SHA1 f4a76cf100279fce93efcf44c967c47065c19991
- SHA512 0ae840f03ef43fdbf1fe6a866b92c67c08668bc3d15ed74afdc337ca8a16744536a99bd68e7f1c0b59ff23a44e0196a00a37765e35bdfe143837176d1ef84dc3
- SSDEEP 24576:UGW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OLNiXicJFFRGNzj3
- TLSH T1765523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2543E5E923CFEBCF39123
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 349856dce5aafb75e2da149e915427c96b7c1cbc1548745ac32e8add8e7028df
- MD5 ade1f4565813ddc76415ed28174e6e50
- SHA1 7da9b0459f93558e4c34e25a08e80d9344fdce4b
- SHA512 aef2ff5a6a46a5298680e7f4c8f15ad057c6d99626a2fc0096d7450d6fb5776bc6547d2be5f9153b3a776f69946256ae597e4046467d4a393524ecbc5a6fefa9
- SSDEEP 24576:LJIUl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LJIUlLNiXicJFFRGNzj3
- TLSH T1C875CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 a297959866308bf4accf69d2d8bde5adddc62ee4ccee5f5c695c078a5f2f1ef6
- MD5 23ade5e05df7303536b6750c0789a89f
- SHA1 761330b0853f7d6b9d04c920d4d1ad735855a814
- SHA512 cc7f1533b82d46107335999a9b453b0948311609e349976e490b0a46deca799af88ad4f898093d49f0acfa2b0bb90f324b7217cb3c380fb2ab00b9972ce20894
- SSDEEP 49152:fQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THd:fQvGAdlCEL8c/WRNw5Cc7wRGpj3
- TLSH T180266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 4cd0378059b987a1edef90d926905df5f16a3ab89566ef4fd115ff284d5a743e
- MD5 c27c1806617cb835ca986aa5c079fc15
- SHA1 52e031f698ce01e5e689634bb4908c7bc5c5e402
- SHA512 78c2ce79f4591ed4a16bcddd26d39b8382b2f622aeb676cc77574e4d4013cd5e90ce95a342b394a9f55d41e8b443d98b596fd1b62cf1ef90fa63c809bd0b078a
- SSDEEP 24576:CfewsAjv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4ljvLNiXicJFFRGNzj3
- TLSH T1BF75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 dfbe752506be865e4adf67c126b9cb7e5d7482013f2b1d412091629c50bb388f
- MD5 3e3757780208b72a63e3c1589dfa3511
- SHA1 beae31c80440d7220ce790634a9928817ab4a6cc
- SHA512 52eb9626c7b60346a648e258c99da9ffa037971653f6d94faef15d2fe1ff102bb1b4ff0b9a818067d3478c941da5d22c23a1afb453920981fe3517d8adddc19f
- SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHrF9:sUEtQevvqc2W1cpV20I3259
- TLSH T1C5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 486994ef3ad98983e06a935cd0728e075e9efb5df69b5d3b5c43808446966566
- MD5 ad673dd71ce0677eb51f76a2d6eba65f
- SHA1 c7e484c6f485c14aec26e9e77194aeda725d6d1b
- SHA512 6026d8654062ce33fb429f5aa2367ab3c806007965901107f7d53b0d2ddb8c8c811f406a4fed99b2631b38107b6bef8836223830eb8c0e6c4100ad81fd0210ff
- SSDEEP 49152:PCbRquA/m2yL5zLfFiV+XenmE3/zPLNiXicJFFRGNzj3:Ioq2Vjnmw7wRGpj3
- TLSH T168D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 9b694bf6d222a423da455efe4c5e9c7250bdea7f3e6fd8977b749025e73deb4c
- MD5 e49e8fb33df07ddc10817fde5d13ad97
- SHA1 7535afb9fb7dbe0b69ed60175329e5cbf94744a7
- SHA512 96371fe4853ddc4b0247c0eb648e657f5455ee11fbed25b949aadb4dc27b1352fb0dea56da6d168077141615f732a77f32b30051e86f530f2621e6d667e490e8
- SSDEEP 24576:5AhGL6IFoiwtA5l7S53Q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5AM5Foiq5ALNiXicJFFRGNzj3
- TLSH T1C9359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 398603507e66d91df884406e7ead10f537d2cacc8e0ac595128d85487eac0da6
- MD5 62f51410484c151eb200b5839d2149ef
- SHA1 9e70cc7b97e486fdc98716cc7184faeaaf9f5349
- SHA512 1c82f43b03854841e9058043b4ca94ec3c1bda3bbf453bdb5c65b629792d688438d4926cae3a44f7c8c269b51d1f195059926a50a70d1cbc014e8b7fab22e074
- SSDEEP 24576:rwuROWz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rwSOkLNiXicJFFRGNzj3
- TLSH T15165F18632980CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 ede12d70533ed44f104459709374629c0b252b22d99c7918ea32d32716d24f09
- MD5 0376e244c0b2d151e4492841fac9f06f
- SHA1 ad6f76fa8e4367695f64e7dcce4560f95583ddcd
- SHA512 b3871c1abd06529167cb64b191c4835b63a8626f60502e1e1cbd6610d57e7367615d62b24aa6ef0212b13eeaed640846aeb1f010afcf97f247afb9cf095c9d59
- SSDEEP 24576:LZui/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DLNiXicJFFRGNzj3
- TLSH T1C555129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 12bab92167bab8c7c3c614ad5715b4c41ff092f96c476a3e8055e3c5a7dc3fb6
- MD5 e5d96f86d12dee5abf251654433b2324
- SHA1 5999f5b807dc4bc2b5539e25bb7470a91cf8925a
- SHA512 e697f4d53c783c577d9edf8629bf1a1b473aadf130ea39fc8ff9fc96d1006afc749f02dab0cbccee5b240720871c076ac42961a4d8203e4b6628c8669c728a74
- SSDEEP 98304:KQRQyi36YOcPDLvw2gAf+PN3J7wRGpj3:hQyiKanX+PNNF9
- TLSH T1BA667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 e590a594ee08ab8e8a3f82bbb6e36e60c2b792a2290486ee8a1e2768c0a3cd0d
- MD5 5a35a1ce2961d84a4f16d26551547bd4
- SHA1 0da739bffa4c1683f2d4826a7c2b4d72b6e7acf0
- SHA512 374bc2e6b50f4556258561c285e1700619e51d54e9f67b9a70808bfa65ac32951d77ec72308de78df5b0da57685f8721670df3ae9f62a119de0764cca6143ffe
- SSDEEP 98304:6QRQyi36YOcPDLvw2gAf+PN3J7wRGpj3:xQyiKanX+PNNF9
- TLSH T1C3667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 fde9e41395aa583f3983d7a57599faf590fe44710e2289b62e55c21928dfc992
- MD5 081c8270249e6871ea9d36add5eef751
- SHA1 42d180e6e7384cc658f8109b6f734decbc777047
- SHA512 c5e14800fb88c101bc280474be508c6ed0033ffe87e869633ccd2efbcce381bf126cd950bc50c0ccce6e1116810625c3d6fc93828c6d2934ed2d6cd93f0efeb6
- SSDEEP 49152:w68Qg55nhkeWu7PNU3/fLNiXicJFFRGNzj3:qthTRc/f7wRGpj3
- TLSH T146B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 7179041e4e523634f27a3b52747afe246591efb0a554b934eac4e1aee28c9a87
- MD5 2c618224ca55996de744293098b447bd
- SHA1 023ba1878bc1bdd310ce6ee048042fa0aaf48969
- SHA512 23c81f41eb0defacf08065ddce6f7b6dee8c60e4c6fb7200433003fde1242ebccfdbda41b082ae6173bc6a9537c6ad05798458365ac7ece30982e7f29feba2ae
- SSDEEP 98304:8y5112gYy5azzVvU69nLKnhZW7wRGpj3:9LIHRWhEF9
- TLSH T1BE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 1210f53f01c2429df0a2d997400e81688a02f4467b6777ff8292efb37fd514ed
- MD5 3266dd4a26144b9bd0692fcd94de99e4
- SHA1 edbd90ccb712f6e6f87e1328a985ac9c9d3dbed7
- SHA512 998cd1d3c2f43ad79e9d5f32a98cf8d9bb719c3d6f74253f91aff58f77bcc04b6b8832a4180147974edeb60419d205d1fc7ad22105f39054f5982739db04d7cd
- SSDEEP 49152:aB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glBLNiXicJFFRGNzj3:Iu6JmIxd2dB7wRGpj3
- TLSH T19BD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 4c8a50dcf2500d10cf54c1ddbe06ecdc9c90340c4dfaf4ac801713941d275605
- MD5 5e49a61493a466ea8f16a0a1380a2951
- SHA1 8b0319333a341c88da5f1837104913742e51558c
- SHA512 3bdff058f5a27167816f670b7b70900fa5e70131558fd196ea39675e7c40720c9116f839f1f2e793f539e55b752ed1f297d67ec83b3437b55be6211a7d21a4e2
- SSDEEP 49152:61hpsNoJpF1A67U44CwH7R4xFLNiXicJFFRGNzj3:6mifPqRw7wRGpj3
- TLSH T167B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 53c403c967d7ad07873524610632061dbdef92b5e19f7af786744356f5e11da3
- MD5 89de59b283b4f62b77fdbb3eab71152c
- SHA1 76d68e431c7d830df96add74d615c1788c8e6cab
- SHA512 ce33aea1aae6f76c78e25883390458389f11dbff51fdc75e823ec5269f91f7ba04fcd2bcc993c41e7d3a45763958ca4ced8fb540447b891cbfdfb85b3eac3f19
- SSDEEP 49152:jSuZQIY0Be2KkRVtOnks6NMHqiLNiXicJFFRGNzj3:B5dKqi61i7wRGpj3
- TLSH T104C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 ce61e42852fa32e1854c76a50a750e1bd7b7eb7df733d96e3fd89578b132ab9d
- MD5 8def14ad9a17cf8e62038d00d2709b65
- SHA1 e66835fd832d61c0348fd78a5043528df7ccfee2
- SHA512 8bc510848b209e9be4f11585d2b1f86657fadf333eaaf49996f6acfd2d76c3d1cd31f4adac5c02f60435d2ffed44d9cd1215d2f3fca6d718f80daef7ae0f6778
- SSDEEP 49152:yhtSn8EApI0figjgiDn0AP5wRLNiXicJFFRGNzj3:zX2iWphE7wRGpj3
- TLSH T17B95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 e29e3c4c511c0733a04bcf6e892e35038f965392d80c6d6ddb20a47e80a3f8d1
- MD5 ad7d917a064c8c83bd3b91fbb35b88eb
- SHA1 2d0acdd1e059eebda3ddb1882487415b6b7450b3
- SHA512 a2ea4d9e66cc4657225dfa1cf0783250f937ae4cdc22fbc44482e6ede6b014be72101d60cc3a0ae3ef56b8565ff16e6ab737914de673612c4c02c0773d99dae8
- SSDEEP 12288:ukiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1825523D3548955B1FAFC0039C6754428F5882E2DEB5618E3E3083D1EA278FEB9F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 b4be4209e165be26fe496bb250096b02d95ac8615c5c2c8108f991cacf5a124d
- MD5 5ca4c26459c455db96ee82113650a3f6
- SHA1 2b02229a79db3a7e2900e25db7c5622ac5da9a2a
- SHA512 bc53cb37edd17d2f534c9c56f7afdcae35d491a6e2dbf6ef48636c68fea0ad532c2abc55a9e70ee6df7e465c528ce5e4244ce61c88d160df955dd792481a2d5d
- SSDEEP 12288:ZPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Z7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1A65523D3548955B1FABC0039C6754428F5881E2DEB5619E3E3083D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 b0b085cce2fa1c34eb91bc5bf29fe992feb05d45f04c80884849be65b2fce483
- MD5 83e8b2ba292c557c96cd09ece73a5985
- SHA1 edddfe27e24edfa223b524cecc9dcd6856a23ab0
- SHA512 4fc937da5b5f1e475a54fddfd65730e37596030b2e9c022249106d0eeba24c380e889709f1726b949c459b4695ec06ffa625945cefdad0a8c742d92a269f3548
- SSDEEP 12288:wRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1795523D3548955B1FAFC003DC6764428F5881E2DEB5619E3E2483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 90afac307f3ba7ce1a02b7ce7c2b2547f153f91bb6e3d5dd4c86bc0eb509d4d0
- MD5 4e48775886fb6752d56601fd672cc6cf
- SHA1 7553e45b630c7734c94adf3e9c1e1fa19f1f181e
- SHA512 4a35d65549091f5b783a05487ad501dcc89c8a9c83f3f7f54f0d549e43b76072d0e6cffce8d36abb2a63bfc36296686d51c7ae7d77b5de0f3ee0692e1907691e
- SSDEEP 12288:xVGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1BB552392168900F1E9FD803DC6764428F2A47D6CD7325AEBD3003D1E5A75BDADF38A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 7acae180463617fe67cf802fd3550b872ef8c2a6998c07dae7c46f9ff6981130
- MD5 9ae48bdc1b600fc754e6cfee694c5956
- SHA1 1bc271620f1e641abee2b8f16d0c1399e6d7aa6c
- SHA512 521be290f182ff815e0b48e24c39313239708331d04bc7644a4f384ddbccb331aec903dd156e85dbca088ba6183acbe806b62d425d635424b6460cecee41bc29
- SSDEEP 12288:hOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:h4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1845523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 6474f2b063f430006232e3eaf8c301a81986ba0d8022d5f4b58728ae743436e7
- MD5 6a161217b649eb82e33a37c43af14eaf
- SHA1 a6368ceccee48a920f3ac524a5306ea680819efc
- SHA512 e79d4a9bcc97db712311f2effb23839bf5814496a06e1cb97fdf0c645eb358544222cd96aeb052bd6a98dcde88d302db2633e21271431fa302420626ef42f624
- SSDEEP 12288:8ziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8H/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1E75523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 4abddf9730be5035a7f8ee3d3184083df9c93b66d4fd3a5f7b35321c2687ef40
- MD5 64e430aa05c59736afc1838591138647
- SHA1 413885998cd2e98c70d692bb93dd70387f583241
- SHA512 c102d13fdcc2d564fdfcd2f62e1b9a48306f979d9b769c2fa2510ff91890c98854f93c38dbf34d50dcfec710ea23668eba7996bd3074075e6ebe3ca5d5ef4052
- SSDEEP 12288:QXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1455523D3548955B1FABC0039C6354428F5882E2DEB5659E3E3083D1EA278FEB9F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 7212682ff35e62f290ff54e7a086446564f550177319b9c23daa526bbcca3fb7
- MD5 1ac786766cb936695423313a72dc4343
- SHA1 ea555a1f79dcaaa82a1739c53f4eb755fb900a7d
- SHA512 6ec1da97a40290a3b7da49f0740e43e92a20197e1ade2dc186c6c79e71f8020cad491112895c46e4a9c25e732aed5edb4e5fbc01b95b237320991cbbc3c1ea7e
- SSDEEP 24576:gZM3zFVSOb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gZM3zfXLNiXicJFFRGNzj3
- TLSH T1A9750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 48a7327d6e6941648c44dc7d37dd6d3abed641c967873d3025d9f2024c1d7119
- MD5 f37a38eed2d5d5daec4724a948121651
- SHA1 06191c99f054ac6bc11c0b31893843f4a7b202c8
- SHA512 635d4ca45285cfc70db12622ff0866f61a9c9f54f4d76768c9a82ae33648d5abfd1553b1abff1ab375e8659f6173c33939162a5468db3e08ac06358b70128162
- SSDEEP 12288:BgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:By/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T15D5523D3548955B1FAFC003D86764428F5885E2DEB5619E3E2083D1EA278FEB8F3C466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 114912fbadf29875a5c665336fbd496e9ccfca76e5a9fdf6b2b2d12c79d77a3f
- MD5 8d48becdb174dfc081445b7fa98b5d21
- SHA1 b69822b3890f27977b19cb463b13a34a2957560f
- SHA512 fdbe2b85063da3ef41124c4581721562102e857619cee95b8037f6b413fde99ba11e0559587b1c9305e8c8245cdd0af0d5d2811a6e3c56fb1eba07d3423bd11c
- SSDEEP 12288:WciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Wm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1985523D3548955B1FABC003986754428F5886E2DEB5619E3E2083D1EA278FEB8F3C476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 74083847c8ff38bad27e4e193ebddf90ffc8b6af71c7af230e72eb1ed2fcada2
- MD5 65624adae5ce9604544f87e4da9a909d
- SHA1 42234d8bc00f4cfe4dac6e97210a59152950d2a4
- SHA512 686af90178980e94389dfded9f68a4625fa0a82ba7cee1cd1906ff30081f1b85efba43db8c8c6740495d1fc981b737769bfacb134ef4d6951e4a3dfdb0a5d4a0
- SSDEEP 24576:yzy//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yELNiXicJFFRGNzj3
- TLSH T169650243629530F9E17A4139C9620915F7B17C3647208AEF53642A7A2F37BE19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 878d6234cadf14c1dc01486c924f73047ff4857bb93291e04cedf26f1acacb90
- MD5 56ca1d48f78da79004459beae511c586
- SHA1 582cddb1c8f4a569a2e0dfa340bd06a35af0b880
- SHA512 c348a9fd96c582a66e90d4d21a57ddc0ba4df3349c0e18d00650ea4a066947a492447cf811bf48933f45f84d9671e31c95b6e58c41bceff8cf3561f7fbede40f
- SSDEEP 12288:CgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Cy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1C15523D3548955B1FAFC003D86764428F5885E2DEB5619E3E2083D1EA278FEB8F3C466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 0de35a38f0255fc330c4a5e08e49a55e8b70aaa8a080e6590fc8029ed192b957
- MD5 564898af3c17250824df3434fab5d95e
- SHA1 9349712042d0d6b703092a4bf410ad7ef9ac4974
- SHA512 1b658c4b65d2bdf75fbc3db1d9b94921a9404fa24883c2a1af127b16eb0da5f58153177701c4bdf5e4963aeb67ce37584c9f9a222c03cadf9e98ed4925c778af
- SSDEEP 12288:egiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ey/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T17B5523D3548955B1FAFC003D86754428F5886E2DEB5619E3E2083D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 ac41dfc0bae9081816d26ec95c33c24f0b9b65434893cf2e8847b817b21465ab
- MD5 b43c5267f1730b80989f0e4ce6ec6311
- SHA1 78c25e9d317050f4be9d4e9073ede5ec350be5e5
- SHA512 52b98ca41a128dd1c1830091de8bdfe326f1d7d2f2bbc16d0e219a3ede00e8bab87cf0387450be09a9dd85f0d3b1b6b0b8582eaf2ee36c052247dee1d32fd7d7
- SSDEEP 24576:CcP4mcvIjkGOxhKP2l71nNKbrh/8KB6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tP4m4IpOO67W8KcLNiXicJFFRGNzj3
- TLSH T14265AE2DABDC0096D0BA913885658A49FAB1742E1F3286CB1160A33D7F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 9adb04200c1103051c178f4384588dbbe60d14d32ab538474738e89d5482f7d4
- MD5 78d46c0a49bcba020fa9790e299c9c05
- SHA1 77e85fefdbf47e49413e5e7ad4bf5c61c0c0699b
- SHA512 624e7418fc485d6981a0d6a874962ba08bc0596dc90f8b7977d4cdf77754f8902d5a4ef49f7534328cba979da341fa5be06764e462a953d701c6cfd82bc22d4f
- SSDEEP 12288:BpsfwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Si/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T19065F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\WinRAR.lnk
- Size 1KB
- SHA256 68592d76dad86148ac10e7a3370b0e9c2e07e630b1cde212e52e2cf44e0bf814
- MD5 64cff6c964b4f40eba27ed00f62e0058
- SHA1 2301d4bad4292383e2613878005d92027fe46b8f
- SHA512 abad97759a759cea73e6e80fea86dc3066978ba2dd25c2daf954927da789037a4d93712c222c1e03ee866f38771abe9fedf6b3b9837fb112c2c0ac884db3762a
- TLSH T138112B129ED52B22D6F38F7083E77312C7A53C66DF982F0A4040C1842831A05AE75F6F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 e3f00f60c9a239fefe7fa03c576efab2bcc3407234f236e3062694854516fbb2
- MD5 cddd2425e2f565d1d00d696d5a9914d4
- SHA1 877d107fd3398fb7236be3caef8b79872e6b460a
- SHA512 87181d92d369c3aa795a3c66e2081a2ca49549016835690bcaf3b15dc0782f0a11246103e9a142d6b75e7c547b72c4bc90f17210edf48099dd58c5f9e34ba18e
- SSDEEP 12288:4QiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4C/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T159552393568C5562FAFD1039853A8438B5497E2C9F1598D3E2043A1EA238FEBDF38527
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 35c71eb6a24d6c9428e19f3e7b0ddf3afde17d1f807c37083b754d2ecea251f8
- MD5 a00a7ba0adcff7b94e61167dab83c7ee
- SHA1 5d8eb6c721e26a85190c7794c6b83e47631598a1
- SHA512 5e65bcef95cea326e48e735c9524a253449db58797c7309224e253650fa11ab49f1197e96217793a64d8c939b61b48a554b9745482200627eed75d46056fb7a2
- SSDEEP 49152:ya0h2GEkuAe73q3pp46zwwQ4LNiXicJFFRGNzj3:ya0hNYG4Jw37wRGpj3
- TLSH T10685AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 8f2934f18a065770cfdb3ea934a8a8523de170c56d95a4e61a7fb914641ed5ad
- MD5 67e7066623938e791ab7c65636607d65
- SHA1 96f173187df78f24429f23e9fe3fe063cb11b17e
- SHA512 b4a5e6742e31c7234f227cdc44fa6f22829b6669779acf53337c07b2e3852bb9d5646de1e24de66c9e254099371484c4ffd6245cdae6c350beb608d4b1f43eaa
- SSDEEP 24576:4hbHjPr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4hbHjjLNiXicJFFRGNzj3
- TLSH T12E5512BE169C20E5F6B5903D86668409D370BC29172193EF6381527E4F3BFE94E38B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 3b15541821200981e8221691820e1e2ec312c01decd0f2d51573823027e65d7f
- MD5 1728dffeda790ea00c9d5ec73ec56fa8
- SHA1 ca821c5fe04ba8315c8a9a641971a5bc09052233
- SHA512 2c27afdf86b902ff97fe055d9b224d1681c8c43b07ec927d9749c36ea12a515589fe62a37cc8ebd73c4f3dd91d250de447b6a1b96b2ef099ee1d874876e29910
- SSDEEP 24576:t3YgnJcRTk4yti+R5dBR/z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tIgnaTk46pBR/zLNiXicJFFRGNzj3
- TLSH T13A45B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F39F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 6e8166338580519b67741a93806324ce2918d8adaf7be65f40c92511aa66757e
- MD5 4bead4f756562cada82bc4826e54b6b7
- SHA1 f4a13cbdb4c9659c81886b54e68d6e9209b8d93d
- SHA512 6587399298198b96c30565754e25e8743896c15145838531ea7e85d64b32ae1b497b425990e08b4349be2d2344675ead8f769daa5ac9e0dc55ae50e85abd1268
- SSDEEP 12288:/MiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1145523D2518959B1EAFD003D86764428B5882F2C9B2619E3E1543D1EA378FEFDF38163
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.6MB
- SHA256 725404510df97257d72efb0ec1c1e3e5da6b4bfc1b05395011aea308b8624997
- MD5 317bee4800e127b208010e6da9634e1c
- SHA1 d4db63ff97f89a10d4b502a559ed614008cbd3fe
- SHA512 22e4c7141de50746cdc4c0dc31206a5532d03ee7563b37546b4c9390f94e516bdea48c412d4091dfcd7967091b21f8b044b43a1b9fe9a20d5bfef3e04df0f2e9
- SSDEEP 24576:eAL3UTR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eAL3UlLNiXicJFFRGNzj3
- TLSH T1B5750155E79400F5E97B813CC9728916E2B2785D0364E7DB03A84B6A1F237E68F3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 70e62db4091dd601cd9769bc0890c330011150af9fcc9f1a9a5ee63a779bd43c
- MD5 9a4ec7a258a5e5ff631314dbbd15284c
- SHA1 34eb463f7f71928735d4eb82abb3a5e08a688794
- SHA512 8c6f0d39ede17a349f3e3f67b23c003abe4ae494abb7475b7d317476182eef12b74ac7d133ef612a00defed496865bce9ed389f57773e6174d74deff627c288e
- SSDEEP 24576:QOF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QOFLNiXicJFFRGNzj3
- TLSH T14955125A32DC10F4E579503D8AA2820CE3B1BC29072257EF4290557E5F77FF89D39A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 0addb1ad3c173fc7fa10d84f89121a1381e0491889f89982b45309ab97f32472
- MD5 15434759988c3be914361a7c501e63a9
- SHA1 14c83fbfe5c68180e6b075d42240ec0c058149ce
- SHA512 b52e28951917c0e572cfdb43628b0b0964fe9ff57c674445c7d10691800d7c20176505222c91ebf9581c67ec27b9cd35f857afc017fb72e1dbe4883b1c57f21a
- SSDEEP 24576:c7NM9YqZqmWMUkPjZM48Mv6bEhsy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:c7cBWMpPjN8DbEhLLNiXicJFFRGNzj3
- TLSH T11065AE2E6BEC81E5D476D13DC9A28205F2F1B8611B318ACB5162833E7F37AE44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 fe39473089308ad41202b54e33a43e844935e0882724139e2a31da4eb642d091
- MD5 ecfff4892095550186a7aa4d66d2d506
- SHA1 9e1e0d20f6a97c0fe7eb9a7c92fca0f5379ed3b9
- SHA512 d5e6cddc5b3b286bd8673dc4f82a22a9af0e952ef475880034661467f828191d24cfd7664034feefaa2a191bdbb85b296706b366f04f11254890cfaa7dc0d910
- SSDEEP 49152:nF2YuHNETovAvNYf8kmSLNiXicJFFRGNzj3:+6BCf8kF7wRGpj3
- TLSH T181858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 827aba54f8671768ca2952375583b262907bfaf575cc8387ff35f3ffae2a142b
- MD5 b504da84ae7cede229e3707a46ba76ad
- SHA1 c9c012c1d6f53bbf13a6d5a6a76ffe71aef112d2
- SHA512 aec3919c9f079f7c27dda46b2b4f345893712c92d0bb50eae763c8277ad382eac448b36e13e7654bc4c4052b06e290ae7f71cfaf63594cf244a6a572aa1ac05f
- SSDEEP 24576:sAFs06+Omlf8NXEbTop/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BFs060loXuYLNiXicJFFRGNzj3
- TLSH T17765BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 c0b7397563d0ae87714baa05f96108e6de409a2ae02ffccc4d3de2bcd3e76507
- MD5 e084ee50f10a0fd5a41b8881d87f2dc6
- SHA1 36f545ea375d68ed9d5657666269a3a57e747114
- SHA512 213e25d1079fef5c5cca3a699e9f30e5ebde737973689a8341db26de96a2370ebb099d039766076f90799fda610e571c1adff34deef6b98986533932f2044786
- SSDEEP 24576:hJnJ5D3WXY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hJnJ5DGXYLNiXicJFFRGNzj3
- TLSH T15B75D02DD29810F4E4B7C274825A1A55FE72383D2F226AC724B4E5357F22FE09A79F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 6af00b26a4c318e0ea2a09ebd79ede52bbc862714412d8eacba09d7230b91ad4
- MD5 98936dbc02553bbf0f18c8198286bcbe
- SHA1 b1f11298850d2afec57c68d215763a97ccfacaa3
- SHA512 8b1ec04defcf0fca116d681debe268bac8fbce9a7ceea685d48d028972a92e75cc5e8bcbc319a7d2e85ff305af88b1a01533990bd6850a8801c6968c04c66cd4
- SSDEEP 49152:ag06DIKdwc+eQnSt65aVuLNiXicJFFRGNzj3:zU7wRGpj3
- TLSH T1B1956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 b760026a0c769eb5d0265a8ff7435bff120e29aa0dda4d358633019259ee945f
- MD5 b0e07878bdc4077dc0f0961b5299f8d5
- SHA1 c4a04ad5f93916cd2c00c6e00a95e358fb44a780
- SHA512 d7584a3f03676129f66c2a976e7e0e98b7adfec4a95932dada245f49f86a441043691aa03f4fe39d12dbf7c023e2b5a772f9decc99aa7e4f73e75fa8015bffe6
- SSDEEP 24576:dns/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dnsLNiXicJFFRGNzj3
- TLSH T1C15512AE278C60F5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.4MB
- SHA256 63c22bc423b63609a0a57e2c53babaa36646d1678f339078467e599e8e3355ee
- MD5 bf7c484fe092ae6e635b82a874fde170
- SHA1 c9731da05ff128298dc54c0acfe3e6664a4684c3
- SHA512 81b69ec6fa589bb12725bf9f0ea298f5df3d2fcd6aaa9ab72ba87147088f652bb0eb33c8aff051635124459d07ae8ec082ba889eff438e62d6336be41f52e3c2
- SSDEEP 24576:RIy7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RIILNiXicJFFRGNzj3
- TLSH T1ED651245538860E5EAB9013CCA734064EA74BC349F2156EF9190BA3FAF36FD59E34B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 6e891f94aa26d4de09f909d06028843d6625882cb10a65bf27469b74f6bd7489
- MD5 4366cdf2015f8d41730e72d62c783471
- SHA1 520031ef882b165b8d679606ca9b7d8dd5e9229f
- SHA512 55021b3e5ad1f28bd6cfbb3bfad7944395a144b0469dbaf044258d4c4ea276a86dc970b99438342fad313db913d2d8aa581310eca0bf2721f8f77b837347137b
- SSDEEP 12288:ayJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1C5552396118964B1FABD003D86364824F1943E3C9B2628F7A194793ED379FDBDF38852
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 9d5e2f56495ac36d44986a056985f3a262e85371bdccfb33aae2d886a8266e70
- MD5 f422e5f33858e372e811ce4282a4300e
- SHA1 46ab84f5a2b2b81202446459d0c56296740d719c
- SHA512 ae68089a65e65013510e0533df4d4ffee452f4f7047ad475a11cd71f3364cc5138827fd19610a547cd812208f1f05254ef8643bf4ec3415de6b15969452b6982
- SSDEEP 24576:DQ9MxZKdcz9dw3q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DVKZqLNiXicJFFRGNzj3
- TLSH T101558D2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 04a3543163d91e46448d035bf0886c914a5bcc552d9bd90ab681b66268151fa8
- MD5 5dd4e45c7e0e10ac646ca6fc8f9e66f2
- SHA1 0ab0353c671f3502ca210fb1cee56374661d0776
- SHA512 f5d197088c0908c0c4a446c3afb02e6e19f56fc8770a107bdc8ec8846b013a61d2862c4606d04d2ced0b512a16aacbe92bfd20e28e33caef2662b8d7cf53a6cb
- SSDEEP 24576:ryocDApv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eocDApvLNiXicJFFRGNzj3
- TLSH T11E65E05FB76D40A2E176813C89858204E7B3B4345B6257CB6191C73D8F37AE9BE38B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 1605f09c553b220cc5e0549d40ce07981ef32471556994b6d238b844d1ede057
- MD5 c059d180c0240719ca9033194cf4b842
- SHA1 5e5b2bcf534260cdeea4190a8c3eebbc96726f42
- SHA512 2500c8c9a6f068a61b554fa41c2537595230e5b5cc8ee49bb4f2b923b39a651fc12dd6413b6c747117db8eab240b8ee70c86d745250647c2e6a38236f8404598
- SSDEEP 49152:iWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKvLNiXicJFFRGNzj3:U0zuNIR7wRGpj3
- TLSH T110A57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 23abad730d7aac5ade3b77f551bfc125c48f01f88747f9b30d7a720c39ac5d15
- MD5 36aaa7b5a3ce8a8ac4151aea4b066dfe
- SHA1 98912328435d13ab948b75899f63368a75218593
- SHA512 f5e0ea5ac4956400b2aff5e9ed30a4e5dea48f2e170542d70d0dd3f94439a07610e54de99d1c2920aa438be49906e36bb59840929c8511758bad6b532f7d95fe
- SSDEEP 24576:O1QT7EcpfxR+N5AWAz3ooiYzjMqbs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DTDxR+N5YzTBjMlLNiXicJFFRGNzj3
- TLSH T1A755B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 0d2108b033273c3014e31cb8e963f5b3d3d3c4d6f57725eb9ec3abb9594fe72c
- MD5 306a9596b105c9b13b0a4c5089e80539
- SHA1 d7cff01ab7434527897410505e692d6798d863f6
- SHA512 4b9203fe00c9839b17b8e15a5a0f57cff4791bc4bb8fde9b963cfdb2b40aadd6174983bfc0d301dde85fe72debb3a73ca238fcb9cadb55ead08bfeadcd2fc9d9
- SSDEEP 24576:CTMdOz0FFS+UmSLw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:O0K+UmSLwLNiXicJFFRGNzj3
- TLSH T14975E17EA39D14E5E57AC17CC6538906F672386503226ADB0290C17E2F6BFE47A3DB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.3MB
- SHA256 a5bfffa1c2b5badd9a89edb2e9be4cfbc8e0eda5be8c66bf6609e5edb2b8005e
- MD5 8ed9df658a608625d680d456d3089355
- SHA1 222f5feac36590b636191533eac7ef5241e1f1bc
- SHA512 1ce7745fa431299f9c2a28e3291bf8cfc272f7d0d1fe5665d7522a6bf9caa7ac7718040f1b03ad5e0b5f68fb8719b9c3e24ea56fc72e05b8096d232b163f36eb
- SSDEEP 12288:m4KNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:UR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1E355125A13D830E0F5BA5139CA364014E660BC3957251AFF71D0A97E9B36FDACE38B12
- MD5 SHA1 SHA512 SSDEEP TLSH