Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/07/2026, 12:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 3.8MB
- Sample260709-pyf53aby2y
- SHA256 b1a0784b498675b8dfdc5ea19638ad92709e1f6a80b516975e14df0b519a1683
- MD5 70d1d443bd6a546dce17c9471d55af35
- SHA1 7e1163f17821d872deb3fe6e7df6e91eeec6e29c
- SHA512 97a2b90db4fa22233d03ff3a5d927405de73dc6e20d573a08869aea6de894a86f91b965d0d9944edd52e8d46a5d9c45b5f6491d33215a5554d2287512de98ea6
- SSDEEP 49152:h7JynhJ8EhdVMw7Y9odwfDFqfFFJVgrvqzbut1wOq/eCgfUeT+uXEkjNEEBHLYPr:QsoEC9ha+uUkjDBHLYP7wRGpj3
- TLSH T1C706AE0AA7E406BCE0F7C679CEC6C553D776B80D07B0669F029099A64F772609F29723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 4736 alg.exe 4356 DiagnosticsHub.StandardCollector.Service.exe 4060 fxssvc.exe 4744 elevation_service.exe 5116 elevation_service.exe 1296 maintenanceservice.exe 4436 msdtc.exe 4228 OSE.EXE 4224 PerceptionSimulationService.exe 1668 perfhost.exe 2308 locator.exe 220 SensorDataService.exe 2296 snmptrap.exe 1780 spectrum.exe 1808 ssh-agent.exe 2312 TieringEngineService.exe 3584 AgentService.exe 1648 vds.exe 3356 vssvc.exe 4276 wbengine.exe 2968 WmiApSrv.exe 4920 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\system32\locator.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\c7e5e7b5f77cf242.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b70439aca00fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000731a0eaca00fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000819e74aca00fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000324dc3aca00fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ec57baca00fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d88beaca00fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000734015aca00fdd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000462d21aca00fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe - Modifies registry class 28 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0" 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "Archiwum WinRARa" 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV" 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rev 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "Wolumin naprawczy RARa" 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "Archiwum WinRARa (ZIP)" 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,1" 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0" 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4356 DiagnosticsHub.StandardCollector.Service.exe 4356 DiagnosticsHub.StandardCollector.Service.exe 4356 DiagnosticsHub.StandardCollector.Service.exe 4356 DiagnosticsHub.StandardCollector.Service.exe 4356 DiagnosticsHub.StandardCollector.Service.exe 4356 DiagnosticsHub.StandardCollector.Service.exe 4356 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeAuditPrivilege 4060 fxssvc.exe Token: SeRestorePrivilege 2312 TieringEngineService.exe Token: SeManageVolumePrivilege 2312 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 3584 AgentService.exe Token: SeBackupPrivilege 3356 vssvc.exe Token: SeRestorePrivilege 3356 vssvc.exe Token: SeAuditPrivilege 3356 vssvc.exe Token: SeBackupPrivilege 4276 wbengine.exe Token: SeRestorePrivilege 4276 wbengine.exe Token: SeSecurityPrivilege 4276 wbengine.exe Token: 33 4920 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4920 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4920 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4920 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4920 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4920 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4920 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4920 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4920 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4920 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4920 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4920 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4920 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4920 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4920 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4920 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4920 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4920 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4920 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4920 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4920 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4920 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4920 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4920 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4920 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4920 SearchIndexer.exe Token: SeDebugPrivilege 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 1192 2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 4356 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4920 wrote to memory of 556 4920 SearchIndexer.exe 115 PID 4920 wrote to memory of 4512 4920 SearchIndexer.exe 116 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_70d1d443bd6a546dce17c9471d55af35_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1192
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:4736
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4356
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3396
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4060
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4744
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5116
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1296
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4436
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4228
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4224
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1668
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2308
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:220
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:2296
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1780
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1808
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2312
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4712
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3584
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:1648
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3356
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4276
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:2968
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:556
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:4512
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 6254537b2f2e592baa50dd745623d5cbba0ca5c4a9b2eb97b2299a60bd5fbc81
- MD5 4d7e2babc2ddcc049d3a5e95a6f51943
- SHA1 80136d97eb637820936ed17f6aca88e3648e2358
- SHA512 34de0ff80158767e93cfd1ade488060974dc72d62c38b178fadd1395c9669701948c4f137d824c1321d61d71cdf45f9d73617c16d72e938c9fe0e1b3c87017a7
- SSDEEP 49152:Nb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnzLNiXicJFFRGNzj3:T3q6mjB07wRGpj3
- TLSH T1F2D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 75b8a1e47d321b6f116df7c19271e71ac3d3e95e788c2e8784667488a2a54d8a
- MD5 38a17c19e089d6e90fd04c111ee023e5
- SHA1 5ede7d87f54a5bdc933d54f22ac317d5720e4ce8
- SHA512 d5f45aef17a1f5c393ae815318a40c874f716a925a2ccbd8cce22a6d7181a44336666e0949ade01b841ed9ec44034de616ba10428e7d52496f91c25e7ede7e4d
- SSDEEP 24576:bXYfDtczA4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+tc5LNiXicJFFRGNzj3
- TLSH T12B75012963D408F9EDBB813CC8A28411E6727C554760E7DB03A4A92A5F337D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 64c8e484edaeef3551233d0474b71b4db6cbd5c569386fa6d1af17bed778ed12
- MD5 c179d5f54002ab57676ad5ce573d01be
- SHA1 0c8fd856d25a480a63508d385d741d3d211fc3bc
- SHA512 607c5ead7517221ebe29317b8ce41115d03cc480f65e5bdae08960844ecee28a0d183e4e41011655da06524fe42d2b5fe80045fbb2db72fe7cc59528e53255dd
- SSDEEP 24576:h0Le5ji0hmxhrMr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hPji0AzaLNiXicJFFRGNzj3
- TLSH T10985AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 38b7ed4466770193aa02a49e8cf43e70194ebc7f7f5d24c719d2cd14834fed98
- MD5 ca8c1ca5035f0f4e4fc45218261939f2
- SHA1 2ce8fc46ad7edbef32e572c1fd337694695005b8
- SHA512 75e7cb27d4e484d5372936b31a07244b2eed31b9cde5184660ff826121deb0cf5850c1f0be7d318a10b41b8e2afe18c80665489ea752b2658166f8aab8e64034
- SSDEEP 24576:Ea7/ezSC6vUyD/aqgrvWj6q8wyup/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:z/ezSC6vUzPv+HjyOLNiXicJFFRGNzj3
- TLSH T12B756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 bec902e9379d68fdb1ed32de058f9356427c733d3f3b450a0f5dc84a85ca2684
- MD5 96124e0bd7e7edaf8401bb5e2adb33b1
- SHA1 972ceec15c530de62faa8f5b5b0918629d0e577c
- SHA512 2bb25a1509af26edad0a83843c7c83226691a707c457e43c3672bcc6758e72c3148a4095eead67b833ddc713475c440bcd30bf108e3527adf1e450305813f13d
- SSDEEP 24576:4VbqPb88hv/l+Bk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4VO88hXl+6LNiXicJFFRGNzj3
- TLSH T16D559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 fec89c1b8bafd834beed9782901a54cd8703c77206b5cc688bb9fab45a6851cd
- MD5 37f816532487fce59fa110005433c914
- SHA1 71e661799c06bd667a6a4ccae1f9754c9490c899
- SHA512 3c38641c4f2dd025d5606b4da99632ce2ce564baed8ad2174000687a47d55188d0cfdba283f7067d26ce68ba9fb93c66f0e9aeea372e2b87112b18a4886f4e11
- SSDEEP 24576:PG3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yLNiXicJFFRGNzj3
- TLSH T1EC5523D3468864B1FBFD003A867A5828B5845E2C8A595DE3D2543E5E913CFEBCF39123
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 52b77a7d29665321007eae2170572734e245a96b0989b80e5a2fe10cf240ec71
- MD5 b9fe4338e1d4907987b12387d46b40fa
- SHA1 51358d9c4ef2066af3ca917f0281d8d557999fa9
- SHA512 01dbd7973be4f76761de2fc57ddf684adb9bbcbdfff9edb5ae3ac26efce3f682e3f245a7f705668a8b2656c0eaa25e6e211a372b0722f8765c45a25761894876
- SSDEEP 24576:gJIUc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gJIUcLNiXicJFFRGNzj3
- TLSH T1F475CF7BAE28FCE2C27E4C7957518600E76278304F62A3CBD165830EDE236E55E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 0f4d49d8d86dbe3e95eb2cb634acb793a78bc63ce2df8ec1ea35fb41c6667d6e
- MD5 7110b02e10f0fcfbddc827dc473a1ab7
- SHA1 479ec8e72d614e9d214cbd47d59c9e406c622001
- SHA512 47a35ae40714d54394398390df55b6d1e29a1a2a51229f781c22d550e3e521ff26be38ef00a0c32412f9f2d1861c25d2103dca7eb7d9282083667fdc4d2000c3
- SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THi:nQvGAdlCEL8c/WRNw5CZ7wRGpj3
- TLSH T1F8266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 ef428014f87f1cc7386c0d1251ada5646273661aab9af8bc6ff59dce2c947109
- MD5 86c05667013343d708daf2eeb9ef5921
- SHA1 f013534bb036a330de46bb9a28d8a0ae0409b387
- SHA512 a91a0251266985bdf113638f3b8f03527de3a3339c0e35e8024faf5dba9bbe060a5e48010fc2a0ff233e9c9ef1e0879037647e9fa134bd25752620036b3b85de
- SSDEEP 24576:mfewsAjK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UljKLNiXicJFFRGNzj3
- TLSH T11375E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 8744f5217098495fe9fe2afd9a179b982b19b9f22cbbfc2b83d76b1cc1d75404
- MD5 8e9d87b9948de3a22c3a57f55ab15b8c
- SHA1 b9dc7398d275133687427a8217a461d80c58c97d
- SHA512 e5c966e0da0ffe4684c87df13f13c7981668127453108e32f4f0edc9a08c909a514dc2afc18d2258027733acd5c0cf4555af2fa3fe5e2840d3173bf838da0999
- SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHWF9:bUEtQevvqc2W1cpV20I32a9
- TLSH T10C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 c87eeffa6095a5f72a365caf2b2077dd558487c86676211801bfe9933270005a
- MD5 449174d70f38a3022eb9765bde82dc60
- SHA1 72d26a626cda094ea902c494df4541e218d45a89
- SHA512 1ffd092258d7465337ee0afa5f8376c126b9b3e8c913b54d69cf1df423f67c2d400a02a2943c05fd88596f7cafc7d51b7cc5761b0b60c3c826388ca0440b0eac
- SSDEEP 49152:LCbRquA/m2yL5zLfFiV+XenmE3/zqLNiXicJFFRGNzj3:Uoq2Vjnmd7wRGpj3
- TLSH T144D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 f1d22c4ccfd8777872fc29b65ab780bc33596bf1fca6fe49d35aaf384041d303
- MD5 f934b468de6fb22f12e6ffaef75c4ca5
- SHA1 7697e5ad3c5d6c02efbb9f316cb3401d11363669
- SHA512 aefa8fb4705ff2131a4ad513db99d87fda42a69d34196bf29df7d741891f629c895467a832cbff50a266989449028a5f2cf33a4dce27985c03352cff1cbe6094
- SSDEEP 24576:zAhGL6IFoiwtA5l7S539/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zAM5Foiq5NLNiXicJFFRGNzj3
- TLSH T1A6359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 da2fe8d34025f88895203a154024497a0168f73c8ac4fbf5d00816fcec1d97a4
- MD5 1e44149914a2d3f011660f0a964197ba
- SHA1 14c0036722d87880d6bb6bf4dbedc4e42a6fc4c4
- SHA512 bf3bed08e1a9e3920995ca870e62b09ed94d18f33fa4b1ae6c75935612851717e7ae45077a8b7c07cb6bb2a811786e0629bd3d78174e937f91d03286464c2183
- SSDEEP 24576:xwuROWu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xwSOBLNiXicJFFRGNzj3
- TLSH T1BF65F08632980CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 13a9591d66f802a02f37fb3606ea6b54894ccc6dc364ac3ce4f15c7453fee942
- MD5 44cedf6603e16e9c8764f03a9bcc83c8
- SHA1 f587a5efec08f89321d7067e36879c96a5d44bb8
- SHA512 bd2cf9bbbd72a531767e8c571d1545f20906a48cc2dc498c19a5dcf0ddec59f04474cabfaffb5ae22028896ec9a1d28870809341950fe4063be106af02b8c14f
- SSDEEP 24576:gZuj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZLNiXicJFFRGNzj3
- TLSH T17E55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 925e60b29ab7b850f22e448aa0c34237b260a287329507cc13d9159eb11a0938
- MD5 9d2bd6926b028da08ffc2a35782ea336
- SHA1 fa3264a8a02d331693bb59ae04d7491db06cc31d
- SHA512 e4901c1f31d2176a7163a9803c31cd0987a0357cecc624c1ad522dcdf73f74e73847e29d558287d1ef3181cc04276082341bcc2dcaecd360441a903af9ec57f8
- SSDEEP 98304:uQRQyi36YOcPDLvw2gAf+PN3w7wRGpj3:1QyiKanX+PNcF9
- TLSH T12A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 81dedf6c0d2bc1144f4a202bfc1e4aed685d3cb7a2940d89c24c9af9d4a454f7
- MD5 db08a614f7f11f18915cb3e8fbba00cf
- SHA1 873fcfb6d929188f2c03abfb7502335462624888
- SHA512 08f1d72ec0b716da615a635a4743b1f6563251428aa14c26d5f70913cec129f70fe737c581e35bfd4cd5f05a9767b6db4812053c5152098ff0a7e1ac68a4e461
- SSDEEP 98304:QQRQyi36YOcPDLvw2gAf+PN3w7wRGpj3:HQyiKanX+PNcF9
- TLSH T12F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 f907cc7c6c0488e867c0be35a2348fd3b792002497e81495a065b866e6de6921
- MD5 8673d38507da49fedc413acba11e2433
- SHA1 0dfae0afc8adb4eaa628482f7afd9cc439b0d4dd
- SHA512 7fe97a6e4d5f87ee855719b608e98e0decaf4aa7acdfc79970f406efabe1d0eb3e0ff94e8c4ced6f02fd6871662c20670147899e2cca71cea1a7f56cb5ef97f1
- SSDEEP 49152:G68Qg55nhkeWu7PNU3/aLNiXicJFFRGNzj3:kthTRc/a7wRGpj3
- TLSH T117B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 3f3467d5eb4b6b327bc58f9ba8016e4ce68dd0f687af0a4daaa1cdbc38eb0424
- MD5 25824c029ae9a6be09c3094fe98ce47a
- SHA1 8da48b9aaaa87dd949422164026ed2193e043311
- SHA512 03bdb870950161984296aba00dc85e4ae96e72580dd3dbbf087a888622b8d7268b8e7ec9c85d1b3dbc5e00aa527dff2edefda047a4df273e0499d531b5397950
- SSDEEP 98304:Ny5112gYy5azzVvU69nLKnhZ37wRGpj3:wLIHRWhZF9
- TLSH T159167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 99e64736c746f7fbdd51dddb91050160a8b23aa32f096faa0b68bfc2e0a428a2
- MD5 1ebf98a1012b561cbfcc386a76975cd4
- SHA1 d02d8ded468312330841eb4a4b6c14c24b0d5a0b
- SHA512 d41c295a5a91856704a81e232cfc128f9cf5891e69a283150e050badc051314e3e244b5299720927dc5f23ec825c4126074738a35d154fb1fa708eab1e3ed85e
- SSDEEP 49152:tB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glILNiXicJFFRGNzj3:zu6JmIxd2dI7wRGpj3
- TLSH T16ED59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 bcf8d6909a486b01300970ee68dd7ada30f959c3dccc8a6f13ac628baf05786e
- MD5 3d9da3bbdb26b6b3347c911c5228b1c6
- SHA1 350f0d5c26c44ad193d8648fca79adf94a3255a9
- SHA512 199f092b0a388b1a75b4ac7e24825d4bf928988748d1aa1f15e08d435b5fe2dbfcf2f5de3ea7c92455b2f44802550762b9e4bec1ac3df9c13ecc129da4a3c287
- SSDEEP 49152:W1hpsNoJpF1A67U44CwH7R4x8LNiXicJFFRGNzj3:WmifPqRd7wRGpj3
- TLSH T17EB5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 ccc68323bef34af7ff7eb7857f400c7e3e62c16a1c8f732c7639fe3a39589819
- MD5 bf25050011eaa8f5eba542553c58c6ae
- SHA1 a79e5551f260d1fa937b82a4c589bf8ec32b9f9f
- SHA512 ff7337fb74fa73cc210bad0138cf02dacf1eab16a6bafc3da1f9582266c3e079836d62ec80cbd0657c029f7aa0d3382c60c1e555955b91a0f698482d4dfaf66c
- SSDEEP 49152:hSuZQIY0Be2KkRVtOnks6NMHqjLNiXicJFFRGNzj3:v5dKqi61j7wRGpj3
- TLSH T169C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 8f20fdacd480980002df367c397b35f8f906281034bd89e59ad9eee00ce87270
- MD5 942c15eb4c10dc0252b001c7c9793f62
- SHA1 28132110eafcfeb27d4590f4d307a238ef5ce6cd
- SHA512 5e9ce08a257c56f7c4ce638d253aa110147cc973d27fc3c2ef85a94e5f000a4b541d8c1fa7e9d662f90354318137962417e7bf6b4fc3a4eeaa71f991e85ccf10
- SSDEEP 49152:JhtSn8EApI0figjgiDn0AP5w4LNiXicJFFRGNzj3:4X2iWphh7wRGpj3
- TLSH T1B095BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 7cdd9be3a93847aed47226d7f2d5870059ba6d8dd249db92917dce368f727c59
- MD5 86e5e9e21aaa71e07ff719082d0aad02
- SHA1 eb418490c34fc3c5d89b7995a915575fff40a247
- SHA512 44bd6b9558f8577be892037b5a82f5902fc8ec8140b11dc79fa063deb919546351548ad71ff904a38bb982f6e4ab693a706e7159c89b317ff7cd6d532a4eaa1e
- SSDEEP 12288:e7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ev/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T10D5523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 d6aeba194a64cb13fbb66e793e5cf60d1ba1c4120f3f4a2d04cc4544872ac248
- MD5 353c9a045ea1d58d56ff5b227b52837a
- SHA1 df5046d4a1cf6dab1fbc051a4e4a879a51d41455
- SHA512 4c9d3409b5fd4ece9c539929b32c4a08f724f529efc08e8a1ae5234d863d3fda4a7ad0df2e521e63bc41f1e28abaeb93aee85b34998a0c094100009c592ce7e0
- SSDEEP 12288:psiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1B65523D3548955B1FABC0039C6754428F5886E2DEB5618E3E3083D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 673f4b12d3c49752c092dc92ad0f48ab1aaa5109f7b900a66c4f7dc3d6fc3425
- MD5 c9ea66da637f306802e84c76224a5764
- SHA1 3b118e451d694492170bef71267f3aa79faa2350
- SHA512 0b4685730c20d749c237bc59def8513c9e1ea84e70974334a9a239cf9f4b2eeab2e382f55e047926f960a900afc5fd28a9f931a8c153f3e1dd820bfe01854a84
- SSDEEP 12288:LSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:L0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T10A5523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 216a2a2d889e6eb781a0b6b7ad9e4e5d7dc42664b98a72b8e99e595bbae24118
- MD5 e9527c56442d21d3aeb8371aa2c8fada
- SHA1 997267dacb263a1f862b67d33ec00a1030e3001f
- SHA512 3c13b3132ad6c5be45b6acda2f3f464c900d35b2ae136fd9888e0344f1ab708ff5c53f8f43eb001a3aeb705876d0dd9a8e64c86c3c35fdd03d0af02661eb53a7
- SSDEEP 12288:LVRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1F3552393168900F1E9F98039CA764424F2A47D6CD7325AEBD3003D1E5A75FDADF38A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 faef4ba5ac4945610184ca70b8a16d8e3145de0878e473b5b4e19200921914ef
- MD5 cba2a8fdcd5a450d8dff6ac78db64ba7
- SHA1 2f866aaf68221b2e7785c2a7d4f20c3c0d7da712
- SHA512 4d981584a4e4a432fa61e62d83f747a291401978317062b476027ea6635b3f5f093c9bb8fbdc7f708076b14a0f4e5cc45eaf0b61ef124144cdc7225a9d0fe2ab
- SSDEEP 12288:1ZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1F/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1FE5523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 238d2a3f78977f1f37afeb4f9d166410f9fd71d965d07a3e37da723e5c305cba
- MD5 72457a4a94ddc666ffd649a17f321aad
- SHA1 60032d57f98212f1b9bae8e272b77d6594f18114
- SHA512 977ad47f2753436fc9cc872198f60481da102c6c36546fc00cbbb9c16bdfecf36588a3ba68a78d3a998f9e539c4a492d5b7f49867bd8ed1f33564ad02f0222c0
- SSDEEP 12288:8QiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8C/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1E65523D3558955B1FABC0039C6754428F5882E2DEB5619E3E2083D1EE278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 ae83ced9f3e7959909301e040d61c247e2c7104025a96977c0bd35008759ab68
- MD5 d68c0e71c8fbc5c7ce18883a6da405fd
- SHA1 395296d1ebd143f78eff701f3d3b2be7bfe00677
- SHA512 08a0a174fdb4129c431fe68cbce658e842025767b4a659fe76250aa984f251064934f2a270e5087fa04f9a8d74250bfcafa593cc71d9b59943e6af96e9e6cf8e
- SSDEEP 12288:fUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:f+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1545523D3548955B2FABC0039C6354428F5882E2DDB5659E3E3083D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 9969e3825708a8b16619bb33b4dfd517653ef3f52142a1ef4cdb4fdf255ea84d
- MD5 3544d7895b6a87e0f72faec9b9dcb854
- SHA1 9ef7669e3fd9349427dc3ce129c7294bf6aa6be3
- SHA512 a4a802b5eab06e7c0fa30fb9d1c773a74da4adabc3ac242930e11d763c4efa4a97dc99be7b59c698fb2c61f317d80219729cbeae375355733dfba45fcc7ae8b5
- SSDEEP 24576:BZM3zFVSO2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BZM3zfyLNiXicJFFRGNzj3
- TLSH T188750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 3247ea12bd35615c44d15aaa7d6ecb92a828feba3e8e1d136c349bcd5d73c84b
- MD5 ecebac6e612b26ca618047bffb8f0de4
- SHA1 8af859a48e6b4d37f25ddfa1f3a14ffe81955bd8
- SHA512 271907950c2b7f234a4415f2652a464f7ff874ca71da7bf64e07b2fc4ee7e43e82def849b947d8d2d315837ad11d1aae45c55b24ae4f0b41d342dcec2501d695
- SSDEEP 12288:jniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1BC5523D3548955B1FAFC003DC6754428F5882E2DEB5619E3E2083D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 407e69ee3c4cb966ce86dcceb4d71d5fea978906578b895b1ad068bd5a254908
- MD5 d1ad62901ad4488f67f9a0d1c74bfd66
- SHA1 2726e38b963ac28c7bf3d7441c676d2741275140
- SHA512 142d291aee43cc70aac0074ee9dedd229b7d8549d79d0976e25e63af22a78b5d2ca59ea81baf4be2e065bf8e34795d05a2f3b296ea08bab638e0c687403935b4
- SSDEEP 12288:zTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1645523D3548955B1FABC0039C6754428F5886E2DEB5619E3E2083D1EA27CFEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 3c93a6f5bdfe41f742b203c1edf589283c274fbd6e43b30a2ddc4650b4f11ec6
- MD5 c80efba8979dd5147dcf60eb3f3deeb1
- SHA1 7e1e4a775882e4aa6da48f1ac73a746276e47888
- SHA512 d098fdbb6c98afb310317b6d8dc90edcfec40450f957b814a3110f29e3991deb406cb71c8c896dbdf74559fdfca019c2df9335155ba020b40f3b15e93f2b06ae
- SSDEEP 24576:Tzy6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ThLNiXicJFFRGNzj3
- TLSH T184650247629530F9E17A8139C9620911F7B17C3647208AEF53641A7A2F37BE19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 b25912b0e1ca11274aff815bb0af912b278265501803f22e8550b925077dda31
- MD5 3a43ac6cb7237043a935c82492ed5b99
- SHA1 995bf20c4ebe2552575e6ace4924ebb9cf2d569d
- SHA512 7c6115a1b599dcad641631309f603f1114ea55d5f0da64945074dc85298637dc67ac1527befd0b975f0f33d0be8dfdd1de6beaff9e592e33c22d050dfb1e8844
- SSDEEP 12288:WniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:WT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1A05523D3548955B1FAFC0039C6754428F5886E2DEB5619E3E2083D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 29930bc516f200d5c09110d1421c002b15e8ccc64e631178e9165d7b86068688
- MD5 315623f986c829f0789ebc6ba4f2321f
- SHA1 3c5b45a51d4f9e3a93c0551fcbe65d915103a3ea
- SHA512 ab13edc2849a31361eeb13d44c8997fd316ae6c52b3880b01bb5384cfe631fb96d71b5e8e316f7b308cef020ee84ac648f923337198bf9684abdfd977dde79ec
- SSDEEP 24576:oT/TwSfVcYG3K/cJHlnFR+IGNe8j3Izf:gLNiXicJFFRGNzj3
- TLSH T1875523D3548955B1FAFC003DC6754428F5886E2DEB5619E3E2083D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 cad3cccee25d83cc636f55015b43ca95ea31ae3aeae25d5dde10fa71cb90f8ea
- MD5 291fb04231ad853fe16f6410c24b9c28
- SHA1 a684a814271e2a15dd7ba729d97505761fb53e8a
- SHA512 7daa9b88c09ae04e23382249e8f1d2a3ca90e1432fb707bf9ab8c557e18cd1ff6f2ac781a5ea567066c8970ee1ce7f44281c388932b35739d8e1756fd824b4a5
- SSDEEP 24576:dcP4mcvIjkGOxhKP2l71nNKbrh/8KB7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iP4m4IpOO67W8KZLNiXicJFFRGNzj3
- TLSH T10365AE2DABDC0096D0BA913885658A49FAB1742E1F3286CB1160A33D7F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 abeb154d5b408b9d3388054bb2427d07701f1081a2c56a8b22f566984add2334
- MD5 fa1c894072234f795b5eeb6f638bef2a
- SHA1 649511efc1f25be5152be453e52ac717b38b4df2
- SHA512 579a99655bfb1c1b8d249f5ab44fa89d077003a6cdd384945287f102ef421850b355784d62b25d36b9db043c9d1acfd42104ff4406ad7ee35126214746df96b3
- SSDEEP 12288:ypsfXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7j/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T19C65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\WinRAR.lnk
- Size 1KB
- SHA256 a9f02455dddaea622b2254f20917c4ae0699d3ec80794e1660bb5f40e010b013
- MD5 d2c790906c61aea75c8fec1b46742532
- SHA1 5986d504a4a81c75945777e53e4e83e05979d197
- SHA512 3b9f35be6365a4f0738bac377e967ff280d7028c29781de912b6a9b1427cfcac52ef3c08fb4179f4887bc3705b08df2d3f994ee602df390cec015ecd8de3b160
- TLSH T1F4114E169DD62B22D6F7CF7086E77311C6A93C75EFD42F0A4040C1492835905AE79F6B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 502085ec6b4d5584ef17d4e32d8b03b262abdbb74b5f6fed220160919adeb4ad
- MD5 b3172b913e1955e2ddcfbc6708ed242b
- SHA1 0846499ec07d7be7b5b834945c6dcc2d34c5a3dc
- SHA512 d93c2b5045d93afbd1ba53313fc6e458f75ef617858106eac71c742c2f0baecfbf0ce6f7270947805481532755612d5d90a2d98804260f048bd74650c77d0f3e
- SSDEEP 12288:/3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/D/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T109552393568C5572FAFD1039853A8438B5497E2C9F1598D3E2043A1EA238FEBDF38527
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 debf7c9f9b76b7066db2f9b132bb9a14152428b2ff805db15f9e4e999afb93fe
- MD5 92040852562381ad73179ebab81fc399
- SHA1 aff0ef7643a58b3b926e3c3bf54b53c064aefc18
- SHA512 2a4ed52329c0f3c9ebfef5eae4c178bf5758fa1436f823200cdd8c36f4050c069e6de0c4a18e2d73758a3c9fcc35c1f68c5c099aa4661e4a7e3bc230a8c2372f
- SSDEEP 49152:Ba0h2GEkuAe73q3pp46zwwQFLNiXicJFFRGNzj3:Ba0hNYG4JwS7wRGpj3
- TLSH T11C85AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 4fd0a791f0f7ace0806e9bd598cb6bf01d3a774e08a10b8b8ca73e959a003e4b
- MD5 73aa92116a947dd662f6384b8313946e
- SHA1 454214612caee3096d47ab6a90b09fd2be0a4604
- SHA512 8cc53fce47930c0b03689426ddb1e085d6e32202d296d6db90e0878919db4d4bb68accd29055c65d1d4b74756914c58312673d1d792e6899bca7d1267debf2e6
- SSDEEP 24576:vhbHjPm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vhbHj+LNiXicJFFRGNzj3
- TLSH T1345512BE169C20E5F6B5903D8566840AD370BC29172193EF6381523E4F3BFE94E38B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 606ec802e7eb49d4ffbd2e0b223ca6f2f7700cb62dac09e309a0f46eec59274b
- MD5 63e6e2cf4b0e71825de2559d3a71cd64
- SHA1 8268dbddd27d0a598c9961c1ea48d8b9b0a29559
- SHA512 fe9bfe0e1c5b4ff5d97356818765d88115b12a61bf77021b0574bc3e39df24c5cb3fd2f674f647336bbcecfc483418d0c830a03f1ef6db468ddc9790001690a0
- SSDEEP 24576:h3YgnJcRTk4yti+R5dBR/u/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hIgnaTk46pBR/uLNiXicJFFRGNzj3
- TLSH T1C045B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 7f0256a68866db9b693842ad5030a60d98cb9a4a7fb6bed72c3c2257edc1c24a
- MD5 e204dca6b0c2ec756e29fa0922a592f0
- SHA1 04db5e74b13f49f1a9b411b4b246ae28685d29da
- SHA512 1371b3e1903af21401f28627f230623f4f543dc785491e4a6c2b838e9bd47f1958907d8a15896ec5e9746de6fca45d566f8e9c18ab87d16f33de799d80c5bb92
- SSDEEP 12288:IjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:IX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1C55523D2518959B2EAFD003D867A4428B5446F2C9B2619E3E1543D1EA27CFEFCF38163
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.6MB
- SHA256 55dcf14e101cd03dc51d963c7dadf0922bcfd047ad45ea6786c62b5fe5908987
- MD5 30c6566946f30d67410e239acf34edcd
- SHA1 29c008df653e17124b9b20db6e2b49aa588005fd
- SHA512 a002b09d8b9b7e3811ad5b19351d030c789de43a641e016b708dd162b2f2e1da09db8374a330f3388bba489fb4ee86b8605b1ad8020157889c065c42154dc9d9
- SSDEEP 24576:MAL3UT4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MAL3UcLNiXicJFFRGNzj3
- TLSH T172750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 649663554548d6f324d00eb98c5096e5349b247675ca619e894193df50a2f59d
- MD5 04f3ee3df183195833e1177352cc5d09
- SHA1 5a308f438e2f1f64820d5900acf94f6f6cf7eebd
- SHA512 5d714ca886134d4734ad0dad118cbacb2b9c02de1bb6905f210c4e9da896a2c12c81ddd4a5cb96d82f87cde7c3ca5a35daefeb04c928f0a4e500ec26057455ed
- SSDEEP 24576:AO8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AO8LNiXicJFFRGNzj3
- TLSH T11E55125A32DC10F5E579903D8AA2820CE3B1BC29072257EF4290517E5F77FF89D39A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 e74ca536a60100f171f1521a5e112e711c5b684a200e37477b9c3a1ed6e02ff3
- MD5 707346c90928a559502f951c094592db
- SHA1 d098fb6cacd9f1be6fc19fe8ced87085b9784cec
- SHA512 527f07b25e670a592bb43e305be4ff934985baf6fa51c5e659cd367ef6f7591681e9452605901f55ec62e7c52845bd8568046481c4ab942d19ef15d0e1795a00
- SSDEEP 24576:p7NM9YqZqmWMUkPjZM48Mv6bEhsT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:p7cBWMpPjN8DbEhGLNiXicJFFRGNzj3
- TLSH T19D65AE2E6BEC81E5D477D13DC9A28205F6F1B8611B318ACB5162833E6F37AE44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 af567d67a338d3dcf6d1b86263c5a45fb6b2720d5cdd6699959cc0290aa0814b
- MD5 12b94dd276d679745b621940c4ca3d8e
- SHA1 1abdca608528c69d2609673c0e8874dcf4087271
- SHA512 922793e88d403995973e14ff94dba976520d7b219ea54a7cd35a04a9613af6bd7c08ab3c61f9e52f4e18216b81b98cd0fdb4c2f5060140b8503149217df673ac
- SSDEEP 49152:XF2YuHNETovAvNYf8kmzLNiXicJFFRGNzj3:u6BCf8k87wRGpj3
- TLSH T1F9858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 44273fe7c3e475d9dc7baf8fb540bb2fe866c24686f58a492d353df8f202ed2d
- MD5 a190ba9eb7949f7de3fad7f1430f8097
- SHA1 1c55e52588e672b1af998b76c2b1ae4ba2d1c044
- SHA512 ede74ea38d884d92db279f234e00f6a96ba4f990391d488b26d2adc57c7eda572ed7a48741852186816a2e33f1a9807b7310efebf26b063bb73ce7e4b296e959
- SSDEEP 24576:CAFs06+Omlf8NXEbToQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7Fs060loXulLNiXicJFFRGNzj3
- TLSH T12D65BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 8d32ebb9c7cda633dd036e4c20f9beeedc68195693434886d7d96d5a9b8682a5
- MD5 7a5d6fef445b517adbbda0f6c93443d5
- SHA1 e55829294a621f402434c129414b67dda208ea2a
- SHA512 06df760fe055f957d4997fe79c945824b6bc457f6c728aaf92d583fd7f33ae6742c0d1af2fdbb4eaad3850e1d8d04082b1f7eb46faa9ec464d16a72e8eb1443e
- SSDEEP 24576:QJnJ5D3WXl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QJnJ5DGXlLNiXicJFFRGNzj3
- TLSH T11F75D02DD29810F4E4B7C274825A1A55FE72383D2F226AC724B4E5357F22FE09A79F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 830f6366474a707303d30859a93ddd79c921a8334c2cf1eacfff68fea07c350d
- MD5 e5bca5c421974e6631419ed73ed19cb2
- SHA1 a1d18031ee662d15609876fb642ed91fadc36438
- SHA512 e6fe205ac6eb2948f083f7e7f20483fa5e1f7f11032c4e56fc1612f537e37c133fdb9343b404ca97b251722d8747aa3e6d627ac9cc8c0a1addbcc1e3923f7c09
- SSDEEP 49152:Cg06DIKdwc+eQnSt65aVvLNiXicJFFRGNzj3:7R7wRGpj3
- TLSH T192956C16B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D934B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 715ef34a401597dedc35d710c33a31d157ff110a1eeb58e41843c5f34beef146
- MD5 045aa53d93a19823bd2f442bd331dc14
- SHA1 d016c481d95b4e10b23b5cadf3b6ea088e128595
- SHA512 4ccb372a397bee0b94a0fa6e2fb23dce7ba5f75f368d54a5c33958e17ff165e699f381c99c31f2c950061177942a227734c715bb826052163c489e0781882b9b
- SSDEEP 24576:JnJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JnJLNiXicJFFRGNzj3
- TLSH T15D5512AE278C60F5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.4MB
- SHA256 61b0d29e142c2d0604c7a790e1c4b195e3b85552f48d9d9f7866b9adf2c2c3f7
- MD5 1cf8dd9e8f6ee09012931dc41b2467a0
- SHA1 642804bbb9c9a4ce091ad75baed6564d35bc6fbd
- SHA512 d7957b1770a8251d361060352d351e9f3a9c2fccde53af3f028076b1ef991fedda8d5a6c4d51ddf3b8f5d442d6753978f0ae6821c859ea258760ed8d6bbeb7fd
- SSDEEP 24576:2IyW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2I1LNiXicJFFRGNzj3
- TLSH T136651245538860E5EAB9013CCA774064EA74BC349F2156EF9180BA3FAF36FD59E34B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 f6ba5293a342131d262061043241be81e2ba2a9fd081833e4360293be0795348
- MD5 321e8d23363ecae3d29d0dd34a6821ef
- SHA1 67b48d1f737d38d8b84a00356413fe69b3224572
- SHA512 71f38b631f018b6acb550240d7281244d99a219f5fb559ab1692bc69c2294e6afe7d6adf4400a4fb352b64a85fefd29f2ea31a9d4d293d5eb2c8b5fcfd562fe6
- SSDEEP 12288:+yqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ns/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1D85523DA118964B1FABD003D86354824F1943E3C9B1628F7A194793ED379FDB9F38852
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 c85ab95c3b6c344ca89d4c52861ac5a066831a62a50b373e6b89fe5b19add623
- MD5 11e964d10e0de78c7bd787746dff1784
- SHA1 ebeeac6709db69abaf411122cfe9bb0bef905879
- SHA512 0dd96d674be65eb160d65e40df3760391bbf6daff17caae6c76865aef0bc8c4fc8a1ad7aa55da4b7f589702c71e246ba7e80d590ead83c3ec7e52849f7070b39
- SSDEEP 24576:8Q9MxZKdcz9dw3L/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8VKZLLNiXicJFFRGNzj3
- TLSH T147558C2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 00e4ab985102fbe6761871ea470059ab9aaf2ca147dede4078e1151f037be639
- MD5 59253d33fdf0af32513a4e04c10227ca
- SHA1 e4bfc4b7b0ddde9e80c2678bc594dbf944dc68a3
- SHA512 0a8f2af6fc5d3738d67dd51167a1b396fee417d66745a9a0ade44a315d3028e26fcf72c00141c5da3c0ad02d748cb6b7cce2adf291b5383dc063e8a859b585d4
- SSDEEP 24576:zyocDApK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WocDApKLNiXicJFFRGNzj3
- TLSH T16C65E05FB76D40A2E176813C89858204E7B3B4345B6257DB6181C73D8F37AE9BE38B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 5656999036318069749d5cc9c141d6b54166e1b24c9e8b9c3f0d153958dc50ff
- MD5 69752b54c3c9a0167a7a78a773aaabfb
- SHA1 78d00ab21a6311b50228b21a874ca1df9ead8b07
- SHA512 01ce24f675f2c6a7ee1d21a85375c2e42e9fbfb47804c39c405eec5412a99009956474141e2ec35aa6145a659439cc44b4ff1674a0e7e809758f9371d04dde24
- SSDEEP 49152:PWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKKLNiXicJFFRGNzj3:30zuNI47wRGpj3
- TLSH T120A57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 cc8c0a0c4375fb526f575407647a42034268aa187d8a0f6c5f97799d4e80146d
- MD5 c1ec9a2c233604caffc8ffb23a25d7f8
- SHA1 10daaf9f2fc9e14a47540842d0fbbffc7577e721
- SHA512 eddeb080674679ed300a9169a3f3a1c76263c6f9ae3b98e5595c7efc6844607bf9ebbb1046cc649230772eea5e95bb99a014c84e2816bc586f270d4a9759e6d5
- SSDEEP 24576:N1QT7EcpfxR+N5AWAz3ooiYzjMqbJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4TDxR+N5YzTBjMcLNiXicJFFRGNzj3
- TLSH T13655B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 e07627a01822ecba032ede6109b2b0b71b07bd5de9ef93f61f5ce1b01ba422ff
- MD5 ecbd3150ec9805c83258feac1245a82d
- SHA1 af37b67f21b6283884a2ee8bdf8a1fb3a9db350d
- SHA512 528c8df124cf80f3c181f101d5bbc50cf7c502d79dcb1e599a73ae61e76d97dc1d06025e6a893b5d81f3148fbeb707cb5942570e624cf3f098d3a0b1b0a9f568
- SSDEEP 24576:YTMdOz0FFS+UmSLd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:w0K+UmSLdLNiXicJFFRGNzj3
- TLSH T16275E17EA39D14E5E57AC17CC6538906F672386503226ADB0290C17E2F6BFE47A3DB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.3MB
- SHA256 9108fffc45d780bd25cf1b11097ace0ffe0c26cc2578154ed559d57d3fb807d6
- MD5 4f6ec45049c9d1a7bedf686fec6ef3bc
- SHA1 9d84d2152055314b391ff0cfbde8ac7e1338deda
- SHA512 9591b1b70159435a6943f1fe35fa9b33a9c9338cb55a7c7755800e44775f72a9f5b608f3647fc0eae71b6d764a552c946a4ef4236a1f61048b1ac8d4692f5f6a
- SSDEEP 12288:Z4KOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:d4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T14C55125A13D830E0F5BA5139CA364014E660BC3957251AFF71D0A97E9B36FDACE38B12
- MD5 SHA1 SHA512 SSDEEP TLSH