Analysis
- max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 15:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 3.8MB
- Sample260804-sw9w5stcmd
- SHA256 0225a551cffdc34d8ef6c783d2fd01ba01ddbde683dacaae2c735c74e8652460
- MD5 69e4ada01067ea836a8267f20c249ba3
- SHA1 a40275c7b3daa91ad7d0e49cfcd74039456e69c5
- SHA512 80e0b38bf0872334796d67cf597f26925b178f150e4c273a8785c097e5dac63ddb56eaa2bd73204cba672c98bb0f8d446131be5f048879b5a51d0c816e690702
- SSDEEP 98304:jNUA0ZunZhrqa+uUkjDBHLppmqrWETR9b:xP04nZhIuUc1j9b
- TLSH T1D206AE1A97F806ACE0F7C279DED58953D776B80D07B0A69F02909CA64F732608E79713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 756 alg.exe 2624 DiagnosticsHub.StandardCollector.Service.exe 3536 fxssvc.exe 1536 elevation_service.exe 1700 elevation_service.exe 3128 maintenanceservice.exe 3828 msdtc.exe 1408 OSE.EXE 1716 PerceptionSimulationService.exe 3836 perfhost.exe 1652 locator.exe 4744 SensorDataService.exe 568 snmptrap.exe 1840 spectrum.exe 732 ssh-agent.exe 4940 TieringEngineService.exe 4788 AgentService.exe 5060 vds.exe 1312 vssvc.exe 1092 wbengine.exe 4416 WmiApSrv.exe 3848 SearchIndexer.exe - Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\System32\msdtc.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\locator.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\alg.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\6fe0480af77cf242.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\vds.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\javaw.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005afdd1f2624dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c993d0232624dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004fbda71e2624dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000174ddb1f2624dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008fdc681f2624dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054218b1e2624dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006de68f1e2624dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf1ce81e2624dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000097b471f2624dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,1" 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0" 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive" 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR recovery volume" 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2624 DiagnosticsHub.StandardCollector.Service.exe 2624 DiagnosticsHub.StandardCollector.Service.exe 2624 DiagnosticsHub.StandardCollector.Service.exe 2624 DiagnosticsHub.StandardCollector.Service.exe 2624 DiagnosticsHub.StandardCollector.Service.exe 2624 DiagnosticsHub.StandardCollector.Service.exe 2624 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 672 Process not Found 672 Process not Found - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeAuditPrivilege 3536 fxssvc.exe Token: SeRestorePrivilege 4940 TieringEngineService.exe Token: SeManageVolumePrivilege 4940 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 4788 AgentService.exe Token: SeBackupPrivilege 1312 vssvc.exe Token: SeRestorePrivilege 1312 vssvc.exe Token: SeAuditPrivilege 1312 vssvc.exe Token: SeBackupPrivilege 1092 wbengine.exe Token: SeRestorePrivilege 1092 wbengine.exe Token: SeSecurityPrivilege 1092 wbengine.exe Token: 33 3848 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeDebugPrivilege 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 832 2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 2624 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3848 wrote to memory of 4988 3848 SearchIndexer.exe 110 PID 3848 wrote to memory of 4856 3848 SearchIndexer.exe 111 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_69e4ada01067ea836a8267f20c249ba3_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:832
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:756
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2296
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3536
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1536
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1700
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3128
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3828
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1408
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1716
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3836
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1652
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4744
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:568
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1840
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:732
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4940
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4788
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:1608
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:5060
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1312
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1092
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4416
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4988
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:4856
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 fdbf6028518a5675d7d034b1ce658e4d7d3a18483697454b610469ebc5207642
- MD5 21933ab0720bc7b0e0e3d84c882b6dcf
- SHA1 dabc636d10794ccd6971e7a16ea1da83accedbb0
- SHA512 c8c7d097e74d8b6ac5d4dc5776f06eb56c5acabf618279631ef30b9f23d1d414b310464f7e67b2adc30f1c08262d701221959cf8fe6fee676ae287b292649428
- SSDEEP 49152:Vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnam+brLC2hTR9quLB:r3q6HjBjmqrWETR9b
- TLSH T17DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 9f8b0b67576674ebe776677e496de4fa2419e3d85b3717af2aaf82027ff9763f
- MD5 987f5d8b31c66cf65ef142a8bc0ff1d8
- SHA1 a32bfa3fd9239002c0e98abb3908c709cc9e7f37
- SHA512 f0e308e62eabd23b66eb4b2edb1c0ade231a8f0ebd30571fdd352152e099d5dd43c19587e1d861dbc97d013954fb4963a0af8c43eb5c2f4114e5dc0af3f26b5e
- SSDEEP 24576:GXYfDtczA3Rmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:ltcMm+brLC2hTR9quLB
- TLSH T16005022867E408F9ED6B827CC9A2C501EA33BC914760E78F03E499651F336D85E3EB55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 1d50788c3c3b0a6e15c4deb4240a0e3d44c72d2321c9a256d62873d107e3fb67
- MD5 f217e2f158c5ae3619c8d9a57fef1f3b
- SHA1 b7f65f0b77334468107eec09764423b603564144
- SHA512 38921d25a8e18661b6235da517c9a9a1d619b14f34a4713ff4da629e323d89384ba41b69a7eb82a8b5e2ca9fe126b1d3f7c61a35c18042b0fa82ef22377b859e
- SSDEEP 24576:40Le5ji0hmxirMSRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:4Pji0Actm+brLC2hTR9quLB
- TLSH T113359E15F6788335D073C0B9C5D2A69AE97130865B308ACB4286D77C3F67AE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 1aa1e21dfc5080c5416c42430b03766daf3fbc2183fa8bcc115a7b1721b99fa1
- MD5 3f7c1676cb7f973c42a50f40e5cb0c53
- SHA1 41c34578390a0c971067fa86262a05c3599903b9
- SHA512 ca36c8a3fcb7f60e8f8aa4729890d48d72194888c8b05af635ccf7af30fd2d989588bebc7db828a2e8846598bb33e7fb329dd02427a755366dd4ff89a5d4305e
- SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWE6q8wyucRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:n/ezSC6vUzPvxHjyxm+brLC2hTR9quLB
- TLSH T115755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 3fac58fd1184c8e15d2a37e5b1529549fe66218e0371250f3f4765e8454b8944
- MD5 bdfd19de807e6ba3bde4d2f4b75303f0
- SHA1 7969c05d0c6606e5d3efca8f6ce1f441506f802b
- SHA512 61e9e1296d449f91695c3f7eff8e4645e1e14a70978ab52c9fb54281321d0d355f93fe285f7f334f3aa368a60aa1cd3f6a534cf101e401d2fd5a4ca017cf11dc
- SSDEEP 24576:tVbqPb88hv/l+6zRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:tVO88hXl+mm+brLC2hTR9quLB
- TLSH T10255AE65F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BE6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 eb3fa46432e4ae7d1c43530a77bd5f01f761f572c36cfbcfd7e60865de7238d9
- MD5 d532f64e7147b723d61be87905e0f170
- SHA1 8dfbeff815dbb97d012b1169f1496e8cf659f9c7
- SHA512 52f10b7f45a4a2c467c3bc93f9142591eaecfb483545a4b3706fb31b74ae5c6fdaacd223070780163d784e9e69bfd9e423a6f92fe47f0918a23aaf4ff0cdbd58
- SSDEEP 12288:SRvWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQoC:SRORmlh8t0D+7y8G2G9yL0cMoThTR9P8
- TLSH T11CC42358CF2D0082F39FA2B1B2E198C5997DFCF1E984AC0EF0817DE41674CA4972599E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 521a238cd47b98c5a5c03e5b48e98a50ec4ec2d5c29dc8701cd180a58b2c8419
- MD5 ca2f3f6c4506eb30e7193de3e576e88d
- SHA1 b6b765b02a93eee05abdeada83955399463c8451
- SHA512 73e6a07d3f8280d3b9c03c4c83b8be33dd397b5fa13cd1021141e1144f3c47a249f6c7950fd12817b6cd1c66513561ef8980052248c717d7f1afb1fa50622f88
- SSDEEP 24576:rJIUrRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:rJIUrm+brLC2hTR9quLB
- TLSH T10205CF3BEE28ECD2C27E9DB85791C640D77278704F51A3CBE165824E9E239E05E39C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 76d11bed8f02aa23a215c8119d356ab3dafbfd38035ccc4e6fd04f091aa20c8e
- MD5 04f13f2a44e7e589e9e363c076223749
- SHA1 db9854c69338afbcaf337f3ef6d557bf3d73000e
- SHA512 e2d0da8657e5ab33ec5e2ca0a86520a79e29dcf1fcf81de1e965ffc6ae081c210760d0801c776bbe288b81c6e32a62b99f2a2f78abba09be4417884c1d77fe09
- SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THR:ZQvGAdlCEL8c/yRNw5CsmqrWETR9b
- TLSH T107267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 9861de164ac6c45b776fcfb3b0645190c4502b0a143611b252e373bce5bca519
- MD5 7b9e756d515c9f6ab5c38ef3c104023a
- SHA1 0ba62fa49baf4e348699fc0c6b9dfb0a7ac2c71a
- SHA512 8637ff30884537601ca7315f176be3d3c7d8d30ae2366c20557d3d43fe98885661ba78c0338de0a3ea011d15b69a7f3a8513d8d3485b139477b43a1406297b0b
- SSDEEP 24576:adewsAj9Rmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQoH:qlj9m+brLC2hTR9quLB
- TLSH T1D615EF31FE74D032C3BF0DB22B62C716587DB9604B511AC3E3A89E9D59706D22736A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 14acf72a05382b7a0e1d082de8cb612df7a118bea3717133a43ffeb3e3afbb39
- MD5 f2c04848a3d0102845491f1187666620
- SHA1 6f293e2fd7cce196b302e976ae4e9388f962141a
- SHA512 fe5326e5ecea3a77b8957c7c20f7c700fd1b2fb622efa151edbb2828507628b5c047131c7028e3fc0c0153781f02feac4e4bdbb55db68ada7b6ebea23dfb399a
- SSDEEP 196608:+UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH/9b:+UEtQevvqc2W1cpV2EI32V
- TLSH T1F6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 176168ebe63fe256b45b4c8ee6678f6f4113ef239c7d00fbaa989f8aa596b34b
- MD5 0af633b8528f1cc3b01f0dd14a27358b
- SHA1 edca974b77c0bb03f7a44c9c3518135a1b5158b0
- SHA512 9f93fca7ff22e6cf0a67e9b5f664f68e15ad9cf58b1f88c6250a1df720ed45c35c3859e59ca372ba1391d0fb788277f010eb34258829a8afd0e60b5e06c93415
- SSDEEP 49152:zCbRquA/m2yL5zQfFiV+XenmE3/zdm+brLC2hTR9quLB:MoqtVjnmgmqrWETR9b
- TLSH T194D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 3c49046daa3c648f4d9e42e1a324981f1bf80ada61e779a0307a1aa019c17449
- MD5 3594fb3d843407bfde467843f36cfdb8
- SHA1 0ccbd92548ea08a1eda8ac615fca02c017a32b18
- SHA512 3da9615bcad73e20a172c6c341fc4ee2507a11c63300c22d653c9d055e21d6d3c2d6c65b23eb14f5c2b946ca04f1c57340c4d63c0d9e62711f406595f5a74c8b
- SSDEEP 24576:yAhGLJIFoiwtA5l7S53ARmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:yAMyFoiq5wm+brLC2hTR9quLB
- TLSH T14E359D80EBF945D4F5B3AAB899B68571EA76BCA65E31C20F2150D11F0E33E509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 dce244d53b8454c68e124593009ed218ab68f4b4ba5b8f7db14b7ad0367f7068
- MD5 aa2517f6ece575bcb6737da61f203a74
- SHA1 4e05bfb5e1c7c92e98c1b8d800cd44d5bbc411ed
- SHA512 222546762d47a95ec334522f5713fa670d4ebb053cf076735a1956cff5b2edcc2cf32ba11e3c8d1b523d5b1126d3f9e6d6c36f3bac13033eff7ea3e68dc27d16
- SSDEEP 24576:NwuoOWRRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:NwDO0m+brLC2hTR9quLB
- TLSH T19605F14976A80CF9E5679238C293C536F7F2BC122A21DB1F5360C65B1F376616E2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 2e7a73d9f7ea2a90a693ea2e94b2ac22b9087d4720e944952684f4476d80b159
- MD5 28106b8105e827e5180f2943f3c8ba25
- SHA1 6250de838d3017e183a6bde8c8b265f544dff7cb
- SHA512 98db0193575e4f4f5e1d21671df49e022c7facbdbad0f7ebb219a5e038fd0f38b4f639da103390077a38a1f89d500a19b422f969afb41b9861db711450c186d9
- SSDEEP 12288:kBZ1Iy4WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:CZuqRmlh8t0D+7y8G2G9yL0cMoThTR91
- TLSH T16AE4224927AC20F5E2AB9278D1F18985D7B6BCA2673183CF215056E51F33ED11E39732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 b6d622760825be1b0d220f22255b6efb302305280a87b015871170ddd1268929
- MD5 f77409876aa57a54c9950acb43e92b62
- SHA1 72231c48ac948df91f22fa816c8b4a2e0d482c83
- SHA512 d8967c365ece1749b6c5abd632936634dfbb8f5c778bf83dd86c4c60914e9efe57e3b347c269e43c08142f1f6ff34c38a64372a129a30e1801dea656e26c9350
- SSDEEP 98304:DQRQyi36YOcPQLvw2gAf+PN3PmqrWETR9b:SQyiKayX+PNp9b
- TLSH T14B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 69ae74324e2951cb3342872d46e5f7774fd511fc035333089694df3a1622316a
- MD5 6b533c0754de248a1686225c50c90653
- SHA1 cb0a6e46b5b970389151b9321adda9f4d8da22bc
- SHA512 6524782d1c6f4fa8a4297232ba919969573b8e5ae27c3533d4d9883843ce1cdcfebe64ea910b57c0e560f1d074984cdbc4112271241af29d32031a07661c5386
- SSDEEP 98304:8QRQyi36YOcPQLvw2gAf+PN3PmqrWETR9b:jQyiKayX+PNp9b
- TLSH T10D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 72d703d2d183fc1d5ac47a67666a916e8f66330c1a151be678cd6608bc732052
- MD5 32d918a751e0ff2c58ebfa26e630790b
- SHA1 4af34358bcc33c58ba53b3950dd4845b345369d1
- SHA512 2d52d7317b41f0db17e05fe9f915fcece761c28f1eb679c77da9a2a9d6c46febba146717ead2fdedceca6ffb0487791bed41c19577faba98303c1a9f376150fc
- SSDEEP 49152:h68Qg55nhheWu7PNU3/tm+brLC2hTR9quLB:fthWRc/tmqrWETR9b
- TLSH T1F3B54933B2F600A9C04DE1769F46872196E27C75CFE0E3DB815172561BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 a0734390345125f46ca19ab0aba791f6c668d1a6669ca2e80186956fbd48589f
- MD5 b1efe451a74628ec385f076d98fccba8
- SHA1 fd10eb5768e2e7968a1465999db94f4aec989ad5
- SHA512 060a6abd783ceb266e9fa8d42a68b01eaf8801e180f3c96a6f8d91c64a4098a53aa9f61529cc1c29ca89d43b66bda9a3e2107cf2097e03357adf1156157122b8
- SSDEEP 98304:Sy5112gYy5azzVvL69nLKnhZOmqrWETR9b:bLIHmWhm9b
- TLSH T15B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 3e354d0b7e7e3e0dcefcf2e81ce0938e0adc62d19e0c20d2f1e76e0d60f00ee0
- MD5 256edca352938c2fdb75b501c2e1deeb
- SHA1 53677cf6a75247ca0cf8e80d363518f574a38608
- SHA512 165409fe847bd76d0ad6eed70810b30fc12eeb83a8ae887b0891d5fac86648fde777e913209107c26d58937d1f7da4353f9a8c46bf10dca389b3b518139397c5
- SSDEEP 49152:FB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glnm+brLC2hTR9quLB:ru6JmVxd2dnmqrWETR9b
- TLSH T1BED59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 0a3837dd01769f4f1f69e360b956cd4d6679d8aecd40aeb84d4f29f7c25584e7
- MD5 c4ce5de2abf2cb4c3895e021c1360e6f
- SHA1 41a6fc23e2a8fc1b2bd9ef6d15bff061d0332795
- SHA512 8bf21e109e5d324af52471f71c4a0ffa9ab86ef249c92aac103a84f34ca53ebe10d50cfec0c8979d4fca32c5c6a55a3adb05a24930c27383e1e3a2761f096be7
- SSDEEP 49152:B1hpsNoJpF1A6UU44CwH7R4xLm+brLC2hTR9quLB:BmifPbRgmqrWETR9b
- TLSH T1EDB5AE13F29900E8D06ED17887569632EA72BC460B34B6DF0A90B7961F7BEE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 65542329445457bd259ac6fe0145fceabff06d4d26bfe4fce9bcb269a44f6b4e
- MD5 f0420087d9ca345868b03ab452de48d4
- SHA1 f866bd55f7eb5f3bc1f5c75ed68a28723ad63e30
- SHA512 6ee6deea4c5439868d33e2dbc623770461eb2693ef9f8e6414049495b628c077de98a0e8ec8e5d6675d589e588c47f22cc5f0877a02823f9fbda8952be36c74c
- SSDEEP 49152:4SuZQIY0Be2KRRVtOnks6NMHqqm+brLC2hTR9quLB:i5dKTi61qmqrWETR9b
- TLSH T1B9C5BE03F2E940E8E0BEE67487669632EA72BC464B34A6DF064072551E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 a5e21b01c592557fe83f8aa0618ec380a0dfd0bd8e00e150de8492d9f1578a12
- MD5 8b78a38fe577c585595682cc820eeab0
- SHA1 d4201b47024a90f2b2c104e1a16684ddf7e368be
- SHA512 c0fe388cf5603c3fb4223b238bdca22ed75bd5cac7708a17d9cc23cdce336034f048b6ef2a77b3e339188f414a7c09ca8fc016b579f902894ca54994cdb62fb8
- SSDEEP 49152:8htSn8EApI0figngiDn0AP5w3m+brLC2hTR9quLB:9X2iyphUmqrWETR9b
- TLSH T10095BE13F2D900E8D05ED178C7468632E962BC160B34AAEF0A90B6561F7BFE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 5931b497dd04ab25485636f0806d03b3f39e628fa3077f1fd2990b12c95cac75
- MD5 6a173cb2c290c1af8bcf87a5855fcd2a
- SHA1 fe3c9753bbcf264e4e8438c85b57feede3d69358
- SHA512 13d283c5776422d94f5353bc4613d00fe0a1e450ff091c87848d82aacc2928e2183c440de3179eafd2bd6f63a9633881c0206445db6577b9968f62674cb5098c
- SSDEEP 12288:F3WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:FmRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
- TLSH T1D9C423188E6E0086F25EA3F1E2E184C5D8BDFCF2FA85544EF1C578E017B5CA8272599D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 228e069fc984d47627e61fd8aaac5be47075ee5ba1fcca239e57e60f15b8774d
- MD5 1de580336968bc30a5b3d829c18b7f09
- SHA1 473d173f1f9d82634ef90fb4469ef62610c50595
- SHA512 543fe943b6f71712f60fa6fee7db3c8f7c869da278c62cddfb033121d65a1a6d59c02f47aeaf853ba0097f7db0ae0da54648e45bb9057625e05858d6ffbf909c
- SSDEEP 12288:U0WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:U5Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
- TLSH T197C423189E6E0082F24EA2F1E2E184C5D87DFDF3FA85944EF18578D017B5CA82B25D9D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 4655a27551ad35e2876abd5c110d553de1ecf78c3ee8f17e09e3c2841a09ff71
- MD5 cc0ec9eee12791a1a371b8fce972f11e
- SHA1 d503925436af13b64d6f9f281ebdae9c19007648
- SHA512 6cd3859f9b33c56df3b30c82dfe0eff0f4c1c3213ff493baaedae758b6f8b7013cf362db121db3d32382f0cd2ef9fbcd3e3016eb311b8985b001362d028b1518
- SSDEEP 12288:lyWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:ljRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
- TLSH T1CAC423588E6E0086F24EA2F1E2E184C5D8BDFCF3FA85A44EF1C578D01775CA8272599D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 56ad63c3c751eedc8444794c7151368530d833eeef651dbaea7b16118dec5e57
- MD5 3bd8809b601f6d356e1469b7549b75b5
- SHA1 afd0e878314947cda480b564f6ac5fcc8f18bcd4
- SHA512 1c112e60e99f94bf6311d322fd7348a6582ed940ae34888af9bfe0d92f116cf2195fb117e92dd776c3ec510d0ef1b59e16760c3693e6ab4250f284e84cff833e
- SSDEEP 12288:gVFWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:bRmlh8t0D+7y8G2G9yL0cMoThTR9Pyul
- TLSH T14CD423185B7D00C2E16BE2B0D2F184D5D5BDFCE2EB51968FE24028D50F71EA46A34E9D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 8e24639b0b539f143af1a85de54dd3f52ebf75c52087a545aecb121fc850e0bf
- MD5 d92355e91154d7de16b052933b8ff799
- SHA1 64918ac9251f50693a0e1aa947cf7eac7e5a25be
- SHA512 01397cbc2b14fac9a96b7c879c5b9af2aebfcc0d41c2b6d4bf95a5a21357d8f9c392e2a35be07e7c3e9e7de87e349c9b118a5653a44a66c648d3390b64240532
- SSDEEP 12288:79WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:7IRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
- TLSH T150C423189E6E0082F24EA2F1E2E184C5D8BDFDF3FA85544EF1C578D01775CA8272599D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 78ce010301c9a15a61913146cb221099dd5fc8bb778126e9e951ec46c1fcd4d1
- MD5 f86d5f39c5aae43f50b9e08e9f9125d7
- SHA1 650e7762b2228080f968f819064f21f315d5fd39
- SHA512 e52ccf11a338c78fbc5ce78597554c91983c7c1fa47c6583f073841b326462534ced97e5eb7bd3ae054334310615d4a9d021f31edfc7b114227bff015cd931f2
- SSDEEP 12288:nwWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:n1Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
- TLSH T1EDC423188E6E0082F25EA2F1E2E184C5D87DFDF3FA85A44EF18578D01775CA82725D9D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 e276c21d5fc3b8a3674a4e35060ef63ef592b3913134b2f7207bde915733c4a2
- MD5 ac47ce85ff0ee439639b96cc6dbb56c1
- SHA1 943e5993a153c31e26a65e240088a87dd366601c
- SHA512 6015316297bf3b4424cda9eecd6e3d10c63450e27fa286ebe2f3c7543d2c8c4ebf7dfa563e32eb6ec93d9d1c805e9c88bd70bccb4700551355f59b8718eccf0c
- SSDEEP 12288:2sWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:2BRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
- TLSH T128C423188E6E0082F25EA2F1E2E188C5D87DFDF2FA85944EF18578D017B5CA42725DAD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 ad0774bb1717b347bb4500b83bcad89c8d47f76e07bce1681584756aed6cc5bf
- MD5 cc842665d581e33ab5e743fee17fe2a6
- SHA1 04c3c24b9d95dcbb87f168f87d051b3154e8daf5
- SHA512 b099ae5359bda8501641b08a635c033d1db79d7d4982ba9b076dc353ecf9a35b76795723d63504e671a7060332913680919d4c202cdc64a26ff2381b9da3248c
- SSDEEP 24576:2ZMSzFVSOZRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:2ZMSzfFm+brLC2hTR9quLB
- TLSH T109050294B36408F4EC67827EC9618946D6B2BC664B60C60F13E436671F337A11D3EFA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 5a7a87f70ee65a361c6028035d75c6fa30a4cf97ddf8b93380ad68361d301c63
- MD5 bc839a670da6a477429e56865906a66e
- SHA1 7d3866cd9102c8da17f16af4be95e153561101f9
- SHA512 6ec0cfae5827fac2f1fe0cff6811b4b1eb3d726be7a65f074637e80d1a1aee28df62790510db0dfb48cd77167c620ab4ca2cf32f93ee76379c2c6ef3e9823202
- SSDEEP 12288:zbWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:z6Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
- TLSH T106C423189E6E0086F24EA2F1E2E188C5D87DFDF3FA85A44EF1C578D01775CA8272589D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 7bff975d2d75e68965bbcdb5e70a8d3c4abd4f49996f0539de0c66b8cb589ba7
- MD5 de33ed9f9491da6f186b662c22b25717
- SHA1 4aa254d6a5a63b58b38cbfe2af738388ead3ffa5
- SHA512 f09df06916553681bbc94905ae55244eac45bc36d6b2df9e6966163a29adb272a3dbbc1c49ccbdf8ee440d6e8ae5a1ed97e8962157aab42f698365a705321547
- SSDEEP 12288:O/WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:OeRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
- TLSH T1ECC423189E6D0082F21EA2F1E2E188C5D87DFDF3FA85A44EF18578D01775CA827259AD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 51afce324991ce590308069612905be65ba592c7137c577fe57cba2be1967c06
- MD5 7421dc538a50f6b194caaa5f7834d354
- SHA1 53546dc45d6ca9c09369915f4391195bd6f97340
- SHA512 3f2e33ccde9739b85e66b99e051b2847bc6f339580abbafb12cd05c1c0af764fe0874eaaf7cc62f8f2ea0a25143de0df311326b7aba2fb23dcf954c1e4102293
- SSDEEP 12288:ByPz5L84WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:QzyNRmlh8t0D+7y8G2G9yL0cMoThTR91
- TLSH T106F4120777A520F9D17B9274C5A20942F775BC725B208E9F639016B62F33AE05E3EB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 bb74e9eee02194a1d45e28c6474385cf48db3e9f60252ec5e26571af26bc87b3
- MD5 273ab9e2acd116f79fc9a0296bb44608
- SHA1 fe2b8d9fb0df5b7285e7d39f884663b7507b7480
- SHA512 f22363c02164cd0ad5bfc46370d356e1247ea2619f1d0dd329a4f4041c001fba26fca34c62348d63cdec757f436a3b2954e401813cf808b4b50499a6b170c5bb
- SSDEEP 12288:HbWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:H6Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
- TLSH T1DAC423189E6D0082F24EA2F1E2E188C5D8BDFDF3FA85A44EF1C578D01775CA8272589D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 2964ec234821710051774b920ef42c6ff332279f90b820d010a86beec7fb7fb4
- MD5 4b61b7fa364da039b72824d1c246a04e
- SHA1 baf2fdb180a7b080baa83c3f7bfaecb8877e5589
- SHA512 fcfe6a615f5bc2f405d6807480632c69538e1c71de57ad554226c09972ebe18c494b073c199a7dbe9a5a0f82ca3a92759fdb60a45439294739c7c44b8d3b915d
- SSDEEP 12288:ibWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:i6Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
- TLSH T177C423189E6D0082F25EA2F1E2E188C5D8BDFDF3FA85A44EF18578D01775CA8272589D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 b87ae024129479f1d92ae243fe08632c4545f9da98272df478581dca8d2f0290
- MD5 1bd522cb98121f09a5c48d25efde1567
- SHA1 99790677ac36e2632749c12ebfa32eecec0b3679
- SHA512 69e1be02735479a685484fd1da20e14c91dae0cd019f944d824e16dfc493830d24439c0d39ceccabc36dbdb46f6b513cc51326faca169f8887ca258bd3086a78
- SSDEEP 24576:wcP4mcvIjkGOxhKP2l71nNKbrh/8KBCRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzt:bP4m4IpOO67W8Ksm+brLC2hTR9quLB
- TLSH T1CB65AE2DABDC0096D0BA917481658A4AFAB1742A2F3286CF1160937C3F77EE54F35F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 c5733c0fc82a003f3ad8b27e14801e95bff5df0ccfd108c90926601ff1ef3220
- MD5 4f6ec2fc5bbdf7f9938c1486aa0daa20
- SHA1 ff86868a45ea0380f4ed4962842986a07811f942
- SHA512 911ec2cb7e831833daf128fe1f01a4fada3ad3e655a3dc2fafb46c79aeb4ac5233cbff4be5497014b6bef61eb8080f696ca1fb78508a4f5c302d2198ab0ac9bc
- SSDEEP 12288:nNsfLWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:kqRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
- TLSH T176E40119D2A801D8D06EA275C3928A81F3377C6197E1D3CB62C0F47E1F769905EE9B47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\WinRAR.lnk
- Size 1KB
- SHA256 aef415f3aaca5971ffdbdb17a2cba6ca267f6c4c90e19110f20d723a9c3df891
- MD5 a0e8e230a4a92d7528c356ef16ccda8f
- SHA1 8eda5a1ae8bef34372f469a9cf1103662910a599
- SHA512 648df8503bcb4a8bf3dac53e96e57f4b613dc9ad3622e97953a8a6566bfcc69cad031585482740de361fd68652beda22cdc7c98310496465f5257080517b084d
- TLSH T1DC1170129ED61B21D7F6DE3082F76321C6743CA5EFD42F0E004081492430D00AE78F6B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 759f8fbe29d63d7ef749d39d4a46ba9ceccf1c4c2f7e730ca9007197e99d09df
- MD5 1cc0d870bf9053f9727698144f4d6f50
- SHA1 85e121b259cde4d3f9f26325ec9521b0f8bc08f7
- SHA512 4c851b22af931ea3385f7f820c5713b423c4c9884f78bef1998a5bab21aacbdd02babc5eb3abff7bd4392c000cada8cf2d1f77f7dc7a1a20a3e3f15f709a1d45
- SSDEEP 12288:vrWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo6:vKRmlh8t0D+7y8G2G9yL0cMoThTR9Pyj
- TLSH T122D42318CB6D4442F2AEA3B0A2E1C4A5A53EFDB1EF40D44FF08179E41674CE46E34A5E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 42b93fd15ffe303b55817ab1da002b5063af5d8a3ad07d60090b455ad7860a60
- MD5 76e9ba4bad996e2e5230276be436504e
- SHA1 8b463b60f5bdd3aeecfc2956727033c49d1c3dbf
- SHA512 616bab7d45efd4c3b54ef5fc18dd3960be987c6b15378917905e17f243b6e46c611d65d1258b9e433eeaa3825d109464c3c9e9879b1cfd0bff9df113a827487c
- SSDEEP 49152:ya0h2GEkuAe73q3pp46zwwQIm+brLC2hTR9quLB:ya0hNYG4JwlmqrWETR9b
- TLSH T18A85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 659KB
- SHA256 718310da569802b7d06f2482de35939cd06664d27046be4df6efcc3617c8db21
- MD5 b0ed0b0d712fafae4abf4100d9d35818
- SHA1 9d54d195fa7616bb00fd8d51c7d052f3ebd72d21
- SHA512 eaf5a6aee3b1ba441d7704439f5d7fee6d359c0d356c3767567b1b1b4476fba1236bbfd34c58ddd2f0285c85b1bd4fc14c4c4a16269275d5d71f739fe62f58fb
- SSDEEP 12288:EhbHjfXkWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:EhbHjPpRmlh8t0D+7y8G2G9yL0cMoThh
- TLSH T190E4017D1AAC10C5F276E2B89292858AD731FC661B11A3DF62C181B90F37DE41D39F92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 0f1e853e2673d79b0699354b5112e050c4ada7b70568c2897a6d77b34eb9faf3
- MD5 a6ec9ed2a0c3f24057e7c862dceb4fc0
- SHA1 87b6c26186cf691cdcd1ec549e53f85913e4b546
- SHA512 c7c5057b915892a8b4f704a081ae958cdf4a13746436a6e6438494071b54bfd93977b086e32f728ade61b1cd6d848c336856d80cd28ef0f01d3e04da1425b3ab
- SSDEEP 24576:53YgnJcRTk4yti+R5dBR/RRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:5IgnaTk46pBR/Rm+brLC2hTR9quLB
- TLSH T1F445AF2DF2B910B9D4AAD236814147B5FB71782D1F209ACB0170C538AF1AEE85E39F5D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 578KB
- SHA256 f4fb3410f3f2d66cb2bede428e7a1f5535e3288f702386ab6269b1531155d897
- MD5 4bf5dcd66841921a972f62aac8d79f94
- SHA1 db66eaf6005ac87c13eb27a97a748efce5e9394e
- SHA512 700c3187e76ea0e90653e685f1c03bf1b958d5f1d0980ac144c2f5cfc489a98fc854cc2acf75bb901033c15d4f510496cfd277b22f7278168de2180d067a51dd
- SSDEEP 12288:GPWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:GuRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
- TLSH T1B0C423488A2D0482E25EA3F1A2E2C8C5947DFDB1AB4559CFF085B8E01775CE92B3499D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 940KB
- SHA256 8706fe108e9fc8ef33b05574a16609aa4db74ee9b062fd4332b56e8e566d40d1
- MD5 bc3ca8ea7ba861678ed337841501fb5a
- SHA1 8103ab4e1818ca15d67ec4e8b230d0e431839674
- SHA512 309fee98105fe30626e00e6e90492d42095aebaae1882e378e8b6b3f794ed4888184db31759de19df66fdfa76c5638c3dc4325eb9c4b3ab63f75f2f8c9842b70
- SSDEEP 24576:5pL3UT3Rmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:5pL3Urm+brLC2hTR9quLB
- TLSH T1BC250254E7A800F5E97BD13CC5B28916D672B89D0764E7DF03A84AA51F23BE14E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 671KB
- SHA256 83759a58fca301dccac6a0c2498dca1b2196180650dc9a9242392857b72d01af
- MD5 d1b1ec4a9517d39eb5adc329ef686fcc
- SHA1 6aaf33851bfe1ba6247a3ea92a9903379fdfc6c6
- SHA512 59899e06a2cd1c944579c460f4a9e4d047569aa332cb9a7e4621123ce1b3b97c50c0762b5b6bbb8191a657443f554b6062909939726ea69015115f9764a62278
- SSDEEP 12288:tpFtpOqWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:FOLRmlh8t0D+7y8G2G9yL0cMoThTR9PN
- TLSH T17EE4021D37ED00E5E17AA27C9292824DD375B8A21B1257DF42D080BE1FB3EF86C39A55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 5abeb419802ec31db62f87c0a5a09f04acb31705e40225a5979cdc3719bbb261
- MD5 db92503b0bd66f5cf16aa316ee118868
- SHA1 9553d01716503365e89a7b5ce9670308a065c4dc
- SHA512 134d79caa7b0704dfc3a125b2a986de8c2fc2c0131f29d0165517205e7ff674c581b2babf4b123f21dbd7d08fbd22e8393f9c5513d33c877518a80e778b6e3df
- SSDEEP 24576:e7NM9YqZqmWMUkPjZM48Mv6bEhs6Rmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:e7cBWMpPjN8DbEhJm+brLC2hTR9quLB
- TLSH T13165AE2E6BAC81D5D477D13DC9E28246F6B2B4611B318ACF1152833E6F37AE44E35B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 1b136a355b389a9208105e5a036c914bbf52340e75189d71031f6185fab70cb1
- MD5 5aaf29f990088e80aad21a62494fdf79
- SHA1 b2921ba423c56e7af3076accb6a0adf76a27726a
- SHA512 4d84a5751412930a658326c8c7f986ae2e78eab954e662c7c0d60e7ec2cbb9d156f41ab53086a5c6bf05149af656fcb4244745142ba1e62d5f63997f30241303
- SSDEEP 49152:jF2YuHNETovAvNYf8kmam+brLC2hTR9quLB:S6BCf8kLmqrWETR9b
- TLSH T173857E2927ED80A4E0BBD27D45B7D286FAB2B8511B3055CF4255862E1F33AF44D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 0ed07ef24990d874bccb4e0f153251430dabc3a332d487f5d7643e56d53591bf
- MD5 b223dd51b5b65d6f3803c2507a3fc3ca
- SHA1 d5e5f4acc48cc3913e912061a6274f6b3f2f359c
- SHA512 9ac78ee688cfd99d1012eba447178ac33e055e1239d59141e24326cebacff1546b2fe657fdce1b5135d2e3403bed2b213231a339331903cf2b0915d7bdf5962b
- SSDEEP 24576:XAFs06+Omlf3NXEbTovRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:wFs060lVXuom+brLC2hTR9quLB
- TLSH T1EA65BF2F66EC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E3F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 885KB
- SHA256 ef3e3a0127b7be96f5a02f6d245aaadb48efe5338c1685052a04512373ee2e96
- MD5 09576be78e5d544aa20ed7f7e8542313
- SHA1 869a267fa5f21a5e2ac4929955f55384248e4982
- SHA512 682a3ddfdd214e9fa4df65e61ea8b9ba92611132127f0c51591cb74bc13b212aec3e866fb02a212ef964ca9c2f09a5ad443905598f38cc07f706d37af0ef1a56
- SSDEEP 24576:+JnJ5D3WXoRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:+JnJ5DGXom+brLC2hTR9quLB
- TLSH T1C315E12DD2A810E4D0B7C3B4819A5795FE72387D2F2269CB64B4D5353F12EE09A39F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 38781df2f3ac35aa426c270094901f256259e856bcd9f1ed237824fb562a964c
- MD5 1ff3d4514a46aebcd7564643f9a1da5e
- SHA1 f38c5108f469a8bfc9259fdeb27c630ba2f24d85
- SHA512 a077687333bd37d724878d516b98638eb35ea8e1f907506aae8ba57fea4472b0ee88614dfff0d113696c362ba48a01b6cfb8af041457e9b26f9d620a4ea81c88
- SSDEEP 49152:gg06DIKdwc+eQnSt65aVmm+brLC2hTR9quLB:BkmqrWETR9b
- TLSH T1FE956C15BBEA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D934B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 661KB
- SHA256 bd467d62717c509c946da72cf79ee9f8c16215fcf949dfebb9f94eb34121d3b3
- MD5 11152436a4866e07eb37cdc02815c500
- SHA1 bed9ba2859c97e4bbbcbbaed6b6f0cfff5eb1dac
- SHA512 79280a08f15e0ebbd20ec01a353f7a364f1c74df61a204e718db272e03c34df52c07d959bd4323479eabd953f5d914460eb15515015da9e745783f819ce0ab06
- SSDEEP 12288:qEP3RnBWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:Jn8Rmlh8t0D+7y8G2G9yL0cMoThTR9PN
- TLSH T17AE4126D6BAC60D5E12AA17C92E18585D3B6F4B16B4227EF61D0C17D0F73DE92E38E00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 712KB
- SHA256 0b28bd81eb7666a7e3e7b7566025597afca1e403adb7b68253caed287efbd918
- MD5 e9c38df71bfa4a902b80eb31c393a7d2
- SHA1 2d8f7d40e18e8ca311ec5a22effa6688881c3235
- SHA512 030826e243c3d7ede8b3960f69bd3fe647153abb95dfe70439272dea45bc002e1e26bd51e217c345f810b98e79ad12cbb8e1cc7e483f78824ea5040810bd6c34
- SSDEEP 12288:Ojky0WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:OIy5Rmlh8t0D+7y8G2G9yL0cMoThTR91
- TLSH T140F4120857AC40C5E2BA5274D2A281D49A79FC70AF1196CFA0C0F67E2F36EE46D34F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 584KB
- SHA256 48f38a870a2e60bbf51789c65d0b1cb025dfe8c4ca603eb2700bc38f6ea62570
- MD5 4ef9ffff1533eb36ff27111d372c5699
- SHA1 249e7345c226e0c5ceea564f8f6ea84a9511131d
- SHA512 839ae56171f48b87bb6933a45ad1d26009df3c28a480ccbbad25e46c7dd6c40007f46d105289b246c86cbb9f22ee8b16182d277efb79d00b6dbc9f7f66dbf04a
- SSDEEP 12288:Vy6WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:0bRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
- TLSH T119D4231C9A7E0086F25AA2F0A2E189C5957DFCB1AB4568DFB0C0F8F10B75CE52635D8D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 b69be3234b64cdc13f06e504088592b81b596c9169b01169e5a22576a9ca517d
- MD5 c165f3c7cae54d3d076628431abc9695
- SHA1 39e9d827fa0015391a3a00d3c3341e8bc39ef2ab
- SHA512 4a6e91adfec8c7e1c770e543fce21390b82e55aaf07824e2592cce0ebc24206c0cf5b722916c8e2ab5b64e77af940d4fd58fd6a4348545813b584a7361fd339d
- SSDEEP 24576:eQ9MxZKdcz9dw3yRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:eVKZym+brLC2hTR9quLB
- TLSH T171558C2DABE9058AE177D27595A250C3A673B4311B31D6CF2448D03D4E7BEE8AE34F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 772KB
- SHA256 455fa9ea4ce240e611721334aea271a123b70acc870fc7d1de4f6a787857033a
- MD5 9351dfc833c110d3db74368447548ab1
- SHA1 905652e7134b4cf16d632928b402ee6c55941d7a
- SHA512 71ce8a868ecf4124b5e98ab80792c75083b2944b05e6d8c57b4d320d437144607c5d930a19b5c5d784d6a9f5458b39ca745176cef3b231b5604c415a01e6c265
- SSDEEP 24576:xyocDAp9Rmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:cocDAp9m+brLC2hTR9quLB
- TLSH T106F4E01FBB6E40E2E176823C89818685E7B3B4705B6267CB6181C33D4F679E8BD34B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 971a67435463fe7c9cf597a5a892d75fbcb850f7d9abc23bad9d57f15267a55f
- MD5 9ab3717ae1833900d03112538309212b
- SHA1 4596906564bf38723cd251e3c799b6ea34d9efac
- SHA512 c068b9fac2f2180fd287c0320d48f214653303969cd567f7caa0dbaec5d657299e5cb848b1f8f1ece9d51fcf1ee73c8209dc2f7c349a841639619f352eb94c3c
- SSDEEP 49152:hWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK9m+brLC2hTR9quLB:Z0zuNI3mqrWETR9b
- TLSH T1D1A57C3DA2BC00A9D9AAC375C14513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 a3743ecb9ef62d562c96cee809603654307a46ac72ef5a4b3e46b19a5270e967
- MD5 498a0f1c41e69cbd99678dc8e7d70273
- SHA1 977cf6fdacf96c013cdf8a48de4fa8ed2ddadd65
- SHA512 11a65b51fa442f96328b26c4dd4aa1d016bfd562410a76faf675a3d564c42ca750995ddce2d0773673a53c91370423b1ed25045b946297c89efe31fce61ac3c8
- SSDEEP 24576:C1QT7EcpfxR+N5AWAz3ooiYtjMqb8Rmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:fTDxR+N5YzTfjMrm+brLC2hTR9quLB
- TLSH T18355B02EA7F805E9D17EC5799A23C512FA727861033193CB42A0C17E1F6B9D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 877KB
- SHA256 d994cd221d25f101f01d3a867085d8b18840b84fb86e361caf068cc85c2ec845
- MD5 ff8e83c5df5384b8855d41cc8c27e6ca
- SHA1 067c66268143122cfec5142f9c90e88aa215bcf8
- SHA512 03df59da35c9178060afb20e80023e0c3353cbb927b96d60ec2fd13d935286c02cb8557e3a79725ef88d002861384a8e5411c0b4c0bf341d790d35d1a7cdb68c
- SSDEEP 24576:BTMdOz0FFS+imSLgRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:r0K+imSLgm+brLC2hTR9quLB
- TLSH T1EB15E13EA76D04E5E17BD27DD6538906E67278720321A6DB02D0C0B92F67EE43A39F40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 635KB
- SHA256 d4a8b1b7337135d930495c18fed24c6a331bdbd97aa41668d942a0ca9fa26754
- MD5 0568194d7744090dc1b998a4f51c89aa
- SHA1 ce1dd63767f21024fc955208dc3eaaaabad0a5a0
- SHA512 9687cbef645cd0eb046bd4deae26a0958430959b5094a032721c2e68f03598f4aebb2361285316b17606bc206be30f5e54ed47672d6706426490d632c54cbaa1
- SSDEEP 12288:j4KmWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:P3Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
- TLSH T15BD4121C57EC20C5F176A2B4D2B281858674FCB267156AEF30D0D9BA0F36DE49A38F16
- MD5 SHA1 SHA512 SSDEEP TLSH