Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 15:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
- Size 1.7MB
- Sample260804-symjmach87
- SHA256 ac4be8c9e4780ee0ecc400aa8ac13fdbf0e40f515f38e30f4d41d55e14d83aa4
- MD5 66b7163781f4e3aed42ebb832c525fee
- SHA1 968d0ff667b4b9be1d865468ca28158f3cdce949
- SHA512 4cd144377d43453732ba816cde6a4cb1773f02bb1ce03b71bf3a992803857ac3dfc781852e02be248c5dc702ba29dd817ccac8eb03c886c6bef2324d597348dd
- SSDEEP 24576:lLdgMU71Nmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:cMEeb5+Pl6bJTIZ5jdgp
- TLSH T10585DF06A6A518E5F8F7813D85929537FA7E78414364DBFB02934E562E23AFC5C3AF00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 2716 alg.exe 4076 DiagnosticsHub.StandardCollector.Service.exe 4952 fxssvc.exe 1228 elevation_service.exe 460 elevation_service.exe 3600 maintenanceservice.exe 2496 msdtc.exe 3492 OSE.EXE 4344 PerceptionSimulationService.exe 3140 perfhost.exe 212 locator.exe 8 SensorDataService.exe 568 snmptrap.exe 3928 spectrum.exe 1640 ssh-agent.exe 2500 TieringEngineService.exe 2852 AgentService.exe 1884 vds.exe 3016 vssvc.exe 3796 wbengine.exe 1000 WmiApSrv.exe 3136 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 38 IoCs
description ioc Process File opened for modification C:\Windows\system32\spectrum.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\vds.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\6725bdea7c8d181e.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\locator.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\javaws.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\javaw.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\java.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000098b2bea02624dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d0a540a52624dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000869cfaa52624dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dfbf99a42624dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e01b56a52624dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4076 DiagnosticsHub.StandardCollector.Service.exe 4076 DiagnosticsHub.StandardCollector.Service.exe 4076 DiagnosticsHub.StandardCollector.Service.exe 4076 DiagnosticsHub.StandardCollector.Service.exe 4076 DiagnosticsHub.StandardCollector.Service.exe 4076 DiagnosticsHub.StandardCollector.Service.exe 4076 DiagnosticsHub.StandardCollector.Service.exe 1228 elevation_service.exe 1228 elevation_service.exe 1228 elevation_service.exe 1228 elevation_service.exe 1228 elevation_service.exe 1228 elevation_service.exe 1228 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found - Suspicious use of AdjustPrivilegeToken 39 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1896 2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe Token: SeAuditPrivilege 4952 fxssvc.exe Token: SeRestorePrivilege 2500 TieringEngineService.exe Token: SeManageVolumePrivilege 2500 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 2852 AgentService.exe Token: SeBackupPrivilege 3016 vssvc.exe Token: SeRestorePrivilege 3016 vssvc.exe Token: SeAuditPrivilege 3016 vssvc.exe Token: SeBackupPrivilege 3796 wbengine.exe Token: SeRestorePrivilege 3796 wbengine.exe Token: SeSecurityPrivilege 3796 wbengine.exe Token: 33 3136 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3136 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3136 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3136 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3136 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3136 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3136 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3136 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3136 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3136 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3136 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3136 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3136 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3136 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3136 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3136 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3136 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3136 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3136 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3136 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3136 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3136 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3136 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3136 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3136 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3136 SearchIndexer.exe Token: SeDebugPrivilege 4076 DiagnosticsHub.StandardCollector.Service.exe Token: SeDebugPrivilege 1228 elevation_service.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3136 wrote to memory of 1344 3136 SearchIndexer.exe 110 PID 3136 wrote to memory of 1076 3136 SearchIndexer.exe 111 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1896
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:2716
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4076
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2920
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4952
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1228
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:460
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3600
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2496
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3492
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4344
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3140
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:212
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:8
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:568
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3928
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1640
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4376
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2852
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:1884
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3016
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3796
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:1000
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1344
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:1076
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 d84d3db1e37b90dfa2c0c00784cd76db630ce6b77af14dd3e0e6c39146f10d47
- MD5 74adcfcd9b41ce1a7d174d265b4346a2
- SHA1 ba4df2a3f711b461934707ff61e498c2ea551b60
- SHA512 65afb2d384e2cbebf525a499cfdcc2d821b8b35dfcddbe9aa8101d739d52380a12165cdd47c19ef1b86e43d8b4bdf4657ea7829361c417252c48ece016a9548b
- SSDEEP 49152:Rb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnMb5+Pl6bJTIZ5jdgp:X3q6mjBTslgJTIZ5Bgp
- TLSH T13CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.6MB
- SHA256 f7f2d2a9ce267fb146576c8944f2ac6d0b90ee730c65ac3383185aeb407a1e60
- MD5 caf1fad3945bd550adf6540251096c1e
- SHA1 2a07a026871442a9869a2ab4993a5316838d41f3
- SHA512 2a5e5013f1d9f12c9dca03a9523475a179df87fe3e0f2d6342b393ceb576216465e58f7e557e194ec0640a78da4dd2bd4f818b9b37afaa3d717defd92ea1a8d1
- SSDEEP 24576:AXYfDtczAMmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:3tcyb5+Pl6bJTIZ5jdgp
- TLSH T1D685F11967A508F9EC67823DC8E1C611EA73B85587A0E79B03B499265F333C86D3E742
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.9MB
- SHA256 422bff1e91c3c4f47be73db8e024cb82eed7fc9fb0ddf67b04f3468627bc3ab1
- MD5 f7441371fa8c35418ed798574716554b
- SHA1 e284e6f6d747f817824a0ad7b00e99ba176fa0a9
- SHA512 9fbe0cb169e1a0368ad6e6be1241960f8cd21f7738baf254d9052ea76815e9f10d4c3f6858b9cb27bb23463e69b63f2357aef6425c7908b40ffede8c5fe2d50e
- SSDEEP 24576:F0Le5ji0hmxyrMJmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:FPji0AIlb5+Pl6bJTIZ5jdgp
- TLSH T12295AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 826f9075e0b08025af05ace4c562255cff810d84e09359aa75234ecc937710d9
- MD5 d92cf84f06139c66b0e0ea0100811137
- SHA1 1841ecd6f386930210a0a58bfab15e8c20848a39
- SHA512 21970f696a728d312e3a419938c3aedee8c181da7e31f705c734526f5416ecb86ee96a536dd1f03b7f7c0be9b39921e1de1d0d052723676c48cc3ff1e38790d3
- SSDEEP 24576:ba7/ezSC6vUyD/aqgrvWj6q8wyurmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:2/ezSC6vUzPv+Hjyxb5+Pl6bJTIZ5jdw
- TLSH T196756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 040e0cd05a6bc77af30f000f1cf7bf23b3ad55df8747bc280ab1392c19c0949a
- MD5 21e8f098e2f62561c9ae844838201739
- SHA1 b57eaf39834e1f14bc45949085547987958a9da2
- SHA512 9ba25459aad22f09d97d8f527baba99802a8c52112b697c770e2a77492be27bf4389c392dd9325d858665dc681777cab72f134a07222efd10afcfb0c0fabaf36
- SSDEEP 24576:kVbqPb88hv/l+Bomb57GBiOl6a8JTth/RWZvR6wQQ92pN3:kVO88hXl+Fb5+Pl6bJTIZ5jdgp
- TLSH T171559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.4MB
- SHA256 7463464d2cab92691ce932accfdfd4c45ea7617a99c5394ca3f325f30a0ff6df
- MD5 aa8412fdfd79f1a21eeb05029b64d02c
- SHA1 e7b00d28872b67a17acf0978d2eb8a9161d8fcae
- SHA512 03f2b34c5b8947bc89c5d4a38dc49cb8422a73cec132cd555c8fe11889b171b321344d1ce320895f8b259eebbdd03052c8b980580abc23ea6ee70737d2681dcc
- SSDEEP 24576:GFlmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Jb5+Pl6bJTIZ5jdgp
- TLSH T1D66523838B6930C5E5AB1739E9CCDF00F87AEF55CD866B76C5752C2BE034249B85220B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.6MB
- SHA256 ca54a271bf63198ec3637913a553ff1aedb77bf6b2c9bc1e775a49b0d172072b
- MD5 a596d9ea5574943dc4ec8bf231a48005
- SHA1 d6187f1fe74dbf7e37d61b3ea768226d0bd2bb29
- SHA512 9550c74c36c604ce41d0100188eee598ddcfbb0edb6882b52a41bcb33acbf2bd3cb780893e4ebb75fb0f9965dc6a2423ded2a4f6a68bfd1ce3b3f1cc884185fa
- SSDEEP 24576:WJIUAmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:WJIU3b5+Pl6bJTIZ5jdgp
- TLSH T18885CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55E76815
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 fc82a1e7a3d09e02a48bc468f0d480b740c6ec2e935d9c7978bc71a4e5f2e169
- MD5 542e6fadc770cf1ef495c00ca63fccf0
- SHA1 824e724e3921e2e3f57fe3c4d89010a98fe4373b
- SHA512 c573f6b7f984efdc9cadf40809e63e3cf68c8c2dce0b6a1636b075d3506a1fe28141e3e985a250ef04e478e2548800d0555049ac7abccf6e2b8ef79a4302636a
- SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THt:kQvGAdlCEL8c/WRNw5C4slgJTIZ5Bgp
- TLSH T1C3266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.7MB
- SHA256 697465951a321f30ecd8be60fa40d211f68c1144603d0753ea00d7985b745d79
- MD5 0f25a77e5e984908dd285c467b745e8d
- SHA1 70f91568ab1bedbdacbee47b16a658cd9cccb894
- SHA512 ac8716a4998f5bb8b69eb67ab5be98925860899d0a1d27aa76498bb13350ce8a6f47ef712fed0d6bf12babfcf99c9363f76f84ee97dd801ed57953f73ee05a78
- SSDEEP 24576:pOewsAjqmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:0ljVb5+Pl6bJTIZ5jdgp
- TLSH T17885E031FE74E036C2BB0DB65B65C716647DBA208F511AC3E3B84D9E99302C22776A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 58417a8be5831a05dfdcef5cd5856d32332576598917a638dc21ae8a63b826ae
- MD5 9a7ea042d71d5b532fddcb146f305e48
- SHA1 55d55f8150f11502ae1418e8cdde98707a632d23
- SHA512 2c38922aac7d0536c191a66887ed69b1eaaf7908b47086a78a44249145b9256333eb51a5780bdcdec352bbd4f1b825484f3049be8d0d74702b4098501dad0afa
- SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHJsT6p:jUEtQevvqc2W1cpV20I32Js
- TLSH T17D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 c4fbae727f66b798c0ba5ed607a2b42cd0a99c8335650370c7ea66b16f30e5ac
- MD5 c8a65e15ff1fd661c3db637e4a248f65
- SHA1 df373de70253fe54998c2951d9005bd4a804e46e
- SHA512 b9572c6ff26e5d95b55d9ea5a74460f63feb11398694e95a106774f1b85f515f36e8626fe04a922e512c95ed4c95e2adab89f4d9ace5d5853d55f1d99dcda24b
- SSDEEP 49152:+CbRquA/m2yL5zQfFiV+XenmE3/z1b5+Pl6bJTIZ5jdgp:zoqtVjnm0slgJTIZ5Bgp
- TLSH T1A2D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 b9fb5e06f12717c0315e7a0429895ae18303573f10d75ac9c2d3e4c0d2f4876b
- MD5 80ae22cd44b75c2c07f778cbd6e97b46
- SHA1 9e2aea947e86ea655b24eb82f8b8234f1668ade1
- SHA512 a95d9b7493a5f6de773f0cfb845331cc39dfe31b3b4c8a4e9af9839f599a19f6cb901b38c3021880c0265bac77ba522f0164badaa1176d437213fd3024b30a7d
- SSDEEP 24576:iAhGL6IFoiwtA5l7S53vmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:iAM5Foiq5+b5+Pl6bJTIZ5jdgp
- TLSH T1E9359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.6MB
- SHA256 0edeb79020b75eb4aa272a8721a19f49fc911092a296f14ef7f6b82aa57b3715
- MD5 45611a96cbc9021a588f3ffa40d05749
- SHA1 c3bf0647d1ded3279abba48b2e6c1265d6a6ee95
- SHA512 9536ca1fe76941e8b9676815e5cd6c545b8c966c3ed5d44ae55db38168445a0a84d9144d5174fb90f3cdc5ca68a098a16a0e2ac8bb6c97da2f9ae9eaa355602b
- SSDEEP 24576:JwuGOWumb57GBiOl6a8JTth/RWZvR6wQQ92pN3:JwNOab5+Pl6bJTIZ5jdgp
- TLSH T17A75F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.5MB
- SHA256 3b8f9bdca24aae21cee47a83763d2a7999b5ded39ed7628ba90f4ea040846ba5
- MD5 4bf0d01b2e93e5b3d76837eeca27cbe1
- SHA1 dfd27af18d4df2e8a0db9f133b27d8a6467c7869
- SHA512 16b7351cc94ff08fd780a25c7feee75a64471f7c890e674db24a579bb7e956b06851c43ca04ab4fe48d0dba7b54451e7fd404e51d262ef5c20a091680bfd0a94
- SSDEEP 24576:lZuhmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Db5+Pl6bJTIZ5jdgp
- TLSH T13C65128A17A830F9E1A7523DCCE58B00E772B8529B7653CF4674456AAF33BC52D36312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 b3bc3c5edfc124d8f41fc46e7f64c5f58be0941b8accae2443431833fb2d8e8b
- MD5 07a1f2398fe3f061f58f39a933643621
- SHA1 1bb128ddee2fd33efe0262e62bdac3c7975078a4
- SHA512 e7871d3e6af6c659b85966f61f3046a2135e65f90d4b65bb941ca1bb3903211d3ad721510008518061451c8936b1a376c43173e6cdbaad9928cbfd10ae385aab
- SSDEEP 98304:cQRQyi36YOcPDLvw2gAf+PN33slgJTIZ5Bgp:DQyiKanX+PNnsT6p
- TLSH T124666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 5d02672fd38c93b24be90b6c3c62d2cb9997992f25c92889b0cc0134b4c0c807
- MD5 299dd81c3ba6cacdab1f47aa5bb5932d
- SHA1 526d0cdc98d62cae8db7817502bf2af2f8700f45
- SHA512 4d592c73f22b0329cb2853eecfb23b844cbe07e075440a12e0d651dfeb34ac9671c8af53280c0cdbdd11110eb39382e89939eee8a0df061cb55c5e1e702dbef7
- SSDEEP 98304:uQRQyi36YOcPDLvw2gAf+PN33slgJTIZ5Bgp:1QyiKanX+PNnsT6p
- TLSH T13A666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 4e6854feee07e60ba3230bb751f0858bf4c45d4c6149452bc2ae576e3a129b32
- MD5 044410a2db91457e8946bbb8884fe367
- SHA1 d49c880456c8199b8208529a99816a52bab20dbe
- SHA512 2f7bff45776ce72d62acbab62f9c2fc5c9babe24a39a1a00585a14180e7f2b1eb602f9a71ecbd6de8c1e5cf263081e38059efded3065b579646e40f54c38e5f1
- SSDEEP 49152:368Qg55nhkeWu7PNU3/lb5+Pl6bJTIZ5jdgp:hthTRc/hslgJTIZ5Bgp
- TLSH T11DB55933B2F60099C44DE1769F4A872196E27C71CFE0E3DB851172161BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 aed92981eb0a34bd151d0b6a3272e3febb2299528bc1845b38745ce2a1ad17d9
- MD5 b530821c333bd4c6a1ecbb4b1167f7ed
- SHA1 28c2bba825a73308f17544e954db53b70e942ca5
- SHA512 86df0f2163884f03d634140349f04bf5ca520fd5381effc5acb5802269febcd932c4e1b01feb021637081d919304457ec421ea8ba4df57a5e1cd450b117eeeb0
- SSDEEP 98304:By5112gYy5azzVvU69nLKnhZmslgJTIZ5Bgp:cLIHRWhMsT6p
- TLSH T172167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 6fa35c2c012261a7ed11a87fe75a05ad8ff4944fe2c1466dc276a408a56c6f7b
- MD5 26e3f9226d5f73005768a7ba322e28e5
- SHA1 3570902dbbcaf6bf538336a5cf56fd99e815fbe5
- SHA512 f8dc232f6635c902e607c7bfd7ecdd70c40af8e4786fb2ed21111f6fe4766f8ba21dc906b88a81e992d844b82f380c220a07e0fd27639fdd48bcd9a9ba328f01
- SSDEEP 49152:CB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glrb5+Pl6bJTIZ5jdgp:wu6JmIxd2dfslgJTIZ5Bgp
- TLSH T129D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 37c800a2fb9b1bdb0579e9b403f891187329a7364dfa9876fafcd401f4306bee
- MD5 13af6cd5715202a35abd55209d8793e7
- SHA1 1854376f55120f6edfaa3b9aa5aad041626c4242
- SHA512 633a28fed8f37bd71b6806f15111cf64a7c3f42d8729b1f237ccb308f3175bd5accb0908c4cb51ea5b8f181ac580ab6decfaeaac75c6b542186792156fcf137d
- SSDEEP 49152:L1hpsNoJpF1A67U44CwH7R4xXb5+Pl6bJTIZ5jdgp:LmifPqR0slgJTIZ5Bgp
- TLSH T142B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 8d8d1fb21187c38554e96c2703c028244f6f3160ff47e2446b1a57872c34ae61
- MD5 04bc18fe08a8cddb8e95a20c07ce2a7a
- SHA1 ced34244375fc99ee47f50b47f4e709c423816c4
- SHA512 515cd4c5bfb8a92a13f5cadea7bc7110f3d5732ce0b9c440ef96e3ea8ba234979d2b24059a50a9c26927f34d8a29d62674d2d6c51a430863b2d2ec92b0a0966c
- SSDEEP 49152:mSuZQIY0Be2KkRVtOnks6NMHq8b5+Pl6bJTIZ5jdgp:o5dKqi616slgJTIZ5Bgp
- TLSH T119C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF065072591E77FE05B3D321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 0e609cab5fe414f934a96e158948277d90be794fc60b18a0c95e3b1cb3eb4869
- MD5 d8c8b51e577b39692a36b7201e084ed5
- SHA1 e6a676de693a6e1729ea92e5be0457913c01aa33
- SHA512 37bad80084c3ced2c3770e9935324b783592ee8af31d96c381ffcec3601abaa734c295739e197c043dece41de70731385918a250d469054a0dc3e5a05141fec9
- SSDEEP 49152:bhtSn8EApI0figjgiDn0AP5wbb5+Pl6bJTIZ5jdgp:6X2iWphQslgJTIZ5Bgp
- TLSH T14295BE13F2D900E8D05ED178C7468632E962BC164B35BAEF0A90B6561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.4MB
- SHA256 ec01ab1df93ed93a663769b8db6388eff2a5cf66f16aa46ac15c696751db3494
- MD5 c9632fec5f7e8c3e301647a671132223
- SHA1 6aba60f54169f183836df179ad12f452da44d797
- SHA512 044a64611fec5abab6c1b3292008ae6814579351379338149845257d4e483ce5d780e86461fcdb34e243ee35b02c9e104e8537260bf8ce87b3f7ac50aaf832b4
- SSDEEP 24576:79mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Ub5+Pl6bJTIZ5jdgp
- TLSH T1D36523874A6B20CAE45B5739D9C8DB00F87EAF56DD8627B6C57D0427F231389385224A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.4MB
- SHA256 d8a023b083bd03d6875d8310dfd89a8eb013af42a8951d0b150ec0c9f1b3462b
- MD5 fe913bf8fd07332c285ec1b26b1b9d05
- SHA1 a71708306aef7d2d7e977bbdca03ef45a6ad5402
- SHA512 2380fe8bd9a18dcddd456dc02c66f63a4bc864e5e688561eef16c55fc9d3f22a4fffe2080f362358e16457108f4f528ca38e2285ea7dcc7a2fc895facf756009
- SSDEEP 24576:D2mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:9b5+Pl6bJTIZ5jdgp
- TLSH T15A6523874A6B20CAE05B5739D9C8DB00F87DAF57DE8727B6C57D0827F231789385224A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.4MB
- SHA256 bbad10522fab0fd974bdf950de3fba97c563b5a19e3b59f18028dacdc273658f
- MD5 181f7011382af5f31e5fa2b1da85ed8e
- SHA1 67b262c27b34f610fe51ab60ca6b78287f0aa2b8
- SHA512 1cf5766356f3f249b6b76f2c24039bbb2569b7b38e199b3131a40218c20da59e746dceee46981b647b68615bdbf3cc2e57cef055fed56e82fc61d2528a00c8ca
- SSDEEP 24576:Z4mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Zb5+Pl6bJTIZ5jdgp
- TLSH T1656523868E6B30CAE05B5739D9C8DB00F87AAF57DD8727B6C57D0827F131789385224A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.4MB
- SHA256 1e4eeffd7bdc2e076d66d36eecaca97607f3b57b47b8a853f4b50e00b9e65e3b
- MD5 551f27ed4ce60cc93e61bb94015f1123
- SHA1 64d77def8bb3d9e5730e1b7f94b13fbf4e02fa21
- SHA512 8b14ac15693346ecaabe2039362aa6a6d244bb0617cca3557b126d5000ada1184f8621455d67ebafd2f2c1b2490e37330158185d0cb700a4b4539408f3d900b2
- SSDEEP 24576:cmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:rb5+Pl6bJTIZ5jdgp
- TLSH T13B6523464B6A20C5E4A79339C9D5D700F4BAFE96DF5267FFC675082BAA313883831346
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.4MB
- SHA256 2e3fc7c3dfe2f777a4e1429e02d8750ed5903d384a4319c89a9bc32bdeb71e0e
- MD5 ad30b736492078072ae9794724fd9e99
- SHA1 047acf74311acd4d0b5c520f2af1d898fb294f08
- SHA512 4758c79728639148feccfabdaac33c44dd62ffe32ae52d8418dedae3ee243e0c3be8f26555869b5f803ebf0b459832b004b8712ec50ed35b3d8a82b9629efe4b
- SSDEEP 24576:SXmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:3b5+Pl6bJTIZ5jdgp
- TLSH T1806523868A6B20CAE05B5739D9C9DB00F87AAF57DD8627B6C57D0427F131389385224A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.4MB
- SHA256 8c2791c59562a73cfc4ea13555d76bb321e0314aa6b0806ce8de12961257edf4
- MD5 26095dff42049090c0c5689a6f453fba
- SHA1 fe1fc41b9fb2f4313b1c8949b126281a0731a13f
- SHA512 5fe2f837a5e05c6b5587373aa5e3769672a1f382c2f76854c23e0a6adeadfb0b7161a26384f9493f96fec01b59ddc50f3a4b71a1022fc6502a68b7588f6c8974
- SSDEEP 24576:DCmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:pb5+Pl6bJTIZ5jdgp
- TLSH T1766523874A6B20CAE05B5739D9C8DB00F879AF57DD8727B6C57D0427F131389385224E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.4MB
- SHA256 296b6382594b671de0c325a8fc63260b84736a47cc4083b973106007c36399c2
- MD5 88146e6c1857c67a803f843b6e4a7fbc
- SHA1 c8a7b4e75895d34d0cecc6b283463fea53dd76a1
- SHA512 78648cc75cb72f1e6db6997fb065b01066bdd3ae4eff6e7d1f48e6e41207f944b8e57323d42c01e52ed43ec4609a75d75b102f035dda8411399d62335bcd3d17
- SSDEEP 24576:Y+mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Mb5+Pl6bJTIZ5jdgp
- TLSH T1ED6523878E6B20C6E45B5739D9C8DB00F87DAF57DD8627B6C57D0427F231349385224A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.6MB
- SHA256 3aecb67e442e41c7882a178e406f556a25b8db6a0d98abbe450bdcc9076e9aa1
- MD5 9a7cefbd8215143c772c778dcf85b121
- SHA1 34fe70d4f7194858910f6153d4bbfd6eecf9e64b
- SHA512 f4ed8594868a3ed48eb210461f26db83bc1c660a907f948f75527c9e057b0b54e9ce74e4552c42895290aa71e2563946725ec7b5c64a5bb69f7983942a3a036e
- SSDEEP 24576:iZMazFVSOWmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:iZMazf9b5+Pl6bJTIZ5jdgp
- TLSH T1A985F295B35018F8EC67823ECD958A05E5B2BC5A4B60C65F43B836275F333912C3EB5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.4MB
- SHA256 4a08b9df960385289733dacbcbf637a3590cc7d89d5bd5144bd86a9b504dc6a1
- MD5 9300ca7f041f8be0f5bde8edda4823e9
- SHA1 498323708618a06c912e823ccf4ee52fffcdcb1e
- SHA512 ca5a4cc0924fee6a3ad4c098d4f20e2176aea373a698ad7844287a871ba78de42cebb7435b447213ef98fcdda03191777ca727c87e986e530236cb280741e6cc
- SSDEEP 24576:5Rmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:6b5+Pl6bJTIZ5jdgp
- TLSH T1B46523874A6B20CAE45B1739D9C8DB00F87DAF97ED8727B6C57D0827F131789385224A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.4MB
- SHA256 4c8e9c9d368dfd168dfd624209bbc8a16fe6ab6bd2ff8a312a2c72fc6cbcbee0
- MD5 0fc97c6f20fd2884146b979dd75d604e
- SHA1 64fd5474f94a45533769a2e5c4e0771749e869ad
- SHA512 69a5952f9eb53aacae42bbac3793b00937cc942eaf8bc7f54c7e8cbf2ba2a9ba43694930f2991cb3d99ea5ac6e2b151bbe975919cfd3a49ad2908c207e28d084
- SSDEEP 24576:oVmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Db5+Pl6bJTIZ5jdgp
- TLSH T1A16523878A6B20CAE45B5739D9C8DB00F87DAF57ED8727B6C57D0827F231349385224A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.5MB
- SHA256 ba076bf8c5cc4176adece99dcf48bfe0bffb4ff6a12ad4048d55ca3b7eed5f98
- MD5 e93e8998f3ff79acafdacbf9642e308c
- SHA1 1409b564f8b80e990ad219a25e5ed7a1bbdc4a8b
- SHA512 cfe771013793f42e16c8af3de9a3040f158577a39f2b8dd285c53430e222d05594b0a42e1abb9c73511d482aa87b0ab04f11dc2f6b08c97d52e22a2b126d2ff1
- SSDEEP 24576:0zyamb57GBiOl6a8JTth/RWZvR6wQQ92pN3:06b5+Pl6bJTIZ5jdgp
- TLSH T1C475024767A630F9D0679239C8D25B01F776B8328B619BAF47B406376E333906D3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.4MB
- SHA256 ef781e1078f9b15dda29565dd660aac7a678d13e794d092c1cbff167b3979197
- MD5 b652e110600bf2f0b0156ba2cc804686
- SHA1 0a94f726c4885ec36703b2bf14f852774ae531ef
- SHA512 b12689a6b082f8fe86c6635d33409f33be632a4c230982425bfdc0bbad66e367833eaba400b03a0e1a99667ecf08e26818b0bc91b51926f57a0574b7c8a740a3
- SSDEEP 24576:PRmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Eb5+Pl6bJTIZ5jdgp
- TLSH T1066523878A6B20CAE45B1739D9C8DB00F87DAF97DD8727B6C57D0827F131789385224A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.4MB
- SHA256 974833a53bcf096a8d3017b769659dbee60862db2564f77ffbbac27fd1ee34a4
- MD5 3eff245fe48c2673c6115edbc399e215
- SHA1 a5e5e0791942cfc5afd4dee5aae86e889b40cac2
- SHA512 815e59c990a0dbd5bde1ba9df61da16eebb9d1a6c190231754e3b33d1c34cfbe53400510a3b8e50a19f14108f8b2394d6be93f229cbed704e8a0f998293c1b52
- SSDEEP 24576:lRmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:+b5+Pl6bJTIZ5jdgp
- TLSH T15A6523874A6B20CAE45B1739D9C8DB00F87DAF97ED8727B6C57D0827F131789385224A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.5MB
- SHA256 4bd971aa52642592658a790d21b15e29f22515daba64b5ab2f493b22acd71776
- MD5 bdb7f66e6b7d08570c8570b0eb0cf87c
- SHA1 915dd0d3feaf7556625ce808a968e174a8afca47
- SHA512 885462996f172cd942f2cc1664324e06fcdd32c35b7f9d16400266040e7caf3e7b09e624b4693e440106e0d4dbf7a57aa9afc6db492476331ab1d185e77320b5
- SSDEEP 24576:jzyamb57GBiOl6a8JTth/RWZvR6wQQ92pN3:j6b5+Pl6bJTIZ5jdgp
- TLSH T11A75014767A630F9D0679239C8D25B01F776B8328B619BAF47B406376E333906D3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 7e62a8353f4ca8118a5ac09a8191d558f263b7958efcf6a6ab63169d7c801c51
- MD5 eea5a0547667203c06818f20d3864fab
- SHA1 ebcaa427a22963d432e8c6f587cff61b6da23dc3
- SHA512 9e8957ad790707adb2bdbf79388678030bad42cb07cb7c3979170b361e371088fbbd1dd289c7d04df8024d822ea84e8b0e7a122a2fecf47541849dbefb53aa8a
- SSDEEP 24576:kcP4mcvIjkGOxhKP2l71nNKbrh/8KBZmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:fP4m4IpOO67W8KSb5+Pl6bJTIZ5jdgp
- TLSH T14865AE2DABDC0096D0BB913885A58A49FAB1742A1F3286CB1170933D7F77EE54E35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.5MB
- SHA256 f82380e55ce67442d9a3ebfd6beb604cea0c923eef12c4ba3aec8667b55da322
- MD5 fc40c4869747097f853bca2b57c906f5
- SHA1 c1aa3c6cee83a45528e3c0c442c2473f6ef890ee
- SHA512 c557a2e713e763cb4ed21107900204c6079200e8aafb4448a9432c1a4026b9f5026eb99d19850f6d65219954b336ebf5b19232993540de8635c1396242205f64
- SSDEEP 24576:Dhmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:4b5+Pl6bJTIZ5jdgp
- TLSH T1FC75F14AC29811D9D06E6239CB858A00F7377D65CBE293DB86E0F43E1F366846DE6703
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.4MB
- SHA256 0dc2cc6f98e9f3df3d9a670863dcab29b188e99f0ca899b8e0a6232f5fc0767e
- MD5 b48def3f84ae4d3d143cc0780c896576
- SHA1 848284430ddfeb666721175d2fd9b5ae80b50056
- SHA512 55d5f7d396fe2525d33421a2459e25417db799a6576ce62325ff0e423fad7e92015d257d08646e34283c1b4bd9075214b4541092d051b09cdf5afe6cdf883d7a
- SSDEEP 24576:dBmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:dcb5+Pl6bJTIZ5jdgp
- TLSH T1B06523438B6E6086E4BB5735D8C9CB10B83EBF65DF8666A7C579142BF1306857C2230B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 b495653c25302742fb796b6fdf1f08adc01dacd72c0915a5c9085e533852ed99
- MD5 6cb3fb4de29ffe16d77e35c532f0fca6
- SHA1 d8528f481e38bab3b61b0684bb76073fcc6a8b91
- SHA512 c27c96dd267fe07c827c943eca3c90c01501cc460a1e8a0608c567798fe670087ef311eabde30ff251be7f1fb8fc34d32fc8e5a7591b651b2ae9f53a5381814d
- SSDEEP 49152:Oa0h2GEkuAe73q3pp46zwwQWb5+Pl6bJTIZ5jdgp:Oa0hNYG4JwJslgJTIZ5Bgp
- TLSH T1CE85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE44D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.5MB
- SHA256 de7465ea6cf045662a41082c43970d2dcbb31d24ce017b65aefcfc03218bfcdd
- MD5 b398efd0e0fbd6dbdf0209320b67409d
- SHA1 7b536e889cb7de78f5ff288fb8c51ab9d7c942a8
- SHA512 f097d4c95d7f2a1f6f5f254fee45caa76659b919f5a6d6f3ec0dc9d523a8ee7e89da8567774b1cb3e95de35d241b24813a633b47cd48607b5844b89a91e4eed3
- SSDEEP 24576:LhbHjPGmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:LhbHjhb5+Pl6bJTIZ5jdgp
- TLSH T1AD65126E06AD20C9F076A27DC9C5C606E731BD265B1263EF42E5813E9F37AD42C35B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 33d4d7f3b4bece51f110742f0a7efdb50d50d7174fbb7557d022995c1e99d5d9
- MD5 64f09f131f76e1281ea2cf35ee1dfc7a
- SHA1 f1e2f0fd500fe36c916de512876bf407e73f4b68
- SHA512 ba8352f3507034aaadbd597756aac0ea179ff7ff9d9175f936e2bbfbb1da15a94248e03c2cfd0c584c43d4807e8ebf32c233b7625fbed5b75332ff7ac912382b
- SSDEEP 24576:I3YgnJcRTk4yti+R5dBR/umb57GBiOl6a8JTth/RWZvR6wQQ92pN3:IIgnaTk46pBR/Rb5+Pl6bJTIZ5jdgp
- TLSH T1E645B02EF2B910B9D8AAD236854147B5FB71782D1F209ACB0170C538AF16ED85E35F1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.4MB
- SHA256 c4c849fcc5275c471ce3317e98e8f3167d96aab7bb449b6c492050c33420a802
- MD5 1de465d7b21982b4c82825cc408d23ef
- SHA1 23a40cdab4bfabb4074a9370fc25ca3c033b4d48
- SHA512 6a4bdecd46a9e82820b257216d5182c1bd976132d0cafebb04a58846028a87e02c8ac843ba55294a46e85688a5d99a01fb7d83a485932ec8566596abf1c65424
- SSDEEP 24576:1Fmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:1Ib5+Pl6bJTIZ5jdgp
- TLSH T1206523864A6A30CAE46B5779D9C9DB00B879AF51DF8727F7C4791427F2316C9383220A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.7MB
- SHA256 8c34e619f303524910bbaf3fec50202d903846a67e3ecaabcf82c20d6dd409e6
- MD5 73dca76f63004f9c4ee5fa65b2431998
- SHA1 bef7e222b7bd8e4ddb66ead4506bc909efec2f48
- SHA512 89bd57fd86bc150a71f098a93e473b4526932432482ac4f152d315e5f751cd76ca3ed9a89d26585fd92b8d5b158cafdf959253f51e2b423f764f8d2383e5404e
- SSDEEP 24576:WBL3UTMmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:WBL3U3b5+Pl6bJTIZ5jdgp
- TLSH T1DF850245E7A500F9E87B823CC9A6CA12E672B85D0754E7DF03B84A661F233E15E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 d6ce938820e48eeaafa8ed8566e65bc65b5d500f2c6a1fd549a95e7f55a79c73
- MD5 690fef0d13ef8482c7dd306d6ae03c8e
- SHA1 e77c7b57e4838e7b09eb4b8e52e7147696af19da
- SHA512 ed273780c071d13df7ad85b30a4a15cd32e2f800c1e8d46457286b024e2e21a0daead42ac9f8037944ccdfca874bb1d868e3207da744d4befa757bbd6fb1b8ee
- SSDEEP 24576:DOgmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:DOXb5+Pl6bJTIZ5jdgp
- TLSH T17775020A27ED20D5E076A23DC9C68709E771B8668B1257EF46E0407E5F63BE87C36742
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 7f9d922ad450bc2e8a930be7d6b1ae9815453ba95d7d0f58c0911c8bb946f1ee
- MD5 97266889f6fab60e77fa15281bbba7d4
- SHA1 7409dce934bb78eff5eba8c60dc1957bc0948e48
- SHA512 4ca73cfb6b3dc07c38485969ee0f7b1226ae7f5ae2919aa2d94b31030b4e02a62b73886a4d96575b132a985e3d9a30eeb0cbcb5ad502c99e1fb9d4b985af320f
- SSDEEP 24576:T7NM9YqZqmWMUkPjZM48Mv6bEhsRmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:T7cBWMpPjN8DbEhpb5+Pl6bJTIZ5jdgp
- TLSH T12E65AE2E6BAC81D5D477D13DC9E28205F6B2B4611B318ACB1162833E7F37AE45E36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 174cbda5b3d7d96e2ef90ff3269cfc200cf96b6fa90aad05ec15fc84ea36c14d
- MD5 5f36740381bfb9e6182d91ca0a11d1e1
- SHA1 cecc0edd38b36972a1c7a828bf53e7b884c9b620
- SHA512 07e256776933808889466acf90a54a72a1e652d0f045bd6a4c3f7216e68cbec503c5da51e78371327fd4595033ac5cec4a2f12c9a7a875f5c367aaeb85f99d98
- SSDEEP 49152:8F2YuHNETovAvNYf8kmMb5+Pl6bJTIZ5jdgp:Z6BCf8krslgJTIZ5Bgp
- TLSH T1A3858E2A27ED80A4E0BBD27D85F6D246F9B2B8511B3056CF4255862E1F33AF44D3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 9578121e004da6b635ed171e0de4257b5a6efbfd3c181e11bc66c9a31c063ee5
- MD5 e11c4b1e7570e58df68c65445bd0288d
- SHA1 33682608617e7c7bc34ec04096f310217091480f
- SHA512 8ca9ccde222ffc734208423daac8bd05c1077377b441b72c8570060bcb345fbd000a7a1c962b0639bca5f11395adcf4c37ff363e9bebf1dd6e05bf8d0d306a06
- SSDEEP 24576:GAFs06+Omlf8NXEbToEmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:vFs060loXu2b5+Pl6bJTIZ5jdgp
- TLSH T1C065AF2F66EC00D5D07ED17D8997C91AF6B1746307256ACB0260863E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.7MB
- SHA256 174e061033e9f8a080aecefdeb68ae0c7ba19838be850c59e58dd9f3d40687b7
- MD5 68a55095d07ab5fea188973edd06e2dc
- SHA1 2c7b5d5f7a76f9b20b47f00a262bd70241f0eb12
- SHA512 f33de6d58e93929ececb48a5da2cac1eaeaca8389d0a80f4d79debc4796773bb22c164aa5f3a53492ba13cd7ecc795006a4bf307745cb8c84c066d73af79b5d4
- SSDEEP 24576:aJnJ5D3Wx3mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:aJnJ5DGx2b5+Pl6bJTIZ5jdgp
- TLSH T1F485DF2DD2A810E8D4B7C274819A5B45FE72387D2F226AC758B4D4357F12FE0A979F08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 34b3d559baed5af20a224010dfb87f928ae99386321b9ae17c375323f6700883
- MD5 3610aa1e5f615b6b480dd86969764f4b
- SHA1 5d07b527cb04c6038a484947feb3ce09ccc2984a
- SHA512 9d866209e3e92cccf988a9409f2de431928df21fb88ce4c6e5fd2ca846a0a3f29931e4b41539dafdf29e71785f64a4c1aa02df2a21ad2022206f600299daa718
- SSDEEP 49152:Xg06DIKdwc+eQnSt65aVAb5+Pl6bJTIZ5jdgp:QgslgJTIZ5Bgp
- TLSH T1C3956C06BBEA5294E8B3CAB1C96295159B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.5MB
- SHA256 217825e6ac90329318e3dde9469527ed91a6b27b971d0fe97dcd77ffe5b8c225
- MD5 504037d0d78088f53c7e43aa0ca18fce
- SHA1 5f6f22a6ea8fac0f9e48bb4d39cfbcbcdce03698
- SHA512 c3f50130456cefa67a93eae5cf520262f7ad64d5a6ad90adbc7c732b92eef09c1826c2c18450edcaa894db72dbfb22b1d785acfba266b63602ac527f025609a8
- SSDEEP 24576:p8Lmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:p8Cb5+Pl6bJTIZ5jdgp
- TLSH T1E465025E1BAD70D9D06BA23DC5D1C704E372F461AB4227EF46A5813E8E33AE92D39701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.5MB
- SHA256 763fccaf55cc458c6e4252a005d9d77693bcc81ae084db56d127c400181f5374
- MD5 8a34a0403eaa1ed5bc9fe8386b1b738b
- SHA1 c2efce643cf6e34bf803a757486e9cd3b378a745
- SHA512 88206fbd36d28a24931b2ca0576a4a86883c85b7294e049f72771258312c2beea5e3372e19d2d3f85143867c3d40128fec9f6731fc0a787e8a066004664d0472
- SSDEEP 24576:fIy2mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:fIGb5+Pl6bJTIZ5jdgp
- TLSH T15B75124553A860C5E5BA4738D9E6C350A979BD21DF1267EF80A0A93FAF32BC47C31706
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.4MB
- SHA256 9fd2cc1229ca1ae317fb2d7f39aba0df297ed4650c997ed081066c12c9edad2e
- MD5 92c75ac3d6d34a53b9eab7f69c743859
- SHA1 e902560e3345f2a6c1e4856791573c11b3455fb7
- SHA512 8a8090c595e26b86b8a7e001328872d89b41109fcab3e42aae24131d4a020b1bde8291e9d0510db3f65933a733c8c89a65c6c128594390f0695e35d7e5cc2683
- SSDEEP 24576:RQmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:RHb5+Pl6bJTIZ5jdgp
- TLSH T15F65234A4A6A308AE4675739C9C8DB00B479BF65DF4636FB84F99437E6317C9343220A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 1672f0418ed8aa005a90f0618968026b3e7b5b4a40a298338b349aa599f26b52
- MD5 127b26af94ea72aaacc1cc9937ea20f4
- SHA1 1bf25c21af53426b81b518155807ba3eec447be1
- SHA512 2cabc2bc7f2df0768e8f4f29005ab1823d49e9f67ab3ec1c511f4aa4aa9ef683bb2a57fd7beb70fc6deb6d7017ab2289c224ca5d1ce793b7f42174681abfc033
- SSDEEP 24576:IQ9MxZKdcz9dw3pmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:IVKZkb5+Pl6bJTIZ5jdgp
- TLSH T165558C2DABE9058AE177D239D5A250C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.6MB
- SHA256 841beb5f2abbe0d4efa8eaa4e8a4d528da6a334fea19bb4dee2eebef7f9cb931
- MD5 78efd8af734a13e87f0f72bda3faf8d6
- SHA1 c36708c6ae3176168d3147f0859c4d5721ef64bc
- SHA512 f2743c198b847d672e410a6bce21fd367914a729e3f53255afc24b703ef5877fd87b14f8f2bccca8ef0f6874c5a11a71666a52111be9e602729e7e3ffbfac23b
- SSDEEP 24576:gyocwApqmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:tocwApVb5+Pl6bJTIZ5jdgp
- TLSH T1B275E00FBB6E40D2E066823CC9858745E773B4309B5267DB55A1C73E8E23AE97D35B02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 8766f4de1acdaa92b488b84cca1f20e42ea5e2cc049fdb20a4a35f4df43fd4b6
- MD5 1330bdec441978a3c167c37be372000e
- SHA1 218e2f6720d7560307c554f3cfbe4de3dadd3bca
- SHA512 74509b14874f648e2d30ac3aca747593b68f100cd8ee9c37af803dccf515ddb7077250bf93157e50848b454628e912566b1b0d7fc962740600dc59a0c877f7c7
- SSDEEP 49152:WWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKVb5+Pl6bJTIZ5jdgp:g0zuNIvslgJTIZ5Bgp
- TLSH T1E7A57B3DA2BC00A9D8AAC379C5451365EA71742E3F2065DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 bbcc13684ebf718ec96718cd6660490f880cbf3cbd763eaa146343b94257a02f
- MD5 2eda1767fd9c186d1a1f2be356dc2818
- SHA1 52a9bef12b67876c95f8f4b31741d287e5b33be6
- SHA512 7d327547ba673b24f585271f468ce2c3bbe383adde6f4d4698583c14d20d74982ee315884f552d372ff17f38edb5d45400ec18d861bf200980734c1a8e7a918d
- SSDEEP 24576:X1QT7EcpfxR+N5AWAz3ooiYzjMqbLmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:qTDxR+N5YzTBjM3b5+Pl6bJTIZ5jdgp
- TLSH T13155B02EA7F915E9D1BEC6798A23C502FA727821073193CB42A0C17E1E775D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.7MB
- SHA256 b070fa9a6f94dd78ead57de5c971f3e389f9bf49fa452396811928480fd80b59
- MD5 ce8b58e56240f1887ff87057c36d17ce
- SHA1 edbf45add619ff8bbba858f51592db726850a000
- SHA512 76dfc9eb4e94191af63fe5d648ee47d7dc6aac71f6ff513a5cb83d49577e2c1cbf6011ca5ff21ba10342f9495dd8079346e712e94f7195f5b62022b21d997cc2
- SSDEEP 24576:WTMdOz0FFS+jmSLPmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:y0K+jmSLOb5+Pl6bJTIZ5jdgp
- TLSH T1B085E17EA36D14E5E47BC27DDA838A06F5727462032266DB06A0C07A7F57FD4393AB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.4MB
- SHA256 2d2ff4c2249afd6be3250a9c078b942dc9ced1c386aea8528dfab0bc158e6ff9
- MD5 2c1aa16de9ee8dec207f063ffa39c640
- SHA1 72224b7208b4271eb5f6721f59ae536552511cf1
- SHA512 b077ad4cc5976ecf1968dd407da4aa0596eae2cd0d269ac22512ce4bfde0bd453e333037ae6f5f1d0f28f7d7558d28118cde86cebc74c417cbf0ff8869b624b8
- SSDEEP 24576:YMmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Ybb5+Pl6bJTIZ5jdgp
- TLSH T1FB65124A07E930C5E4779339CAEA8700E571BD669B5627FF54F4C83B9B326C8A835702
- MD5 SHA1 SHA512 SSDEEP TLSH