Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 16:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 3.7MB
- Sample260804-tspbpsstfx
- SHA256 727f89c10e00531bf19747c2232cba258e85e2cd041d0b0000247591a88838be
- MD5 2dba6d873cfd97858602dbfea52c04e3
- SHA1 c97f102988caf3619f7aef5a1dc786d839100844
- SHA512 027280741dd0c37ea5a51111f9f28ceefb2a70517aadd9c42c840ab77bec84d94ab21527dd5fdd74d3b88cc60b57279ca631c4039f06e7d4807575c0e2b05491
- SSDEEP 49152:o7JynhJ8EhdVMw7Y9odwfDFqfFFJVgrvqzbut1wOq/eVgXUeT+uXEkjNEEBHLuY/:bsoEC9Aa+uUkjDBHLu7Lm
- TLSH T12B06BE1AA3E406ACE0F7C679CED6C553D776B80D07B1A68F029098A64F772609F39713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 3808 alg.exe 2720 DiagnosticsHub.StandardCollector.Service.exe 1832 fxssvc.exe 2428 elevation_service.exe 3804 elevation_service.exe 2044 maintenanceservice.exe 4828 msdtc.exe 1728 OSE.EXE 372 PerceptionSimulationService.exe 3740 perfhost.exe 2112 locator.exe 4984 SensorDataService.exe 2860 snmptrap.exe 1984 spectrum.exe 3176 ssh-agent.exe 3044 TieringEngineService.exe 3124 AgentService.exe 3196 vds.exe 2884 vssvc.exe 2900 wbengine.exe 3008 WmiApSrv.exe 4028 SearchIndexer.exe - Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\system32\wbengine.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\aa401b1ba19fe9b3.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\vds.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\locator.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\javaw.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\java.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dcef5f0d2d24dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d57e2b0d2d24dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000528d9b0d2d24dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003161d20d2d24dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ed6e70d2d24dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aba0700d2d24dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da45d60e2d24dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR recovery volume" 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rev 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive" 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0" 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,1" 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2720 DiagnosticsHub.StandardCollector.Service.exe 2720 DiagnosticsHub.StandardCollector.Service.exe 2720 DiagnosticsHub.StandardCollector.Service.exe 2720 DiagnosticsHub.StandardCollector.Service.exe 2720 DiagnosticsHub.StandardCollector.Service.exe 2720 DiagnosticsHub.StandardCollector.Service.exe 2720 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeAuditPrivilege 1832 fxssvc.exe Token: SeRestorePrivilege 3044 TieringEngineService.exe Token: SeManageVolumePrivilege 3044 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 3124 AgentService.exe Token: SeBackupPrivilege 2884 vssvc.exe Token: SeRestorePrivilege 2884 vssvc.exe Token: SeAuditPrivilege 2884 vssvc.exe Token: SeBackupPrivilege 2900 wbengine.exe Token: SeRestorePrivilege 2900 wbengine.exe Token: SeSecurityPrivilege 2900 wbengine.exe Token: 33 4028 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4028 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4028 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4028 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4028 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4028 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4028 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4028 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4028 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4028 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4028 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4028 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4028 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4028 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4028 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4028 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4028 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4028 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4028 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4028 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4028 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4028 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4028 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4028 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4028 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4028 SearchIndexer.exe Token: SeDebugPrivilege 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 4308 2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 2720 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4028 wrote to memory of 4944 4028 SearchIndexer.exe 110 PID 4028 wrote to memory of 952 4028 SearchIndexer.exe 111 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_2dba6d873cfd97858602dbfea52c04e3_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4308
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:3808
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3448
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2428
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3804
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2044
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4828
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1728
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:372
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3740
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2112
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4984
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:2860
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1984
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3176
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3044
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3124
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:1928
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3196
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2900
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:3008
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4944
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:952
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 5cb42d964918b06ce4d55912e9dafc4a804537625832fb08888e3746e7d8a2ef
- MD5 3ba7efc0edd81299e659bca42cec09a5
- SHA1 f9b8079e8b8830c2e51932a8344a449c99593b43
- SHA512 1aa1dd1f4e92eab02efe7b2b67f9df3a8eb2ba9b6a8557f7dc9f4519588440867adabde2c1e4fca2a06eb9f92ca572fc2c4d12448270104a1311cb5cfd728cca
- SSDEEP 49152:/b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnoQ/lFTjN4:93q6HjBQLm
- TLSH T199D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 f6071acd8f22a791fddcb4fc1daca145e1ef730937edd1b648c8d5ed8283a7e2
- MD5 feaf453197d0c26633cfacc24afcebb8
- SHA1 7838c2069237d77ce99119f0bdb55509428e8a93
- SHA512 0b27d4c1d15d02a158e5da394196e9c0d1b0e2e530d0e96a6ebb56c8b812cd9c94fffbf48ee5e65b1123b27c2ccce526c16e3f303f208c67b656f6e3412082af
- SSDEEP 12288:t1XLsswWkxy2lRq2czAnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:DXYfDtczAHnQ/tbw/2Mkjy6Fr7g0ou
- TLSH T11165F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 6722e3f3d5cee15529aa61977e3c7bb1ec8c0d089df1c2d6d35329d0ee836963
- MD5 c3b733b21bb0f48e8793a72154eb6a54
- SHA1 fb617fae683ff3da52b98e9f3c0a424e0a010e67
- SHA512 08056bf84c09b3090f3aef48309c1c8fbe478141c9285f56e05744e77a293d86ca4f299162d19f3f2211f249b63170a588a463c7219c40c8966ef5e2f4d28d73
- SSDEEP 24576:v0Le5ji0hmxLrMAnQ/tbw/2Mkjy6Fr7g0oo:vPji0AlhQ/lFTjN4
- TLSH T122859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 84608ee1a4a4b40695ba4e4c85e782d47b7318c2df8515d18f5802895b9a9e4d
- MD5 31ce48ed1e99ab7b1e48f21f6bd560f8
- SHA1 cd722c268624d26fb3a7b6b43d423b9e150dd64b
- SHA512 0b0eb11ee4e366899783406fb25ad6cc4705bef1b6e0701aaa3115812cd759a7388477f96ab42cc05f741d4c24c4aaaa5faef7d1bedab19f5ebce873f53fce36
- SSDEEP 24576:ka7/ezSC6vUyD/aqgrvWE6q8wyuunQ/tbw/2Mkjy6Fr7g0oV:T/ezSC6vUzPvxHjytQ/lFTjN4
- TLSH T1F6755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 0dc4a097d639a6c82182e582b1fe0748ced7bfe41c8f6002cc171d728c43c008
- MD5 549ac86231e3ec9ef1da44004ba8f953
- SHA1 c341dea40c4e7b34dfcccb6c970bfd50ed3bf975
- SHA512 cff1f6ffc5ed81ec89eb9057718840f8a85a978d4d8c06c9e840f57acd186c0480dc4d6d73099fc6b715bee3d8747037c7d6442a2dfa8b5ad9a58ec943e63362
- SSDEEP 24576:vVbqPb88hv/l+6rnQ/tbw/2Mkjy6Fr7g0os:vVO88hXl+sQ/lFTjN4
- TLSH T101559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 3909a3e74d998aa28daf3b0e4be67f9c59d2f900036e1371fe973e9b411eb1eb
- MD5 dd62d8454a3c75a47554ad5a303b335b
- SHA1 c5f7ade425fd77ab898e7b28cc63ea7b41257568
- SHA512 962444d60188fa28d9421c7a3fc2887aa8db855f3d84a0c5234065d910f88b855c4e60c48803aa2ff6e6f2a28ee017d2929823c896dcf4c13b0ec182ac41ba64
- SSDEEP 12288:vz0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:vzUnQ/tbw/2Mkjy6Fr7g0ox
- TLSH T1525523696A24F897FF2B06B15CC284826B7B0EC1BFD4A74E7B44322D857C39446DB385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 570f84af73f384f597ae6936925984da44d4cb448227a8abe5adee3eff3840af
- MD5 fdd294ffd9bd9d93ecec77946c90ca2b
- SHA1 3c78b6eba8526f7468e7feb6652ad2ecd45f7107
- SHA512 0a934d73618b9033ffc495a1816df8b9a5860e75e8fe7c7332463b1ea9c351bbeb81e6d835e2eaf65489ac80a1be498a8394d36fcd83ef9e56ad535878f5753b
- SSDEEP 12288:JeBNUbTVO86UzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:JJIUjnQ/tbw/2Mkjy6Fr7g0oB
- TLSH T16775CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 47b23f30d7b7feebdfb490d09b91e76ef70231b676651fe71d67d34c8106c1fa
- MD5 f76772070d90a528bb9b4b38c73db064
- SHA1 21487f3149fe9755c963d9ca463c404ece36866d
- SHA512 47f13fc0999fa447d8db814a1150e5cbaee1a2f82d3292a7368ac4187c603798b2fdd29b9a312257840e15ab8e05b0181e2ed4c5de5b253423feff1ddf3580bf
- SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THj:GQvGAdlCEL8c/yRNw5CZLm
- TLSH T1E3267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 b253c674d97710075e2d6aba82d7f04fe29ab13a14bd651b3392dbffbaad91a7
- MD5 fb0332240877fa714bc4e053b0f1b001
- SHA1 d0b6755fb6e66d83b2f961d903084b744f814128
- SHA512 90abc96c6ca89ca94990fe3d68752c3b6e3cbb0fe6d16d9af2bfb914f6a4d1daa8294c5573b1bcb2a2b00f25719ca057cbf1ab5d5cbdfea8fac6e8f14eb33a91
- SSDEEP 12288:nAwSfxL/2Dc39DLLmt0LDQewsAjhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgY:AQewsAjxnQ/tbw/2Mkjy6Fr7g0ou
- TLSH T1E875E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 1bb7fe3c00f61370d20d2251f4170691e2dcef03570d4f59e0ca9960227413d6
- MD5 375be1e876799256217f5d68c8c6d616
- SHA1 c73df514fd1ef66606661fc3fbbf62317386ac16
- SHA512 1d666d29d6171289c4b26f168364ec885d1f53aca227a5a4ae9330287668669b9b71243523742dc1891c50450581c4815959e0796c92d22775457add35142648
- SSDEEP 196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHOL:GUEtQevvqc2W1cpV2EI32
- TLSH T115474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 ff0ee9e674718805a701ee83ba9df1f45f9473412e596a9c030a1b03ee8019be
- MD5 4532af0ceaaa731227148083df931bce
- SHA1 a65ef581907e503287fb423b45005c57a29a87b1
- SHA512 ca655a23e1ce7e13889f2f9b2d9cea5ffba2c73d8fa35e9fb71cdc5b87a101b430db3a09ed95b5e914777dab9d3fe111a5e5e9f014972db2b427c81fee3ec679
- SSDEEP 49152:nCbRquA/m2yL5zQfFiV+XenmE3/zRQ/lFTjN4:woqtVjnmFLm
- TLSH T16DD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 ddb31fafcb7f1b9d94ab666a25d3bcf3dc39d43352af1d5fb8f6a99307929186
- MD5 20e785f94be342105ec0afe09bee9213
- SHA1 58f0b4628c1becb01201e9b1a437f35fb4cdd83f
- SHA512 c9f628bdcb2d06a6df56b4ce3e757eb2f59bcdfae247c5c1585762eedbbea3c6d96e586855f58620e47d11d6872babe47b324bf8dd4910affa55784621a15796
- SSDEEP 24576:sAhGLJIFoiwtA5l7S53qnQ/tbw/2Mkjy6Fr7g0o5:sAMyFoiq5aQ/lFTjN4
- TLSH T16635AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 03baff449c2bcbc4b5d681660b23dcd7d150e998ff00b432f89ef42a47555040
- MD5 b512df46faf57c8b110a0f8af1e72b36
- SHA1 6b495c5face7c3bfbc02128be4bd227a494c36bf
- SHA512 1b635fe9beaf995b08cbfdbdd4345e7fc7379b2cd3ced424cb42766779f7d440a0adb39d76547c928595c655fa8b929323fbde25a8ada094d6e919bb4b0797ac
- SSDEEP 12288:qmw5HEjsChN2BFgl0WDm+COGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMf:jwuHOWNnQ/tbw/2Mkjy6Fr7g0ou
- TLSH T18E65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 0d512aec0d17a1f686135a95c40525d0ab36117ba633ba71ccca95a524731ad3
- MD5 3b771d1fbbf610b791f3816b4d46f2e3
- SHA1 e2b6688d77f1c2475671e33b1b44e29c1ee9a722
- SHA512 420290e1d8a764b856aa59b98c095541ff89b0c07730036007321dcf0f2a961673afb38fb6b3c83afc11bc809c652f6968e5afdb85ee658e499ecda8f1739224
- SSDEEP 12288:ZXZ1IyxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:hZu4nQ/tbw/2Mkjy6Fr7g0o9
- TLSH T10855126A37A4B0FAE6670278CCE28646E7733882677183CF275402695F3B7D11E7A711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 51e1ea41b0b071c7072be1d0d17db581821622c97e7abc16396dfa3e5e2e28a8
- MD5 cb87f42ee04bc76ea914bdae4a2c5a65
- SHA1 4a9963be1398292018b6a5627436279645e800e0
- SHA512 4bb1c47f0b3d3e4582dea0c7f5301e2592ef62c721638e7b0b11dc5e9977df2abf6fbb78a70bc49ec784487cc9954492a2718a19c9ce5fda1ce835232e24e1d0
- SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:+QRQyi36YOcPQLvw2gAf+PN30Lm
- TLSH T1B9667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 2753ef70a057e4c827a48ca86c8dbfd3bf2e84106665a053a469c9bc96c824b9
- MD5 30970f6aacf9a90599bcbfb6a4417a5a
- SHA1 6fae4b94494beae1502480399a490efab44c57a3
- SHA512 1299508da45eb60d76c824072623c464314457755d0f58135c1c27be8af102b85c4c6df66d4363272f090bbca62d091ce7c9d237245f11d305af824e77e30346
- SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:TQRQyi36YOcPQLvw2gAf+PN30Lm
- TLSH T151667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 cbd20a49c17333154ebe670b9e05751e866a9d27df21722a2dc94a88fd0c3762
- MD5 4f60462d22c8289915a1b4ccfcbcf995
- SHA1 aca6c362e0f0614245bb99475d1bbf782ab887cc
- SHA512 4b986f130264b5466845a8b57e12d5874be2e227e184c1965ad50780857e4ade09f835ed200b63d5b869cb4f431c49393bfa7b452623cdea0246d598f2db5b81
- SSDEEP 24576:BwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0onQ/tbw/2Mkjy6j:N68Qg55nhheWu7PNU3/hQ/lFTjN4
- TLSH T179B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 ab86a23a36a80fb7ba539e6e8b7c8fa1f699fc9255d0e7fe1e1624eb0f101cc5
- MD5 ec02517a1ef19170af54e287036b19d9
- SHA1 42ab27ab6333de900cd5d45919e2350dd99d27c2
- SHA512 2a295607cf7122a7ba20f77b4418ba8b16edb9cbdeab232dd97d7885fb92d2b597febe38eb829e6f099b96d340031799ad8836915b5ce61bfcab2f4f5ae96848
- SSDEEP 49152:i3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99R:jy5112gYy5azzVvL69nLKnhZHLm
- TLSH T113167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 ef2233e22fa9ab62e8e976106071cbb00b56bb748a4f43a75cf1344b58592ae0
- MD5 c4eeb236ffb0a5afe4a28fde3b02c07d
- SHA1 24b835570909091f4f042c895e8b9c21325909da
- SHA512 e776c291ad916d6895a9b331dc7b791e2667ccf4f59c81cd5728924f83fe78e4ace95ca1bfd8e329593c4c675dd07c7a0a49cfaef1d03e8b60a7431ebdcef156
- SSDEEP 49152:kB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl3Q/lFTjN4:+u6JmVxd2dcLm
- TLSH T1C9D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 0b55a1374d8dd3d87122bab3ac895e3e8a9eac5ed5c8cd5e6fb7b40e61fbb9bd
- MD5 df74fbff806ff9197c72231c6469ab1f
- SHA1 b2bef57d12d3343f9c141e5163ea2812f9a1811c
- SHA512 63419eb4858551b8ae63335419cce26f9cf37ee583372fef7d5bc36cfa9a269a161250bc5ef1106df8a4db30ee08be4cd0589679eee96a6fcc183a7bd51bcd5f
- SSDEEP 49152:W1hpsNoJpF1A6UU44CwH7R4xDQ/lFTjN4:WmifPbRFLm
- TLSH T1A1B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 5b872c1815af7aafe1a91e88224341ba379df154806e15c104aab3a871ea7799
- MD5 15e0e0fb2228d83d7d2e028c2a349065
- SHA1 6b27d4af7e50ca3954a03a8b48d1a9d85483a0e8
- SHA512 633ce3d1fc59de4d79dc425b0d0e100b5b2b2e96c9cb95be24b7a866bf9c586b9349703d5bd8e03d25cd02375c69e11b2faba4c1b2af42791c4e83a3cf3f847e
- SSDEEP 49152:5SuZQIY0Be2KRRVtOnks6NMHq4Q/lFTjN4:X5dKTi61bLm
- TLSH T168C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 0713cacfa2cc236de3c9ed99f66a85fdf066712233c1e352cea285bab863bc26
- MD5 47c2b2f45a70958cc437b574b696bab9
- SHA1 b85f8684b30eb59bc61774479a31af90c8abef42
- SHA512 2e16f74a192c0e69117a9aefecef08c7f4c074a66dd119b1f0fb1bf36a0f156c056d94f25d2569ceda3f483b4d9e1ccd1c7170ba8d3c8a0f9a856253cd5141a3
- SSDEEP 49152:rhtSn8EApI0figngiDn0AP5wHQ/lFTjN4:qX2iyphxLm
- TLSH T18795BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 c359881e96ade5135b2ab01a27ccd6d9440a59aa1cc0db1d4c3ef9c84aff2792
- MD5 0668561127b15c34d88f7c5cc8358921
- SHA1 04b9e195fd7bae8cb8cd798e802469e1a20b212a
- SHA512 ba645b2012aaff7fce1a3fba4dcfe6a202fab6e3791d2c7ee18760f54daa3c09639ce1714c9f1f70c9867adc2c8cc807382b08f4882f3ff617b17ec9a624d09e
- SSDEEP 12288:3sGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:3snQ/tbw/2Mkjy6Fr7g0oa
- TLSH T13E5523697965F98BFB1706F188828182A73F0EC6BFD1938F77482129967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 385213030926d4be17fd53adf55199f0ecdad99efd1a4983b3afddbd76f1cfb3
- MD5 e685ca49ee032b10f30e92319b47b3c1
- SHA1 4f60f3b1dd709b1d6e2c1d88e4c953f0cd08165a
- SHA512 9e955d1b02395a7bdcd03f1f752457d63ae36cbc5998cf881db3cae67a733f8fec831d36c9a5885aa42e279f0c3014a377f0308d33a78ae26c5137d308381564
- SSDEEP 12288:Z1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:ZVnQ/tbw/2Mkjy6Fr7g0oa
- TLSH T1145523697965F98BFB1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 8d67882c78c4386da05dc6a20794c4dbda0a8256f25c1e35e58623386dec523b
- MD5 b69ee5b79274f14d950dd77ee7af27d6
- SHA1 ea3ff3f8a6709b487008b251ff527f27b3066dad
- SHA512 4d4e6864ef52cb635b5f3c159337ca44fc9cbd295e9e19efe77564b347a28d602a1b43b8d55f16d5a120db27668bdfe35ab87095ee39b15b77173acfc5fd9b28
- SSDEEP 12288:0rGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:0bnQ/tbw/2Mkjy6Fr7g0oJ
- TLSH T1B55523697965F98BFB1706F1488381829B3B0DC6BFD1A38F7B481128967D39406DB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 3a2f122ec3d5432cc1bfac0d85396a24d43364b4132233ec857264d204de1506
- MD5 19cf2ee45dc2dbdb375c49a63487098c
- SHA1 657dd50175e976f96044fc9dcfea2711df32b4e7
- SHA512 e80dd9839fc5d51f9c34189f3c80110393abefe88f7bed69699fba4792216d1b0724e8a1bb84c5bb9a29568726e3b30b0c274e1c0e8df8965b2551a5ca4f56e9
- SSDEEP 12288:1VKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:6nQ/tbw/2Mkjy6Fr7g0oG
- TLSH T16A5523693A69F4C7F92742B4CC928142E77B3DC5BBB1A3CF6B04111D4E793D419A6B80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 3d4b1a0ff0b834ced2470326ab68857fb249f636309e6a9231d789867adc7c5d
- MD5 ec1a1d5c89c4345e3de603814bdc4b14
- SHA1 5473bd375c597a3548e95456fa555157419bb908
- SHA512 8e469c76cb97a013affad91b94e1da431e72f1069ae2b548c3a45d52290ff479d34c4970ebe4280e1e5ecdd3495d17efccd13ea41361c414956239a8b265773a
- SSDEEP 12288:ZyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:ZynQ/tbw/2Mkjy6Fr7g0o8
- TLSH T13E5523697965F98BFA1706F1488381829B3B0EC6BFD1938F7B482128967D39406DB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 6e2a7eed01768c31c9a2a736050a2923c5a3909729721de2b4d52f33cae0c4c8
- MD5 ab5948ea6ae25725120ea16be75a8a26
- SHA1 932f39a83775f0f4cc5ba4aef0409e2f0220f137
- SHA512 5eea590cf0256b01a62953d725185431a468c4830c22562c1bcb09ba5bacaef9f7b41ce7a41f798fcebd8120dd5334ddae31f795b6ef4421c5f5562bb24926a2
- SSDEEP 12288:UZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:UpnQ/tbw/2Mkjy6Fr7g0o8
- TLSH T1E55523697965F98BFB2B06F14C828182973B0EC6BFD1938F7B481129967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 ef8e6c83d6c939986a29e12c8b0c6359ed3377090a397f4719bfae4f82ffb3e5
- MD5 affe03bfc935b0fe5a6da3a6dbcfc221
- SHA1 41f375d5ef88bd731d06e29922b2cea65111e430
- SHA512 9d16b09a0318556c570d97001ca878f1601f01e793903f420224c6190824d76b23abef86eefd6ec97a9ccd5308cbd34b46dab489573fce98e59d48c4a1c8d763
- SSDEEP 12288:8dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:89nQ/tbw/2Mkjy6Fr7g0od
- TLSH T1845523797924F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39416CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 1596898d463f6998ffdfd84b82f8515e8472388698bd90d0ceb68e9c4db7b62a
- MD5 30d083cf5034976ef15b08aca2f568b4
- SHA1 836e5573ed578a0a7778a565186197d61f385575
- SHA512 dc8806b5f9b04faa759259a1f2c3b1dbda37e2fbda7d197b0eab939453ef388df10b73fb26858bc42818f650b98587ae54e47f1f1cad59a4c73cd2afd5451314
- SSDEEP 12288:YiZwbDzzFEoS2cPvyVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:bZM3zFVSO1nQ/tbw/2Mkjy6Fr7g0oL
- TLSH T1117501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 78801c46727037f9f9f6bab6a0443ff6174e3d4da2e12d1ed0943329d59f4539
- MD5 e1f4b2cdabe2f53de7ba897a1af53296
- SHA1 1e67caf081b5bf83d401006774e80b6f2ed13b81
- SHA512 81c7bd88aa1fc9ee6ebb16ccc0a4aabfc593d93d59abab0729c56d097055fb749fa4d68fc701a4230ae663d0e845e68679abdc4ff6a74d01b638a4bd814a3257
- SSDEEP 12288:iIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:iInQ/tbw/2Mkjy6Fr7g0of
- TLSH T1435523697965F98BFB1706F5488281829B3F0EC6BFD1A38F7B481128967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 8b07e539e57d0be925cee6e67762e2cfceb40643707e510feec9dc47f35464f4
- MD5 f6e224a893b0ce639aa1c5e84222adf5
- SHA1 8d8fbacf387ffe932c4cf2d0af95458d3f764b22
- SHA512 ab7185de9bac978a22bb185a77a1732c3db8cea10703662dac0dad435bd84509f7ca29d78f27ebd40164d3878f467a702c1425e36c051863a67c4483be4da130
- SSDEEP 12288:jEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:jknQ/tbw/2Mkjy6Fr7g0od
- TLSH T18F5523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 fac3a37db51012a84302240e7634178c5a1c11a7d2a4eb8d61255ee62c75e4e0
- MD5 b238ead9ab3b39f47766b5ca9624a0bd
- SHA1 e8f997765eb854501da1f582a71c5de45b59eae3
- SHA512 116842c23350c1a4cf9b821df563a3d9c6f50d406aa8bb0f0d4ba45b356bc87f0eb824e3e7cc92d71200bb7a4711166c8b10971358eafaefed96ab54577291d9
- SSDEEP 12288:oyPz5L8xGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:pzyBnQ/tbw/2Mkjy6Fr7g0o7
- TLSH T1E565021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 f2a3e2e860498009c737411598c4beb4e9f54827e516eb57fdbcd0b6f2cfec6d
- MD5 abc0e78993777358c3dd4e5a769612af
- SHA1 afa8cf880d56538adcc957c4f0dfb6ae8c00740c
- SHA512 68a3fd3cf8a1bf0e919002bc8dbb318eb32effda486dd7eef98343c3fa39bb444a81879c473a485f2f676fef970d9cc0e45110323d3c9d832e2e3b6fda34be75
- SSDEEP 12288:yIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:yInQ/tbw/2Mkjy6Fr7g0of
- TLSH T1375523697964F98BFB1706F5488281829B3F0EC6BFD1A38F7B481128967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 3a4ebfb0a3ab2e54f051e4b7ff69d0153beffedb95db75e5f584626bf8780179
- MD5 58b75a311a80cfac45d7e06a64f57d1e
- SHA1 e575f6f75610c34b9896a81e4bfa635f483d31b0
- SHA512 04fc7f3a0a35a5070305fe7d6195c210669564bc4c1420c64832bbc79173b47b70c05b8ef5f9f422c114d7a47c3301ef2df21720579f37787004324cbf7137b2
- SSDEEP 12288:oIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:oInQ/tbw/2Mkjy6Fr7g0of
- TLSH T1C55523697964F98BFB1706F5488281829B3F0EC6BFD1A38F7B481128967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 3554316a39a0db5bcf544828e84bbc1a011a595debc589a333933104d438b528
- MD5 5c7e87ffb5eb2a969dfd1fd46da529d1
- SHA1 6cad0e10ad173d88d617c51686745564f7da953a
- SHA512 d9d272eadaba2ef3e64bab89e608fbe506f7d18c1ae1c745d05065aa56886888e38dab87583535caf874935aa6103a8447ea2c1065a7b8a27063dd190141e040
- SSDEEP 24576:bcP4mcvIjkGOxhKP2l71nNKbrh/8KBwnQ/tbw/2Mkjy6Fr7g0ox:QP4m4IpOO67W8K+Q/lFTjN4
- TLSH T12C65AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 5a21357147d50dd5afaafb4185759e128ec50e4db9ec9a63c7923e271a16ae6d
- MD5 219e74e2d3bc812432d8e6d16bc65c17
- SHA1 2a8819e9f49dfd7a09ad639a01f13eed5c678720
- SHA512 8e5e82fb445a178baad99b51bb46968f1850c751870e9c03370810f9b8b1561a49c9be196465d961971f5fbff88c6d57f8eff721a7274e46b3827bd7362bd45c
- SSDEEP 12288:zssf4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:f4nQ/tbw/2Mkjy6Fr7g0o5
- TLSH T1B465F119E29852E9D12E1275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\WinRAR.lnk
- Size 1KB
- SHA256 f70a4825a4d290b557dff46cf38fdd0e67136cb31aebebbf39c60786b0213293
- MD5 fa40026ffec86023e60bf7899434640e
- SHA1 0576bf4d178dc90c2568447708d93ff1e7d7d71c
- SHA512 fb93932542e55338b1a2ee9d50040219b932300ccb6ceb8241fc045fbef58f57ec92adb6859a5d62795d36de8743bfd5a944712d85485b2e47266a34e87764f6
- TLSH T12D11FC129ED61B20D7F69E31C2E76321D6757C69EF996B0E000081492871911AEA5F1F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 71bc9ce0491b8c8c91a8e14568d0ee18b8acb6603669ca05d9381ab8e3350e1e
- MD5 451c0181a928253d199bcc46c1c52ad8
- SHA1 0bfef939ccf7734380a539890d780615a526bb50
- SHA512 87a9bb3975152e3ed4c81524ccf2b9ddffabce2901c799a48c40d352166460ed09e9ba99242da8739b6b80fe675ac0c4c25af8c98d5c93cd601c46a50d709641
- SSDEEP 12288:1YGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:1YnQ/tbw/2Mkjy6Fr7g0ou
- TLSH T14A5523296768F94BFA3B06B05882C151673F0EC5BF91D38FB708222D957C3D41DAA745
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 ab08cd730ad9f3dec142fb175d9c1f44ad82eabaac6d35c19ffcd9d9ff208855
- MD5 00736be9b282b9a79f30cb864a236e65
- SHA1 ea4c32d454c0bf7e792feac4f52443d30600c052
- SHA512 003d432fd86452923ca9cc0d74bdbcedb63a296adea83047dc603435ead6a5d513c943dff8e10359189e8b653354ee6d1376bd2d593fcce84662158a1adea437
- SSDEEP 49152:Na0h2GEkuAe73q3pp46zwwQyQ/lFTjN4:Na0hNYG4JwOLm
- TLSH T15A859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 f01edb43661a5d7f0140c8c3ba74c404aa12cef92d1ee90b8d93fbfd77910a45
- MD5 f6184bcefe180fdbc65187b72fafa1bc
- SHA1 b2f802b2464af4becdae9bc0d2fc5645e800a503
- SHA512 d9776aea7c1d607d362bb5fceb4da24871d9058eb80e6089e40cdf953148fa4f448bde48a8f7bc9d117780e2e79b9eca81ad1ae8efb14dac6defbc10ebc8a94a
- SSDEEP 12288:EhbHjfXlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:EhbHjPFnQ/tbw/2Mkjy6Fr7g0oi
- TLSH T1FB55027E26AC30DAF63692BD88928546D7327C552B11A3DF2381423D4F3BBE41D79B81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 8deb4e0fd2a7aefd9333da24ff07140ea1c71fd44eda0325d2c2a3218c08685a
- MD5 489721ed836fd4285d55cfc68962d657
- SHA1 357f709841e94a388f04ac30bedf88ba1f0148d8
- SHA512 200e400a397d235e80158a70276eaff86f3faafa3651b0463694b0dfc2c0985efce1d69d119f2c7d8d21c550aa2d0e5266b99110055389744acd1152eba87422
- SSDEEP 24576:n3YgnJcRTk4yti+R5dBR/NnQ/tbw/2Mkjy6Fr7g0o6:nIgnaTk46pBR/NQ/lFTjN4
- TLSH T1F345BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 baa2b68dd0ba58e33aae28a1bb82973f383a5de38dc71be856fa432c458039d1
- MD5 20f6a9d17b964b392c8b2f733b0dfeab
- SHA1 2e8aea8d2065c68b7603eccbc7db6026ebecefc5
- SHA512 1ea8e0fe5207ed4a10364416b90ee99f2adb0d850ef79d24478cfb9957b4878a6581842b30dd7c09940a44319d15fca1650388cf531ce0f7568d136db9e2c2c1
- SSDEEP 12288:cUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:c0nQ/tbw/2Mkjy6Fr7g0ob
- TLSH T1F95523696614F98BFA2706F54C838146673B0EC17FA1A3CF7748222D967D3E41AF6380
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.6MB
- SHA256 7486e8dd9462a33e6527795e9c59673e2f322003fbb545cfff8bf62e2faa1993
- MD5 6027d4feed3d6a8a6c298b1d61f1c315
- SHA1 89a6bccc6d5cd84f6d7d16b65a3a55c9688439ae
- SHA512 d0a36b7809326af01fed1ca0336dae03b8d916f565c8a47fbd97a5d6492f1f73bebcbf91f00cd6d7039e68f0d5dc95192604a8c43b16b4b02ac2d3717c968842
- SSDEEP 12288:vOb4A4LWOsvAYFTnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:wwL3UTHnQ/tbw/2Mkjy6Fr7g0oK
- TLSH T1F275F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 b53cbfd40c4d2597178e9c054ed49399ba1a08b5d015b8b64b81c9320ef3ebcf
- MD5 93957cf58fa455afafe961bae0a14664
- SHA1 55c63f0bbc45f97745722fb77bcacf0ead94362a
- SHA512 f3f0b33c081d343a6cb67a651287a50d1bec305d8113270cc379767292bcdd1ecbcabcb9bd35a20b95af6f838c9c3f5252bd74265cc79f30aa65967e990ebc4b
- SSDEEP 12288:ZpFtCOTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:yODnQ/tbw/2Mkjy6Fr7g0ob
- TLSH T18C55022D36EC60E6E536527C89838249D37278961B6253DF0780817E5F7BBF81C7AB81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 a9d1f189130bdcbb868251a482a2b3d4e24d83453356f3222398cef4f4c3c388
- MD5 7e3579838d1070d3e62fadc6503c9ddb
- SHA1 4a68e912ca1f128ebf08a5ae527bd15f7298bca9
- SHA512 09bdc38d8a005fbe4052dbf7da91fab3301f69f5e6c7e0a0adc765ebb17ed60bd798e957567f65df46189b0631fc0ef8c98d2e85486901fa22a833f060386267
- SSDEEP 24576:D7NM9YqZqmWMUkPjZM48Mv6bEhsInQ/tbw/2Mkjy6Fr7g0o7:D7cBWMpPjN8DbEhlQ/lFTjN4
- TLSH T13E659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 52703ed622351f3fd01ac03332a0ab3af5e048926afb9a1559e6c53e511c91a2
- MD5 037b057bf830e9e3b505612f1005cf94
- SHA1 53e26d8149ddf92285e063779ec28914ad79b25d
- SHA512 7fca16353c7de8ed5e4a86acdfdaa0b1920b11d3bab7edc4abf9c27f005b3b8465e8a8671cb93b03436002e40ce20299827b48a693a719536757127c52887608
- SSDEEP 24576:/W6BApg2YuyuNDYTabvcdvNYf8km1WnQ/tbw/2Mkjy6Fr7g0o7:/F2YuHNETovAvNYf8kmoQ/lFTjN4
- TLSH T179857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 1efd5bfe4a981d8fae1a412641d7e74e47865334ed4c48456b8d3b93e859405f
- MD5 38008f70be176f81545027fe0ae5f621
- SHA1 fb886f9aa32a1097b5a84dcd301c749fe564df9c
- SHA512 8373e3b7243d4fe76970f00815b85239e321084f7399339e34590a7f2fc118084207e66f190859b43c2ebcc1883b426eb5444904aa57b47eae8df0a52b050ff9
- SSDEEP 24576:rAFs06+Omlf3NXEbTofnQ/tbw/2Mkjy6Fr7g0o3:kFs060lVXuSQ/lFTjN4
- TLSH T17765AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 2b12758474ca5ce3fa74ffc8e39ab851abc4be5db9e0afad34a01960f8d5faa2
- MD5 0563850b46e293e9a3196815068836f4
- SHA1 d9a2621a3f2792ee5515e29580cbff8324dee34a
- SHA512 969b37ab77216b7d07a0ac39244ee45e156500625c3a9cdc0f6aac694fba0dfa900f36dc5ea69b7285af996fdc36e5ac802797499d4f08adeb4dd1b4fa189869
- SSDEEP 12288:+CJnJ5D3VkrqzxoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:PJnJ5D3WaSnQ/tbw/2Mkjy6Fr7g0os
- TLSH T1C375D03DD2A810E9E477C2B4819A1746FF72386D2F226ACB2864D5357F22FE05979F04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 939685e11e09b67e4c40edbdb5368f3c43018a76ac9dffb4d510e6d03aaddb8e
- MD5 fca5bd529edc85ae8ba6621a0d262d9d
- SHA1 ff13781a3d22abcec3bf9d0bf25747bc0c0335b2
- SHA512 b07fafc626606a378f5e0dec44db6a0706d8e70b73189c83f67f7951f48f7985713ed23969acaec592d51ef7d93e18b9534a6a4aff6e18a637bd68c652b0a950
- SSDEEP 24576:+EPghm6/7IIXdwcXrif7qQncjlP65i3VuNnQ/tbw/2Mkjy6Fr7g0or:Zg06DIKdwc+eQnSt65aVsQ/lFTjN4
- TLSH T117955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 ac20c6a613f3ab50413c61c6376c20f27213b5bc2d52eb2104db715512648e47
- MD5 89d24e3c71da9c2b1012f3500fd04a7a
- SHA1 cb54241c15ec21b588ca8d72d5f149add3b41517
- SHA512 bdd59f01ffe51061fff2b7d17b0664ecee12d3ad041ab88c531763916f49cc763998d28141373700d9bc4af9efe5fe00244b99debf83269ee2f53e5b918164f1
- SSDEEP 12288:4EP3RSOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:TSOnQ/tbw/2Mkjy6Fr7g0on
- TLSH T14455126D37ACB0DAE52A517D88918145D373F4A12B5267EF2680823D8F7B7E81E3DB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.4MB
- SHA256 027f56ae8421487b4657214910aea4a188a08e864703cfe081fb0a2ffd482ec5
- MD5 f38d73ff7cbcbc0e12709c94a0ab72da
- SHA1 b2a331459dea89d87b5ddad33ea5d683151692e0
- SHA512 17ccd8d1251233d7aa51c17849e66b1f8376387685eb7eb124189e0692d1eeda4bff17adc6bf8c8297524a35871afc436c3d3aabccf502a3f682b044dd0e2e05
- SSDEEP 12288:Ijky1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:IIyVnQ/tbw/2Mkjy6Fr7g0ot
- TLSH T1A96512186398F4C6FA7A06788DA381919B367C506F2193DF6280F23E9F3A3D46D75B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 0830f48c07e6307e4e8b743dd55428f0e471589ddfd1f86709611321f74be332
- MD5 bc88fda5dfa80584dd0eae1ce52336cb
- SHA1 4b30bee25c7144473970eec8acfe2abf864d8646
- SHA512 78d49104b499cc279fde662aee4bcd6ad27f8680ac1c36da73f0ee430171da2009c398c8c308ccf7e65c65e0ff68266863b434751dedc184494c056a0529ce1b
- SSDEEP 12288:y0jGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:dTnQ/tbw/2Mkjy6Fr7g0oM
- TLSH T16455236C2625F89BFE2706F448928542973B09D17F9163EF36886239CB7D3D416F6B80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 537ee19cff88d85b9c0cb4726008a7a54c424c9cd87f8959d96cc70c3a941261
- MD5 99f4b9b69cb63844dacaa9337cf846d8
- SHA1 b468ad47143bdc29d5887ed07b5ea1becdefb0f5
- SHA512 a16f44ce3ca8e13f465eb92ad7b732d59e92fd6c7a66b53e9c201381c654dbf782fbc4cb13cabfdfb668d2e2a1ee5d392d0f56c481ae03b2d9f231069b8117f2
- SSDEEP 24576:7Q9MxZKdcz9dw3gnQ/tbw/2Mkjy6Fr7g0oK:7VKZgQ/lFTjN4
- TLSH T173558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 9e55bd05f4519e5cba420713beb2014714e6549f7c3f618f7006cc794054e4a8
- MD5 c1cfb124c82a59d3ae81afd8c265e5ae
- SHA1 331d1f85f5dbf612e6a275cdb0457b258ac9d374
- SHA512 5f61a8aa189983a66f24fc4934e05d760992d61a43ff2b339bc7018292a89a9513824732095ae8139fdb130ae677ceb12a0dd634264d41ae260b88e37cdb26b8
- SSDEEP 12288:JyoKo20Rple9phGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:JyocSApxnQ/tbw/2Mkjy6Fr7g0oy
- TLSH T1BB65E01FBB6990A2E136813C89818645E773B4706B6263CB6681C33D8F776E87D39B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 5979b6c79cc0a92f9c2015ee31e2dde80fc7390f9254a64b7f85f3797b6957e9
- MD5 41f9c5eda269f3dafaec86af22822197
- SHA1 0fa4fe48a6a137b3ad9227fd09fa4cebaa3bbb30
- SHA512 6cc2825d9416718e5dd5178de3b3e29f45f769c52c3cfd7a2bc988e052c70daa421e92d0b36ec1ce2c73d783639debed760f81ccf734c3f6a48bbdabdf9bfd5c
- SSDEEP 49152:WWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKxQ/lFTjN4:g0zuNIsLm
- TLSH T123A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 d1a1233401ed3fe3e6682c285877fd6b4fd38da9b0f2a40c78f47dfbb018ff5f
- MD5 3524b9c9385be7b0d216b2e6fd235f8c
- SHA1 8f5a4531ea682246bb6b40e4d1f43160bd917f86
- SHA512 b7bd867b4c4a705ff94be95742909b008c1e2b97e48db2ce3f803580332f8cd0f5d9cb7d61ea622589b04e7341b6fe89f940f26f073265802f4ad24af779fab3
- SSDEEP 24576:t1QT7EcpfxR+N5AWAz3ooiYtjMqbOnQ/tbw/2Mkjy6Fr7g0or:YTDxR+N5YzTfjMjQ/lFTjN4
- TLSH T16055B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 6b4419c54a9250187239ad7cf6f0955909191de35b50da0fc04688ff7b1d9a94
- MD5 31b4d75af598c87272e2e9bf5e854c39
- SHA1 3a475dc2733a1e4afbda43a2b7a84642e1fe38de
- SHA512 42f401d9f7a9cefaf1a2a989bcc59b04a6294234dd890d1ee10e50044162c596b80756e690e6aa4281fa1815fd85dfab5fccc1afe9c16b095303842574dc4d1b
- SSDEEP 24576:DTMdOz0FFS+1mSLKnQ/tbw/2Mkjy6Fr7g0oE:h0K+1mSLKQ/lFTjN4
- TLSH T1D475E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.3MB
- SHA256 a1459a03925d80aa8bf7f9fd7636f31b0470283fb6e6bc98892d24e006bcfbe2
- MD5 f8eacfb90066b6645adc3d20b0606263
- SHA1 19f40abf89b6714e7a0612677a6fc076d7b1378e
- SHA512 f2b99a3c7f92d17f850131362bb17dcdda3c18e4f168f0feb49e2ff6faef1d4f6cc5af2790c909923093a16325b47f0c0cf91a49866994867b0bf1fee08a86b4
- SSDEEP 12288:74TnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:GHnQ/tbw/2Mkjy6Fr7g0od
- TLSH T13F55122D23E8B4DAF93752B48962414697327CA2276167FF36C4C23E8F3A3D44979B41
- MD5 SHA1 SHA512 SSDEEP TLSH