Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 23:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 3.7MB
- Sample260809-3x2l9sda42
- SHA256 26178ddfae3b6a9c5d00a1d6e8de96909f8f68e9016b298f4e305041c1f083a7
- MD5 70f2dab8147cb8a219d56c800d8c66e0
- SHA1 a6beea71526ae620e642a570fca6546eabc4d518
- SHA512 03e6c2e46090fd6cbf9abbdcb1d494ecd0ffa7d6f7e8f3729ceaa10aa24c24cc945668bc89e2be0098f1d6a960b29cf2941dfece024d53f872312a3043fa6251
- SSDEEP 49152:1zksfrJMv7WyI3kkv6h1oD8eiMv3SmGlO3m17PnKtbtgbscUejuOXk0jdEKBH4SP:yUyhvdYRKuO00j9BH4SVqGsQr
- TLSH T1B206BF0AA3E406BCE0F7C679DED6C553E776780D07B1A68F029098A64F772609E39713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 2256 alg.exe 4796 DiagnosticsHub.StandardCollector.Service.exe 3816 fxssvc.exe 5448 elevation_service.exe 4720 elevation_service.exe 5916 maintenanceservice.exe 1032 msdtc.exe 3968 OSE.EXE 5444 PerceptionSimulationService.exe 5536 perfhost.exe 960 locator.exe 1820 SensorDataService.exe 2796 snmptrap.exe 3220 spectrum.exe 5832 ssh-agent.exe 2100 TieringEngineService.exe 968 AgentService.exe 772 vds.exe 1912 vssvc.exe 5716 wbengine.exe 1764 WmiApSrv.exe 2956 SearchIndexer.exe - Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\locator.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\48536adc5a3b5d25.bin alg.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\vds.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\java.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d445a7785a28dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000055c140785a28dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000131976775a28dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002fe928785a28dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067bc9d785a28dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba0482775a28dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ff28d775a28dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eecd67775a28dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034914d775a28dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc16b4775a28dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive" 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rev 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV" 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive" 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR recovery volume" 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0" 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,1" 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeAuditPrivilege 3816 fxssvc.exe Token: SeRestorePrivilege 2100 TieringEngineService.exe Token: SeManageVolumePrivilege 2100 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 968 AgentService.exe Token: SeBackupPrivilege 1912 vssvc.exe Token: SeRestorePrivilege 1912 vssvc.exe Token: SeAuditPrivilege 1912 vssvc.exe Token: SeBackupPrivilege 5716 wbengine.exe Token: SeRestorePrivilege 5716 wbengine.exe Token: SeSecurityPrivilege 5716 wbengine.exe Token: 33 2956 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2956 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2956 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2956 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2956 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2956 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2956 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2956 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2956 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2956 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2956 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2956 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2956 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2956 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2956 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2956 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2956 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2956 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2956 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2956 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2956 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2956 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2956 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2956 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2956 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2956 SearchIndexer.exe Token: SeDebugPrivilege 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 4732 2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 2256 alg.exe Token: SeDebugPrivilege 2256 alg.exe Token: SeDebugPrivilege 2256 alg.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2956 wrote to memory of 3860 2956 SearchIndexer.exe 118 PID 2956 wrote to memory of 1056 2956 SearchIndexer.exe 119 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_70f2dab8147cb8a219d56c800d8c66e0_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4732
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2256
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:4796
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1800
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3816
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5448
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4720
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5916
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1032
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3968
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:5444
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:5536
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:960
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1820
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:2796
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3220
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5832
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2100
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:3084
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:968
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:772
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1912
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5716
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:1764
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3860
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:1056
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 d93db7568394d3f231d35947f2aa21b24bed2c3cba64bd9a0c496432efe60c3e
- MD5 896c794a35c9a744422e08282b39c15f
- SHA1 0dfed48db0a052571f21042b2c4b04a517f13ccb
- SHA512 d0d555555a701c3c829eff7a7e22a198f2578aa1c07f5e2b9dc31d3a35740f5892b959ec52f8a83c02b91172b86cd2b5690debe794ed112595a4763b6d4050e9
- SSDEEP 49152:+b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnYAQgAT76sQuE:A3q6sjBaqGsQr
- TLSH T1B0D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 78360412e22241a4b72baa8acc9cecf609e8186ad883343fe69c56bcacce9667
- MD5 dd31bd259ae42bd02d8abfe14394cbee
- SHA1 4cf20e57f9184acbdfc9d645c15d7652493c5300
- SHA512 63ab73d2d8c08c670bc1388d54c6470f347683dd72f70bc2a0a69ecbd741a561f6ce1c426466bee8862f4900747ed468c1ec62faf961c46587f6c840e06aad51
- SSDEEP 24576:SXYfDtczAFAfYLH8AcevDN0FImbwQuq3Wia7gD:5tc+AQgAT76sQuE
- TLSH T1B175F12963D408F9EC67813DCCB28521E673B8954360E7DB03A49A661F332D85E7EF51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 24b09946b7ddac4b2276a5a417032d735683b7a4653dd6b9c62c82fe2a8728cb
- MD5 160c0119d80b39aa79f46850cf58ea72
- SHA1 cd2fb6a1e0384cbddd8010b46c166138d6cd37bd
- SHA512 db2aa64991cdc47b8f1941c1d60b1d0308941b34c8821b5f5459de93ca057461e79a3ff245120f47de87dacc8ca1feb441d6326e071bc5c97247bf4a5114e194
- SSDEEP 24576:/0Le5ji0hmxxrMQAfYLH8AcevDN0FImbwQuq3Wia7gD:/Pji0Aj3AQgAT76sQuE
- TLSH T14785AE16F6748335D073C0B9C5D2A69EEA71308657308ACB4286D77C3F67AE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 54fba8373597e9c176015b868b9f00756201cb13aa534a5731d7ff08c516208a
- MD5 b797250f89af5d1c4da92e9359edd811
- SHA1 d44b14900f61dce7fe0e7845a25df1975f7dd41f
- SHA512 7a7f35f913b6c850c2c360298aa6a25f2a37d305a752bd247df5e7c67ac709e15df1a07f4c7210bd6899940fa0281405329efdf9ae1bce2cada8d64d09958ed4
- SSDEEP 24576:2a7/ezSC6vUyD/aqgrvWn6q8wyuOAfYLH8AcevDN0FImbwQuq3Wia7gD:B/ezSC6vUzPveHjy7AQgAT76sQuE
- TLSH T19A755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 0399d43f92964bf50ed2904f70ccc417dc5921d2b402dff94313af7062a7be5c
- MD5 24663f36d1c730270d185c9a13030e49
- SHA1 b752457971465681a7330ff9c7a8a7070738e392
- SHA512 4047ae3fd30812105b07914832e3ae45a0647d11af6600101bece00d117f7bb653caf30d1d50bed5cdb2e32ed188bd0e31a39e4970761bd08ee9a2071152c677
- SSDEEP 24576:LVbqPb88hv/l+YhAfYLH8AcevDN0FImbwQuq3Wia7gD:LVO88hXl+WAQgAT76sQuE
- TLSH T185559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E67AD6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 1a547adfdf6be9dde1a6880e70bb35b427cf322756ea2c4e132db2335714f3bc
- MD5 a114e1eaf6389ecbac7d3b102619bdbf
- SHA1 7f304f34257291f0cd5f6dcf4cda7ffbfb0c99dd
- SHA512 11282de6f01f8dc85500a7822521d3f8bcd2f820253408c4ad3592e9d1b94905d14c6c3ed662e5ec58d4c980339053003553276e71a3619ca4dd6ac5064f1087
- SSDEEP 12288:mL8AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:mL8AfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T155552357864C30EAFEFBD1369CBBA5B963D1BCB88284979A04463BCA793D408D0D4D34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 a4e4c95af8ae21756e89abc629071a490dce6818ea1e70052e5b548bcfe75329
- MD5 c4356c0836e1c035ed0c2114446eaae1
- SHA1 bbf91f00b3a100cd617b1f552fb38a74e6171c8b
- SHA512 de8ea631f8a2811d3889940bb2e6f83d96006f03ab39dc6ae29c530edc5f3df724ec56c03693c5619708e42fa198a4c5a2311d333e1254c23a5e38fa6b0d309b
- SSDEEP 24576:IJIU5AfYLH8AcevDN0FImbwQuq3Wia7gD:IJIU5AQgAT76sQuE
- TLSH T1A375CF3BEE28FCE2C67E8D795A918600D7B278704B51A3CBD165830EDE235D05E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 07a3aa53d9889a5ea4cfe70cdfc06428a0dd0e442208f0eb19c5a735acbca662
- MD5 bebbb3f89cc69ea87fb49045c6fba17d
- SHA1 bb341ad984cef7dddae90ab24e05ef5194208f4f
- SHA512 203ac6bf336a5a0ba8e75724b121411225de5ad83bdd9eb56c4cf26f3fecfdacdfc777bf059b34ec65d693a5bebb7828d99259fcd8599eeae7197da4608f3368
- SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THC:8QvGAdlCEL8c/DRNw5CXqGsQr
- TLSH T10D266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 000e75ea0038c02371ee9097f0ffdc50f9046dae94a039c7820b4bcbc6c5352d
- MD5 17d959f38b073521eb2c46083551a675
- SHA1 499afb53cba524c586469edd3646d1e8fa23055e
- SHA512 6adc558800029f530601d99316fc36c34c27d9795e75ca6dd4e296b2480c92a78ce85468f8d9fda5bb0fab7c40054ac078c8fccc74c9e3ecc274bcbff8a65cb7
- SSDEEP 24576:L0ewsAjHAfYLH8AcevDN0FImbwQuq3Wia7gD:IljHAQgAT76sQuE
- TLSH T13775E031FE74E036C6BF0DB21B36C716146CB9604B511AC3E3A85E9E59342D263B6E27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 a2087fe3ab201a84da0e50ba3b596ccc567d362ba626f8608703c1fd41896c5e
- MD5 a21c34e34275d2637177f931109ac704
- SHA1 821257da76aef690ca46471caed984700e58d500
- SHA512 5300becb9a05c68b22982b12d914ac837524c325cab0567d575a4fe89dff74c861e703968c398ca7b6a4ea9c47e44f1e8eb61c1be157dd61243877c8995cbf62
- SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHej:lUEtQevvqc2W1cpV2tI32
- TLSH T10A474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 15a436f11e531333c9ada5297c6f6779019cea67b3d0699ba11f65a8ebebf997
- MD5 bf61e0d074481a6908899ee1665a9c5a
- SHA1 15cd12cae4db8531f42a9422374bd49dd2f4b6e3
- SHA512 85790d4c1343f043458d77616cd50206ee16255fd412b6f9a2df779fdbd27a3fd68a19c3830d2d2961658e9068c8ead9ff055b78e05dcb555046308c506be0d6
- SSDEEP 49152:nCbRquA/m2yL5zTfFiV+XenmE3/znAQgAT76sQuE:woquVjnmbqGsQr
- TLSH T115D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 5dd82fda6e79654179054e94d61c2f41b85a1317398e92dbaff04d5dd47f4530
- MD5 9614f4b5c92017fc5bc3a871f8ee7dc8
- SHA1 e582cfa60289608fc795da3933317ef473c54fea
- SHA512 a090315170688e8481cd03d1ddd4eeefd24dd797a5a6574e7f3e50d71aef2314174da8ce028db47d06f73dffdaa72809b5095b7abc1c4514cb70a55588fe4c80
- SSDEEP 24576:aAhGL3IFoiwtA5l7S53iAfYLH8AcevDN0FImbwQuq3Wia7gD:aAMUFoiq5SAQgAT76sQuE
- TLSH T1E1359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 9fbb6d22328c2acc12a6fa5996b4423026259f1fa02170c4fe5b2e013599eecc
- MD5 5f93c97b1da8e860f496c90e29871678
- SHA1 7504e2917fb0c41e22096aae4ac3e38933466cbc
- SHA512 724c5f8be2afa63f35f62e5d3eae78ccf8e8b705fbf2d7729de666e04b51b303e1420ca04955b6d97a15adabc01b1bdbaf5aa34cee82c0cb8701b2ed11514da7
- SSDEEP 24576:Pwu4OWbAfYLH8AcevDN0FImbwQuq3Wia7gD:PwvOGAQgAT76sQuE
- TLSH T16765F14676A81CF9E9A7813985A7C136F7F2BC152A21D71F0360C75B6F37221AD2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 738f20aea6431714ff9fadfabf5a71c3b607530ca51964ed0a07ae7600ab2a06
- MD5 52ff3ebbcc13062288ad6cdb88c0a07c
- SHA1 c6e696d20bb5bbc3c696c1a686a35c043ac6bbc6
- SHA512 49bc5791eaf01a1ceeefc53d2e0b306364231759e991dc86266b9fefacd535607592ae4a27fcfe1927431e1ab6efb75d39d2837cd8a0b3f9641b64830ab28e13
- SSDEEP 24576:cZuoAfYLH8AcevDN0FImbwQuq3Wia7gD:KAQgAT76sQuE
- TLSH T17555129B239830FAE5A7C139CCF25659E3B278A6532183CF0115079A2F37AC59D79B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 f275339974c8dbb654fa56770300673504c32169b4e4c29110a2e5ca67939ed7
- MD5 379653dca835331ac45151f21c2d6b9e
- SHA1 7ce42f0ad479266a1c7ac0ed5585ca3dd0ff5b5d
- SHA512 d5710e1539cbbeef7ca37e65e380a0e4687e31af74eb917f8345a43efc73974f44a88b442a438d9c35894c8aef9d95d75f5c3ac0f8329e76d6166d438e3bd887
- SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uu:gQRQyi36YOcPbLvw2gAf+PN3GqGsQr
- TLSH T1F7667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 660d182846c4769815fbd8a63eacd2723ceaefa5130dcedae1e302b6875b591f
- MD5 1b56bb2aeff14233c2db608386943b40
- SHA1 a2cd1f9b03d6e47852b18ddc4e140de31b89bd3b
- SHA512 a3ea91ce850a4fe3afd3dd737aaf2610bfa687f5660fd221f93fe7c7d5b6cbc8b3460d839d5d58d3f48d823f5cc7c286b5000fc94339610959ddfa48d46f0377
- SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uu:5QRQyi36YOcPbLvw2gAf+PN3GqGsQr
- TLSH T1C7667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 129f876cb9c7300c4ce001eb4067105fa97536b4989a87192fa8353b471e7899
- MD5 0a0fbd013becc196015d02a0b5038a4f
- SHA1 b941037a6e4c9edf14966e45c6b941db80907d89
- SHA512 e07dd59d00b5921ac01412f692f99d98d12ef754b9347c8e9251865dbc4581937f20a07a7fcc03927fa04b63fb7d7b96ef9a26a1ae20c8815d71b1efac5fac76
- SSDEEP 24576:MwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0YAfYLH8AcevDN0Z:y68Qg55nhceWu7PNU3/3AQgAT76sQuE
- TLSH T104B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 f695658d3b6996775a7fa206e830d7fafe0a535f63391f9aefad560f1377bb90
- MD5 e6cfb5e0aadfbd2496e0901f2a6aa7a2
- SHA1 8d40e5805b43e0e3488185b986781100f5bf0521
- SHA512 a29fe567a0afacd6d12c93b0c9c04184a39bf0adbd2ff95681a5e8a8b51967981a6930180d38a91f368983e5dcf3fdb7fb261f345b08df8285fea8f6cc899dbf
- SSDEEP 49152:F3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99k:ky5112gYy5azzVvt69nLKnhZBqGsQr
- TLSH T139167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 ca0dd7105b0a2eb38c28b4176f5a53622cf608154bef00bbbc21749bd6f8f665
- MD5 a4c4165198912c7604070ddfe6db47ad
- SHA1 416dec08e6452217c367f4433866ae68aa862de2
- SHA512 30b04a9fb00db6637d71dc9e3f01db687790b62965eaec1cbb3c3509f9f893f78dfdb4602b853608b9556a9168944f237177f6cf578c8408f6ec0e315cd1e161
- SSDEEP 49152:ZB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl1AQgAT76sQuE:Pu6Jmdxd2deqGsQr
- TLSH T1B6D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 4257eebbac2ba83f3cb0548202348b480c7501e7b2cbb47123583c20f29c8af4
- MD5 24453d7e5adde0956862b91780c19755
- SHA1 11cd9edfe6f870e79ea1b35cd9b776fd904c4f9f
- SHA512 05bfb9ec2c52f50806ea5f79cfc41f990b3c252c24a50ad910d915d21f78a26b2a92dd7d964be2bb70104f66d63bd1aac7a661cfbdf87095891b5322205d47f9
- SSDEEP 49152:71hpsNoJpF1A63U44CwH7R4xZAQgAT76sQuE:7mifPWRbqGsQr
- TLSH T1B2B5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A9077962F7BEE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 1b934d41ead577c7133ab394efc9a87317549738b3815373b4b670e95c1d3fa8
- MD5 4124f89f72d7569991fff617e91012dd
- SHA1 b831dd8ccdd150bff4178c1c511923dac2c1a883
- SHA512 a829089083b5065796006f5ca38174425389dc05e7eeb871809bca83dee786f6fe57b122288bb66db5a567f4ccd03ef6c50eb3298a8f587abb49b37f14cc14a7
- SSDEEP 49152:JSuZQIY0Be2KcRVtOnks6NMHqoAQgAT76sQuE:H5dKii61dqGsQr
- TLSH T1D0C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 5143d092c29a9d01bbc9cf77bb7706573188fcedb04067e7a262201e2fd171cc
- MD5 d637613482e1eb7ecbfd2575dd6a801a
- SHA1 1d07f7b99f63241cda131c7ddfc642652bc7909d
- SHA512 fc36d57df2860ccf6dcd38b23650ad22c3006068eb02be93f024195d3439974054be3641221b11315c8c034b5e5c9ddbd2f0102305144a969d90869dec62a1e2
- SSDEEP 49152:9htSn8EApI0fig3giDn0AP5wFAQgAT76sQuE:sX2imph/qGsQr
- TLSH T16F95BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 8a4508575abd82df766c7849907d39ccf2a7afa49a9180859eca1269f7284d89
- MD5 f0ac4598ea3c86664c3f12411f8d3adc
- SHA1 7c2573037f0d7b9f28ad0f59d42fc272a137c22b
- SHA512 5510a3176ee8d68455cf8f1ed40127604bcadeab22f64bcde56b2c94d092d0a7a0c4f823ed11aa01c56b991b81403ac0c4d806c60c501fce18f72e8e46ad7c4f
- SSDEEP 12288:L0AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:L0AfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T16C55235B594C70EFFCAAD1368CB791B8A3D07CBE9345939A110A3A8A7A3E408D1D4D74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 033351d2138981d0437126486cf74939e5b5e8077dab9d86f6c5dc587b8f7ff5
- MD5 ab4b2ab5992af5464bf77db623b44ac4
- SHA1 e2dcb22b82e15f0628437f716a2c32e44edccc93
- SHA512 56fe8e1f9ce749ead09c70d577c23011914eaee60ed4b89da41528040978e3bec9e610ed954c9242981aeb15ecc734caa5f6b9a99177a006b6525ba23e2b9ae1
- SSDEEP 12288:TDAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:TDAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T13E55235B594C30EFFCBAD1368CB791B8A3D07CBE9346939A150A3A867A3E408D1D4D74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 4b1628b796665f21677fc5425c5b8054adba8eb11e33dafbfdfdaea92b24f817
- MD5 cdc78daafac32909be72b9f074d29faa
- SHA1 4f26d28899979ea014b91b43e1e4b5a4e6f8acf2
- SHA512 d10ca022ed5bece76f94b2ef1385caa6271f3c0189f82797ea60afcd8e624485f0dbbe49eab84c687192f9ecd89d13d0621468cf82d2aec984c8245c8ceda067
- SSDEEP 12288:sRAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:sRAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T1AB55235B594C30EFFCBAD1368CB791B8A3D07CBE9346939A150A3A897A3E408D1D4D74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 4a19bda8c3085b3be9be540b155bb5957d9ee6c9d04cf772254b54eb29563fb0
- MD5 4560411a253cc6fb4bdcafb6b22c0fd7
- SHA1 f5daa73b537ef1dbc190d1c1b30db38dfe8a2601
- SHA512 71e73315cd7a8ca48906d054ad5129f0c874e87999ef5f604eeef1288198e71db45b85f742e60ad1c4b1e70511f2bb31c8ad23ab18186d36660470915bf8a746
- SSDEEP 12288:LVCAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:YAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T165552357169C20EAECB7D135CCB79179E3E1BCB9931293DF46011A8A2E3A248D1F4E74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 716d054eaf8cd22a0cba24a196c7dab14e88ad08d42d9aded0fd8e50acc201b2
- MD5 0a2414a60b504050e40ed0c1435f69a2
- SHA1 c26d29200179f6c92f7c99eb592fd85d17259fd0
- SHA512 729d7bb076ebde64cdfb4806616c4c64b697c6fcb3a1ec09a5b06b8be4384c089e2a7af5f3a638786261ae8f7eee7c7fa25629c58a20bc3737bbd3e335cad2bd
- SSDEEP 12288:MqAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:MqAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T10455235B594C30EFFCBAC1368CB791B8A3D07CBE9346939A150A3A897A3E408D1D4D74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 e6ec62f2363f93e078ecb3606d4907b34d16babd301ecc4c02e3cf77323380eb
- MD5 37c361adfaa83ed5a124bfa5153bfd40
- SHA1 2572e51afcbe00b7affd680837a5284e721a4cea
- SHA512 9a84156774ff2e6d9e7203429c92f286a11f2f99d9fc15ff8401aa96a83895bb2f9dd5497071f9ecfa67b852fcf3b1e0381ba3b31278184e74cfcbf7124dfce7
- SSDEEP 12288:4/AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:4/AfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T14855235B594C30EFFCBAD1368CB791B8A3D07CBE9345939A150A3A867A3E408D1D4D74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 cdc1f1c71fb0b64d71318ef70acf1599e84f0076adc96922068dadb1d7a088ba
- MD5 8197df6dd2eca2dec8bc9160bff6e1ee
- SHA1 2b27b1e54c7b5c195753af2120f39406b23e4290
- SHA512 e8ffcc262f1a8b5a64adfa2927ce969fe56691ffc4354eff61c158b7197045d0f5a50ad8177512b876c859974732533e38d432168e6d97cf86b08bc983e81ed3
- SSDEEP 12288:9LAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:9LAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T14555235B594C30EFFCBAC1368CB791B8A3D07CBED345939A150A2A8A7A3E418D1D4D74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 a38ceb0c501159be73bf0e226ed862c28189264fe0e6c30168fb1ef84ba04b37
- MD5 972aec6ae51bfbe86bb711df83b0dada
- SHA1 468f7f1519b9ac744b700cfe6404efc58288b6ae
- SHA512 6a77fba0329a644de2950b8707501851943252e9a0809cb257604b3a337511c8fe690c9f0c54a1fd5e9b0bc5ee5b6fa6b70a8fb78df3b414a7fc254b1491b06a
- SSDEEP 24576:UZMRzFVSOjAfYLH8AcevDN0FImbwQuq3Wia7gD:UZMRzfPAQgAT76sQuE
- TLSH T15A750195B39018F8EC67813ECC668916D2B27C6A0760C65F03A4366B6F373A15C2DFA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 ea970ea6b33f76fc2f5380c7ec6825f74ae424fb480ab8aa8651581bfdec37ff
- MD5 9b2d51ddd14f8cd02598705827975871
- SHA1 f49caa7ebc5dfa835e85b5bf84e898a27fc6ce2c
- SHA512 f3afbe55fd3c9274e031cdd87108c0c8aff108ad565887fbcd06648b4d4c06b3db602d1a3c75bc34675949e96aaf96cdd18cdc1da8302e6a480ce05a3ed7e6cd
- SSDEEP 12288:/4AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:/4AfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T18955235B554C30EFFCBAC1368CB791B8A3D47CBE9346939A150E2A897A3E408D1D8D74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 e7e12ccc618e7c26b07e7be3ce4d083fcaebc7b928c1e4be6f35f916f5c3de72
- MD5 36b9c82cedf15ef6a9aea89911bbdaaf
- SHA1 7fce2c786630c7841ae6d974132f44fe16007ed4
- SHA512 ddc088bb538e7ee04670cca8e0725efb42f4f61f28be4a324d33f2c18c49e4d15f54ae4cc763471b0bc590281ab962331cb3e11cdf3f33d2e5bc704dda6d3b19
- SSDEEP 12288:MMAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:MMAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T1F055235B554C30EFFCBAC1368CB791B8A3D47CBE9346939A150A2B8A7A3E408D1D4D74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 8997eddd4a55d7e5efa8d97289921c404e57022ac261dd4f02a57840db9b00b4
- MD5 416684b6c7a1c0f2fd2711b618c0011f
- SHA1 ef1d3ce53d7a528e2be8e217756c1a799eeda0a6
- SHA512 a822cc2278a0606bdb056a43d09118c26e782e034a777e23980b3e7202d384f6f50b867881745e12c3655aa84d45a873c7305afbcb77064e9b1bf5848b3c5f80
- SSDEEP 24576:WzyXAfYLH8AcevDN0FImbwQuq3Wia7gD:WmAQgAT76sQuE
- TLSH T1AE65015763A530F9E477C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 cfa15acaf67eee84c183c498b30cb43724cb74f22a49341110aff7b9b328d63a
- MD5 b0843e7c0598068f1f1e76b9955134d4
- SHA1 7790ec70d06f7f0641d3d8f87ffb3ae35c3f0e6b
- SHA512 83a09d8f36b9cc853ddedb205e622f2cb6cf8522c7fcc44a33d928b6f329741e0d30ecc414d2066470b3dd5afc6538c626c7142fa730c83f54fc7ad5f8467416
- SSDEEP 12288:b4AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:b4AfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T1FC55235B594C30EFFCBAC1368CB791B8A3D47CBE9346939A150A2B897A3E408D1D4D74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 57645334799ffe3a0a97f14ef0a3dc711bed261a2a747294de345e73dbdb01d2
- MD5 81d43e6c184932ba7b1ac4832c44fe2b
- SHA1 af37dd9622584363017d59a5923d1c36a1874d92
- SHA512 dfdbe7416c35a381c25644a069897d852bab255c47a77839b71917088aed38a8f8059cfda9fd65ed2a44db42b7a8232c922a7fe9b02dc3aa4724e6f7bc973775
- SSDEEP 12288:T4AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:T4AfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T10B55235B594C30EFFCBAC1368CB791B8A3D47CBE9346939A150A2A897A3E408D1D4D74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 a371ec11b9f02265e7d95864db22814d1eeef799c2addb8db231ac480595ddab
- MD5 7c899be51dcff2cf2fbd4dac56df250c
- SHA1 ef76a19f3a4f10e9f9b2185f5392e0d70fd7b220
- SHA512 e72fb1708b7ab213833e140118aa60effd71daf258c2a252c6f29fff51f3fde7f868c23a9a884979b7f846d5121c923e10e563d095cbd4e168060ea52b67d597
- SSDEEP 24576:CcP4mcvIjkGOxhKP2l71SNKbrh/8KBAAfYLH8AcevDN0FImbwQuq3Wia7gD:tP4m4IpOO67N8KeAQgAT76sQuE
- TLSH T1D265AE2DABDC0096D0BB913885668A49FAB1742A1F3286CB1160933D7F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 c7b0f0039da236aa5082083c72901faeda7b18e4615d545216513b192f8c956a
- MD5 56f61f5c62255224cb37584c39390283
- SHA1 b377dbe8f2b39472a0554aa9670ed672a8fd7a39
- SHA512 fc75238af4c080da0f7de03dd0ed48e42abf479f880f826b5f938554acbd70be07903ec9ca63a54a9b28f9bff4a7cdd8c94a55b0b870c60dfabf00c65dae8e69
- SSDEEP 12288:vbsfoAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:CoAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T1AA65011AD29811E9D4AEA135CB664650F3737C6983E1D3CB12C0F57E2F3A6809DE9B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\WinRAR.lnk
- Size 1KB
- SHA256 49787353097f406e4a07b1d4d2a81670769c98fd058a007c8e1042e5ebc7b1f3
- MD5 cae9ea3e0baf5007f95b9160aa3cc404
- SHA1 e5e4655d2e6d4499c6abf005c47a1968e38e42a6
- SHA512 af559be9baed92b194c328facfbc9735938fc2240340a35c1b65b6d400b5e2eac2586a10291373292d03a5bcd9bfe98d0e32041ca4a939275ccebc0b99b060a5
- TLSH T1A611FC129ED51B21D7F69E7082F77321C6753C6ADF996F0E400081842471E119E75F6F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 72c2eb0fee0e3cb0d2e1e7fa31ac7e323fb6bfbccfdfaa6c0a946b55c6da8e93
- MD5 aed14ad89f80e1e1c5549d20ac1ed502
- SHA1 d44253fdbf3b6fe472ab21b535f5dcf647f58b2f
- SHA512 b081795908eb60eb4a53bd7622ed355bd40ec319d08f2ebe8fc4bdf738db979526aec99ddff4e4f6d495a3d40a4b180cfad0b3deef195b92191b0ddb1cf408ac
- SSDEEP 12288:yIAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:yIAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T19D55231B878C74EBFCBBD1314877917863997DBC8B44C29B640A278A793D848D4E4E29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 c03e6493aee4fae989fcec93b89f9008c96f734b263e6dc185859312c999b8be
- MD5 9c899fec5afd8b10f00a588f3a2524ca
- SHA1 796848554ba5a1943177670f30fca7f694009457
- SHA512 13c50287307662869d594bf3ba39491f3ca07d327889e538962cf164caf21a5b4404381a76d64a9ef08b4feb299fc1bda12dc5dc27b8894c1850bfdb83bce50c
- SSDEEP 49152:Ra0h2GEkuAe73q3pp46zwwQqAQgAT76sQuE:Ra0hNYG4JwUqGsQr
- TLSH T116859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 12632a8c6062112afe647711b6361b3d339f404b890b949c8396260e743c29ab
- MD5 18f4bf88870dbe8ba5fe97c4f7655a6b
- SHA1 369e1380df27470aa7b9ef7cb2b7a7144bf77a87
- SHA512 13a32cc5fa66511af05bdd700076a256cd4edf17a5adb8acc826032bd8bf611b2193d22c22d502bdb2a9ccf16e500bbc15e554a6af8684337d0fbde3fddd916f
- SSDEEP 24576:mhbHjPzAfYLH8AcevDN0FImbwQuq3Wia7gD:mhbHjLAQgAT76sQuE
- TLSH T10B55127E16AC20D9F5B6E13D89A2854AD371BC79130193EF128282BE1F3BAD85C74F51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 02fa29464a324c242314a8c4d1f99ee146f12a686359830f28bd65cf68a9c7d8
- MD5 3c855f1a597abb71da22c484c2b2946b
- SHA1 4a019077296ec7634782f10f335757b1900096e2
- SHA512 0ae4ae1e3dad9e912115d5e62a039da3bf2f734ea1c08a1b9e401859e9e69b0a8b440b4d3ebdcd961f029505e886893c89f3153651f89f86f6d27adf7d384b25
- SSDEEP 24576:Z3YgnJcRTk4yti+R5dpR/bAfYLH8AcevDN0FImbwQuq3Wia7gD:ZIgnaTk46ppR/bAQgAT76sQuE
- TLSH T1F545BF2EF2B910F9D8AAD136450147B5FB71782D1F209ACB0170C538AF1AEE89E35F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 682be1efb316670efbba0a699b59c2b2e068b9ca4337e900824c96885dd51398
- MD5 38368045a26cc2605dc121a3f0e2f7a0
- SHA1 24a455884b5d99221ec55b5cceade905da2d2a88
- SHA512 4c32a9d4532d191b22ba81ed721bb7e9f3db6dbf1c5cc35c1d73d6ad3f70367bf9ecbc5f41ada932ecc2925109524efd5e1f5ada11a82c4e7845e5f8fdac1a50
- SSDEEP 12288:EcAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:EcAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T11355235B464C74EFECBAD1368CB791B863C07DB8830653DB144A3A8A7A3E499D1F4D20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.6MB
- SHA256 a8a326382f1b4354c756601b7f5dbd3d74277e079804c9b7ead87932f826367a
- MD5 76c4b8ae1bc97cf94a89a6df33b49241
- SHA1 ca1ebb7d0ca2cb3eee213b07a30fdbd84ce0e7a1
- SHA512 a5aef365a88116b387ee03bf1a1988a14554a9c58b23ce66f31f000673e47921acc52e15b3dd91e9e36614b4ac66870d4c9b8658d43f6b41dd9e6fe6fffd763e
- SSDEEP 24576:ibL3UTFAfYLH8AcevDN0FImbwQuq3Wia7gD:ibL3U5AQgAT76sQuE
- TLSH T17275F155E79410F9E87BD13CC9B28526E2B278AD0354E7DF03A84B551F236E58E3EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 434bfcefd4ca7ae87053d6a73052ae246029610fce72804ebe2df53a9ec22308
- MD5 e1060f51ad37f09041018c11b5785cab
- SHA1 2eae746d52b281630d928a45a9b47bd0c3130893
- SHA512 9f622b0d202d95f04c4babc94dda1763238ea6ec3ee29595afd61ebfcf982b9349befe715f69c640e2f8232c69cecbcd58a3c5b7efedf961273e2bde55320efd
- SSDEEP 12288:ipFtIOZAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:5OZAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T13355021A36DC20E9E47AE13D89A3825DD3B1B875071253EF029041BE1F77EE89C79E61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 97640022b26e04ff6304be68d56186aa04842f0d9fde6a3e0f893dba4e6e458b
- MD5 2b40c114401698d2d215a17d59694014
- SHA1 10adbc9a584b2d459cafdb08eb006c7dcbf3445f
- SHA512 6438c92987801129b84729fc8044790c8264bcea5d1d315595e720d66226be74b139910be300931b846bb97b103e9932cdfa1b6fdf357773a32ad0f76403c429
- SSDEEP 24576:g7NM9YmZqmWMUkPjZM48Mv6bEhs4AfYLH8AcevDN0FImbwQuq3Wia7gD:g7cBWMpPjN8DbEhTAQgAT76sQuE
- TLSH T11C659E2E6BAC81E5D477D13DC9A28245F6F2B4611B318ACB1152833E7F37AE44E35B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 e20a7811b453d101c14781fda695b2de9e9396575b6a1d1b720a96629a65979d
- MD5 8a6779adda706792e93161a17f1e5bfc
- SHA1 3aa66eb40aa18973b63b289b237c8dfd7917e9e5
- SHA512 cbb6f88f5db5f07b60f74f836331748712aeea608e85b1dcf44208c69df3015543949e463c23323c97dec352f30e187a77ea3eff34e7a1e9c1accb2c52c848e2
- SSDEEP 24576:NW6BApg2YuyuNDYTabvcRvNYf8km1WAfYLH8AcevDN0FImbwQuq3Wia7gD:NF2YuHNETovcvNYf8kmYAQgAT76sQuE
- TLSH T10A857E2A27ED80A4E0BBD27D45B7D146FAB2B8551B3056CF0255862E1F33AF44D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 0991ace5e8e450c9030c20afff10a6c35a937eeaca7b88434a4d3147c38d53d1
- MD5 75b496a990a8c2fcc843bb9c9df3d6a5
- SHA1 fdc18dd2ce05c14e54af3c5dfea0dfee2fd917ff
- SHA512 2e6ad9ccfa292b21c15b7c50e070ea8a74a5bf26f6f3051d3ce5fa0aac8fd7eaf52fb43828f2dd7fb8829aef2c1cb869bb882be81a68e6fd6c9532c9f939d582
- SSDEEP 24576:gAFs06+OmlfkNXEbTodAfYLH8AcevDN0FImbwQuq3Wia7gD:1Fs060lwXuKAQgAT76sQuE
- TLSH T16B65BF2F62AC00D5D07ED17E8997C91AF3B1746703255ACB0260867E7F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 08c6235123e1c9ab27102f1acf9f21c805ba009160ed6b789027a63fd32af030
- MD5 8c3e4feec533da602644de1b3c4c2d55
- SHA1 4da335d6dbe6f7467fc997b0a736b5cceb12f8bd
- SHA512 66822b6c6bbef1897a5b6c793a5682cc0ba2b4f250d9d4197fb6f0e7506e7e2acd930fa853be43d199c551e24da9eb1c3039dbaf09fc909c70fbde9e828d1203
- SSDEEP 24576:oJnJ5D3WtKAfYLH8AcevDN0FImbwQuq3Wia7gD:oJnJ5DGtKAQgAT76sQuE
- TLSH T15675D02DD2A810F8E4B7C274815A1795FFB2387D2B226AC724B4D5353F22EE09979F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 0054c8a50f3d26ba630070f2aed4f1324fa6f132cee683bde6386560374ae219
- MD5 9305eb8a5e45868199ab173bc30ece91
- SHA1 ba7db1eb5c25d17a67421a30cdc0e7cd5b596f5d
- SHA512 d4f4c4466da0b3aa43ae2e97418e4fe6e26984d1fefc6c28596aaaf118e1f6a0e3f4f416e064b85c8c79e730947db001a9bba1cda4dcd9ac824eae2e2b114b80
- SSDEEP 49152:Bo06DIKdwc+eQnSt65aV0AQgAT76sQuE:WvqGsQr
- TLSH T1A2956C16B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D934B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 730964cd493c34ed3483d5fbe0ec853798deed3cf7a33293beab6c8dff15cf3f
- MD5 3ea6530d5842e49417bd1f5c610588fc
- SHA1 4b6a5b59aae21419f0e57f87db8ef7041bd2a917
- SHA512 b4e0eaff896efe619c30c19959d91a154aadb14e2c437820a79f3c2ec6d88aee46d388a226aea0f1f7c1d70285a36e9884bc063e5c4ab6f744848be7430ae6ff
- SSDEEP 12288:9EP3RruAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:eruAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T12355126E279C70EAE47AD03D88A28259D3B2F474570263EF1191827E5F3B9E95D38F10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.4MB
- SHA256 1550e31ca76377717f5f53c04b717568d3d89a01fdd552149581059c632615e5
- MD5 fa9e3d0b14f7320959ce3a11a0712fdb
- SHA1 114ad56db689a1373f1da01400f3b3d91e6757cf
- SHA512 caaedb7fd3b87c054f7adabc5fbe55d3424b352c3b9b04c2b2acc0efca2640ecd5bc2506289ed892148489489935185bea5bddf29b625ae67d6501bc162978d2
- SSDEEP 24576:sIyDAfYLH8AcevDN0FImbwQuq3Wia7gD:sI6AQgAT76sQuE
- TLSH T10865120A539C60D9E9BA82398D7381B49B71BC345B1193DF5081B73E7F3AAD4A874F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 e2d382d2a0c44c7765fc6d97cfe9ecf4958d0ece9e18d0033f58c96fcb9e2285
- MD5 d3f4c19ec48ad595a314de389297be76
- SHA1 a2c8a8f02856d16e51f4014df279ff9459153a61
- SHA512 b578047e23b07bd5f1e59cbacf565d5757ed643af18ee391e6925ed6b359e40e5ef4dd5ea41c15f950175e6912eaf26e41479411541ccb64603bce3d6fe96026
- SSDEEP 12288:nFpAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:FpAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T1CA55235F125C30EEFCBAC135887796B8A3E07CB8530562EF108576B9AE3E48991F4D64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 d92c13c12dc6483681766c04bb6d2a97972d4f3442dbf04a7031667ac5021fbe
- MD5 ab0784e6ddb355bdcf8244a96d2f2ccc
- SHA1 154819b769a26c50ff807661fb4753f3539f3686
- SHA512 199e51670bcdb144363019c8511cc825f4c25d70a72310f007a7e9d500750520087ef0646e3d16f3fe2e2a790d259fdbef749f98e4782cc861df5902a6916d22
- SSDEEP 24576:BQ9MxZKdcz97w3wAfYLH8AcevDN0FImbwQuq3Wia7gD:BVKXwAQgAT76sQuE
- TLSH T1C3558C2DABE9059AE177D23994B250C3A673B4311B31D6CF2448D03D4D7BEE8AA74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 2663733ced9389ee809e43dced0bfbb82851ca881d1be47166285b9e56927125
- MD5 e87a3f590256b43c424c99f9b5254e52
- SHA1 987d20910f06a2f3c2e200ffffbfb9799f6540b3
- SHA512 b0e65da4877a66d83eb4bb98abcf761f33dd3c4eb620a39394be8ade576f3dfc3b2fd5b7616186629222fa43d8d8ebd71a9a1a4d4640b5643499768aef00c472
- SSDEEP 24576:uyocxApHAfYLH8AcevDN0FImbwQuq3Wia7gD:zocxApHAQgAT76sQuE
- TLSH T10665EF1FBB6D40E2E076C13C89968255E7B3B0745B5253CB6581833E8E37AE9BD38B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 73bdcc704fedbcac546a335614c1ae9ee87bad5fc1cfe3898232a5b628418a8a
- MD5 5766956c34f6a33813faec494935bd2f
- SHA1 6d2d1b9e11f731b14f7f18824509ba28117f8fda
- SHA512 5e7821d1116d61359bec6aac1e578533cb9fd91e9644ebdaecd375409c22df5366baf2824d397c71b6401ec64b858e8637cffb176adee8e575b3dbc78eca8835
- SSDEEP 49152:wWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKHAQgAT76sQuE:i0zuNIwqGsQr
- TLSH T179A57C3DA2BC00A9D8AAC375C54613A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 113c1f68400ddc45999f7cc445f8c82395a3f08a3845c19dadfd620561da6496
- MD5 0a77f7375d67e93a4f66002dfd628820
- SHA1 c989b5564014c1b7ad209956bb9be8a49e8e45e7
- SHA512 2e78239890debc90b2f6391c533f62905ce126bfecbf580e5513c86aaf28318ae5785c5ee0bcc787f16795de855e49915d3bb7ea3dc393eb0fb809e4e37ea87a
- SSDEEP 24576:51QT7EcpfxR+N5AWAz3ooiYujMqbuAfYLH8AcevDN0FImbwQuq3Wia7gD:sTDxR+N5YzT4jM5AQgAT76sQuE
- TLSH T11B55B02EA7F815E9D1BEC5799A23C512FA727821033193CB42A0C17E1E7B5D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 f1c210e91a2247716a81d0f46c43ed7ff6d675ceb58ca8d7a3e97223575bbb9b
- MD5 16cfc3d31ab25c0ea8401760d4cf8f45
- SHA1 20ffd84df17e21d06e009224252f04e23acb2659
- SHA512 fd6c80b1853380b16c428a06d0ffe116cdd08fe4f883d5dabd080b839145c1f64d76cec653cbaa49fa725fd2dd71d1ea902b515fa202074ba658bee016a76155
- SSDEEP 24576:YTMdOz0FFS+bmSLCAfYLH8AcevDN0FImbwQuq3Wia7gD:w0K+bmSLCAQgAT76sQuE
- TLSH T14575F13EA36D14E5E47BC17CDA538906E67238750322A6DB0690C1B93F6BEE47979F00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.3MB
- SHA256 40738eff69a1bd9edd04b9cb54445f27b8b63fb5b86838917330ed2079c9ecc2
- MD5 c679f13fb75c3b6baae6013354e2ed7f
- SHA1 d641faf8bc6de8de99f0cfc0ce5acb50bc435fd8
- SHA512 b4e289a42d61d4ae0f9c5093f6d2c366c642e0d906d014857c5b5977217558a0af148577b89e716d29702803593794f56337d4dcb3e32c52d018a8facd1708e2
- SSDEEP 12288:147FAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:QFAfYLH8AcevDN0FImbwQuq3Wia7gD
- TLSH T18B55121E13DC30E9F8B6D2358A77416592B0BC79130152FF24C19ABA6F3A9D8D5B8F21
- MD5 SHA1 SHA512 SSDEEP TLSH