Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 12:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe
- Size 3.1MB
- Sample260809-plndlsxfnb
- SHA256 8e8e1d281517105488449e81131c6bb7f10b4ef933aa50103098327e697d26ae
- MD5 d62498585659a4c9ce5c7c1a04056dc6
- SHA1 d5a758a03245d02f529da991b5ad5475884995b8
- SHA512 b73d6ffa8c359ef4793fb1f0d32f0d45379d53e17c4ee78845dbf88cd8750d1a8dbac417459af8669ce36f87973669165a533ed36e66aee3e5e28122e1d04922
- SSDEEP 49152:PqA4DtJKW5fcUKW1wgEAXsruxFTLvIY45wsBr/5ZomGzNQeyUHBdH3hsB+kn3Hnx:PX5WmdFBrGKe9BpRw+k
- TLSH T1E3E5CF5967F840E4E1BBD634C9668646E6B17C122F31CB9F1161AA8E1F337E18D39322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 412 alg.exe 4964 DiagnosticsHub.StandardCollector.Service.exe 1320 fxssvc.exe 3376 elevation_service.exe 3024 elevation_service.exe 2864 maintenanceservice.exe 3804 msdtc.exe 3716 OSE.EXE 2424 PerceptionSimulationService.exe 4368 perfhost.exe 3520 locator.exe 2600 SensorDataService.exe 4760 snmptrap.exe 2236 spectrum.exe 4944 ssh-agent.exe 704 TieringEngineService.exe 900 AgentService.exe 1036 vds.exe 4680 vssvc.exe 4112 wbengine.exe 1032 WmiApSrv.exe 3888 SearchIndexer.exe - Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\System32\vds.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\locator.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\7cfa0410f77cf242.bin alg.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\javaws.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\javaws.exe alg.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0d6062bfa27dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7663a2cfa27dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001451462cfa27dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000950d402bfa27dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive" 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,1" 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0" 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive" 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR recovery volume" 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rev 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0" 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Token: SeAuditPrivilege 1320 fxssvc.exe Token: SeRestorePrivilege 704 TieringEngineService.exe Token: SeManageVolumePrivilege 704 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 900 AgentService.exe Token: SeBackupPrivilege 4680 vssvc.exe Token: SeRestorePrivilege 4680 vssvc.exe Token: SeAuditPrivilege 4680 vssvc.exe Token: SeBackupPrivilege 4112 wbengine.exe Token: SeRestorePrivilege 4112 wbengine.exe Token: SeSecurityPrivilege 4112 wbengine.exe Token: 33 3888 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3888 SearchIndexer.exe Token: SeDebugPrivilege 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Token: SeDebugPrivilege 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Token: SeDebugPrivilege 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Token: SeDebugPrivilege 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Token: SeDebugPrivilege 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe Token: SeDebugPrivilege 412 alg.exe Token: SeDebugPrivilege 412 alg.exe Token: SeDebugPrivilege 412 alg.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe 4108 2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3888 wrote to memory of 3144 3888 SearchIndexer.exe 111 PID 3888 wrote to memory of 1040 3888 SearchIndexer.exe 112 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4108
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:412
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:4964
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3848
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1320
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3376
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3024
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2864
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3804
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3716
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2424
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:4368
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:3520
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2600
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:4760
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2236
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4944
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:704
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4036
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:900
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:1036
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4680
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4112
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:1032
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3144
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:1040
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 f9d16138a83b6a169f1719c9ecfec9bce1b6271dfd99be7446c156bda713bd8d
- MD5 21d21b5978ff6b0b2ea6958ee7ac8640
- SHA1 c44609b419ba88732037ce54317b96391a6d0b6e
- SHA512 2c46d52b389e45a2e4bd67c14602f4b3c9f718443402e49fdd5783d02fbde75283ee42dd13111925a31116eae1117b842b5affdb4ac93b230919a7239b9ca206
- SSDEEP 49152:Ob+632BuPkFKRrdE6ohvstBhuXjfS4LWxntB+kn3Hnx:Q3q6sjBk+k
- TLSH T17ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 0db0fe6e5dc20c67cb623b5ceb7b927c7d331948a8d97f570fa81bc80f7bff13
- MD5 254fd2a44328e1701d41bd2bdb31104b
- SHA1 4c53d00d5416ee094a86390614cac24e5451f5f1
- SHA512 d5644346bcc2454b3e6d0c754f3a652ab5f494ef90de12a3cccaba57ac7905024bbf0c10835ebc2e1aabe5d4216b09ee36d36a294c815dd24b2d1173ee790eed
- SSDEEP 12288:41XLsswWkxy2lRq2czAULDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:+XYfDtczALNyBo4kx929bL3Hnx
- TLSH T1D665012967D409F9ED6B9278C8A2C511DA33BC4547A0E7CB03A489761F337D85E3EB42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.7MB
- SHA256 7a0c804850ee154abeb4c6f32a90edd15df0a45120aa79fa52a0336efdc83d24
- MD5 2dc81854ff90cd0f28928a590e984c48
- SHA1 0ba30b848ca5dcd17a420e889aa7e186ffdf1f73
- SHA512 45b24d698ecaa2d425b8d0c7372d3e5f2720d045757b2c7709af0901a71753c067098b32a6b940ba4b3852ce788eae1635973dfeb561913dad053384cd5cc508
- SSDEEP 12288:1XZNYVLeyUji0h90ZD0wxpGZIVuArHsRLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:b0Le5ji0hmxfrMuNyBo4kx929bL3Hnx
- TLSH T1EE859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 4936fc88fda4dc74763f23d26a49ae5053ea1e1a351861790e4fa01484dd4ba6
- MD5 90eb1a39cbf3afca6ce2b753edce61e9
- SHA1 668b78589c0c028174005b83331b987ccc9fffc1
- SHA512 49a2a3565d60d4078aada149b089af550353db3efc653db42f117f6850debb76c1a654ef1fe449cff6cceee449216d2557ff157c6cecbd9ed739fa160b3f9bbc
- SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWn6q8wyugNyBo4kx929bL3Hnx:h/ezSC6vUzPveHjyqB+kn3Hnx
- TLSH T1BC755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 ffb3c5a93a1aa729d7e9966e918450d5c1efd3ccaff2f85180227eb517344676
- MD5 ab0b7a98c8fd225d72e91565c1b7d3c1
- SHA1 f153f53873ccbf79796a72ebecab0b3a128a0036
- SHA512 b9ba01007766d23c14489307c0472ea15eceaefc77c9687b7e4da53bde840c1bab58628b68528e72815eed0b3944ae3fbb749cde9b05a8853d17c7847efcc919
- SSDEEP 12288:lVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im984LDAptNyvUgXZ32dT4ePc7N29CD:lVbqPb88hv/l+YnNyBo4kx929bL3Hnx
- TLSH T14B559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 8e09e9c5eb210c254083f772045b578594646d4e904af48a894090a419735084
- MD5 bc236aee33f03a926adba48d6f8ded97
- SHA1 64ee345279dc2613da0a5e02dc24a2024f4c92f9
- SHA512 870098a790e5b06060a2d4bfc4cb3fa6e9b66da711b955c39859464879b5d9c28af91a39462225c0e892188419275f56fcea4b1107aa109120f2db772a810418
- SSDEEP 12288:Xm1LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:XmqNyBo4kx929bL3Hnx
- TLSH T1F24523134B0C627AFBBD3E70759E8454CC35BC890D95DB94DF62ACBB58BC9A2DA21103
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.4MB
- SHA256 ad23d67b3a6c731372e46d090b7e17dfc14ab4aab8e749bc691dc33071ac24ae
- MD5 baf5781b53feabb8a205aada50865901
- SHA1 c9a576f5e52bd423f2b5fff99e73eb8d317dde6f
- SHA512 1931c72e4e2b1f9a3fcac2c0cfaec01f8d93be8f33b39d70862d472038a97a8baf509ab1c9bfe0a65a089ef8b03dbeeddbe2e0fd57d8b51a1fa0ee79a949036a
- SSDEEP 12288:LeBNUbTVO86UwLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:LJIUPNyBo4kx929bL3Hnx
- TLSH T1C365CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 52bcc3464bff46c347f54045f236e8c57b00430c852e20fd3b345438e4334230
- MD5 096e3d22fcbb320ca4d090c576e17c10
- SHA1 e0b1d1b67fd4360be74794d77748eafc2e6d3859
- SHA512 f9d7e0663f157c4b9744c4b97c157553a533c983df17237340232184623749ef74d77d7fd226c74390890960b957cc527af3c7737f088e5e9714a9659b61edba
- SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THa:kQvGAdlCEL8c/DRNw5CF+k
- TLSH T12C266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.5MB
- SHA256 ca290fec7a5ec02691f7b20e9bf197e4f9b9e4de4d23b67ccec8bb3648a5e564
- MD5 46a7ddf6a2f9f8091795f686913e1f3e
- SHA1 97a119bca386862ace38019bbc58b2bcba439523
- SHA512 90ef84e4976a7fa3d50e285c03699bbebf8af2d2706dab4f8790c66dbf0f4df026002ac9f9ed74cd374ef4253fc769e3560535231cf3fde56c4bb898d0f150c0
- SSDEEP 12288:fAwSfxL/2Dc3XDLLmt0LDQewsAjyLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:oOewsAjZNyBo4kx929bL3Hnx
- TLSH T11475E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 bf3f1d25d32391a34b8435754220e76792a821e645ac8c7e87d89aac5f633cca
- MD5 161a0fcc51b30c0583b6a7a86e698795
- SHA1 5acd28705052133e1d1f7320697b01c67e3d98ed
- SHA512 8ad907f30a4f1720b6cfe86e07d731022fd80af1160698f0b15f61be6667a599357bdda8828b0b8b461c1ff92997b9ad65f138990c00e797614109d6615a78f3
- SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHW+k:tUEtQevvqc2W1cpV2tI32W
- TLSH T1C3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 46d17bddfecbed5c2faf5f772226f8a7694f38c291d08da39247cb40cc5fbc67
- MD5 1475db45e5a0cfe37a851dd0e5d662ce
- SHA1 b3f29d5ed1e90ac8436f286d5e20ed1b53cc9dc7
- SHA512 d3c2ae1cad7a3aa2b16b441e08f9e5c2e2abd9e8ccff5bb7d1bd7b35cb396a236cfd9eeb841a60df80503d61b146b2d432a7c0850846e6dd6f313b8ed1ec58fd
- SSDEEP 49152:dCbRquA/m2yL5zTfFiV+XenmE3/z+B+kn3Hnx:aoquVjnm5+k
- TLSH T194D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 83a3d8a0c3978a8eb5aaad4f480a3e5f926756163a64083f6f49f94df722c94e
- MD5 76f405f634b76cca6577a4ff9a4c34d9
- SHA1 c15eda454ad99cc7ce8e66ba0b5535e74cb45426
- SHA512 68508355fb3219316c5e2050f8bb370603a5f4761ddff24b1e12b905ec4479e4238c55c08f98fb4e23b947642f243cbf0a22a8f84b59bcf1bdfb86d432ba1837
- SSDEEP 24576:qAhGL3IFoiwtA5l7S530NyBo4kx929bL3Hnx:qAMUFoiq5/B+kn3Hnx
- TLSH T18235AE81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.4MB
- SHA256 4cca345f6ba8279ade71a3599df5b2c768374df34d7ad02af6fe10d5412c7997
- MD5 1c39bf561e380ca78560b62320ae4776
- SHA1 3892c2d432ed1ade810e1a5bc0103fbc51b5961e
- SHA512 26837684c0983a4daaf2ed6370215b31ffe331a5052368edf2f244e7f898aaf315d9a3de955373f641539ee092f64555d3d1c9ce148a10faf60ac6840de8fbd3
- SSDEEP 12288:2mw5HEjsChNzBFgl0WDm+CTLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:vwu6OWtNyBo4kx929bL3Hnx
- TLSH T13B65F10677A81CF9F96756388587C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 88410ba968ca9f43065dbcc9f01d8eb3abf8cb15fd41b315a7da14cfeeb3a7fd
- MD5 42f49021ad14a042af457069ed3b2259
- SHA1 9bb4490161487a101c78662e3de4fbc252fcb56f
- SHA512 83f4e61bfd1afed8834f63bc9a761658bc303c5c25163e8b8b9ada76bffe9befe8c0b026c2a112bd380352b92d7f78c9b9e10481873633cb8339e1a40d1a14cd
- SSDEEP 12288:VgZ1IyCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:+Zu2NyBo4kx929bL3Hnx
- TLSH T1CF551216239831F9F2AB2678D8E58505CB32BC461B7183CF5A2146BA1F7BED25E35313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 1ec51a6771f181c652ab3df5c041ee97cf4462b7dae5ad00fe36a013e6656d4e
- MD5 6899f18952032721d5b1d87b0cd0f2e6
- SHA1 30feca6b99286c329541ec2c587d9b0e92e2a368
- SHA512 382c842510a2ee5c138e0a9a796a7f3a10b12593772b87bd7451f0d9289d334f2940b5d5ce05ff9f5fbad72d202094ceb48b9d0212828f09d60900be016d4347
- SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UO:lQRQyi36YOcPbLvw2gAf+PN3g+k
- TLSH T101666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 0a74199e59bd3880e65a926ed76e4263742d575d6146a205a4ed10bd08e45373
- MD5 b6183713d1dd5555d51fcaf0ef6b74dd
- SHA1 e86a30413b2403050e80b9e4206b1735e2b0741f
- SHA512 628179b2daa8e198aee36aad8ec623b4e05d47005a525b44ef45c0893be5aa00169aa37e1941baff0f368da52a448789620f268083d193ec597b0378649f94b7
- SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UO:XQRQyi36YOcPbLvw2gAf+PN3g+k
- TLSH T139666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 e476ef0aa023965b028b23655732547bee1dc97b9672a0912d840161e195a094
- MD5 cba175deb6ec69749cbd5af41b47ec8b
- SHA1 182417160c9ab1b61b91f6670a5d7026ff645166
- SHA512 1d2491366627e1c6a73560cdfe4c250d00c08877d98a153c41b72c0f8f8efee82dfa29e42d485f401d8bd9cd5dd0b98de611e63e3f063329822d43727df698a3
- SSDEEP 24576:wwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0GNyBo4kx929bL3R:268Qg55nhceWu7PNU3/OB+kn3Hnx
- TLSH T1ECB55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 3c4520b1a5e623a4aff440cc46c73fa879e84f6e40fdfb5cbdaeabe40ad181b1
- MD5 5120ff638a0545cc754141c4113a4f0b
- SHA1 1c36b5d5542d6cb948f5ee4612ace6301b857f78
- SHA512 6662cb6f5e19eeaa1acfdfb0b78e2f81eaede185e0b00a1bd22f9ba2781043a2aef8cfab8c2f0f608bc58a7c0b250836e752a9b306aee56d404ed766729771ec
- SSDEEP 49152:s3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99:Jy5112gYy5azzVvt69nLKnhZv+k
- TLSH T13B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 adb6e7a547b50858754a1c6326dea0f7c063543f319c1bff66c0d2c7a0aa2d60
- MD5 be9ffa8b5028f8d2a8a1c962460bb505
- SHA1 dfce6c919b863e30ed944fffe7282f90fe2d7627
- SHA512 42fc321d4f7fc5992ca7b1cf4aa1cc16764e3f34c21f28a0423ca037545fe749c884b72bc5cedd64f0cfa9822d14a2e2ff6cf7f4707cbd9d30e391232d5cb6fd
- SSDEEP 49152:NB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl0B+kn3Hnx:Tu6Jmdxd2dI+k
- TLSH T118D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 62e2a04dbbb45db8f26536dfe806a72def605f56bc5ae2645b6effeff7287c78
- MD5 2d835ac2a437fa472216c931c947b5a0
- SHA1 9090999a49d255dd45dc70d87be97a97d94e5282
- SHA512 9212a818fc51d0efffe376103d3d22f5ebea96351b0c771387fb06d9398b902f024ebf764faa1e0298f3da1fae03c452e999051f5b4e36490e986a233efc1ad8
- SSDEEP 49152:N1hpsNoJpF1A63U44CwH7R4xgB+kn3Hnx:NmifPWR5+k
- TLSH T106B5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 8dc7f92fe02824ccac6751a8fc6f06150807fd70311cf9c0c042a97bb93ba7f8
- MD5 ff08fd879eac944a81cdf51458381823
- SHA1 d5b83072cc676ccf53f88b40f769f74368df5c82
- SHA512 3e37f738dc61ef3fcb305ab82950b4ac693bf91dd630270002af6338e0229788af8bdd8e27c1ecb4052fb6c915541bf66aae95196d84dae62e33cb4731ca7f03
- SSDEEP 49152:dSuZQIY0Be2KcRVtOnks6NMHq9B+kn3Hnx:z5dKii617+k
- TLSH T124C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 8254617bca6220a6797ba600af23d8f6656e9d354dc5281d90cd8ffcb44821d0
- MD5 e355c7cb1a7e56d2b1e4313fe3d44cef
- SHA1 d8cbf0ad70dd0db1228dfb13902331ce473c0868
- SHA512 766c9efddc2df89d4a24b46a4c8e44fc95658b002246fd3e65bb821cea41c04c4857593ebbff6bd0fbc91c5b304dbb3f2de4c7fe0aa87ab177a1caf951fd39b9
- SSDEEP 49152:nhtSn8EApI0fig3giDn0AP5wEB+kn3Hnx:2X2imph9+k
- TLSH T14395BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 3e6dc6c43baa1abd4db76a6e8e35e3870add7cef940e292a97ec665c3bf60cf2
- MD5 a3e44dffa8052e7677b1628dc9b4263b
- SHA1 0880d9f8f25b14635f31603a7fde1ff02731fe31
- SHA512 f99db8d25c479e5702e7419fbcfa1706697f538523d710fa0c9d9362d0bd4f690617e6b38ab20aa85e3e7a440e587c199c7dba03478ae1b52d5d3442b596d8b8
- SSDEEP 12288:7NLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:7SNyBo4kx929bL3Hnx
- TLSH T1EF4523125A0C637AF76D3FB0644A8198CC34BC8F1E9593D8EF27987759FCEA25A21107
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 bc23b84cb33e12a6589318009df938692cef3ab648b5afc838c1cdfa730b4326
- MD5 a83ad4f0db68903810d6b8b0d2fa4bdc
- SHA1 17b6b2da4dffb45a8573987d963c0a06e3e729c7
- SHA512 ed2d5a18f0ee4f93acebd039cf2cef2e0c5894e2f165e382878801d38e8cb30fda1d86a44896ccacb85244e2b6ee981af8945ca9c9da495de4d97b6ae2b96db6
- SSDEEP 12288:fmLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:flNyBo4kx929bL3Hnx
- TLSH T1B64523125A0C237AF76D3FB0654A8098CC34BC8F1E9593D8EF27987759FCEA25A21107
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 0df1449c974881a2d2f1e68d07f2a951cfc91d773461bd8c5b747fff67f3585e
- MD5 81c559ca63f48592d34ffdb9e49c4bc0
- SHA1 92bc7d3d819d2578c7c9617a4e936f23fe0c4d2b
- SHA512 306405a3f7435606f3276b5dbc280c4ba812322a0c5330b0d78a76f459b52c12789ca6fb0305a45008d236f0f0419f0a4ed7f5b703c3d168c46e94cc5df29d7c
- SSDEEP 12288:WoLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:W3NyBo4kx929bL3Hnx
- TLSH T1A84523125A0C623AF76D3FB0644A8198CC34BC8F1E9593D8EF27987759FCEA24B20147
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.2MB
- SHA256 737a4666fed36c4ae4d32689536668e3a45246f47dc9647135e7a5b87033a823
- MD5 45b1570fe6aaf32bfc570fa825125132
- SHA1 628e00a2b931c17f17e4fafd8869a6cef44c4f91
- SHA512 cccb49983b3c786e7ef567bb5f44a7eb5a5e1fcf756a1c14535611c6147a3132948eb378006530f1e2c6b13c6a8e46bf4635e15766c8d7518766698919a43a26
- SSDEEP 12288:AVvLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:/NyBo4kx929bL3Hnx
- TLSH T1494523125B5C12BAF97A7BB0985A8054C834BC8A5B7197DFDF124CBB0DB9BA15E30702
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 caeacd55de3bceb5ae0a8b353a10a0897d05153a13d69d9ed801cb4becf22dfd
- MD5 80c36668c83a4c8352534490cfab9ed3
- SHA1 34af27ddcd63b7636f988d288fe04709e15bdbd5
- SHA512 1dea75bb65e7aedabd4df0430a80cafc2869ed83b9903f703b16fe8fd6bc6d48ce5e2506f604511b2aace7afa4ae273a579aeaf149c01689ba39128fcb4bcec9
- SSDEEP 12288:O3LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:OMNyBo4kx929bL3Hnx
- TLSH T1A84523125A0C623AF76D3FB0644A8198CC34BC8F1E9593D8EF27987759FCEA24B21147
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 eec3352968b748a9487d205bbc2ae2329351c78e6ab381429f6b185cbea28b9c
- MD5 3e39615a5be85ba056a043f1b5ce3dab
- SHA1 c8bc5aa794598e3a787004b3f7c6cd3bd27195ae
- SHA512 e8d7b3c4a70cbfccbbd3d70590f8be0f03ed216edd39d98d36333b70002b7e8e512949ae20ba9eb09b84a7dc9f7e542fb3a726455b25a521440c3d3b95aded23
- SSDEEP 12288:/qLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:/hNyBo4kx929bL3Hnx
- TLSH T1C04523125A0C627AF66D3FB0654A8098CC34BC8F1E9593D8EF67987759FCEA25B20107
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 1b775ceaf2bd42f30064aa2aa995467ddb01e9b9143980ae932c45ddb113be8d
- MD5 3d69d51ca5427ddef39512a6eaacbefc
- SHA1 85a6102d3b2523dc02e9d32c934ae3b99d288b23
- SHA512 df7dae18d3015f5cd3a964c74b7c0c1d15ca648e8badadbe108a3d31a31ddf6f9b3129574373f19fa4a44a4711ca98aebce9ca43339acedff252afa368f5c718
- SSDEEP 12288:NOLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:N9NyBo4kx929bL3Hnx
- TLSH T15F4523129A0C233AF76D3FB065498498CC34BC8F1E9597D8EF27987759FCEA25A20147
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.4MB
- SHA256 b3697bf63b10edf2dacf9109c3b2009d59dd25f29fa5196c67cef783360d0818
- MD5 04b4a64eb47ab40e9a689a5dffb89ba3
- SHA1 45f6a2e460cae3ecb3880d1d48feadf6b4275a28
- SHA512 e567589940dc15aa048e9c87a03b99d9b2f5ffb55b43b11f300dbd49c99fdde802371d2924a3b80562fe2be0b05a79fabea074dbb9cc305e8d32aff78f86d907
- SSDEEP 12288:miZwbjzzFEoS2cPvyGLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:pZMXzFVSOFNyBo4kx929bL3Hnx
- TLSH T1B9650195B39418F8EC67823DC8158906C6B2BC4A0BA0C65F07B4367B5F773A11D3EB96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 cb1494843ae08751605698402cba15ef7ce1d875d1e60a89c81988866c0e78c5
- MD5 0678b95f00ee58d9f1ac9247fb3e600f
- SHA1 f0bfbaf1ee08342518d5bb1304bd2cd75a76e313
- SHA512 5d688160b2f25dbdcc9d94c8aad4d5b6952b45e027acd213ca0206229fb52987038794041675d3b6fda38d81aecc1c2cae9814df04da90725f450702f2955093
- SSDEEP 12288:D5LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:DmNyBo4kx929bL3Hnx
- TLSH T11B4523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 16be2023c11b2f1628b65e862efcab4a4975ed67a5a4fb84a200a20bf92a9f5f
- MD5 2cf72be8e5c4d1f009389974e873e464
- SHA1 47dfe59292b990576dd6ed2c9e083820399be935
- SHA512 4ce4419e365ff164fecc0f0ef796b5676c31c61b9aa443012c01f7cc40f09fdc6f1118f6e4b97578cd4b89126b6b4a638ab435651123a9bd13c7c7c3d978bbad
- SSDEEP 12288:KFLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:KaNyBo4kx929bL3Hnx
- TLSH T10A4523125A0C227AF76D3FB0654A8498CC34BC8F1E9593D9EF27987759FCEA25B20107
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.3MB
- SHA256 5c442570c3ee42a18031de09281c29d995c93e79264fe2def3b973e4448f604d
- MD5 fd1621b026b86d56abbb9235f2164574
- SHA1 e75ea0861c56e595f99a23b0f9391c96a7625b06
- SHA512 3b198501cdae5513e9081480957e87ff5d69a5b5d8602d1c430402e6c3ba4677bfcccdb4e2d68b74c72ac85c983f482aceecec1791ad0ed127de6eba16f03e53
- SSDEEP 12288:zyPz5L8CLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:+zyJNyBo4kx929bL3Hnx
- TLSH T1EF55120773A831F9E17A6234C8960A05E771BC360B608BEF576046771F7B6E19E3AB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 128b7bbda3ce646a1d3d56901c97dddb70d22b96f3e47c79008d803139548aef
- MD5 176f7ae7ea481ea5493ff94039326327
- SHA1 b5f78be40ad7e1048ed5bd419a89ef4d96da9b81
- SHA512 62b70814facae3ab372d0c006f7f3efab3d2508301aa97885f9ae678e32e0c46b34a7d8e73529b41517fbc7801188559740003a909fe8aa4ac1ea2d54413e701
- SSDEEP 12288:+5LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:+mNyBo4kx929bL3Hnx
- TLSH T1D14523125A0C227AF76D3FB0654A8198CC34BC8F1E9597D8EF27987759FCEA24B21107
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 6cc3a702a285b9803d017a83192af5b237c12cd96cc4b5c2006b4b3152780045
- MD5 3a98ea3e2f49eb2936a9fdc55e5d7c85
- SHA1 85f351c4268dedfebf110b8a17dcf28151c56eec
- SHA512 8c87fbde8ebf3bd080d2ec241c4b5dcf3f79a6c03fb20376fb8a3fdf3fea445d3c523b543c19bb5e059a4167c1e9e531a6971ea39555e50b9c06b9674e6c2ac8
- SSDEEP 12288:r5LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:rmNyBo4kx929bL3Hnx
- TLSH T17F4523125A0C227AF76D3FB065498598CC34BC8F1E9597D8EF27987B59FCEA24B20107
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 205efc8639bc04775d61182fa46728e5e9e2187c4f91dc437a25a0a776a66835
- MD5 0689247f22f289a524fec784ccaa13f3
- SHA1 6b219ebd7762ab3e11fc8ae80679d6e828995d10
- SHA512 3fccb9e8c0ca8f7af19005901e01e46bf48508336149d283c95bccf9c0a907a2bcaf08098f73ac8799be4fde170fa3b92620beec3d1b1322c33e2931a702d28d
- SSDEEP 24576:mcP4mcvIjkGOxhKP2l71SNKbrh/8KB+NyBo4kx929bL3Hnx:hP4m4IpOO67N8KjB+kn3Hnx
- TLSH T16D65AE2DABDC0096D0BA917885658A4AFAB1742E1F3286CB1160933D3F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.3MB
- SHA256 9da04ab4895a56d9e49627011b920268924836bfad467b3c2c4fdb582fec5393
- MD5 e7f926bb73015b693bf3a04dbb4c83db
- SHA1 fd1c942ffb36636284e761137e3f256e51753e5c
- SHA512 72741856d344a6f11d3cad4cb9eef71e1736be03b7136cf6d988f141aaefb419915732473811aebb3fc7bf374ea5a7d58afce0aae7c874a21bd7f56a22ebc1a2
- SSDEEP 12288:1psfpLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:y2NyBo4kx929bL3Hnx
- TLSH T14255F01AD25812E8D06E6274C7468A40F7337C5A47E1D3CB97D0F87E0F7AA919EE9603
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\WinRAR.lnk
- Size 1KB
- SHA256 aef415f3aaca5971ffdbdb17a2cba6ca267f6c4c90e19110f20d723a9c3df891
- MD5 a0e8e230a4a92d7528c356ef16ccda8f
- SHA1 8eda5a1ae8bef34372f469a9cf1103662910a599
- SHA512 648df8503bcb4a8bf3dac53e96e57f4b613dc9ad3622e97953a8a6566bfcc69cad031585482740de361fd68652beda22cdc7c98310496465f5257080517b084d
- TLSH T1DC1170129ED61B21D7F6DE3082F76321C6743CA5EFD42F0E004081492430D00AE78F6B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 4a85d41a3778d6448025441485195c83aa7a762bb6d056dd7329b1dce10092b6
- MD5 cda3d5b516e3269cb6ec8e1f9659aeb0
- SHA1 d4681159862e68943e25a89c175180effcf74d35
- SHA512 fa445d7c39e1aa83ff814c559d405b1049a1608ef74830bd50a5907d9aedd69195486dc43fe54159d7eed476d41fe956d4929e5b029684748788599f8051534d
- SSDEEP 12288:GJLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:GWNyBo4kx929bL3Hnx
- TLSH T134452312975C623AF6BD3F70645AC024CC39BC4E0F54D6DBEE1658BA59BCDA29E30207
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 eb66836eaf3088133cd42cafbb3d20a86036b393eb2069706646cce5529623ba
- MD5 b302c62bf0afebe43f47b84b133a1350
- SHA1 03e890474ec8726b6f5f61d06f0e87210561c17b
- SHA512 3bbdd0a6b149886695e981c3b9fccfaddabce5afcd816f16f79cfbbf58bb50691ca4b69bf42365d860a2e30c23877d05398d4fae05acaddb5b62c42869b1d1e1
- SSDEEP 49152:Oa0h2GEkuAe73q3pp46zwwQXB+kn3Hnx:Oa0hNYG4JwW+k
- TLSH T15585AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 5eb8130c655a6ca859add5549a9c7d59dc283b819edd6e8938d28863848ebee0
- MD5 a10284141b47163c2d60feeb624a5a41
- SHA1 19717666466930ee7b446e0cb05a5d1e236f8cf5
- SHA512 707cbba872eb6065b6a6fb7a81f94b51ae5c4eb3aaba540a2499ac5b259100fc2e47b0058ce9bde7aef93ff35ea12ee854eb69c18d06af9d817c9fc03525fe8d
- SSDEEP 12288:ahbHjfXWLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ahbHjP1NyBo4kx929bL3Hnx
- TLSH T11B55123E16AC21E9F275B67C9546850AC730BC1A0B1193EF6792817E4F3BEE50D35B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 4187510da3141c090d4004b0b7e1e8613281a7116af15643b7e703c9ba8fab7d
- MD5 0fa51ceae100ceac18aef3f46d7f696c
- SHA1 652da33ddb45b7561d6fa1a056c6f1324fe4473f
- SHA512 331b4c386602515c2e73fd2a60775049c40e55aa7ccec3363a78814e035e63ad2afeedca5992d1bd9e8f19609c02f288d1cb79f1b2a1aafd9a64755465bb3f24
- SSDEEP 24576:f3YgnJcRTk4yti+R5dpR/tNyBo4kx929bL3Hnx:fIgnaTk46ppR/KB+kn3Hnx
- TLSH T1A745B02DF2B910B9D8AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85F35F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 6aad4326febafe31a3aabfc4a681bf483b4531278f04df18edf832beeaed14a1
- MD5 f903498bf11d5e522af7e4ecf874ae15
- SHA1 7a3e78acdda839d510d86e063a782d463a533efb
- SHA512 58cc066bb6d507e42e7c909312ccf00fdc32fcdd4a53d717014f1ec527e19966bd4fbaeb29bc65e1cd4e6b52fe4aae6649f393a6af133989c504f53fe3a2aa40
- SSDEEP 12288:IVLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:IKNyBo4kx929bL3Hnx
- TLSH T183452312560C627AF67D3FB0644A8458CC34BC4A0F6597DBEE6698BB59BCEE35E30103
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.5MB
- SHA256 a7d35cc2851f5ff91f2865c48d4f7415ea98ecdd9ef4f31fef93c5a5997f84cd
- MD5 e71abc58d496964eee7f500b5d8820e2
- SHA1 492d01265f58515fb6976c75713a1e9e52244243
- SHA512 6ac6fb200c871bb7f04fa853f034a5f987e42282ed566b34022d8ae35172a5b8381dc19daa49acb2d446daec6dae61c63f5e221e6215993944b52bff440aa6fe
- SSDEEP 12288:jObFA4LWOsvAYFTULDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:MxL3UTLNyBo4kx929bL3Hnx
- TLSH T12B750115F79800F9E97B923CC8A68516D672B88D0764E7DF03A84E661F637E24E3E701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 e26d46a9e92dd4f8083eedfc470639aeb3d096e5ee7078534fa3be9bcb4a4821
- MD5 4917120e96b1b19fa0aa357f3e947d5f
- SHA1 cd4cfd80d3104737924d89511214447bd3174b27
- SHA512 74ed9d150f7f164ee479b5bea415225c82b279903407c1d4782ffe05ed4cf49acb2065e88d16a0d481d56e8c8af59135f9bb995d3451f63fd0382880717d6969
- SSDEEP 12288:4pFtuOQLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:xOvNyBo4kx929bL3Hnx
- TLSH T13555021A369C20F9E579767C8986820DC731BC560B2257EF46A080BE5FB7FF85C35A42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 e8337f40a9e502d65eef230e1e574e266b44fa3d33099c4a862065279e7ffd7d
- MD5 b61fd6a85e314aea06aac034c76a821c
- SHA1 ae2016557daf8c6c8dbc5224b378ba5a3db10ee7
- SHA512 0e02ccac046b9424924966ed17be8d5a6b34ce2df2754fdbb87e0de095bfeaf9c2b37e1144d74053fabbb5d0a259e8a0affabcf0bff313704cd15d51e9e9f79e
- SSDEEP 24576:k7NM9YmZqmWMUkPjZM48Mv6bEhsmNyBo4kx929bL3Hnx:k7cBWMpPjN8DbEhCB+kn3Hnx
- TLSH T11865AE2E6BAC81E5D477D13DC9A28205F6B2B4611B318ACF5162833E6F37AF44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 578a938e3d7a9f393e8bf4ee6626dc5d70697423e667d8f9b322b27a04ab8a84
- MD5 4f15ed1384c7df338bb58fe5bea09369
- SHA1 15d896557523212bb53ab713d908d58229b0dbdd
- SHA512 16f40273646229bcb8ed951336e071611ef8817e430ba75735de5d0889067a1a6350fb9e263f907914a2e502d393d4ffb3ff22fb5ba1b6bbe6f6a218aa2dc96c
- SSDEEP 24576:nW6BApg2YuyuNDYTabvcRvNYf8km14NyBo4kx929bL3Hnx:nF2YuHNETovcvNYf8kmtB+kn3Hnx
- TLSH T1A9858E2A27ED80A4E0BBD27D45B7D246FAB2B8511B3056CF4255862E1F33AF44D3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 9199d76c4abba4b62f4706c9f5eadde39457bdf58c9b9b2357e9d3fd8bd08cd9
- MD5 60044279c1fba03eb1e38af9972ec5c7
- SHA1 e6728f34bffe6c120f20abb8fd6e1bf7b5a95062
- SHA512 f8fe78014b862f933b91fee6073e1940aa54a03ebb2f28d6e48d9a4a97fad50f0502c014ece9ff3b757fa7b156f7dcb3d6980656449eaeeac4825449331df7f9
- SSDEEP 24576:FAFs06+OmlfkNXEbTozNyBo4kx929bL3Hnx:KFs060lwXu3B+kn3Hnx
- TLSH T1A465BF2F62AC00D5E07ED17D8997C91AF6B1746707255ACB0260C63E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 0d5f186bdd084bc9a19883c2646e06d7474bf4f4907ea4a7302b6dc4ce34014e
- MD5 6e2fc194267d066130baab81a7374b20
- SHA1 ca59df3352a3e1af0b58b55b4482c8bff0767da7
- SHA512 b09333a48345ca038bcecb3d99fb1d13614a6b394ac14efc2a964e45ad939d343ac7fb2bab9e399bf1d009a64554bd285b1ab23ae73f5a4e613dc6374959c320
- SSDEEP 12288:pCJnJ5D3VkrDzxZLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:AJnJ5D3WXsNyBo4kx929bL3Hnx
- TLSH T1B175D02DD2A810F8E4B7D2B4815A1755FE72386D2F226AC76874D4353F22FE09A79F04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 26fe535279a468af6fe3fcb7ee1123eac63709aa1f9959ee69196bd01cee59ec
- MD5 84dc87e97afd2727789aedf27a79d0a8
- SHA1 e400f7c2302c8baaf7a2a64494a135aeb3df88aa
- SHA512 592542fea33ed1aca92bcb9d72276a413498a5d629b214f8c2c7736e8abdc40f9cccaa93f518163fe310f3c7c82542604f59deb6b83305fe88a6c765b665da48
- SSDEEP 24576:qEPohm6/7IIXdwcXrif7qQncjlP65i3VutNyBo4kx929bL3Hnx:9o06DIKdwc+eQnSt65aVxB+kn3Hnx
- TLSH T1FD955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 9358118c09979ff4cce3d28f8015da369681f2c99ae4e21d7704c6805f95cd24
- MD5 1586e53fba59107d358e32194c6bc3f0
- SHA1 a1b01be06d239a99f4d8b9ec9267e953e98c36c3
- SHA512 23619a3bd11d4c499571aebbe5aca62ff025a98f0f063414836eb8128dec0a442630951d9791de2afd19ffc7aae9f48cb40a6d1a1448e223a2a1404129e2c0b4
- SSDEEP 12288:nEP3RlTLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:slANyBo4kx929bL3Hnx
- TLSH T1F055122E279C70F9E13A717C94918104C732F4651B5267EF9AA2C17E4E7BEE61E38B01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.3MB
- SHA256 1b5d36b2b162f7073fa730cbb13657441660a1813e7e6aab4bdeeb4991b0a950
- MD5 205174dfd30520ab630fa65e80282633
- SHA1 3ee92bfeabc1721641e8565c819ef195ab5e47ed
- SHA512 eff02b70fff0592fa139024b3e2a12c88de5a9f0f0d5c7ac8f15044dc22dc06ab6476ba73f76f1d97add84945917e07341588caaaa85a7fa0607d383798ad9a2
- SSDEEP 12288:kjkymLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:kIylNyBo4kx929bL3Hnx
- TLSH T1DA551205638C61A9FAB92A3899678194CD34BC101F2193DFA591E93F5F7AFE15D30B03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 c49104726c6dca0dd435ec213fbc8bfeb240eac76ddce65cc3d23c2da38d9e35
- MD5 7dc46c4698ba2c6c9fd82324f806eeb6
- SHA1 2aa14f00b1e754ba7d859dba21c62b4729e68276
- SHA512 b94679ca6650a69e505f978b279203f118115f356e9b69bd6205c3e99a6ed34c1b316e598df5f0417841ff3c2c3f811bbf7d693a5573dfc29bbadf94e730c47a
- SSDEEP 12288:VagLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:UfNyBo4kx929bL3Hnx
- TLSH T1D0452316161C327AFA3D3BB0645A8554C830BC4E0F51A6EFEDA2D8778ABDED35A31503
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 a242f940980d31d04ce4ac20feaf16c9875cd73d5603f6d02ae680683761c0aa
- MD5 adafcd9bcdd444562449f704b9efa758
- SHA1 aa002c3f9ae3651fcbef28d73fb476f3786275b4
- SHA512 8fc4c5bd6af1a397d5ac17a6d99f063099e40d7bf03a551f4753387f5a76edf01ee8afa67d48887e813b9d03de41b072ba1d65f99ba7ce76357f7f153f1c4844
- SSDEEP 12288:eLQZb3C97GYnZMv5zBcKY97MD3xLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxfJ:4Q9MxZKdcz97w3ONyBo4kx929bL3Hnx
- TLSH T18B558C2DABE9059AE177D27595A240C3A633B4311B31D6CF2448D03D4DBBEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 72a86dc2e52bdd7961b8a347b723564663f89908801fff126f5d0ebd90a7a77e
- MD5 f33c3772ba22abc1929c7b3c50cdad9c
- SHA1 b192f1703d819e2bb474582d52db2b5f6e49318c
- SHA512 54f95eba5b04f6cd997929862b8afdcdb7c80d315253975ec82ffc008eefa4736404ff909bf808a1d84f12d1c45d3102da9f114d3887c7a1005506d2e9dca74e
- SSDEEP 12288:zyoKo29Rple9pyLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:zyocfApZNyBo4kx929bL3Hnx
- TLSH T10C65E01FBB6D40A2E176923C89858245E773B4301B6253CB6691C73E4F77AE9BD34B02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 03e08430e8e29dc5bf576b3a57733afaf40ed34dc02bacac3cab5c530b81e796
- MD5 ce34ba772aa49103711efe112fd9716d
- SHA1 62dd88a5a40a7540aee4123d82a445a5095e5a00
- SHA512 c683ebfaf041991e90883d213feae179f98074e34d8fae8b49361e53b441170ab652f0ba4de3c5aeb50d490ceb73cad276dc8f25ae38d592c33bdfb1effa5fa7
- SSDEEP 49152:7WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKeB+kn3Hnx:r0zuNIy+k
- TLSH T1D2A57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 e8be18048907aaccb3ec55ab566f03519ee57a407c9ea2610eee245788d36cba
- MD5 55be17399883e9d3e9bdf4a6497012ce
- SHA1 29da29fb2a9c3c818ccc108c8ff1d26eaa696590
- SHA512 3c14a28030dc6799b359fbfe8c3eb259d7eb368e8024314da196d4d4a27e79f37d9d3e9f7449400af69afb452f02b93af869baa50539123517e963fe3bc772ad
- SSDEEP 24576:q1QT7EcpfxR+N5AWAz3ooiYujMqbANyBo4kx929bL3Hnx:XTDxR+N5YzT4jMAB+kn3Hnx
- TLSH T11F55B02EA7FC15E9D1BE85789A23C512FA727811033193CB42A0C17E1E7B9D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 9b14f083210f5e2683546d689af7ab8009aaba812ced05b6f77cce6016d44205
- MD5 7d90dc3cf007f0aec818dfda8289919e
- SHA1 5b2483277b10c3ca1a893022e186e9512973060a
- SHA512 cb82a97618aa143455f3624b952070d53765fe1768884fc645fac41b621edbfe5c368898f172da8eea2c59a920c5e8030b3a347269c4995b7e88a398d77a4ca6
- SSDEEP 24576:STMdOz0FFS+tmSLUNyBo4kx929bL3Hnx:+0K+tmSLvB+kn3Hnx
- TLSH T13165E13E636D14F5F57FD27C96438906E97278660321A6DB0690C07A2F6BFE43A39B40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.2MB
- SHA256 52092e89e425175bb9525f2ea1caaf175212fcb4744b346c216ddf9a8e6bb1c0
- MD5 701540eecbb887509c05856b5305252b
- SHA1 4fa2ada67b6ce3402e277c4e9b020ff72c73d004
- SHA512 60dcd225f2b4cdca7020e00fdd1c9768026413be73bd7a904449b5917b9a50f45e72e65fd140bc41c73e8ae7a9dd803efebce3d836f99995451ab233a6273ae7
- SSDEEP 12288:J49ULDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:iLNyBo4kx929bL3Hnx
- TLSH T16A55120913DC30A9F57A76749A2A4145C930BC6A1B2167FF79E1C87F4F7AAD18A34B03
- MD5 SHA1 SHA512 SSDEEP TLSH