Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 08:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 3.7MB
- Sample260910-kktf1sttgs
- SHA256 2a5084c669f84d01fc5e5bbc9fba8004b878fe5986a357e08b9a9cacdb6fed0c
- MD5 f7e7704687b06ebb74dbabacd5f69ed5
- SHA1 c1c6e3ee85d1a20c33338bfca3b1acf5d18d4e06
- SHA512 2bf38746b653c3dda1984452f43d87c1098a88e2146fb313ad619ea1282ca24c6877e10c9bc1968d5fa4d2030cb442055701789a256e6da765cb76a54d62fb60
- SSDEEP 49152:A7JynhJ8EhdVMw7Y9odwfDFqfFFJVgrvqzbut1wOq/ejgXUeT+uXEkjNEEBHLu1B:zsoEC9ia+uUkjDBHLu1U023W
- TLSH T19A06BF1AA7E406ACE0F7C679CED6C553D776B80D07B0A64F029098A64F772609F39723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 2988 alg.exe 1972 DiagnosticsHub.StandardCollector.Service.exe 4416 fxssvc.exe 2132 elevation_service.exe 1316 elevation_service.exe 2656 maintenanceservice.exe 4688 msdtc.exe 3344 OSE.EXE 2200 PerceptionSimulationService.exe 1968 perfhost.exe 3888 locator.exe 924 SensorDataService.exe 3420 snmptrap.exe 2588 spectrum.exe 3052 ssh-agent.exe 3844 TieringEngineService.exe 2560 AgentService.exe 3580 vds.exe 3784 vssvc.exe 4972 wbengine.exe 4704 WmiApSrv.exe 472 SearchIndexer.exe - Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\alg.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\locator.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\vds.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\14dfa27479c0b0e8.bin alg.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\java.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\javaws.exe alg.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a2369010041dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000097fee8020041dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018e68c010041dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d61eb020041dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c3e2e9010041dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d20a7010041dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000028d479010041dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f8ab4020041dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,1" 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rev 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive" 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR recovery volume" 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive" 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV" 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0" 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0" 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeAuditPrivilege 4416 fxssvc.exe Token: SeRestorePrivilege 3844 TieringEngineService.exe Token: SeManageVolumePrivilege 3844 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 2560 AgentService.exe Token: SeBackupPrivilege 3784 vssvc.exe Token: SeRestorePrivilege 3784 vssvc.exe Token: SeAuditPrivilege 3784 vssvc.exe Token: SeBackupPrivilege 4972 wbengine.exe Token: SeRestorePrivilege 4972 wbengine.exe Token: SeSecurityPrivilege 4972 wbengine.exe Token: 33 472 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 472 SearchIndexer.exe Token: SeDebugPrivilege 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 2100 2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 2988 alg.exe Token: SeDebugPrivilege 2988 alg.exe Token: SeDebugPrivilege 2988 alg.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 472 wrote to memory of 4488 472 SearchIndexer.exe 110 PID 472 wrote to memory of 984 472 SearchIndexer.exe 111 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-10_f7e7704687b06ebb74dbabacd5f69ed5_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2100
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:1972
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1576
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2132
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1316
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2656
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4688
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3344
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2200
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:1968
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:3888
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:924
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3420
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2588
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3052
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3844
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:1848
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2560
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3580
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3784
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4972
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4704
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4488
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:984
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 cc91ebbe2fcadea4f60602a544940c07a220800acbfc00cfcbe33ecf9dec36d4
- MD5 9a1c0dd4667b6274f25fb22eb09cbc7d
- SHA1 eed25b0284e5ab67dcefca12d8bea7d3b3419066
- SHA512 689a63dad69422c7ba89d811d326de713a91ee7c45c6a9cfe4347bae8c8e92bcf712c0a3358ddf8153f82906d4b6ae291225f0d0a206da78c2824e2fa967e6f1
- SSDEEP 49152:/b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnae30jaNf1TWbdz:93q6sjBPU023W
- TLSH T17BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 2d0efb476dcfeb6c2e7d47d72714c280870fc753767cd25c7486a5f2085860c6
- MD5 2a4073cba728140ec7ff9b15f793d2e6
- SHA1 174ac8687906b9e9cca05a0933e5df8397502aff
- SHA512 ad538e17058e122006d4708ace14b5b645bd1be0ffe7d65a1bd93b7658279777c9ff54aca6646df2584025de987340c66bb30899ad80e021c1f997813c5a60d1
- SSDEEP 24576:lXYfDtczAkgXe4i7ojhsP5Lgrk1TWb4AN5:wtcMe30jaNf1TWbdz
- TLSH T17F05F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 a971181ce6321cae1ed4e71df6f37ce9ad717afe553408b2c6ca925bfdb045e7
- MD5 24dd1943a273f496edeba8cef79299be
- SHA1 284e04cdf745c6416fd86ca21a70ed6b2da3be79
- SHA512 0dcfc3454f34fd4bc5535455b3f63e1c99f12837556ff901b0dd200355fa950d4616049126929210dd07f9e9ebdaa268994072a3c234e642c608c76d1575d4af
- SSDEEP 24576:v0Le5ji0hmxxrMrgXe4i7ojhsP5Lgrk1TWb4AN5:vPji0AjBe30jaNf1TWbdz
- TLSH T1AA35AE26F6748735D073C0B9C5D2A78AED71308257308ACB4286D77C7E67AE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 cb5c871e7e2a9f211dcca493f4da40941c94f39763979cdf94316ecb7e315f64
- MD5 b695bf1e4fce97c1afd5985f97560bb7
- SHA1 ab95d661dfff5838346939556eeb68a3e5d3c22f
- SHA512 51715c883d1f914e19ad04619f5dfa1302ba963a6b2db5fa153d4d88784d94a3d5ce575cd1ce086183c61a4587f69ecd7cff42703e22612a000b0bd042dbdeea
- SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWn6q8wyuBgXe4i7ojhsP5Lgrk1TWb4AN5:+/ezSC6vUzPveHjy9e30jaNf1TWbdz
- TLSH T17D756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 99866f0b97e5d29fca77efdb1939d0606e246efb578c603a13c38231dd4d8f7d
- MD5 150eb0f6d177bfb009c8fe95308a79cb
- SHA1 83bca873d13b38b76508a8d2144e18fee51f286b
- SHA512 1e695c131b46eb0f62e2fff005e646402a7748a5fbef1f27ade473f30505d38cdc1690f91c48ebc14ba2c0686abee6d09b2c9e3c2283e290919dcfb0b4cc12b9
- SSDEEP 24576:sVbqPb88hv/l+YIgXe4i7ojhsP5Lgrk1TWb4AN5:sVO88hXl+ke30jaNf1TWbdz
- TLSH T111559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 d46c993f1761832dcc87c50b9dcd0829a8bccae216bd113506d2b28002b86e9b
- MD5 4fa51b16dbca82f3ae5fd527f942213a
- SHA1 9771ca1325e94157904a40da149438a65c19c856
- SHA512 aaefd53d7f6f5cdc2bddfd0ab9245ae2fb537528440b9085cd34f2510ec8fcb6c8591c0e84aa7412ca9973d8fa0ee52ddd0adef898ca17ec6f900ca28bc8cb2d
- SSDEEP 12288:hL20DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:hLvgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T142C423929F5409C6F38FC3F4A0F7CBD1E9E11EC061448D6B47E0BA9358BC899DAD8469
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 87548c417d7b0135d737951fd803f5e7c1184fdad036159e5df3d0c7cdb81357
- MD5 d3773819e2f0a73e7ab8fda9df625306
- SHA1 a60b9111bd27e0f0f9c2fc2c57db89c45d39392f
- SHA512 3c303d2d7217c6d2f88a6a80c4bc97a98b23d300291893092d5fedbd1745820c2787419bef477525f555ceba15ec5cb19d34161ab47344408604736e62796b0d
- SSDEEP 12288:YeBNUbTVO86Uz0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:YJIUwgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1D505CF3BEE28FCD2C27E8DB85691C740E7B278704B5193CBD1A4820E9E235E55E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 7ac5bf30efe9c018ab0c9eb01e7b51de739d56333b35f6b5e08bbbe428437c86
- MD5 cd0049fbf5635dec2bd8420e08150192
- SHA1 0bc48c5a13fddb95f7789b959079f75bde5ea131
- SHA512 57d3f46d63b55deb79a879e6c006132c1677e6b97e2a2fd965e73788795361713c8c36b5eb0e5fba84b354682660787b9a269088cf7c640bae3c4d05572577ac
- SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THJ:GQvGAdlCEL8c/DRNw5CsU023W
- TLSH T109267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 10c49636776730ffbd811e0ce4b2e25e4a299f9dae2085d10713439ca9842c3c
- MD5 8ff599f18f1bdd63b2dbdc78ce1ae000
- SHA1 53f1c42cbf56103dee7a88b85a543c228feaf563
- SHA512 cb6f846b96729be52d23fd992742060a6deed3da93ef0506116d5c23046786f77194989647850f8cab3abf1df51c1d4ebffa2ba8213b71dc0ac6a69a63540485
- SSDEEP 24576:h0ewsAjegXe4i7ojhsP5Lgrk1TWb4AN5:aljxe30jaNf1TWbdz
- TLSH T11C15E031FE74E032C3BF0DB21B76C712586C6A604B511AC3E3E89E9E59342D22776A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 f54a093f524f22cb0175960431bd55165207c73d2fec33498079e7d267f10851
- MD5 2c1fa86a71713ff55ddd6e88176f1eb6
- SHA1 464f563e2733ff3bd6cdbe61d52299dc5dffba0e
- SHA512 6a582071517a51ade702d2dcdb15ef1a7dcad20d4545e09d14ee73bc63fc4cb4c77a42ade8eab2a4a4d2542c90d6f64ba59db394f043b53a0f0498d97485a1cd
- SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH5p4W:kUEtQevvqc2W1cpV2tI32r4W
- TLSH T139474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 a410e3dea4c882b9512d7957cfb1cae44ca6fae286f709af5f452ab1badd2e99
- MD5 53d58efb213b4819035e364098acfb0f
- SHA1 6361eeaf64a5538878f60d20c33d8780f13192b9
- SHA512 034a3b769dba97f45678fb2f0ca8a66c601e90cc190cd8f11ef8ed752f10480469a0aaba2bb6b8589857e134586fb47663b52d107f38a9ec5004115585e8a16e
- SSDEEP 49152:2CbRquA/m2yL5zTfFiV+XenmE3/zRe30jaNf1TWbdz:7oquVjnmYU023W
- TLSH T1ADD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 8923ef2ad237ca955b39f2b3e4c69829a8c992ab5a6fa7b92398053d084c9b55
- MD5 55a0c7d3452d9ad36ad86f4362985fff
- SHA1 cac2c8d06bd608c1c255c339dc81f59c5ae9a795
- SHA512 3ad254bb3e2ad689b70ba96afaa5a7af114dc60e7e306dce6840a394372d5781f7a620b5ce263cf2d47fc2ad0fbb53c3bd5d4710b5a2e28961346cdb48d2cfc1
- SSDEEP 24576:dAhGL3IFoiwtA5l7S53dgXe4i7ojhsP5Lgrk1TWb4AN5:dAMUFoiq5Ie30jaNf1TWbdz
- TLSH T19E359E81EBF955D4F5B3AAB899B68571EA76BCA55E30C20F1160D11F0E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 def0b776a34efbccb4a7ff41886dfaf09ce8b9863962f0903da05bdd3996dc5c
- MD5 5824641ca796ceb9a6b208f3f6dcf2c5
- SHA1 f7009d8a6a5bad64f66797a74b397d410dd1f2f4
- SHA512 44fc61d1a84bd42e8d95dc1ee5a0ef1a8c08951e984fb0fbd281e4b46ec4edc2358e2363db1c013ef72f9b9a3b29fc1d00a38ca7eed637cf87bcd1d0ffe07d1c
- SSDEEP 12288:Zmw5HEjsChNVBFgl0WDm+Cg0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:0wu4OWagXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T15205E14677A40CE9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 4224fe1203c28d35d2c2b512f32fa57efff98d0f86ef096efc0b8037dd39e472
- MD5 719848cb9f08c808243a1d6f1bc7e27a
- SHA1 028b2b8b4afa2bb00baa2d4f12067441a53b309d
- SHA512 9989f8885da6b8caa14c864836a7aed486085aae88221057673eb2aa50fb06520797aba49ab7d0b646508c549cbb1339f3e1683e01cf44ef9eb99032fc23ab30
- SSDEEP 12288:PeZ1IyB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:WZuzgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1EFE4129637D421F9E2978278D4F28741E7B23882233147CF06A096A71F76ED65E39732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 30bd28d34aec0dcb010e426d8d5689c029dae2e818da64480607dc3c6467db02
- MD5 9f7c26a42ce2fd964f735d5caa570979
- SHA1 e6c01cd944e55d5647a62b02cd13d3e145e91826
- SHA512 e6f73396c8c3480f8eafe0161e8566f57cd2d80d01f33dc7fccf62ed62500148705339dbd757b05f4cedbe04f7071200f2b43e2fa291b4847ee52df866d5c2fa
- SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ut:MQRQyi36YOcPbLvw2gAf+PN3DU023W
- TLSH T125667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 5874bac724f63089494442da5b89efdef6d6f39af9fea791388c8c70d1ad2bca
- MD5 a7d2ee3aa7cd56285d61ee73b867c6a5
- SHA1 e684d36c31b1b6a193b69ccc2ccad06053307cd4
- SHA512 0c7d987e0f1be5f4fef891db75c8265113008925f5a6ba2d4991cdb41f6350e73a343c1510b36c05eefd98454d3f9118fe956840ec922dccc0cd39726321556b
- SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ut:yQRQyi36YOcPbLvw2gAf+PN3DU023W
- TLSH T110667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 ec7a789923c92a34e7660135186879262d2ae87c76bbb165bcd35580a2f2246c
- MD5 b88543892a0c4bd0f1557694b56f023e
- SHA1 19a362e984498a1a99ad4637c786cf56af0559be
- SHA512 4190d4f119b96ce8477f07f457dfa0692c337507a0da30d360848456b049705c1cc714b32f3c657c299f24e1743e739d67254b4de401fa2996bba55221e9e9ee
- SSDEEP 49152:U68Qg55nhceWu7PNU3/Be30jaNf1TWbdz:+thLRc/BU023W
- TLSH T1FCB55933B2F60099C04DE1769F4A872196E27C758FE0E7DB855172061FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 d75cef466ee411bc507a9a24365927bc8b08749345263a34056a642d052ab662
- MD5 aa33c472378d2af5bd2fc68991db857b
- SHA1 cd2dfde3cc0f93ff33422d266ed5cc226781efd6
- SHA512 acf692a2c265acf7b644f33323b206fe792b1f077ebae94da22964ca37fe667c0a973b8ceb290cc3c43091ff9850ae045a0c5306cb4256eff979c16108d0c73b
- SSDEEP 49152:/3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99r:yy5112gYy5azzVvt69nLKnhZmU023W
- TLSH T12F168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 714c21381693ed22509d12452ed1636e234d24f0e624ad5ceba1de1fb381855d
- MD5 b30d6a9967ed3985fca00680ddaa1778
- SHA1 abba956156f38265cb5dc3835af03d16a97967ac
- SHA512 4eb9c32dab71ce26013a9de8cced4bc75bdfedb6e7fc814de8b7c275f6801565541178b316d24632224050013429336e02b2fc413917689f3cbd7dbbdac54d84
- SSDEEP 49152:nB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glbe30jaNf1TWbdz:pu6Jmdxd2dbU023W
- TLSH T152D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 ca6793882df2e5fa3a445e6088416c04bdde9eb7b072694f0be80acf50856da3
- MD5 ff14f1ff6e472093f0f467b1c4c9bdc8
- SHA1 3b7a8a578094739468f2d8f122b7c981bd35be3c
- SHA512 1a9d5cb15569c72a64d9a5cace9fb9c13347e96f13decab928536756f68237f2dd1a3c9c92903f12eaaab9c5e2072cb6330ab7866414f7874fc1d8a7143336a1
- SSDEEP 49152:O1hpsNoJpF1A63U44CwH7R4x3e30jaNf1TWbdz:OmifPWRYU023W
- TLSH T152B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 649d259e4e28fe540a429b6502c0b13f29fbae166594200aa761fa35d6bdb419
- MD5 97c485b98d6462e2b7100b90c9910300
- SHA1 ab7474f669ba398970655b88a04ca5aafce46cbe
- SHA512 7f6b5b3a85edb46d40b2454264e27345e569c15d3f1a5b44b71899a3fe016d2c84c1f7fd7ffa245158fb3199359b4b3950c47ab350ddd06810088f4644f28f00
- SSDEEP 49152:QSuZQIY0Be2KcRVtOnks6NMHqKe30jaNf1TWbdz:K5dKii61KU023W
- TLSH T15CC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 6b8d1d955abcfdd0c13f3317609a187745ace22cb9c8fec85a6b3068138fb413
- MD5 0c4db1d1f0e35b84a72c551a7a7fbb46
- SHA1 9ef73c29d1d3edddb926b75e9cfd6029ecf78ed7
- SHA512 cd5233fd2594d52cbd8f074dc4c8fc2db631c5f3ead62a389ddaa8656e4c2fbd55f1808f1c6068d7c41db231ab30c4ee9423c698e5acfe42d2dfd7fca8356bed
- SSDEEP 49152:phtSn8EApI0fig3giDn0AP5wLe30jaNf1TWbdz:YX2imphUU023W
- TLSH T17895BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 089792724bf1121edcec673c616775470146df3f6ad956f03609182b718c2b55
- MD5 6408360c05ea2d0012f79b03a67b4682
- SHA1 737da6ebfd7781151234dbf73b046f4da11855b7
- SHA512 8f96586ffabae0b8a53533e65b2d0facd8298c3599dce83714c6fe8e42798a9747eeffca5a330185c6fb5b80163c23968876c341d3caee0f9f59c922498c633b
- SSDEEP 12288:De0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:DXgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T190C42391AE550ACAE34BC3F0D0F787D1E9E01EC272444D6B57E0B5631DBCC9A6AD8468
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 058236188e22812300af2001842386836c2440f66ad3f293996a7cab3e872a5f
- MD5 05e81baf543f56a9663b26d3a1cfa54a
- SHA1 2b5f4d4b000e8ce471cea9d754e98b498882f411
- SHA512 e7eb3d7747e74d91089e1f1065861761977eff8e796249aa3723f79f7826ae757ff3688650b5808210d8fbda23f07d3da97510dde3c628cef74aa1738e04844f
- SSDEEP 12288:fF0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:fygXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1D1C423A1AE5509C6E34BC3F0D0F787D1E9A01FC672444E6B57E0F95319BCC9A6AC846C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 6d118aabb2872efb9bce63dfbf78df11e5a26620208d16cca85dfa6f972b9d47
- MD5 2e3f8b095c8229291519d66d76068e77
- SHA1 8581b06c8c9894409aa12f813bab15cbc897ccc6
- SHA512 e344f335106591f03a089111225ec895101c53b21b4b59470d154c693b4ac4ab999b19a2b22e01cbd9f733ded9358dc4bcb673ff3b8c125b820f6e3c2976fa55
- SSDEEP 12288:K70DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:K4gXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T198C423A1AE5509CAE34FC3F0D0F787D1E9E01EC272444E6B57E0B9531DBCC996AD84A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 dc0eb3bbb90cc3c89ac46a46f927c0ddb98220ff3db1d1c40180ca8975d5a052
- MD5 e8e46344bcbb598840d7a6af48f79331
- SHA1 555694025bf4d066605590fc78b5e46f5a5b783a
- SHA512 43426ce4c176d2ae7dc6fa7d3bdebe00142d728c236fe18bc48a9fac10a2f6d7bff1705a06ab61db2c4ed9885f2a2d1905e44152a7ffb3e228d34ecb5dd94110
- SSDEEP 12288:iV80DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:KgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T145D423526F5905C6E18BC3F4C0F38791E6F13DC1B3114BAF47D069530EB4AD9AEA8A68
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 a06112c486ec4a88dafba389b38baab131ff2393cc9f6540d9ffce8c61094ab0
- MD5 822ca6a48da447e180fb54ac8eded667
- SHA1 bad27030c05cf38ffabe1fd190956c4b8c4434af
- SHA512 78ca854a66ed7a860dfe4dc9f317eb8c46a6e1bd505ecf64eca07ae4f16e6b52961e5ca64f98afcb881f7203d6e3965f9681af7c9fcedb2768fb0a0a3589ba0f
- SSDEEP 12288:R00DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:RVgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T10AC42391AE5509CAE34FC3F0D0E787D1E9E01FC272444E6B57E0B9631DBCC996AD84A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 829ba407fb618774736dd281782003a82df24f89e27a4c2a8383a212776d0a7b
- MD5 cdb4d0b041e1261b681e080919292ff2
- SHA1 02d266e8be613e36e5d88bc75d36f5bdbc03d1da
- SHA512 b093615ec8ea9c091764d28cd943418dc2c9d0d727612e4dd1d685cd3212a5fcfeca1d0392dad6f8b3b3c1eaa433d692782eb05961efbe5c8cf9f5809bc83520
- SSDEEP 12288:i50DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:imgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T162C42391AE5509CAE34FC3F0D0F787D1E9A01FC672444E6B17E0F95319BCC9A6AD84A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 98d2e3ec0696109df11cbcca59abbbf27fb0a73356246879e840ece88ff7358f
- MD5 ad1d7e20ecbd56744466de887ebd7345
- SHA1 d185027483f5c8142535b2fc2879847dadbf2bea
- SHA512 257b8a26aa3654f08c1480dbd4b4f51493562d3e7efc6e13147f35673e3d173c117c76cb5af2c33d5ee1b3f2e1d62a62faacfeab9f0008821b976951179ea456
- SSDEEP 12288:Jd0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:JKgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T123C423A19E550ACAE34FC3F0D0E787D1E9E01FC672444E6B57E0F95319BCC996A884A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 c930d2341d9411843d81dfaef6d6630ef8b59c9b0eac4ddba76a37e55754adc5
- MD5 284eeab7bdfc0d58d1ceca7995fdf221
- SHA1 45c5fe505f1ff93c8170263acb32d3fe592d6111
- SHA512 e52f6c78fdfcbcb65b1ce7426e43e15386c90c53cfd53222277f0c7133a0ae524f951b585f9b3021a4d7f2fdd55cb757725a167e64cd4b1d0c3061d8bb9df07d
- SSDEEP 24576:pZMRzFVSOSgXe4i7ojhsP5Lgrk1TWb4AN5:pZMRzfZe30jaNf1TWbdz
- TLSH T1EF050295B3900CF8ED67827DC8A68A02D6B27C551760CA1F03F436671F773A11D2DBA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 dd34167503fc7f74a762312535123c8925c2652b70a7ef35835af9bd52277cc5
- MD5 e8df15950d3eb2b4560be28e74eee35f
- SHA1 9b10c9dd47e4b591187d962a5d61e4833b378471
- SHA512 3d159fcc766d7cb7362e7b121775ba4cd7350c5834b4eec597175b32f54ea0b3f9f850688758d2ad5df5fa31ab151f32455b860a011ca92057ac268216d691a2
- SSDEEP 12288:ZK0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ZDgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T152C42391AE5509CAE34FC3F4D0E787D1E9E01FC672404E6B57E0B9531DBCC9A6AC84A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 31483fa26dc47880a9fa250073865f19e8a0898a6a6dbd941d05a577014a586e
- MD5 dd4e481054903cb8382c847cbf37107a
- SHA1 ad9486ed260ee9462f337dcbfc29cf8e10461cdc
- SHA512 c129457ebee7d32696036bc788bb5267df97ddeb087f9fda3610e5bb89a92f58f0b7abbc8f3b410960131900bda4580afca2e92282c61f23ac950cc47719553c
- SSDEEP 12288:3m0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3/gXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T11BC423A1AE5509C6E34BC3F0D0E787D1E9E01FC672444E6B57E0F95319BCC9A6AC846C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 4c598a896cd046019739cdc1b1829e19a07d6573a5bdbc97d2b5beb4c0574077
- MD5 d4a5549159404e8edcac8f65f70a486e
- SHA1 68ae694a6057f2123fec4dbdc374a0b55307b0ff
- SHA512 bf5b210d3c58a31a602e027de0d0a14b1a1b481effbd5a2372214bf5b290d3d395a7c54baaef39097711e0bddfb0623af81a96be0e68f5343bbc799f4e046f1d
- SSDEEP 12288:vyPz5L8B0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:CzyugXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T14DF4025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 44e8e43ce40c2504602f492163cd33ff0eff055e96594ecd2dca0bb32f60b99b
- MD5 92a492e17528798ee90c246d2eeac324
- SHA1 bc8c19a20ed0fbceb3815b12eb886c2a05f650bb
- SHA512 ee8bd1dc22613ad2375eccc9765951008bbbdde90ea5658e3818ef034d72a2bed24a748f11064b2766059f9fc5c6ccb424ac74e3250c3c6a3631490276351111
- SSDEEP 12288:dK0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:dDgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T134C42391AE5509CAE34FC3F4D0E787D1E9E01FC672404E6B57E0B9531DBCC9A6AC84A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 3df2de4ced9d0d58f88ded9f936bf6159e941cb0aaddef346a0203dce6b1dddb
- MD5 d2db592b4e7b4e07044fb705fe99d5f9
- SHA1 b1c60150c96eda765c07b592840a2db7aaa4ae9e
- SHA512 3f693ec34d274a813a6e7a6fdbd4f6074f74bbc25be26a10ff5835e02a46fb52fb6273b9da7c4e6fbf90ce501d00711701cc137775629bd7c41d27762c4e57da
- SSDEEP 12288:1K0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:1DgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T175C42391AE5509CAE34FC3F0D0E787D1E9E01FC672404E6B57E0B9531DBCC9A6AD84A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 d5b883391ccc9fea81b44d9e82a2a1e36a496111ed4f0547f643297d7c3045b9
- MD5 5e90c59c8466556dc9e93e2a101fc319
- SHA1 8993d559d48bf5c234b18356fcf45ae3082c07a7
- SHA512 f03c6d29ecf26729f02e038a60122265fcef478410ec3caf9f086b828ed06c32d8ddb34994ce18889a4d502685a123bad1e10f1da79f5a8467feac4e2adb46e5
- SSDEEP 24576:zcP4mcvIjkGOxhKP2l71SNKbrh/8KBbgXe4i7ojhsP5Lgrk1TWb4AN5:IP4m4IpOO67N8Kse30jaNf1TWbdz
- TLSH T12065AE2DABDC0096D0BB917485A58A49FAB1742A2F3286CB1160933D3F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 9278e47503c04410259b11465eece0ced9248d45f2459c564315203d0bdf0cbf
- MD5 bcf8c1a89117416778ecce225eaee4ae
- SHA1 882ed57919c5112dec11be7b2fcf0f7cf080ec82
- SHA512 2985b9f660170ac74527ab5414a7491ea78891367e60562f9d0f921b9cd73155f1abf7d518ca7ff83da60e87568e7b172a83dfbff713d181726993bebb783ccf
- SSDEEP 12288:Absfa0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:nzgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1AEE4F15AD29802D8C05E92B5C3968A41F3733C5193E1C7CB13D0F53E1F79A949EE9A13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\WinRAR.lnk
- Size 1KB
- SHA256 0cd87e84462efc1b755a79587b770e259df6b4d95f1f55f6af0918225e166d2d
- MD5 e2414b86bbd9bd5e5bd6ea212ae33526
- SHA1 3abb23df7d5e3d9385956d231e799846f3b18ef2
- SHA512 ebc6b7f1a00001aea1e406d2eeb4d56d326f98f4552c859929bd01a4bcc0940d4db8e53b5ac391077f4b7ecf69dacee2fb99e2fa78bb65507247b47a6c9cc92f
- TLSH T17E11FC169ED62B20D6F6DE7082F66321D6B47C69FF956F0E004081482470A00AE75F5B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 02eb31e70f9de62601bbb7aa32c1f0392e184ec7b3b563e189834d50cd1c721a
- MD5 c1e1aa9e4c75ba0ba5d4f5f420d1eabb
- SHA1 6266c2c118c371f75105634c3fff9ded1165e9b4
- SHA512 e39701e1c1d1b2a69234ae27c8ee5e805b7aad2b84ee6ad8bc045f777e12ace05a452dd88373502417243ba43c9f33d97937333132beb49c79238a16d0c328ae
- SSDEEP 12288:x60DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:xTgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1A5D423629B9809CAF29FC3F090F7C760F5653FC06B00899B56D0B66319B8CD59EA852D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 520874046d8a64e8b2b620063dc0c2f5077bc3dad27d0c85a932f6132eeafb80
- MD5 e16a5539b9e2b7284503b9181eed5be8
- SHA1 98bfc3bb5d33bf09809a47e144585421425bda3a
- SHA512 9b648466f8c382a0c7748abf948b6a3ae5b977002669e99ce43543fc5619e6e479ff69c648a7b9234fa1df6901023dbb93fed212e5cd8b769d7f7db553a3ca65
- SSDEEP 49152:pa0h2GEkuAe73q3pp46zwwQAe30jaNf1TWbdz:pa0hNYG4Jw5U023W
- TLSH T13185AE1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1190853D3F37DE44E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 659KB
- SHA256 33a804f3a8b1283138a4eb84821ddfcc45e29d93e12d8c5711246624ca2c4128
- MD5 6d8fa9906a1f4b03e82f9fd7a0be1858
- SHA1 768d976afdafd2303faa0847c5df89dbcfc85b56
- SHA512 9f11d5da6f59801d4bf3acd1ad76bba8bfb042afc4867540f9eab1031cb4dd186205967da19d93b528b291e491982f7d2c0036d2d6d8c194e5503ab4d57edad2
- SSDEEP 12288:nhbHjfXV0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:nhbHjPigXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T187E4127E2AAC10C9F276D2BC91E28642D371BC55271187EF13D1927A0F3AEE85D38E51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 e4bb8b1cd6a2d8c9aab3cbcd8ce6925eda25370e8824d9aa6b5f90d335c547c9
- MD5 ef07a3e9dad1dbd7109000b7b56e83d0
- SHA1 b35b2f99d8266bd0110749ed7fe173893748d71a
- SHA512 f5145515e8ed26902f6583c0ab4ba7d9f2f9a5d4b53514319d07e5990d7c1af0230dedcf3121ced0b5424fbc829a484055eea2df7630aa0a282960c4fc06071a
- SSDEEP 24576:X3YgnJcRTk4yti+R5dpR/agXe4i7ojhsP5Lgrk1TWb4AN5:XIgnaTk46ppR/de30jaNf1TWbdz
- TLSH T1F245BF2DF2B910B9D4AAD236414147B5FB71782D1F209ACB01B0C538AF1AEE85E39F5D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 578KB
- SHA256 1e1a88ae899d8dfc20765c67503c10955b5478f9a58effd3da613307186e1eb9
- MD5 c2797d8db6c287038ab75089d7e2e65b
- SHA1 cd0ab688d16a7d09622c81e8809bf46d3264d85a
- SHA512 9a1ea0e9504223772d9b8b2b499af14859e39457a58f89656ee1a3aeb3a5f969a698933e62681a1f18215118fc37dbdb4c2801097f5a830994c9999e7a6128ae
- SSDEEP 12288:oW0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:oPgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T126C423959E550DCAE24BC3F490E7C791E5A02FC133054EEB16E0F66319BCCDA6EB4468
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 940KB
- SHA256 96c5b01ccae3fe7e80b9c0541dfc459f667634f899ec669a9947b20a9950fb50
- MD5 37396810fff8d63fdc265b701d872cd9
- SHA1 2e6ea54d372f7c940d98f56ebf53f090650d7bf5
- SHA512 36088221d4fb102ac18999def7c5ce007b9a33f668a3a9820c1eb63c2675ee5b3aaa69830a2087cf5d4bcaeae656350a91d89d396ba6c93e3c49c909d7b5347d
- SSDEEP 12288:ZObfA4LWOsvAYFT30DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAf:ObL3UTkgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T19625F155F79400F9E96BC27CC4A28A12E2B2789D1364E7DF03A84B661F637E54E3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 671KB
- SHA256 d5762cd753f50898b2e29bdd494ca48665ad041da8359807cee7b5c307857960
- MD5 7eeb24a82651b1694b53c750ff599634
- SHA1 9aa3225c28294310d55514afcf330355ddd6352d
- SHA512 d6eda6fc8d4c9a75bba3c06a4a25b2bacf21114763b798297645e0addb9abeeded52eab08970c0639fd0785da12ef64833c3565ba10bc4586627b9c18edc3dc1
- SSDEEP 12288:3pFtIOT0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:aOQgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1E8E4026A37EC10D5E16AD27C85D38349E3B17892171147EF02E081BA1FB7EF86C79A61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 6ee3291c7502c8c53000c3c70bbb33dcabb5c8fd67d739917efc8e837078aef5
- MD5 d0ac8a13fb33cbeba93eab7a4ec4ff75
- SHA1 7e9184939ad3c9e6004c95ec3daf30042e81afb0
- SHA512 344ab3d74fdbdafad9b248651f34c55dff220b0776a5241b6f27af8d38e1f455af0edc507634984ff231df7d541f89bfb1adfb92880841d8bbc7d3dc1d9eb390
- SSDEEP 24576:E7NM9YmZqmWMUkPjZM48Mv6bEhsDgXe4i7ojhsP5Lgrk1TWb4AN5:E7cBWMpPjN8DbEhVe30jaNf1TWbdz
- TLSH T12F659E2E6BAC81D5D577D13DC9E28205F6B2B4611B318ACF1262833E6F37AE44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 d0e40d8c2aff3f03ffc8f22604dff74701e453ef821d22b997087f097ae3916f
- MD5 20267df9caf83e15ee9d6d451b35cedb
- SHA1 6f0c2db7a95a47c75d174852831b0495239e72d1
- SHA512 604d624ee63c45b2b81fc810a4564980e04f112ce3572d7e7b2126b619fe49edcbe3333045423481e5fd1e8d8b99fcf7d1e510a220ee8293a0facae2e19d3889
- SSDEEP 49152:fF2YuHNETovcvNYf8kmae30jaNf1TWbdz:m6tCf8k3U023W
- TLSH T19A857E6927ED80A4E0BBD27D45F6D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 6f3338be4b8d6ff7b9997e179b883509c94070651f39cdd7a37079872048b666
- MD5 4b47efc2f3f92d9fcc756bb59d7a2668
- SHA1 33dcbb292783bac5b405099847cf14e1946acd20
- SHA512 1981bc5fddbbaa0a1625feb851d36fa8c9a04cfe15a4ca097d6980d17caeea16f9aec55330b6464bc6f2070ea209f960a6e3fd00b56201ba5bad019acb1a1232
- SSDEEP 24576:hAFs06+OmlfkNXEbTosgXe4i7ojhsP5Lgrk1TWb4AN5:2Fs060lwXuge30jaNf1TWbdz
- TLSH T11B65BF2F66AC00D5D07ED17D8A97C91AF6B1746307255ACB0260C63E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 885KB
- SHA256 c1f3d724b396ca707bda70fd9dadb8760982711f66e3b6bf333cc89233950173
- MD5 c20bd005dbb8ef41658d392cceb4f599
- SHA1 208ee2b6742106b84008d9d007e7996fa4972043
- SHA512 9b7fd1ef04f41907e5c5c6d3a2346bc1c2a0e55764b037154b6ff9a12c01ad6c4db7e267876672a460477d9b43be919f55d39365f1588928994078b8e0520127
- SSDEEP 24576:/JnJ5D3Wt1gXe4i7ojhsP5Lgrk1TWb4AN5:/JnJ5DGtge30jaNf1TWbdz
- TLSH T16615D02DD2A810E8D0B7C3B4819A5795FE72386D2F226EC714B4D5353F12EE09A79F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 e0d8a05c89bfe16978ae7c19993cdd69c0f76fb3adc23d0a0bad33a0cdf1acfa
- MD5 5747a449d40ab116e1f6c23e7678be5b
- SHA1 a7189c51c548be67f4c96f56cd0d47f7669776c4
- SHA512 4f07e87af34f2bb78b7ee8e65fba39a89da407afd3d58627186d1f2f5b0875f3cd1a8e59e5116795c03f65772c9d820dc6dfb990a0a0d074e08665e296fba09f
- SSDEEP 49152:So06DIKdwc+eQnSt65aVee30jaNf1TWbdz:TEU023W
- TLSH T171955C16BBEA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1D33BD1D934B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 661KB
- SHA256 2f7fdc5681cf5b7344e12834b8e928cc3096fd4712943f7136b0d9483689c870
- MD5 620dd9f04d6d628d51a0d5ed8634ba29
- SHA1 47499c0860e985de914e089f479a97f950170f4d
- SHA512 52df10ab8099a5ffd3e1ff4a996a31f93b897e94835bfceb50ce35af5d66c6d860232e704d532645bf06fe140daa0b5a49c3f3640ef46b3703cedb094241c570
- SSDEEP 12288:pEP3Rrg0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:6rhgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1B1E4126D6B9C60D9D16BD17C90E28741D3B2F4A127421BEF02E0D27E4E779E96E3CA10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 712KB
- SHA256 e7e19307769b94999039ba45a4a665489d4860c0a7be1c7eba3a8f6ca3308ac1
- MD5 57ff4ffd5c6155b041aad5126f6da20f
- SHA1 93aed2d0f8fe1d44ac7f232d94aee16a1355eeb6
- SHA512 c4a999e612351130db021ccc1b42c2af5b7f51340bf9f4ebe5cfde965855088c6c616a5d83023fec5e22491b96d6af20853a65a61d04abf291d4c9d9936f00e7
- SSDEEP 12288:0jkyF0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:0IyygXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1A6F41204679814C5E2AB8278D5F38390DA70BC606B108BEF51D0FA3F6F7AAD4AD74B15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 584KB
- SHA256 45b04b7169a58ca7da4d115875f4eca5199021568c3ce7087a41f96882841454
- MD5 965819ae383167f9605eb73d3579d496
- SHA1 7fbda91cfc7d7a21791f878e35fe08a1c04f2229
- SHA512 a06f72b5ee687e1de93baf723ff948e5b8d3b5a71620b7fe41f15b49a4dc1e3e99cb45f3c1f5a5b47e9177b5ec6eab160f47ddce95ffcde973744e2bd1405bb0
- SSDEEP 12288:VFD0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:LggXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T105D423695A5519CAE24BC3F490F78B91E5B03ED133004DFF12E0F6734EB88DA6AB4858
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 466ef96acb0f82bfd9382ad263e6e7040e57660211fd87ac5896ce36f550cc08
- MD5 1f521b00b1ad6aba09a4ddc08bd5f480
- SHA1 fedd572b1127c336ab492a18052ce67b1388aab5
- SHA512 e2ffe5fb7d23c0cb51fab8f8c0241684dbbe077448da2ea8b325f50662d681241d34b1f07a6212e803f05085ec0e393effc94748188926f88dd93dc0eb1ee8ae
- SSDEEP 24576:2Q9MxZKdcz97w3LgXe4i7ojhsP5Lgrk1TWb4AN5:2VKXSe30jaNf1TWbdz
- TLSH T13B557C2DABE909CAE177D27595A240C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 772KB
- SHA256 422f60592d88d76c10b17a1d5f55446bd2c1d883c4f58e15cdcc67f5e0dbc012
- MD5 e65a0eacd7f0a78082c8e1c577a8ad63
- SHA1 53ccc19a5cf6a37caf480a498dd4dd0c68357aa1
- SHA512 ce712d1c11ca2b490f5127a8c7c76e2a9e6985c276c7cb7a08898400f51265b3423fd83562c1c3f08879014aeba04af10b01a249ca920e2d3585082a5bacf4f1
- SSDEEP 24576:jyocxApegXe4i7ojhsP5Lgrk1TWb4AN5:GocxApxe30jaNf1TWbdz
- TLSH T185F4E01FBB6900E2E166C23C88868741E7B3B4702B5257DB52D1C33E4E679E9BD38B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 8c509ea83c4e082ce01e307368ee448fc2d2e1ec5eb8677f5c7d3edb78c00ff5
- MD5 0e5e7df9e99972dc281094e91a961f0b
- SHA1 3bb5217561c08349bab753fa6ca7b277654d3bbe
- SHA512 fcec2308dec77b2d574ba3faee1ef4a7b142dbdb41320286fe4045e1aefe4de95556d8a7e628116a67c40a1873df354747b1c8033f5132acf8a6f9a5d99db959
- SSDEEP 49152:8WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKxe30jaNf1TWbdz:20zuNINU023W
- TLSH T18BA57C3DA2BC00A9D9AAC375C14513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 6d1c642fb3c0446989f8ed5629a03c551b0565b7b13d450a9edba37d51394c68
- MD5 d4b6033c7475083d5f63159e71216610
- SHA1 dd027ef915359ea768f17f803c16708c61a4dfa9
- SHA512 9df5108293e513a1634c30ba0a7af391b75329d3f065f724a729a38f03be6280825c832882c26cf626ba94d86db7ca9a92391a7f5f0c7d0eb4eaee2dad3190ee
- SSDEEP 24576:61QT7EcpfxR+N5AWAz3ooiYujMqbhgXe4i7ojhsP5Lgrk1TWb4AN5:HTDxR+N5YzT4jMXe30jaNf1TWbdz
- TLSH T19155B02EA7F815E9D1BEC5789A23C512FA727851033193CB42A0C17E1E7B9D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 877KB
- SHA256 73e4c3d683298c2f49f911effdcd390e641947e10c0eddf41240ed33f9a6ec30
- MD5 75eb736bf342121294c50179c5c8ee4d
- SHA1 3e4db167c70f0df7b013059e4c83a8e73366f4c9
- SHA512 06c8adda2fd6af3e26d3f4bc7629c9390298fd545615cffd551f5685f194a41bced112bf9f59cb26ebb32ac2c1ee5b9af2b1a3735c13b3b6bdb209a7815da51d
- SSDEEP 24576:WTMdOz0FFS+bmSL9gXe4i7ojhsP5Lgrk1TWb4AN5:y0K+bmSLYe30jaNf1TWbdz
- TLSH T1D415F17EA76D14E5E17BC27CD6938A06F672386103116ADB06D0C17A2F6BEE4393DB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 635KB
- SHA256 412c1e044d496b941b7871c2ed24933ad73f5acd734deec874fd52fce7afe1b6
- MD5 9093b56fd0623d30f7829dcaff951f06
- SHA1 356b5c0694b47ea1d15ee1d83f63dfda3fc35592
- SHA512 1d8b06e3d4de054b98716bd08dc9de24eef695f64695446e8fd6b6de197b8895a535ac7bab45d642b423c706be0b48ee3b66c3a485328f4e184d2117955c1f19
- SSDEEP 12288:E4730DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:DkgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T182D4125967E824C5F167C2B4D1F78381D6707CA123104AFF26E0EA770F7A9D89A78B12
- MD5 SHA1 SHA512 SSDEEP TLSH