Analysis
- max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/09/2026, 15:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
- Size 3.7MB
- Sample260925-te38psfd74
- SHA256 5ffd12cda746da82a100c8ad3e58473d8a0cc756359a1ad72ef81a5a508b5bc2
- MD5 032702ba701635a9e8fbf8d5a191c5a0
- SHA1 ea559ac62d729701a07d41319cc1e9be3b2a8b62
- SHA512 9608f840bbf834694a2766921146d1b952f3af5e52d8e30a22182289ba599792f523a59058b96e07ae52e674e9bdaf643444ca7c6024a19ea4d7fcbdef221ea3
- SSDEEP 98304:AGOweUqCMjGfW/NZArTzb6xRaxC3Y1oe:ZOgqCMjGCunMP3Y1o
- TLSH T16A06AF1BA2EA41F9D8B6C074CE529907E7B2740943305AEF029055AA6FF76F04D3F729
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Stealc stealer Version 3 2 IoCs
resource yara_rule behavioral1/memory/2716-91-0x0000000140000000-0x00000001403CF000-memory.dmp family_stealc_v3 behavioral1/memory/2716-553-0x0000000140000000-0x00000001403CF000-memory.dmp family_stealc_v3 - Executes dropped EXE 22 IoCs
pid Process 3244 alg.exe 5788 DiagnosticsHub.StandardCollector.Service.exe 3736 fxssvc.exe 1232 elevation_service.exe 6100 elevation_service.exe 5968 maintenanceservice.exe 3556 msdtc.exe 6132 OSE.EXE 1380 PerceptionSimulationService.exe 6040 perfhost.exe 1916 locator.exe 2812 SensorDataService.exe 4440 snmptrap.exe 4036 spectrum.exe 5608 ssh-agent.exe 4380 TieringEngineService.exe 5532 AgentService.exe 736 vds.exe 3516 vssvc.exe 1800 wbengine.exe 3132 WmiApSrv.exe 5340 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\F:\ 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe \??\F:\ alg.exe \??\F:\ DiagnosticsHub.StandardCollector.Service.exe - Drops file in System32 directory 38 IoCs
description ioc Process File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\alg.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\f266b9fc227ba850.bin alg.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\vds.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\locator.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain alg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain snmptrap.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WmiApSrv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WmiApSrv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname alg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname snmptrap.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a9dfbad5064ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000316240d6064ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb0100d6064ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000019c604d6064ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000371251d6064ddd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a1dffd6064ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000692645d6064ddd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec62e6d7064ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae080bd7064ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 5788 DiagnosticsHub.StandardCollector.Service.exe 5788 DiagnosticsHub.StandardCollector.Service.exe 5788 DiagnosticsHub.StandardCollector.Service.exe 5788 DiagnosticsHub.StandardCollector.Service.exe 5788 DiagnosticsHub.StandardCollector.Service.exe 5788 DiagnosticsHub.StandardCollector.Service.exe 5788 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found - Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2716 2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe Token: SeAuditPrivilege 3736 fxssvc.exe Token: SeRestorePrivilege 4380 TieringEngineService.exe Token: SeManageVolumePrivilege 4380 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 5532 AgentService.exe Token: SeBackupPrivilege 3516 vssvc.exe Token: SeRestorePrivilege 3516 vssvc.exe Token: SeAuditPrivilege 3516 vssvc.exe Token: SeBackupPrivilege 1800 wbengine.exe Token: SeRestorePrivilege 1800 wbengine.exe Token: SeSecurityPrivilege 1800 wbengine.exe Token: 33 5340 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 5340 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5340 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5340 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5340 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5340 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5340 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5340 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5340 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5340 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5340 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5340 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5340 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5340 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5340 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5340 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5340 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5340 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5340 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5340 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5340 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5340 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5340 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5340 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5340 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5340 SearchIndexer.exe Token: SeDebugPrivilege 3244 alg.exe Token: SeDebugPrivilege 3244 alg.exe Token: SeDebugPrivilege 3244 alg.exe Token: SeDebugPrivilege 5788 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5340 wrote to memory of 3844 5340 SearchIndexer.exe 116 PID 5340 wrote to memory of 3124 5340 SearchIndexer.exe 117 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3244
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5788
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1640
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3736
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1232
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:6100
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5968
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3556
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:6132
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1380
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:6040
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1916
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2812
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4440
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4036
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5608
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4436
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4380
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5532
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:736
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3516
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3132
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3844
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:3124
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 900ecd6d9c5f497e25df7773a295f6b794d16228be32cad291777abe812e698c
- MD5 60490412bef732704a5dbcaf1cd2d69a
- SHA1 170369dc66cf777af1b62549dce5f4fd35697cd8
- SHA512 adb09fd26e4c262d5bc150f418c4c6683ee06b9548442014f24c20b5c4b5d00cdba4a0a77e71c4abbe512e84ce110475f42ebc96e0b7cebe826baab63ddd1340
- SSDEEP 49152:Cb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnYNoKRaxC3YhweoMLa:k3q6mjBbxRaxC3Y1oe
- TLSH T17BD59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 9d0e85a655e62709e67012a8fd2d399345232b08d67e5401b65f7b12bd084eb1
- MD5 63593e5544be00c62c78f3dc1be902d9
- SHA1 b38b0ec9f0053dd1eb81d4064449e8818ee7e5bc
- SHA512 81aa89bc9b668d08aa387020b4967e6ff602d0246143ea50883b17b741a053a6bb9020fb1a06493c192a9ee079bc69f85daad60478935d76f9d0303d302dd3fd
- SSDEEP 24576:9XYfDtczAnNou5MEdf/RavguX1c3UrxhVmerUZyLeh:otcuNoKRaxC3YhweoMLa
- TLSH T15205022867D409F8ECAB823CC9A28511E733789147A0E79B03E496765F337D85E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 8921a57c3a480c38f77a12adac7df5bd479550245eccba70997f404852e296b7
- MD5 e86bfd5b5de3e58b5fd57855174b97d7
- SHA1 ba1fcd563684ed108a19b238880f4c553aebf7eb
- SHA512 1d36e3cd7fd4f2da57f9b1b3e524031e83fce582388b60b949409429792a7ad72dcbbc3ef38e829dbf38bab4732d9c676a816e5475520b27a62dee1676b5dd9c
- SSDEEP 24576:t0Le5ji0hmxhrMgNou5MEdf/RavguX1c3UrxhVmerUZyLeh:tPji0AzhNoKRaxC3YhweoMLa
- TLSH T168359E16F6748335D073C0B9C5D2A69AE97130825B308ACB4286D77C7F67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 cae05d2f32c25b2186b050b7a4b80222a2fa858fa211c9efb59b332a3c8a1018
- MD5 eacfd80ad7b04ef2d2b1521130d3a1a0
- SHA1 d1b91c0c4d5ec83f07ab4e1439ba76208a52e0ec
- SHA512 3b054ab32f00f336ad94ed6d0f2da0ac3350276efc861217726e8872c4f3ccdfad9f9bdca5c4dc560e50a501c245f846f5d3e2f364756e2a2a3d8b2afa68d462
- SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWj6q8wyueNou5MEdf/RavguX1c3UrxhVmerUZyLeh:a/ezSC6vUzPv+HjydNoKRaxC3YhweoMW
- TLSH T1C5756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 b2c2e33d0ea6e7a27d47dc54f83cf318e459923cb921bdceac92893e2ed60539
- MD5 60d32852f78e2a5322963002357f4092
- SHA1 b848c7d3f7fd931bc049b92df35539c362a2d835
- SHA512 c15e55e39a3c082604dabb526e459e397699206fe8b8b085777a061af5136b73641559eb20b55d13547f08b221a06d86b3b32abb9cbd8455dc50f2b83d936583
- SSDEEP 24576:9VbqPb88hv/l+BLNou5MEdf/RavguX1c3UrxhVmerUZyLeh:9VO88hXl+BNoKRaxC3YhweoMLa
- TLSH T1C9559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C2E677E6C636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 60e6f207ee14dd61c99921ac3a6cafe2c6cc163fa933a6ab32b6a21766139cc3
- MD5 ecf460a522f3886a6991a9e500cf3e39
- SHA1 f66188120585767c0a62a71c153c2aeae7465505
- SHA512 40bfe11fe9733e326e26cdf8936f9a9d4d34274a75486882104e43ee90dfd3979e77a4bd0bc886e5034c7952c36394d022c169bcef51bbfd6ebaab7c76a901d7
- SSDEEP 12288:DGEjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:DGENou5MEdf/RavguX1c3UrxhVmerUZT
- TLSH T1BAC42306891D0684E3DD1335B79B14E5E3644DF5FBC01627AB8073EBDA34A79C92B1A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 b0c79f2aedc8941953449f348f189d5c1a787b229f7eb633fb52a3dfcdc8cdbb
- MD5 9bd95303270f527b9485f5a37d7d3895
- SHA1 79c97d4547961d46ec697df76ec4c37ad21e5f54
- SHA512 3c956e1074529ac6d8a17b83e5463341b373243f6bc9aa440cf4a24930f1073bdd2b7596e708e04516d29011136b438b598594c4a628bd1c47f86f931f97f721
- SSDEEP 24576:eJIUTNou5MEdf/RavguX1c3UrxhVmerUZyLeh:eJIUTNoKRaxC3YhweoMLa
- TLSH T1B005CF3BEE28ECD2C27E8D785B918640E77278704B51A3CBD165830EDE235E55E3AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 46214058ca8b10789afe20803ffa41b171bcb64d641799df66c7ba38ef75c4d0
- MD5 e2878f4a51395b70616a3c33c021972d
- SHA1 9a0965378c245f7c7a7b38bb4a70316408945987
- SHA512 90a35f323a26d2abb0c8b7a5f6d12426ff1752d40f1ef5eb107c6edcc21bd363d3e7d81f5de1ca7edc85f9379e3831e5acd1afc692f29da507885555e8036879
- SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THz:WQvGAdlCEL8c/WRNw5COxRaxC3Y1oe
- TLSH T1F7266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 506f14f87f32aeaa585b429aaef2df55a5a926596dd309371ccaf8788759dbd0
- MD5 63a50ef95c076f33336813a53864468a
- SHA1 7f9b8949629d47f20bf679ad4faed6df030418ea
- SHA512 2f6bd27d05a0e4de3776cc20c0b236ced3801d6c9b8a4da3a4926b5d5e3116af02e266fd16aef7c224463d70907a93c78e2927c5a65e4258293726d075d78053
- SSDEEP 24576:mfewsAjRNou5MEdf/RavguX1c3UrxhVmerUZyLeh:UljRNoKRaxC3YhweoMLa
- TLSH T12D15E031FE74D436C3BF0DB61B26C716547C79604B911AC3E3E89A9E99302D22736A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 3d559daced88df065974f2d834b29acd325abd043ea92f98bd091e8652cafa16
- MD5 0a6466ed1b6e99c7309d5c345845c46c
- SHA1 aa7c32d038dabd4b9d3e4f2e5b18b05ee64be14c
- SHA512 33f600d77298ea1748d7540aed52acde5ad7c11db6a04e5cf90935f9dde53eb9961f272b70ced6ddfc8cb513ceeeeebaa56c941ab5f520cfc3c6ef13e13a3395
- SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHZP3Y1o:5UEtQevvqc2W1cpV20I32Zw
- TLSH T153474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 bd4a6327fd8b8c4c737a64b7e45f0d1c829fae4a9ef5e9b90106dfc2f2751827
- MD5 270c8c59f680836c064dd64fb13fa1fa
- SHA1 06c5f6161f0c52d0d95873e7ababaf996c5bb073
- SHA512 bbd10eb92a16bb5efd38ce4258e4d8a99c1936084bf012a1ccd7748a06d448d99ad3b63084716974eed26a3ee921e4cb373e40a830289c5cbfcfe7766c441695
- SSDEEP 49152:yCbRquA/m2yL5zTfFiV+XenmE3/zxNoKRaxC3YhweoMLa:XoquVjnmKxRaxC3Y1oe
- TLSH T1AFD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 56e6b89d37539bed3ad9e071101eadc3d023738a732f8eb8c2fa3e4c0f197f75
- MD5 ca60f70619c230e1b3903be650cf12ae
- SHA1 f2e862836941f005890cb02ccd63f692339e0096
- SHA512 a2794ae0c2fa1eeeea3046ec44d4105bc8917240c33901deae2adf577a5828dcc146dcc67fb96ff562e89c629c04d85a1e11a4fc41218bfcf0069706687aca16
- SSDEEP 24576:dAhGL6IFoiwtA5l7S53qNou5MEdf/RavguX1c3UrxhVmerUZyLeh:dAM5Foiq56NoKRaxC3YhweoMLa
- TLSH T13D359D81EBF945D4F5F3AA7899B69171EA76BCA65E30C20F2150D21F0E33A509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 4a0919a1d6508db53f4c249919844ef93ca225987c89e6aa38f78d66e5f6032e
- MD5 57db3cc4dda4f1ecdeca30cdd9c775ad
- SHA1 b4b419a70c37a79e82f916bb24b81993533b27f3
- SHA512 e673d95b0425294fdd2a699b7b2718de9f9e0575c2d8e9b3a7ba5fc12c49183bfaadb0fb352658695ae9398efe5b181865385c2b83569c0251ecaf9680df0fb5
- SSDEEP 24576:VwuROW9Nou5MEdf/RavguX1c3UrxhVmerUZyLeh:VwSOGNoKRaxC3YhweoMLa
- TLSH T10105F10666A80CF8E9A74238C6978536F7B2BC522A21D71F1760C75B5F37361AD2E720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 4c125b73eb23779d77baeb2d0cc2df0d35067b16ff779056548c47c9c429d9d3
- MD5 2271dced180aac9c620738830abfee41
- SHA1 b10ba82ec61a47265a59c27d336e0a0b94574e0f
- SHA512 b4e3e20e142b5c23bb553b6109dbd1c511e3bf72c5b9d6670a55cc2f34b5b711f297a9bc322b77d11526001003760ea27913e8d4524f3921e4d69a6bcb8e0848
- SSDEEP 12288:kyZ1IyBjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:ZZuINou5MEdf/RavguX1c3UrxhVmerU1
- TLSH T1B4E4120A26A821F8E1EB533CDAE61545E37178A2677143CF165053AA5F33EE64D3A333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 c06a27c3c8e06d27d9c8b8e886eead489aeb2e362e729b1839c791a5c6448fed
- MD5 9cfe909226627d2670b3a6ebe5aadbde
- SHA1 5a989e69a02528db3369be412d9f56509476dca6
- SHA512 7d7f3e6dc7de84bcbb79964975e96ee159af9ef597b6be3f6f3a5059bcde19386a2ece1436e0190cf519720dcb6b8d16e093a184f71d8ef4899f92ac9d9a5c18
- SSDEEP 98304:4QRQyi36YOcPDLvw2gAf+PN3PxRaxC3Y1oe:vQyiKanX+PNPP3Y1o
- TLSH T1DB667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 5e1f51384e60277e2cacf13531f7c20809715c370555afd6ff4409f86d63d794
- MD5 f9e5093ae33699378a531d8125fcb507
- SHA1 dc3f6bdc0e71ac563e50d055d316df6b087a749a
- SHA512 4305fdf8110a5b933b0594a6319e206d9792e235bc2f09c556ce6b521439893daa41679c1f6ad26a5f412de8f151c6da246702ffa276d831077443366363c36f
- SSDEEP 98304:MQRQyi36YOcPDLvw2gAf+PN3PxRaxC3Y1oe:TQyiKanX+PNPP3Y1o
- TLSH T1FD667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 918b645349b808f6ab09e47b326f5e78407c612f032c135aba9d6a3c830f439a
- MD5 558f5d6ff49109e93bf7fd867a00831a
- SHA1 f35dad1677405f61ed2afeb8827d972e2c6d292a
- SHA512 f589b793003a915b3d9e490660f9d71f83fe0166a530004a6b65749a9625898e59d19497bba9fdbb498436126b68c60248aef98ff910eb67cbd06685c754f1b7
- SSDEEP 49152:P68Qg55nhkeWu7PNU3/hNoKRaxC3YhweoMLa:JthTRc/hxRaxC3Y1oe
- TLSH T148B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8541721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 62daee9af725fdae3c322d076dc42e165aa59c78f538110cdb9d405e014ce7df
- MD5 8901a42a279533a29bbb3fa3c50e75dd
- SHA1 d9c34a7821d111089511a01f9d82f9ee02289769
- SHA512 a1bf376a1b801dbd3e419ad564aab07510f8b95a3b43f8317ea6820ca1f34bd36ed977020464ce665d102f31c361f9f53b82421b07efd472fdbfaaec3ff58891
- SSDEEP 98304:Ty5112gYy5azzVvU69nLKnhZExRaxC3Y1oe:uLIHRWhEP3Y1o
- TLSH T1F8167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 16f744048f5927c0522a6a79be6168a4c5f9488fe175590937b7a690f692ff8b
- MD5 74f8df6889fcddc751d697561c8fd950
- SHA1 4dcb54d06f88a3a47a779a47132fe0734f6e8d6a
- SHA512 89162d9decaf7708727488f03537a50d23889c6fc3c8b61a34df16df8a7e50c26ecd57b02e444044d631a87a9a987e2c3b9c2a14eb143788cfee13dbb4b27a00
- SSDEEP 49152:tB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl3NoKRaxC3YhweoMLa:zu6JmIxd2d3xRaxC3Y1oe
- TLSH T1ACD59D13F1DA01E8D05ED178974A9233EA62BC490B34B6EF0A9073562E77EE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 f26c3d6687a3795eff06e13aea503d497aba1151795c881b7dd3656673c86bdd
- MD5 f5d8ddb4d5756add7780361cfb8f5e44
- SHA1 c927f6ddde27f5151e1e36f656a214dd969fd274
- SHA512 ca1f7cefe5dae4a9ee4375d366ff9fa152695d111fc51cf1213db3bd07ec2b875e7b8c969cb0ec6f18ea02ce4805ffb6bce4ee7f0f06ce6898e4f6908f594c29
- SSDEEP 49152:x1hpsNoJpF1A67U44CwH7R4xzNoKRaxC3YhweoMLa:xmifPqRKxRaxC3Y1oe
- TLSH T191B5BE13F29901E8D06ED17887569232EA62BC460B30B6DF0A90B7961F7BFE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 6b2190d2af85e309c9d5aed390ccaa07ff38e21b3e4c41df7e1317b0dea945a8
- MD5 31cbf76c8221e59d85e80a46d76803e5
- SHA1 b77e17d4ce063ba5ce6b0facf55da0bda840cfca
- SHA512 d327df5c93f7001c9d3e208c807d12a8b3b8aeb8d9427229a74af5b91f8d6cc873651081468235fb6eeaff335f35d336f38402f3913764bc8f92de5adc4d733b
- SSDEEP 49152:iSuZQIY0Be2KkRVtOnks6NMHqINoKRaxC3YhweoMLa:85dKqi61IxRaxC3Y1oe
- TLSH T181C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 1fb02c7ac7a6309ff70590599b9ec847757d26265d7fc518a87edaf3eba806c9
- MD5 3517fc75845f08d96a10a4c05b8b367d
- SHA1 d8f84b63427525d196db5b369dc871dccec35c3d
- SHA512 98438992b8b1f6b1d819583d41fc5840766e1fcf0a02057812c531978b275fb07e759a2ac2d940f4c696791d6348d758899389947a0b99e3aa3080266af8217d
- SSDEEP 49152:KhtSn8EApI0figjgiDn0AP5wnNoKRaxC3YhweoMLa:rX2iWphmxRaxC3Y1oe
- TLSH T10895BE13F2D901E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 a0b1409d599ca57c5190f87339e7529dc5dbae2fab732ec7bab6fa267e1b2946
- MD5 d50d6ea42d8a2034fd1f7c0913dcc9d0
- SHA1 ddf9ff9ccfef731283b2c45f9f4672628739e66b
- SHA512 331911b461571ca457d0c910f8d8adddd43516027f381f08df3a85f49b78d02fa28d1eb424bd18230e9e8ea469c3222032ff5c4340814a2dbc2191451fe4f4ef
- SSDEEP 12288:PMjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:PMNou5MEdf/RavguX1c3UrxhVmerUZyW
- TLSH T122C42306881E4788E1DC4335A79714E5E3680DE6FBC11237BB8473679B31ABA492B0A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 c77b0924f4bef9bd092b6febea6827a656ca1d34d69076e6440e2894137112fc
- MD5 1eddd23a3a02328c62068430328527d5
- SHA1 01fb37a9586e12692d1b9eeb617f838cd0580d2a
- SHA512 50b8ee0c50c7fd8d3c766f6601ada6fffc942388134fb805e3f7831c4591b1a207f836508483b3a98e3883bee944d43f5aacdef9db2569d376e5141623a3e2c6
- SSDEEP 12288:f1jXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:f1Nou5MEdf/RavguX1c3UrxhVmerUZyW
- TLSH T120C42306881E4788E1DC5335A79714E5E3680DF7FBC11237BB847267DB34ABA492B1A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 8a679533e7c8b73a44adce29407854216e7aca8d1470caba68a6222d72213efe
- MD5 7037eb3ea52ccf1753f541b4a4ed85b6
- SHA1 4f478c2584920bd8ccf9bcadbd9da56714b24dd7
- SHA512 3cfe9ce1c43ca9f00493d1201bdd5011f58751dace1e5c7a078d792a13de2734732405c884e067af87ee871fa1a9515b848a95211b8734b8b93819ca56a53214
- SSDEEP 12288:rbjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:rbNou5MEdf/RavguX1c3UrxhVmerUZyW
- TLSH T1AEC423068C1E4688E1DC1335A79714E5E3680DE7FBC1123BBB8472679B35AB9492B0E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 e27588d354b99f9f595af3f492e6b046d30c5b9358599e9fdda73f10d5a2a4c9
- MD5 91107672ce6c4d7d9aba38c6bb0d6479
- SHA1 cbe24c03ef8ca96a3e60f9571a2f944db2dcd2b7
- SHA512 d9681100b7f686a0d82c73c6fc413a695c64882ae286aeb8ed4335de747b8d0d20b7e8a1c80502ebd8791a0c796f1bc2f57d532ef1f4263bb581b646bf609e5f
- SSDEEP 12288:uVKjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:RNou5MEdf/RavguX1c3UrxhVmerUZyLa
- TLSH T165D42306491E02C4D4ED9338DBA714A5E3B47CF5FB51136FAB4022AB4F317B94D3A6A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 a1ec1de93c6767ef459f0ef5149480d5b6f964a673d2e9c5978110c932fb5083
- MD5 e17add35caf1caf166c4fae23fb062dc
- SHA1 0747c1e336e0846fb7786c3c66d55abc65032dbc
- SHA512 b7e70d75dc4781f14a2599190cacd44596fb7d6e2b8db6ba66afa7195fe2005332dd81c04828eafe399f3a6b485358d69d3defd2a35619ca4532b3c7134a1f5e
- SSDEEP 12288:3ijXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:3iNou5MEdf/RavguX1c3UrxhVmerUZyW
- TLSH T1BEC423068C1E4688E1DC5335A79714E5E2680DE7FBC1123BBB8472679B35AB9492B0E2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 3392d829e662c21a4027997798b328d0e2f344fd18f848f06ea6c12c1da7199e
- MD5 d2b153bdc118ca56c98368a048948a81
- SHA1 22f96675bed53b007262c3559c892db82032021c
- SHA512 47feaf76b02dfb31a3004232d5e730dd08e133f01c0138654d6b1808f6d6d7edde6622c51591fc8a2e634db35c79d7a6a435d5eb5774ed1852624a5fec845fb4
- SSDEEP 12288:u5jXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:u5Nou5MEdf/RavguX1c3UrxhVmerUZyW
- TLSH T11FC423068C1E4788E1DC5335A79614E5E3680DF7FBC1123BBB8473679B34A7A492B1A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 28b3e88959b9fedec7f8115f464cfce14a8b09b2776097f07f655a8e11b412a3
- MD5 5324b6a9cdd830ad0eb31ab2143496d6
- SHA1 d77004fd33a3d9a94c1e5104a49e402b29e9a7d4
- SHA512 5dccb43f2c3b9ce775eec9ff1e9536802c57ffd647122c4a0dd2982bf0b52ed54f318465e6dbd7233a4c427a00266175df4197f45759fdd691b2edb4307c06b8
- SSDEEP 12288:5NjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:5NNou5MEdf/RavguX1c3UrxhVmerUZyW
- TLSH T1F1C423068C1E0788D1DC4335A79614E5E3680DFAFBC11237BB8473A7AB75A79492B1E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 1f84c2f783d110c14f06b1226439ca0d97f092312baa645fefbf92cacac3cfe5
- MD5 6fce2aca080d637e22a1e30f43b66b88
- SHA1 ec95b6b979cf50d5b3a059dbf04c091a53dffa0c
- SHA512 1db8ef51ee36e3718de5c99c0da70db759028b65848a1e8779292b79e97eb3397db77c001f8a22b9be7cfe23d0cc34ce353163857332809e58370d9ec5750b19
- SSDEEP 24576:pZM3zFVSOVNou5MEdf/RavguX1c3UrxhVmerUZyLeh:pZM3zfpNoKRaxC3YhweoMLa
- TLSH T13E050155B35008F8ECA7823ECD564916D2B27C6A5BA0C61F13E436675F333A10D3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 7756ae63e3907247e4d77014e836b22b7b15fdb1c6ccce314a78fcd427ff07b7
- MD5 c11cae77aac0ccf354b68ac2bf3e30c9
- SHA1 11077392c666cc7478e3bebc44d226fa0c46b030
- SHA512 4809c0fc08868fc1555c174f04c8a3be48eb2faad8a63ea0ef3464c8d3d51467de0c8f6287b9ab606eab5c0c3775c756acf3975ce3bc2b410688bf99d9c41cc1
- SSDEEP 12288:K4jXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:K4Nou5MEdf/RavguX1c3UrxhVmerUZyW
- TLSH T1A7C4230A881E4688E1DC1335A79714E5D3680DFBFBC11237BB8473679B35A7A492B1E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 e679d26c443226c16c667a62e1b7467b40ad9c8668c37154ea3e206307297798
- MD5 bd0a091190e4df4d2de4de2be873b4a9
- SHA1 2ac5cf1f7a5996785cfc11f2f9b41ab9e5495517
- SHA512 1d6e058b8ad0e39c937b79bad262adfb5c3ba54c4982815876e71768e22f2d342d5c9d64361e6f29240fa8f2ea3bc380e4ef1dd1ed3dec3f469f6a040988722a
- SSDEEP 12288:s0jXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:s0Nou5MEdf/RavguX1c3UrxhVmerUZyW
- TLSH T1AEC42306881E4788E1DC1335A79614E5D3684DF7FBC11237BB8473A7AB34A7A492B1E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 04b85f0264133aee7cc260e408912c3af4a8897712b6b5105fd53c31fe048595
- MD5 3465e5e8f64b13fcd650d14331112c54
- SHA1 6b8acdd47d392540d45c36d1dcc1f80aba299a86
- SHA512 18adc8911c8e0280e2f9c2673ea9f90cb8810d9d0b66d1b0f5ea968b541e0105b6c54086cd49ef70b00b82ad05f72f931e9dc9829855c8f4c0a3a815fd04eed9
- SSDEEP 12288:wyPz5L8BjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhZ:BzyBNou5MEdf/RavguX1c3UrxhVmerU1
- TLSH T1C8F4120766A521F8D1BA8238C9A21952F37578725B608BAF179013772F336E18E3F771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 e967f87f934ddf81e7851fd8dc0ae51ee50d28d1b852c851cf6ac2ce68e5c963
- MD5 f3c5111e56849cfb019ef40ed4e9a70a
- SHA1 475cf08d1ba894515b34ee47284ece10eb239af6
- SHA512 16ce97a05751bd1f50dde21f817efb02e5c69a00debaa8ba5d180da45010f903a2cbc391e1c0bda9533b044376fdeedb2ea7f9b99dc4940f59bf9f9f4d6d26df
- SSDEEP 12288:z4jXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:z4Nou5MEdf/RavguX1c3UrxhVmerUZyW
- TLSH T1CEC4230A881E4688E1DC1335A79714E5E3680DFBFBC11227BB847367DB35A79492B0E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 6ed0b0ab7b10282fe62a5cd74ead91e7e32fcba308ca17d26072e01f8b4174b8
- MD5 99607b89b2bc07eba0fa6049a2a1fc94
- SHA1 50200e74701fb0add88cac6db2dfc8eaa597f179
- SHA512 86caae4473317be18b2fe192aa4378e00e3f6a1cfb570c3a5aa6c5d2b9ef89f83b62582a8ffad32f835d9427fde19344d41e38961d5366fbadf2c91fb276c530
- SSDEEP 12288:24jXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:24Nou5MEdf/RavguX1c3UrxhVmerUZyW
- TLSH T1E4C42306881E4688E1DC1335A79714E5E3680DFBFBC11227BB847367DB35A7A492B1E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 8c267eb5eb14c5a126600f736edb45f0bfef398d2619140a63382ba99725262d
- MD5 a021283942953e7265a156268b6aadd5
- SHA1 e0cde01fc777bd3090f35b8ba12fcda1e1527269
- SHA512 b281ad0bf6091455bd9c4c4ea6201a9e1e622bed18f5b64b175a7305d9e9ee7688e936feb9023091f952d0fbaee91e4206fa79da3cba2084a1aa2f9d4295b2bc
- SSDEEP 12288:iyPz5L8BjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhZ:/zyBNou5MEdf/RavguX1c3UrxhVmerU1
- TLSH T15BF4120766A521F8D1BA8238C9A21952F37578725B608BAF179013772F336E18E3F771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 da266b13dacf60231eca480ae32f3433856a1f3a522af1d5e62923cffe2d64bc
- MD5 37c0daf13d39954561a2f447b623a727
- SHA1 debe5ff16f0d141a7058c9fd877086301f4b7b60
- SHA512 9250aaafdf3b94dab962655477377026363ba67f06196a2ecca68c345f1d7fd36944237f29d1104ccb589237618f53c47f1a4fee8f911ee9d75977b37b9b48a7
- SSDEEP 24576:ccP4mcvIjkGOxhKP2l71SNKbrh/8KBwNou5MEdf/RavguX1c3UrxhVmerUZyLeh:XP4m4IpOO67N8KONoKRaxC3YhweoMLa
- TLSH T19165AE2DABDC0095D0BA913886658A49FAB1742A2F3286CF1160933D7F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 c200ee6d79e553bdf7d86eca201766d597d9e888c75723c2428959d83a2bfa8e
- MD5 0c3906ea42ee2bb6076a1157b4f8d4f3
- SHA1 62888d9006f695ee635facbdb2ea87881007c263
- SHA512 f3e41ded5782834e52bd600e7ac9a6201d22c3b4f376d3319875051f68040d8e249bad76f074c5109e0d60a059546e92a76317a23e51d94aa16a5b1296c69ccb
- SSDEEP 12288:opsfIjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:JINou5MEdf/RavguX1c3UrxhVmerUZyW
- TLSH T10AE4F10AC25802D8C0AE6239C7560A81F3377C6597E193CB67C0F67E1F366A49DEA753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\McAfee\WebAdvisor\2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe\log_00200057003F001D0006.txt
- Size 2KB
- SHA256 7fc4fa9fc7162bfc50422c63f448b5e79bf18db62212cb4899b969a265429ca9
- MD5 15032bbb99eca44d9199e206a396303c
- SHA1 486696e5ca0bda85130862d41d3a0a2fd2d7f621
- SHA512 045b1b9dc910bf682a8816a1b300caea3b8aa1f5aea94955f570a922d9c69bb3f7ac13bb5cc5777d38a7f9ba536aebc78fbae2a176d6cadc5ff88d09ba2ae7e5
- TLSH T1E851556B732FA51F293195B2F3E281F126B09099A34B7CFC621C591C8289B346DDF048
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\McAfee\WebAdvisor\2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe\log_00200057003F001D0006.txt
- Size 3KB
- SHA256 3de83f2d79ad5a815cf022ea371cc14a80c427dbd0ef32e46ea16450040bb5d2
- MD5 cd27e359b90c58459b19342bd5f98381
- SHA1 659ec837a67625f3484bc545ac9d5db1e3a126bc
- SHA512 9db37f90810bb4473e34216f8872da437c6ac439c93f5971dc800bb6976a6fe13906703db04673bd507e274f2e39451e9f38717161e5b0c7d1473e1b9325fae4
- TLSH T17D61586F732FA91F297195B2F3E181F126B0909AA34B7CFC621C595D8289B346DEF044
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 0c982fcab3a85e8aff524b0ab9d0d81ec027f8c968f9d71851ceceec84d27526
- MD5 826fd19535b6a5a44eb83ae89e636848
- SHA1 33d94b425a29f36742c4467e6d6fea56096ccb74
- SHA512 5d58441e7329563174d90442e933ae8877ee06b8164cbc81af807f606cda153da7c07fe34bca1535040a644d14d8a79197398afc099e709e603edcb3b420c9b5
- SSDEEP 12288:VojXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:VoNou5MEdf/RavguX1c3UrxhVmerUZyW
- TLSH T15CD42306891D4A48E1FD5334675714B4B32C6DF5FF80522BBA8073AB9B34EB58D3A163
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 28fd0310f3c0bdb1f61354c0e8dc2e9af445e25f40573df720a5a902759a7265
- MD5 03d102ae3b68c1f398e1d70a02e04ae0
- SHA1 95dbd848d35f00eac16ef9c493c35b871ff3c54c
- SHA512 64bf411fc58fe9ae1f4ebe7063958b146924b63cb85e77eafdb924b6a457517e29930e1e9c504b0f2775569e793265ce5cf0002dc745a77ecf6cea64d064e795
- SSDEEP 49152:Ca0h2GEkuAe73q3pp46zwwQiNoKRaxC3YhweoMLa:Ca0hNYG4JwJxRaxC3Y1oe
- TLSH T12E85AF1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37DE84D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 659KB
- SHA256 7d9fbbc2ac3f16174b0edf2be9263adccd861eea0d47450768b979766114d3e7
- MD5 c2bfd596047248a45958ff58113ca509
- SHA1 6e21cf429cacece853cbc92ad6dd633326faf9cf
- SHA512 cc330f63cfdc6a1bea5284bb1d7fc5f0a05774af22cb80fd70a2f7758c3bcd93ed9b13350604f4172396948bf3ff221c5f79c14b842eba40f485d84da420d19e
- SSDEEP 12288:thbHjfXFjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhZ:thbHjPFNou5MEdf/RavguX1c3UrxhVm5
- TLSH T186E4122E16AC11C8F1B5A23D96964546D330BC662B1153EF23C1927E4F37EF94C3AB92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 7baf1339fce48f7f64c3a1d9b16c8dc0f6eab47fba831b599c9ceeddad465592
- MD5 164ddd4a6648849b30d7a08335f0092a
- SHA1 b70e55422ebb49cf012612dfe2635a6848c4381c
- SHA512 42a17bfbd7a70082817377e9a6fd552d5d25b1c09a9bfefcc0a025390245ade8a1324d1646c6f8e6c1204eafa8bce4169ca02fa4246ed4025478040e3490ed5e
- SSDEEP 24576:m3YgnJcRTk4yti+R5dpR/9Nou5MEdf/RavguX1c3UrxhVmerUZyLeh:mIgnaTk46ppR/9NoKRaxC3YhweoMLa
- TLSH T13945B02DF2B910B9D4AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85F39F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 578KB
- SHA256 56b912cec0dae017dd956d08c70797fd9ce9a06bc7a2aa5f1189b9956d7a8fd5
- MD5 a69c6628ce59c72860db7773a38b45dc
- SHA1 069cebb621ec8add77d21f51f68902bf3bde1cd0
- SHA512 4f9ffcbb9cff780279ae07c651c96549a6bf36425a4401b818688b581bb1ebae862ae0ef0ef0fc92bca54c2366bd896ba5583a28582e08e37c796d4ab90a1059
- SSDEEP 12288:ckjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:ckNou5MEdf/RavguX1c3UrxhVmerUZyW
- TLSH T199C4230A880E4688D1EC5335A79714E5E3181DF5FB8113F77A8073A79B35EFA493A1A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 940KB
- SHA256 6b1fc2832e508aaa70fa7d92c20f8bd5b6855c9a3185a663f893f76c88f54391
- MD5 0303df4c3764257a507c80272340d158
- SHA1 4ade08d28e51da05757756e08152014f682f6b1d
- SHA512 e61b06adbed3b8b13cc8ac6549ef60224348c3f0bc049fa5831c1fbe839986191749c0ae5dc1ebbfba3fda1d697a0ffc96e88479acc351adb13bca9bab128393
- SSDEEP 24576:sAL3UTnNou5MEdf/RavguX1c3UrxhVmerUZyLeh:sAL3UTNoKRaxC3YhweoMLa
- TLSH T1D2250105E79400F8E97B923CC9A68916E272789D1760E7DF03A84B661F237F64E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 671KB
- SHA256 f06dd891da3f3525ffc08422a35ce73a4ff3e39f9d4b06dfccea03f2fbeca30c
- MD5 f09a748f0f5b6af2615e96f4bc445152
- SHA1 9e91902dab1d9d0e335df565143514797146d5c0
- SHA512 4934e62d0d747c986fefc2f1e307c68a72b0333edf98d05a0f4d3141f7a329aa0ad213c70c07d0a507006125b426a636b33206d86620adda241ad627e550fb89
- SSDEEP 12288:OpFtvOzjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:yOzNou5MEdf/RavguX1c3UrxhVmerUZT
- TLSH T121E4121A36AD10E4E1B9A23C8A93424DD371B8B6575113EF06D081BE5F73FF85C3A662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 f32843c207c14e5c3675a27af166f26fff106a00f699401db715db6b2f5dff0c
- MD5 eac0fbd9f2e0ff94247f10d2aa181679
- SHA1 8c58ec40974817c6fe20696bd8410f9c53438451
- SHA512 81b8a986769698fc82e63f4329b18b57d946857e40d34dbc548e4ce62569e35394b8fe0b9008f447eddbfe833444ab5b974f0d4550b9ed8fddb10071170f9273
- SSDEEP 24576:g7NM9YmZqmWMUkPjZM48Mv6bEhs4Nou5MEdf/RavguX1c3UrxhVmerUZyLeh:g7cBWMpPjN8DbEhlNoKRaxC3YhweoMLa
- TLSH T16165AE2E6BAC81D5D476D13DC9E28246F2B1B4611B318ADF1252833E6F37AF44E36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 80bd71f4264eba718db4c65e49c71fb3fac454aa367ad412277d9cee05fd7620
- MD5 0bf6e3049d5376c9bacfefd998b59f00
- SHA1 eaf8ee010f775b0ff5ef573e0480644cda0c707b
- SHA512 cf7c4091e727519431fe1ef61ebbe019e16dea37da2d27269a1b0fc47a53de5cffbb690a9acf745a0efed4ec14766dc0811c4c71191ba48cc1808c5303643134
- SSDEEP 49152:NF2YuHNETovcvNYf8kmYNoKRaxC3YhweoMLa:Y6tCf8kzxRaxC3Y1oe
- TLSH T1B7857E2A27ED80A4E0BBD27D45B79246FAB2B8511B3056CF4255862E1F33AF44D3D732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 daee499800c5bbc8e0d20a38dcda0c947f7afff15dd32a009a5a9ea532c65448
- MD5 071fb7200bb74f8eb7e80df790aa0c90
- SHA1 6a4a114921146290136fc44db852c988f45ec9e3
- SHA512 ee826f00834022eb4b9a68120c2691b621f57e5c46755c1c05ae4ef4eb6e47ca2df3f2009dd9810a7d3dccc22a5d72cb9cabfeea98f14ac80516b1bfe44931f4
- SSDEEP 24576:RAFs06+Omlf8NXEbTovNou5MEdf/RavguX1c3UrxhVmerUZyLeh:mFs060loXuCNoKRaxC3YhweoMLa
- TLSH T18D65AF2F66AC00D5D07ED17D8A97C91AF2B1746307215ACB0260867E7F6BEF85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 885KB
- SHA256 c68dda0415185cccfdd3f13c3d64bbfe5fea54bf8d800fca5e6816ac6e38841b
- MD5 55d5131d8b6fc1439fdf82b88e7fbb0e
- SHA1 df36b4ebdf97184ebc1f325b63d2112cfcbc5603
- SHA512 ceb33be06e55b9ad691becac3677611e99460112c3625132a273df8322dca26278513285a3ff1cf9531bc6263f9523a93c8e579819fb5e139f4404fd47bdf0f4
- SSDEEP 24576:xJnJ5D3WtCNou5MEdf/RavguX1c3UrxhVmerUZyLeh:xJnJ5DGtCNoKRaxC3YhweoMLa
- TLSH T14A15D02DD2A810E8D4B7C274829A1796FF71387D2F226AC728B4D5357F12EE09939F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 7d523e78e582f60af53312390086a082ba55c0a9402553cbf252a527c955a8f6
- MD5 601eafec70027706cdb497ad8499a893
- SHA1 8450f2092534b56ab4dcbbb2b80fa3a6c113324a
- SHA512 f9d4c1d582d95e49cc34c4f1598ed41c9cd9b23f366bfd190d2ecc567d2675c9fdafedb0928cf552f9777d784c463d8ec62ebe29904dea296b6d7bf2b040cef0
- SSDEEP 49152:Wo06DIKdwc+eQnSt65aVMNoKRaxC3YhweoMLa:vWxRaxC3Y1oe
- TLSH T150956D16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 661KB
- SHA256 27117068647468f41e01e5298fe6affc2356d495072bf40581cdc05670dd38d8
- MD5 8e32de9da519da2e6b76a6ef0cda559d
- SHA1 12ddb08324e10ff4ee13f2f8a3ccc7471f5e8d32
- SHA512 47c1cc2ca9de9c4e99bf3773bb24912a6f64f056116a93cfd7abb83a2eb5357c5849113ee81b64d669f18784f76387ba65f6a2413d5815d997d7c2de0d1abbd6
- SSDEEP 12288:+EP3Rr+jXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:dr+Nou5MEdf/RavguX1c3UrxhVmerUZT
- TLSH T10AE4121E2B9D60D8D1AA923C96924545D371F0B16B4223FF26D0C27E8F33AF91E3DA51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 712KB
- SHA256 622ed7c555a518dd83addeb6c070666673c8f088177946634de684fa6f4ec53c
- MD5 edd5901f78a92117251961212633122b
- SHA1 cc29cd997fcc30f9cc50e1749d8e6bfd7b220cef
- SHA512 f52f158b116a16aabd908c8a36d71ce28781086f8182b0b020a5ad1d5ab620d41a98298cd469020d6ec95e7aa4b533c7788ffea2e6b6b2d09ad4653aad5d5599
- SSDEEP 12288:3jky1jXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:3Iy1Nou5MEdf/RavguX1c3UrxhVmerU1
- TLSH T1CBF4120953985188E6F902389AA341A49734BC70AF1153EF65C0F33FAF36BE59D35B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 584KB
- SHA256 2db4faa3e6844d0e53236f3fc8a61f0a607fe3dd9589c3128706852db5cf7e4c
- MD5 e0eca2159723b723ce7fb4e88472cd2b
- SHA1 223887efec4420ea3e8a370a3775e64cec6aa92b
- SHA512 1ed4607862392940cc524a2065e6a08c43b39b0732a43b1c6d02f0a3c501ee375bbccc4549a7a5f9357810be4ef67af29576f9894b2af7156b94436f3266b91a
- SSDEEP 12288:6FjjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:4jNou5MEdf/RavguX1c3UrxhVmerUZyW
- TLSH T19AD4230D451E1688E5DC0338A76619E5E37438B5BB8022BF76C0B3B7CB35AF64937592
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 040a55ea853e9d85edee80a86302800efaaa9e0f63d6aa4a09be0e554539bb46
- MD5 409a1fb2191a803a1459dcdaf2c8c471
- SHA1 6954431b9defcb68ab125c38c9e15515d1c45e00
- SHA512 36194022d1518064bffc31947802f77ff2f734f2843d7f43307d03c532a682a723c03b783f8bd1b6a4268cbb288577a64b0ee17a6194156c7a3ee4af05ec3231
- SSDEEP 24576:VQ9MxZKdcz97w3ANou5MEdf/RavguX1c3UrxhVmerUZyLeh:VVKXANoKRaxC3YhweoMLa
- TLSH T15F558C2DABE9058AE177D23595A250C3A673B4311B31D6CF2448D13D4E7BEE8AE34F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 772KB
- SHA256 43da994101dfe0d7e015463ae3a55980155856cd00cbc4c68c298befd0212a71
- MD5 a303a3038c5ff8c973a7308db1e8cdf3
- SHA1 309fd75f3bb88aa1a5db3b19601f8dfd06d6e825
- SHA512 084737ab181b074308e7bc525b210bdd9ecfdc74139c5c6f3132e1eb0b9f97df9595a7d1f024698a2d39fbec3bc476c3ce9a1ebdc3326a9a261c8ae8d940a40c
- SSDEEP 24576:VyocxApRNou5MEdf/RavguX1c3UrxhVmerUZyLeh:oocxApRNoKRaxC3YhweoMLa
- TLSH T186F4E00FBB6E40A1E176823C89858645E773B0705B5253DB6681C33E8F23AF9BD35B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 71cf225a2e641e9cadddd7453c210a9c735518e32815c1db02bbd7981f334c70
- MD5 827db49bd0e1833c2ce4faff0d57dc3f
- SHA1 e60db891681ffe849ade9f43576d4714db06c157
- SHA512 748501a5a57546cf9727eacaf74d821878160b6f5d0a4f267fe635e37ebeacc6890148e86bf42062c290afc61585fd4f2850dce92de4ef1edad035f1619d16d9
- SSDEEP 49152:7WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKRNoKRaxC3YhweoMLa:r0zuNItxRaxC3Y1oe
- TLSH T18BA57C3DA2BC00A8D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A39F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 22867a247a118aeb1b981299fdf21eeba31411ef21761f5dbd52b3961b4754df
- MD5 e8645cf1d8b4edead4a745e36f74e5d3
- SHA1 8de7506a8743b71fc715e0cd16b9433d2a4616a6
- SHA512 438cc967f855b556d359b6b5ee5b179a1e10d4b85f014b650a219a7a0f2f8e852c50c2a40f85344df62c9e553dc74a318d78910c0f55e565461dcaa0897a0f2c
- SSDEEP 24576:b1QT7EcpfxR+N5AWAz3ooiYzjMqb+Nou5MEdf/RavguX1c3UrxhVmerUZyLeh:mTDxR+N5YzTBjMTNoKRaxC3YhweoMLa
- TLSH T1BE55B02EA7F805E9D1BE85789B238512FB727821033193CB42A0C17E1F679D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 877KB
- SHA256 71b2b39d8b9cc9a090fad8768f66db6d29f5e8c0045e7ecae2db7ea0c11b5d6e
- MD5 45ff61a5cdd650379717e490e67b0760
- SHA1 286115a75363890b9af1402c3e67032b865444f9
- SHA512 0ef156b11972ea603721fb54cba5e9714ce32908ea8b39923ccca71c2cc7db14672d94978c531213214547ae2091d1994019b8f0d1a750a2a96ac803539ca5d9
- SSDEEP 24576:QTMdOz0FFS+UmSLKNou5MEdf/RavguX1c3UrxhVmerUZyLeh:Y0K+UmSLKNoKRaxC3YhweoMLa
- TLSH T12115E13EA76D14E4E47EC27DDA438906E6723466032166DB06D0C1BA2F5BFE4793EB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 635KB
- SHA256 6a8d54b1e849d5e48edee9aafb155c6a4d381161ee1a5081f7e7bc933a44d8f7
- MD5 df85a49d7139a3f00cb96bbe72e5a308
- SHA1 9464d03986a4fa6f081affc43f88e40e0ef1d5af
- SHA512 a85c1ea1758189e2a159c24671bafd5c4b955a97e5dc1dd12ffdca0accd22a9cff438e8d0395c651c3a0b6e895d3d48f0a291d5e4523ea5fdc1a19fec32f16b6
- SSDEEP 12288:p47njXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:cnNou5MEdf/RavguX1c3UrxhVmerUZyW
- TLSH T198D4120D57EC20D4E0B993389B660195D330B8B6675026FF36D0D6BB8F36AE98939713
- MD5 SHA1 SHA512 SSDEEP TLSH