Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/10/2026, 14:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-19_850dc47d7da4832c6718ef30f67047a9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
30 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-19_850dc47d7da4832c6718ef30f67047a9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target 2026-10-19_850dc47d7da4832c6718ef30f67047a9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 7.9MB
- Sample261020-rxexqa1vcy
- SHA256 bad5bc928811d90ca03e7b046339c5990ac4acd53df6812f350c96c508f37986
- MD5 850dc47d7da4832c6718ef30f67047a9
- SHA1 ef86633732a0d175053cc76a6b66d1dc0e92d815
- SHA512 06bf3366091eff57f4505c3d92438db61e7201f6a2f8e76eca30b62631335f41c74f347e0ae554fa37bc87eda29fbaefa7432defd105764628d70048fb146d6f
- SSDEEP 196608:pp/lz/DshQrTRPakZOAoM2S0LwA9WpXwgwvyj:HBsqRSkZOHM9R0wXEyj
- TLSH T1AA863349D7A441F8F073A578CA924A06EB73BC0A4735E58F07EC99A70F336A09D15B93
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 12 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 12 3160 cscript.exe 13 2616 cscript.exe 29 3160 cscript.exe 31 2616 cscript.exe 49 3160 cscript.exe 54 2616 cscript.exe 60 3160 cscript.exe 63 2616 cscript.exe 71 3160 cscript.exe 72 2616 cscript.exe 73 3160 cscript.exe 75 2616 cscript.exe - Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2.js cscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2.js cscript.exe - Executes dropped EXE 14 IoCs
pid Process 3416 1.exe 4344 elevation_service.exe 4616 elevation_service.exe 5480 maintenanceservice.exe 3492 OSE.EXE 6020 PerceptionSimulationService.exe 1852 ~ioaprod.tmp 4996 perfhost.exe 6064 ~ioaprod.tmp 3372 ReFsDedupSvc.exe 2956 SensorDataService.exe 5712 ssh-agent.exe 4280 AgentService.exe 996 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\XVO2HPVM8K = "\"C:\\ProgramData\\2.js\"" cscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\XVO2HPVM8K = "\"C:\\ProgramData\\2.js\"" cscript.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe - AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x001c00000000696b-5.dat autoit_exe behavioral2/memory/3416-15-0x0000000000400000-0x0000000000BE5000-memory.dmp autoit_exe behavioral2/memory/3416-177-0x0000000000400000-0x0000000000BE5000-memory.dmp autoit_exe behavioral2/memory/3416-392-0x0000000000400000-0x0000000000BE5000-memory.dmp autoit_exe - Drops file in System32 directory 56 IoCs
description ioc Process File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 1.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 1.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 1.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 1.exe File opened for modification C:\Windows\System32\snmptrap.exe 1.exe File opened for modification C:\Windows\system32\dllhost.exe 1.exe File opened for modification C:\Windows\System32\SensorDataService.exe 1.exe File opened for modification C:\Windows\system32\AgentService.exe 1.exe File opened for modification C:\Windows\system32\wbengine.exe 1.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 1.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\43c3b3603a35217a.bin elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 1.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 1.exe File opened for modification C:\Windows\system32\locator.exe 1.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 1.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 1.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 1.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 1.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 1.exe File opened for modification C:\Windows\System32\vds.exe 1.exe File opened for modification C:\Windows\system32\vssvc.exe 1.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 1.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 1.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 1.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 1.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 1.exe File opened for modification C:\Program Files\7-Zip\7zG.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 1.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\~ioaprod.tmp 1.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 1.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 1.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 1.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 1.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 1.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 1.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 1.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 1.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 1.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 1.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 1.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Command and Scripting Interpreter: JavaScript 1 TTPs
- Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule behavioral2/files/0x000d00000001c46c-157.dat embeds_openssl - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe - System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language 1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ~ioaprod.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ~ioaprod.tmp - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/files/0x001200000001c459-93.dat innosetup behavioral2/memory/1852-94-0x0000000000F80000-0x0000000001075000-memory.dmp innosetup behavioral2/memory/1852-200-0x0000000000F80000-0x0000000001075000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d99c91fa060dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000adef5a5fa060dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a3fb121a060dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000166ab821a060dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ff46c22a060dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000085a97120a060dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList SearchProtocolHost.exe - Modifies registry class 63 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\magnet\shell ~ioaprod.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\magnet\URL Protocol ~ioaprod.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\magnet\shell\ = "open" ~ioaprod.tmp Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Magnet\DefaultIcon ~ioaprod.tmp Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\uTorrent\Content Type ~ioaprod.tmp Key created \REGISTRY\MACHINE\Software\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst ~ioaprod.tmp Key created \REGISTRY\MACHINE\Software\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml ~ioaprod.tmp Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\uTorrent\shell\open ~ioaprod.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\.btskin\Content Type = "application/x-bittorrent-skin" ~ioaprod.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\magnet\ = "Magnet URI" ~ioaprod.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Magnet\DefaultIcon ~ioaprod.tmp Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\uTorrent\DefaultIcon ~ioaprod.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-key\Extension = ".btkey" ~ioaprod.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\.btsearch\Content Type = "application/x-bittorrentsearchdescription+xml" ~ioaprod.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\magnet\shell\ ~ioaprod.tmp Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\magnet ~ioaprod.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Magnet\shell\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC" ~ioaprod.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\.btskin\ = "uTorrent" ~ioaprod.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\.btinstall\Content Type = "application/x-bittorrent-appinst" ~ioaprod.tmp Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\.btapp ~ioaprod.tmp Key created \REGISTRY\MACHINE\Software\Classes\MIME\Database\Content Type\application/x-bittorrent-app ~ioaprod.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\.btsearch\ = "uTorrent" ~ioaprod.tmp Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\.btinstall ~ioaprod.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\magnet\Content Type = "application/x-magnet" ~ioaprod.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\.btapp\Content Type = "application/x-bittorrent-app" ~ioaprod.tmp Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\magnet\shell\open\command ~ioaprod.tmp Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\uTorrent\shell\open\command ~ioaprod.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\magnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC" ~ioaprod.tmp Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Magnet\shell ~ioaprod.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\uTorrent\shell\ = "open" ~ioaprod.tmp Key created \REGISTRY\MACHINE\Software\Classes\MIME\Database\Content Type\application/x-bittorrent ~ioaprod.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent\Extension = ".torrent" ~ioaprod.tmp Key created \REGISTRY\MACHINE\Software\Classes\MIME\Database\Content Type\application/x-bittorrent-key ~ioaprod.tmp Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\.btskin ~ioaprod.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\.btkey\ = "uTorrent" ~ioaprod.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Magnet\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico" ~ioaprod.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\magnet\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico" ~ioaprod.tmp Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Magnet\shell\command ~ioaprod.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\uTorrent\Content Type\ = "application/x-bittorrent" ~ioaprod.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\.btapp\ = "uTorrent" ~ioaprod.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Magnet\shell\command ~ioaprod.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Magnet\shell ~ioaprod.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\uTorrent\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico" ~ioaprod.tmp Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings 2026-10-19_850dc47d7da4832c6718ef30f67047a9_cryptbot_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\.btkey\Content Type = "application/x-bittorrent-key" ~ioaprod.tmp Key created \REGISTRY\MACHINE\Software\Classes\MIME\Database\Content Type\application/x-bittorrent-skin ~ioaprod.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-skin\Extension = ".btskin" ~ioaprod.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\.torrent\ = "uTorrent" ~ioaprod.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\.btinstall\ = "uTorrent" ~ioaprod.tmp Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\magnet\shell\open ~ioaprod.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Magnet ~ioaprod.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\magnet\shell\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC" ~ioaprod.tmp Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\uTorrent ~ioaprod.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\uTorrent\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC" ~ioaprod.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst\Extension = ".btinstall" ~ioaprod.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\.torrent\Content Type = "application/x-bittorrent" ~ioaprod.tmp Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\.btkey ~ioaprod.tmp Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\.torrent ~ioaprod.tmp Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\.btsearch ~ioaprod.tmp Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Magnet ~ioaprod.tmp Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\uTorrent\shell ~ioaprod.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-app\Extension = ".btapp" ~ioaprod.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml\Extension = ".btsearch" ~ioaprod.tmp - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 3416 1.exe 3416 1.exe 3416 1.exe 3416 1.exe 3416 1.exe 3416 1.exe 3416 1.exe 3416 1.exe 6064 ~ioaprod.tmp 6064 ~ioaprod.tmp 4344 elevation_service.exe 4344 elevation_service.exe 4344 elevation_service.exe 4344 elevation_service.exe 4344 elevation_service.exe 4344 elevation_service.exe 4344 elevation_service.exe 4616 elevation_service.exe 4616 elevation_service.exe 4616 elevation_service.exe 4616 elevation_service.exe 4616 elevation_service.exe 4616 elevation_service.exe 4616 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3416 1.exe Token: SeAssignPrimaryTokenPrivilege 4280 AgentService.exe Token: 33 996 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 996 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 996 SearchIndexer.exe Token: SeBackupPrivilege 3372 ReFsDedupSvc.exe Token: SeRestorePrivilege 3372 ReFsDedupSvc.exe Token: SeBackupPrivilege 3372 ReFsDedupSvc.exe Token: SeRestorePrivilege 3372 ReFsDedupSvc.exe Token: SeBackupPrivilege 3372 ReFsDedupSvc.exe Token: SeRestorePrivilege 3372 ReFsDedupSvc.exe Token: SeBackupPrivilege 3372 ReFsDedupSvc.exe Token: SeRestorePrivilege 3372 ReFsDedupSvc.exe Token: SeBackupPrivilege 3372 ReFsDedupSvc.exe Token: SeRestorePrivilege 3372 ReFsDedupSvc.exe Token: SeDebugPrivilege 4344 elevation_service.exe Token: SeDebugPrivilege 4616 elevation_service.exe - Suspicious use of FindShellTrayWindow 14 IoCs
pid Process 3416 1.exe 3416 1.exe 3416 1.exe 3416 1.exe 6064 ~ioaprod.tmp 3416 1.exe 3416 1.exe 3416 1.exe 3416 1.exe 3416 1.exe 3416 1.exe 3416 1.exe 3416 1.exe 3416 1.exe - Suspicious use of SendNotifyMessage 13 IoCs
pid Process 3416 1.exe 3416 1.exe 3416 1.exe 3416 1.exe 3416 1.exe 3416 1.exe 3416 1.exe 3416 1.exe 3416 1.exe 3416 1.exe 3416 1.exe 3416 1.exe 3416 1.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1484 wrote to memory of 3416 1484 2026-10-19_850dc47d7da4832c6718ef30f67047a9_cryptbot_icedid_luca-stealer_njrat_stealc.exe 89 PID 1484 wrote to memory of 4684 1484 2026-10-19_850dc47d7da4832c6718ef30f67047a9_cryptbot_icedid_luca-stealer_njrat_stealc.exe 90 PID 4684 wrote to memory of 3160 4684 WScript.exe 93 PID 3416 wrote to memory of 1852 3416 1.exe 99 PID 1852 wrote to memory of 6064 1852 ~ioaprod.tmp 115 PID 2680 wrote to memory of 2616 2680 WScript.exe 105 PID 996 wrote to memory of 5436 996 SearchIndexer.exe 112 PID 996 wrote to memory of 3432 996 SearchIndexer.exe 113 PID 996 wrote to memory of 2460 996 SearchIndexer.exe 114 PID 996 wrote to memory of 6064 996 SearchIndexer.exe 115 PID 996 wrote to memory of 2384 996 SearchIndexer.exe 117 PID 996 wrote to memory of 5984 996 SearchIndexer.exe 118 PID 996 wrote to memory of 6052 996 SearchIndexer.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_850dc47d7da4832c6718ef30f67047a9_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_850dc47d7da4832c6718ef30f67047a9_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\ProgramData\1.exe"C:\ProgramData\1.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Program Files (x86)\Common Files\~ioaprod.tmp"C:\Program Files (x86)\Common Files\~ioaprod.tmp" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\is-6RRXSQOWEZ.tmp\~ioaprod.tmp"C:\Users\Admin\AppData\Local\Temp\is-6RRXSQOWEZ.tmp\~ioaprod.tmp" /SL5="$900C2,5328052,942080,C:\Program Files (x86)\Common Files\~ioaprod.tmp" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:6064
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\2.js"2⤵
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe" /e:jscript "C:\ProgramData\2.js"3⤵
- Badlisted process makes network request
- Creates a file in the Startup directory
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3160
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4344
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4616
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5480
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3492
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:6020
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4996
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3372
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\2.js"1⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe" /e:jscript "C:\ProgramData\2.js"2⤵
- Badlisted process makes network request
- Creates a file in the Startup directory
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2616
-
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2956
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5712
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4280
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5436
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:3432
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3028 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:2460
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:6064
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2384
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3028 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:5984
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:6052
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\~ioaprod.tmp
- Size 6.3MB
- SHA256 a6a12c0dcb7b5ff8eac28cbe192913f7d1ed03c80c99684340d67f3a96f9fb02
- MD5 db97622bf3abac845a97f95400d5e959
- SHA1 277b342edc4d39ea51af1f36a18d6c6803bca662
- SHA512 54896f1ca517cbe453122df5d3525ac338c6dcd4672a9c569f838738c22bb14cee9566795a6b1f8cba3071cdc227961098ccdca3b2030f3214f036e99aefbbf7
- SSDEEP 196608:RJGhjUu6GrRoQkpqs3K7ZXKGxsY4O7CO6BGKOq:RGdLrGQJs67FKCsfOCOW7z
- TLSH T18166123BB38B653EE06E5A3A7A72E254543B6A5164138C1297F4C45CCF360B01E3FA97
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 ac6d27760b351af8367da4d759acaa93ddc8ed4b357e90e15940997c388a78e5
- MD5 3d73750f91ced3009db447490199fd47
- SHA1 16cab555945eeedef52368063f319ad2ecdf942a
- SHA512 48cb5ae044f04ca76f3b39e9cf0bc7520037bbdf8f23c33488d68d8eeb242019f703bed5a2a1853a62d1fc1bdebcdfbc7219cbe856b68fd0442fb5baf73aceaa
- SSDEEP 49152:zb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn+LNiXicJFFRGNzj3:R3q6mjBN7wRGpj3
- TLSH T186D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 c9df63bd0639fe061b856c41f6c13f5f5eb07f1b76f87d15daef07a13cb83138
- MD5 410f6802fb9bea8d62ab4aa9692c565b
- SHA1 f1139e24cbdda3c5250fe88b52f2e45663ce1f45
- SHA512 d8e3d72ee7bf997045c6dfc8a0f27af16f3f79f9c381ce54207ff5850d10024d5739582edee53d8fc52349ae2f8536219ec5ec083a99f29050cd9c837e33b98d
- SSDEEP 24576:xXYfDtczAZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UtcQLNiXicJFFRGNzj3
- TLSH T11F75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 2650ecfd94a13d917622fa12e9d53cdfaefd81841d183e4cf466db9083c00402
- MD5 76ca2b84e350d6d9a1b383c59ddeef01
- SHA1 fbc857cfa69c8f74d626494c97694a63a6f42e97
- SHA512 4258f3f5ede0c4daa6867d7f315d25d3fa01d816aeb37cf10a5f266151dd29e17052437b41628b7716e91e658c6d3b7d2e4c6b9b92013da71f6bd1f2c6a296d0
- SSDEEP 24576:o0Le5ji0hmxhrM2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oPji0AzPLNiXicJFFRGNzj3
- TLSH T15785AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 cdcb300323c5e2d83a3a0c5043105880cda4a0712850738c037b9ab1fd1f2604
- MD5 aeefaba76cb3bdadb4858b5e44e1e7a8
- SHA1 05ba25a7ac81a65c73b06c25926bbb493c14b201
- SHA512 3f60fce3caf4b404df3ee015eb00c0f4e60a7de80ed5eec54bf21b3ca47973c82069d16e2d80595031777d2149e1665ab11908f310e4dc79f9e623cc9c1dd40e
- SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWj6q8wyug/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:r/ezSC6vUzPv+HjyrLNiXicJFFRGNzj3
- TLSH T18D756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 a48fc42c06e976982f3b43032c7e42269a1c8338b452ce9844fea980d8cedaff
- MD5 65dd7bb9988763f64714b8af5404d244
- SHA1 49dc894dbcc9527a68f041ff0ff4813fcdf71e09
- SHA512 91e9ede1b74f2d180c4f8bbba84e320a14ae4bf546db63fd78e77da7501f4736df5b1c3e8abf7010e84ce5bed7f14b588e9810b56ea8110c2ecaa666981908c7
- SSDEEP 24576:SVbqPb88hv/l+Bd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SVO88hXl+vLNiXicJFFRGNzj3
- TLSH T17B559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 4eb6d02d70d0832b11732e5b171f991d132593c2e7c7e3b95f13c902731f4b30
- MD5 d9ea5e36d1822e88310211526b4a815e
- SHA1 f8aeecc92c86425803575caa7f025729059c1c7b
- SHA512 5401a6db6043fd809755dcc851c23ac99ac33bc9c3bb6521807be133b5b4589d24f02f51a295f2cc34c8abf92110e7ac49c20ad91650e6527c73f6134056f257
- SSDEEP 24576:ZG6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xLNiXicJFFRGNzj3
- TLSH T15D5523D3468854B1FBFD003A867A5828B6845E2C8A555DE3D2543E5E913CFEBCF39123
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 4884771a1f0c1c5696467254c60c032b168da76ab8a7dcb953c89f3d81a08b27
- MD5 9c22e3f05d71db4794bc6173fbcf9993
- SHA1 8ffdbd8151e63b5457f0f48109c0dd4bcddf8614
- SHA512 b7dd5093c88c3d612f4472856f15d9c2da2d8fb9f69b0d4399e85d05a6e91db2e7d06108bc1b57916bfe64f19bba2ede65d0938a4346b5e86533bad12a9ef2c7
- SSDEEP 24576:8JIUV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8JIUVLNiXicJFFRGNzj3
- TLSH T10975CF7BAE28FCE2C27E4C7957518600E76278304F62A3CBD165830EDE236E55E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 39b4191216cae3e2d3f70bcf0b41c27a0037a7e383ee3ca426bea810ca963ec0
- MD5 0b5a18fdbd67bb0be09ad0a838c790e4
- SHA1 a07f6a14093b75563d7655f40697016b04b96aeb
- SHA512 f0aff5187c3f9f33c4aab1dcfbf7b9cc658e0109989cee6997c39c198867a63748465ae34797daa8c206977e14f8cc13e689dc86c251d6b7594dbbf27b6e5a1c
- SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THt:OQvGAdlCEL8c/WRNw5Cw7wRGpj3
- TLSH T1A2266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 606e166d76b7e7e43d31eaae95e1ad72425e19336fabf6b8cb12a709b9338eed
- MD5 6824054bb04c36a0732d8f48d1262458
- SHA1 8e4870494625aa7947f8c147d286fac438d10b91
- SHA512 a9fb5f0eb438746a18b45a50c3b2a7c4bbb38d5cfdf04a75798af90f2fedb99859c4f4296290176681adb96c6ee41e386872783997353de97b87051f717ffd32
- SSDEEP 24576:qfewsAjf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QljfLNiXicJFFRGNzj3
- TLSH T18A75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 bc61e8f166e6ffacf3c53dce548e558768a05f12a00a6e84514c43353e66c402
- MD5 f41c5eba75b5c94d2c8f5cc76c006c95
- SHA1 c50fd76acdf5d64c93db31fb3b44ba7eb224ae2b
- SHA512 b67a6e51f5eed4073ce4eb70346a67515336c7a5acd01c55a4963a1dd4efd90c4c676c0f465bc84a598a03cd27b377549fbf7315701a9522c0596a0cc7bf7168
- SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH7F9:iUEtQevvqc2W1cpV20I32p9
- TLSH T17E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 8558ac5ed0e5ca586ddfcdbd2f022c5205562630f021a8aa1c0eaa06bd4c7e3b
- MD5 de9a8b21cdbacd6504b5e2a8f012d0f4
- SHA1 4236064ad4834cd2d104534259f48fa0aa8aca69
- SHA512 df82409d78bd690eee5e78aaeb7d4e341f270467b7dc7315273139443a7f6bc910dab4b320ba3a5f4f68a34912259ed4dc8934d4b705c95880ff3868a9df442b
- SSDEEP 49152:NCbRquA/m2yL5zLfFiV+XenmE3/z/LNiXicJFFRGNzj3:qoq2Vjnmc7wRGpj3
- TLSH T10DD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 7eca9f1d199d06beaca3b00910d8be61336d935f3a965248ac5b8e390f60eeac
- MD5 00eba141f8513699249c8919d3fd8cb9
- SHA1 6329bf3e4ab3a8429cc761c2f7d9b7137c45d811
- SHA512 9fc141f675a30083de33e884bd2312ff0cbda3209ce123bc1fc4c040971e8121c970a1a283c9b886dc1c63e20024443b85d524a8e57ebe33d6656ca49b135c8e
- SSDEEP 24576:TAhGL6IFoiwtA5l7S538/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TAM5Foiq5sLNiXicJFFRGNzj3
- TLSH T1D9359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 4664fff025a0fbd5b0c3f9e4a28fae2dede6595d9da42d2b03fbd1c682892e4b
- MD5 d7e0a5c4735930647501691c0b400c59
- SHA1 46427951766d6bcef4597012aa40647ae0cfd515
- SHA512 194b7c7686c8b02e281334244b6562e6d8586eb25b15cbeb3fa26299a907f5d86b4003047b795c9339966e5383701c7be172929d8f9ae033cc08dc341f8bfea4
- SSDEEP 24576:lwuROWL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lwSOYLNiXicJFFRGNzj3
- TLSH T1F865F18632980CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 834cf8d6acd1800a6cb2941e0c3d5498df6a05e201b3e0b46bc2df48e3acd225
- MD5 fbed3d0cb490e79a2d0771557a72ab8c
- SHA1 0c3509cf33c350d1188fbed90d79b7dbefe25090
- SHA512 d653e3635bf874412a03b54fc4116fa759f00d43a262fdaa7d7ca7786cc819817988c594aea32f8247baaea544d7c7803e67393910a8c4bf76cec45677e262a2
- SSDEEP 24576:zZuO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DLNiXicJFFRGNzj3
- TLSH T11E55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 403419a0a845393673b04d54ce04ea66933686650b8f38da7b40dba2349d2d17
- MD5 6bf1a232716af891548b91752e4cd938
- SHA1 0c111a413a43769266606f382e82ab83483ef2fc
- SHA512 6b36502cda9585b8a2d761a78e344a0b9e00b68d58158e56392dd6113bade8a9365ea232803c64c8b6dfd8b284a4be701830b4b897b07a2d9157cf0fc47568d1
- SSDEEP 98304:vQRQyi36YOcPDLvw2gAf+PN3R7wRGpj3:eQyiKanX+PNFF9
- TLSH T1C8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 37e1cdce81803cea8ee44d32414f94027f2c2db35457c259d16d334598edbc1e
- MD5 422c56f1a810de3f4d17363c41dacd41
- SHA1 88266601234b875b8c7a04c4e1813f8ce41af6cd
- SHA512 26573bf78eac9e23f795f19f5547e03f1d684a8c4e8a9d0836f3da6c0801f31e39eb25967b2d8e8156351153b47b12a7ef67bb4cac8042bef920127216e74d7c
- SSDEEP 98304:JQRQyi36YOcPDLvw2gAf+PN3R7wRGpj3:gQyiKanX+PNFF9
- TLSH T16F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 bec41b3a20e12dc54081a8ee54f4c47d561fe8e8dabdb640e08f4d5bbb2a24b6
- MD5 5d686cacddc9b5517fc25514e0aee853
- SHA1 cd9374095dca3d08dee78e2636f4ce2efa814c4e
- SHA512 f49d0b3e507e9ae611b892d6dc48d7599e5edabade1a6da2471c2007fe1c746f01c5f0ca2202396d301a0d15decdbad67c37adfd8748cd8f53a6c04f530db9c3
- SSDEEP 49152:P68Qg55nhkeWu7PNU3/PLNiXicJFFRGNzj3:JthTRc/P7wRGpj3
- TLSH T1FCB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 b81aa8ebd8057de9ebe9a4b915de748fe09b1dc5c111b5ff614bf0a68a205590
- MD5 fd14dd72f1ffb30048144d7b822a7392
- SHA1 61c5539452b1c9d650dd976fb95a198de5b6d7c3
- SHA512 f4d51df822898023f0be7e03f5386eaae96d256f632af4826267aefd6f29bdfbbb3b8470d7a9888f0ae4617823e49d915d0e4050605f907f7a2fb9b118a9556a
- SSDEEP 98304:ey5112gYy5azzVvU69nLKnhZ67wRGpj3:PLIHRWhwF9
- TLSH T137167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 5cca56e91ec3cec0b587a729063a9e2de779725f11a15d325dfc703b2d711279
- MD5 c1392960b97077522852de884681815a
- SHA1 141308e8421898e1bc05ac97f1d3091cfed26754
- SHA512 a21a8c3d5d97f615b00de1d3319ef1c71c26d4262e056f0481192c90d6a33b8450532e5d437eff13bb7c70181e7aa8676965f5b84927bb3ebbf378e2579542de
- SSDEEP 49152:qB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glJLNiXicJFFRGNzj3:4u6JmIxd2dJ7wRGpj3
- TLSH T14FD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 f2db463ff2b67b7cf430df2476c6e278a3210783a2673701ee632bf9f4b8ade7
- MD5 b3516e1c70b678354a50db3315fdadd4
- SHA1 304b5375a41f485eb2f8de11016982db027bd892
- SHA512 355f18cf449bd3b763f0f4b5b4d4f83e3fdeacefe091fac07c81989f52b851e6a59c5e1a741c1aa89ae32b3e82d9af96588f1780d1e8dd611ea0f83b7b95c3e8
- SSDEEP 49152:x1hpsNoJpF1A67U44CwH7R4x1LNiXicJFFRGNzj3:xmifPqRc7wRGpj3
- TLSH T15EB5AD13F29901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 cb94f864bfdf1f3526466f509d5266ff0048226c120084c006b36af2149c0f57
- MD5 b6f3eab1dbac02cd8a9f9c6153ee8a1e
- SHA1 7ece027792138e35571bf7787b8507a90d575f33
- SHA512 dcb2dee78b4fee5dce2e3c82d5a8d8eb248671e8b8f330fb124681e2f79bb9958cac23a5db286f7d21af15ad93150e6ece71a3fd2801e23cfa0f5ea8027ef268
- SSDEEP 49152:HSuZQIY0Be2KkRVtOnks6NMHqOLNiXicJFFRGNzj3:d5dKqi61O7wRGpj3
- TLSH T140C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 d9b5e664738f45d152405effeaa9b3036ec98731c97311bc6f06fe7959e740c2
- MD5 22e614bdbaa8e2c8e6446982350c506a
- SHA1 4ed6385b912548233c85187bf7596fe4efc611cb
- SHA512 489c8768a691cc47fdfd86ca99447575f29abf7549bfd75166f69e00c585a372f1c504b72004686431bd62421787a7f95fe07b8e43a4a018f41f7993b9f97dd9
- SSDEEP 49152:ZhtSn8EApI0figjgiDn0AP5wZLNiXicJFFRGNzj3:oX2iWph47wRGpj3
- TLSH T18995BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 0c06fe7a21a140d3272588bb46ed3c0a8c9620562fd615af6e4d292cc3c0733c
- MD5 56dfd31ecd67515f955bb3af07fa27d6
- SHA1 0f7b0ec8f2396cf27f8e3b04ea5a0175ba4db9d6
- SHA512 fd77b25d65838a53939d09d3f7c595b36fda9f063207bfe8f6853bf10edfdbe0dcd4f4161ac59c30357f1beb78d45968ab5a246faf7751e9479e95019a2336b8
- SSDEEP 12288:wgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1155523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 265e9f5bee99f248764322a113159cc66f330f684e9bedb7f3ca7c60e4e66fb8
- MD5 d5fa54b1e5aa34cf69bc61e412065dbd
- SHA1 0bc431f47f54657b95c206e796a9bb9b207aa737
- SHA512 76b84355cdbc810708ee1c57023a1b135b3a2de48eee92fcdf93b82d2fd70faeebb1a9084deadbbf185b6728a6e0a50744b05ac0a66b42c5ce46b21436389291
- SSDEEP 12288:3HiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1F15523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3483D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 1aff5b51e6824f61a2dd5bd2fb7d9b57018d6ebb472b52d81b921329c0e6fa29
- MD5 7ba45057a50c07cbd2259238b1eece37
- SHA1 e77a50052b12e6b82735411d3e68113bf2ba9a6c
- SHA512 7d2b52806fe24fb4d69946568a68861efbde92c83afa34323d3634db63afea8acbd70d07414f392f52b4d13a84a46be745907918c472cd08a25050ccb485c409
- SSDEEP 12288:WhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:WN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1075523D3558955B1FAFC0039C6364428F5881E1DEB5618E3E2483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 b25fa74fe35b3f0cf73f8d56f199df3c8ccb3fb1bd88f2da807c879840f1e808
- MD5 7e73d4680458bd02ea43a5e63f132bec
- SHA1 b6ada2a6c922a70b4ab31a5956b8b613460455b6
- SHA512 358a1ebc2dafe9d73baad7949d199c324a7eaa9cad7fa780359ab1b93d1f21f80fe722e10bd3e7b8a1bbccf6b8698ab9045cfb1557c35d4a9b96d9eddbc3e815
- SSDEEP 12288:yV6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:L/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T184552393168900F1E9F98039CA764424F2A47D6CD7325AEBD3003D1E5A75FDADF38A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 2b7ba4d58c3bf7755e7e21be4144fa37a7aa840fd89f3dd7c28d1f9df8987248
- MD5 fc9d1c5a64d7a2dc31699eee971c16fb
- SHA1 d52cd5662fb6c7996f731e2ba267e82498220c38
- SHA512 0cc58f5d793b1128d0d32c4ad275f82aaf04bc0ebfc59efc04826f8898649fbd0956861b00901daa4bdbdd5a63e110c21c412be00062dc6a4e38a8c9c1f361ec
- SSDEEP 12288:+CiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+E/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1765523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEBCF38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 da2f4a3bd49bf83fc66605517d8cff1f8f154b7ab825d15218169c2c62ae8540
- MD5 460ebc0bca5b42fd3936912912110786
- SHA1 2c7110a8cf8ef88db56a54567f45c12ae2be44dd
- SHA512 fcd85979f869aee81c98fe6ba825d9e8984ef98be4873ddab545318dcec56b69c3bdcdd1b6131263eb6d03c6324f5ba74183c6efe4c16db897539ad030af1d9f
- SSDEEP 12288:GDiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:G3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1905523D3548955B1FABC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 33bd53c9de7c06982ae3c4ae4c156f0a48ac95d087bbd2065f19e4a966df185c
- MD5 d7ccc5cf8de090e8c4098e8cd5fbccbf
- SHA1 ce3cd7c707617291e4b0ad6e1b290ebe8cc3d727
- SHA512 e3bdbf6db0e9ca3f0b559e82a07c94886075491f027bc545ea6696ce4e606c7f7e2e1057f7dc03453bb90114dfe749837ab9167b30d4547de1ead3eb5fb2de4d
- SSDEEP 12288:CPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:C7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T17F5523D3558955B1FABC0039C6354428F5882E2DDB5659E3E3083D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 07871ef4d1759d9de361c591cf134f1c0774eeba74bb575b5cca433e2cb60527
- MD5 56e9ddbe792437f84253d68048e7b547
- SHA1 558daaaeacfa0be743451e5a12726df74bb1f72c
- SHA512 5f925e2e2b9406f93643cf90871c96181366529e0846a1519c4acc0af67785a0f82753e364045beeecb8e411f2f809ea74c7cb2a1cb13a1dde1689b2f0224d2b
- SSDEEP 24576:OZM3zFVSOT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OZM3zfHLNiXicJFFRGNzj3
- TLSH T1A3750195B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 70e4850acb7a86f586fa4fa1091f3df174c65f3b95b28df1c2a3a1b1558bb88b
- MD5 4b68f5b7a3af05d9dcf47f48eafb87f2
- SHA1 2c7373ea944f73e345c6c2b9db74ca727fdd54e5
- SHA512 b55182d7c9304dcea96316740dc86ec8aff03f14a59ac82ef77dfa29ac35ec0fad31347e5719560d4da587eda5e06ad6ae2975a6b0483ae9e692a74180fd0808
- SSDEEP 12288:R0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Re/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1975523D3558955B1FAFC003D86354428F5882E2DEB5619E3E2483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 8240237b43dc1373e17ee004e3981f9bfbccf66c7bf3d9135e6f8be46d88cbf9
- MD5 cc21684516457a4854495986b94f87a1
- SHA1 025a2755ef1563a1d38e2b32a9af18ee1335115d
- SHA512 04b54d09a18206840cb48178bd801d30e616567a293570ea673436693c75a41fbd6562d6e77feea604491642ea9cf9dfac8a26e5c004864130df787fbfd9df80
- SSDEEP 12288:24iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2K/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T16C5523D3548955B1FABC003986754428F5886E2DEB5619E3E2083D1EE278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 64e638a9dd28c6275ed95cb89279767998b8665036e87789e1cf97cfaacd953d
- MD5 a2efb3b74714a811d85e9758dc1b704a
- SHA1 b2353d398a673104ca1ddf93364bd931f1acfeb5
- SHA512 046b51dde1053ed7e8f6d2510b84fb5a9e3cbb5e74ffd1e59c2cf1e7c8991246f0db03736fdd7dabb5360bfb8fccd4aa68ffdaf86912e47521f3e02d25c544e0
- SSDEEP 24576:ezyv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:e4LNiXicJFFRGNzj3
- TLSH T1C6650247629530F9E17A4139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 3abaf117cd829b4fb38c2c77bbd3411d29e6355ad008ecfaf2e27384d7cad169
- MD5 b3b41b0fe35f8b9534582cd250d3709b
- SHA1 46f9bf397a3faa3152ec167d678f9be5f2318c5d
- SHA512 0a629f28ba59fdefa951092d122b33041eae7b603f4ba4b91aa41b2c4f08185246ef9dd3896c30927bb73ba77c9239a88134e5b5442c34622c2d1e705e03bbf8
- SSDEEP 12288:I0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ie/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1245523D3548955B1FAFC0039C6354428F5886E2DEB5619E3E2483D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 2c4f802b6d3031ccc1d5946649f0bffd03e4bdf9516abe45599d440a86f94b4c
- MD5 c24bfb352d51e8d2685e72fa85f037ee
- SHA1 b05b6488e0eb62f45377edec00a971e8b5006ff2
- SHA512 5635dc0890529cdd4e4cabb8a1184d3894de75192a73b009e560740d9d65937e980a65f162e804f74645c1c0a13b9eaacd8c7c9690fa880e767718db0660ba36
- SSDEEP 12288:r0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:re/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1365523D3548955B1FAFC003986354428F5886E2DEB5619E3E2483D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 c37ba262fda44508b9a1a6f1d807dd731ed5d0b33e379acd17b2d559ec9be5b2
- MD5 9995fcee622f769416e5a12b0c856dfb
- SHA1 5af1bc843158a10632d7f2af1e6b2d4587ac51d8
- SHA512 86d7f57c40092b5ea2b724ddf540b22828232fffc5318e11ffc787b6dd37e16d51779c69005f6dcc087d85f00c84f284a95ddbddb8b7180fd47863710035ae50
- SSDEEP 24576:Xzyv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:X4LNiXicJFFRGNzj3
- TLSH T15B650143629530F9E17A4139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.5MB
- SHA256 8f968f51a10db3dc1fa9cd8e3f2774a56e2bc7697a83787e306acc893fd2f980
- MD5 45770324ed203203945aabf0f8d83d5f
- SHA1 4738261cbabd7be586bb8422b2a5d3da1f9832e6
- SHA512 923f84b46c9aefa38478275b538dd2c37700c23b7a1a4ef7fb11007181b3694eef7d958a0ad7484e4758577fbf6e23a67634e4a862b2e03745710994fc183161
- SSDEEP 24576:aT8aLl3z0zD9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aT7LljgLNiXicJFFRGNzj3
- TLSH T1047502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.7MB
- SHA256 af99c63887713b38be5b0362160423865ee3d5b197ca940404d9d6225da28326
- MD5 ac746c53fe1d0900a01490df9804e416
- SHA1 6aab7da0daf2c1231b014f9b1c7a61818b883bf7
- SHA512 b0204211a63df13efe527364a3a52bffe20a62cb0dea1958940319128ccb12f7a96ffc29c3d19d6d84e6dec86a8515e834d79b3c59124dd79bb645894b715f35
- SSDEEP 24576:q3rd9CHKy7GZx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Mrd9CHKyaHLNiXicJFFRGNzj3
- TLSH T17D85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.2MB
- SHA256 95f4a9f6587492b12e6b41949b64c1a05a7c5bb28d5c0b01c6bfa5a5d3fbd8b5
- MD5 88cc3bac1c3f2dc73f816d8acd19eb98
- SHA1 b84e30578de3d97fd50a1e2ed2fed5f248fa5b66
- SHA512 3f01f82edd9962a7a4e68731a852d2e50561bee270d5e8fa09ba681181e5ba626f4cee960c13c90b136b2e0b8c7bc2b00ca05f5ccc40d0622f033129586723d3
- SSDEEP 12288:gBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1BB5523D3558955B1FAFC0039C6364428F5882E2DDB5658E3E2483D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.2MB
- SHA256 9ccfddc47fb29c3cfe95d5f02268685a6b369446a32d0b03191f9cdc57b40ea2
- MD5 4a60c0d607649b0d9ec72359a7cd3b1b
- SHA1 f226f3dccb1fe90576226d84659748518f851409
- SHA512 91dee35d88aab513672484f2538474f99aa04bf7cadc714aff7ba2366f9663fefe53a832ef085d4e63a0cda11263c28224bf304232ad6c42048cf2dac196fc79
- SSDEEP 12288:bbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T14D5523D3558955B1FABC003986754428F5882E2DDB6619E3E3443D1EA27CFEBCF38066
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.2MB
- SHA256 d7463f56d424544fc92b850e4b5c4bc8d456f93b778e06e9bfe145df5178526d
- MD5 0e2353a6f0f3577c945c09ced14693e4
- SHA1 6c2530aa4fb24cb21b34342a8aadf22a14855690
- SHA512 02aef730a2686ffb40894c905ac10521789f3860cc3a6c2506cdd24b83e092b6ade058fde77cacd187242377906311ca0bfe12132564a19315b0bf04068db3b1
- SSDEEP 12288:h+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1F85523D3548955B1FAFC0039C6354428F5882E2DEB5659E3E2483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.7MB
- SHA256 3f9236be7d0a000083e22b1a11aee04a0e53483e663786f64913c64dba73e0b2
- MD5 f0617abc08743f62d7f219582eadca80
- SHA1 a20c3d8621c0db900737cf867e9afcabaec3a6aa
- SHA512 4d0e88c1044f68ffd81cbcf5baca54d1017051e6006933d94804f4efadea864ffdb7a172d85e935f24df0debdf2886977d8e6e6175e51114a985a220e1a3f1fb
- SSDEEP 24576:afwvzk9RX6wkyAIa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hMnYIaLNiXicJFFRGNzj3
- TLSH T11C85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 a8e247fd3f0586f2a8213909a5f4b4b80d3291248afa8d05b47252c6f20521d4
- MD5 e8e28b0d59ca955267aa7cd306eb6553
- SHA1 2784a54ceb9fdbc9adece54911027cff98a925de
- SHA512 522baed0d66f715536b2f44c0737301ea674da356013424ca5f36dda227f82a8cfac4ce012f15255b4f2b6434fdb0c86e708813e0da70dd7d915877b39130e34
- SSDEEP 49152:2YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK05LNiXicJFFRGN:5ySzPx7wRGpj3
- TLSH T1A7066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 e8c7a548c2cdc5965dfb56731c24d1303ebb53fc404d4949909dd812f921e016
- MD5 534030b2cb4c24cf6f6f0906ccb64f1e
- SHA1 9e459d39e663995ff4c3ea2b04accd90e9912608
- SHA512 36f42cc862c8bfc3c28f2c2932521f7a39c692f687206c66018542ab0b668e6d8a28b69fbc3e16f23c4a2ed03ade1ea3cc2fc0b098581d3035e5c4b344f83f50
- SSDEEP 24576:847Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:847JUQjqirIhCnDHUPfF/JLNiXicJFFS
- TLSH T1E865AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 ede733bb2d9a06cc827859d2cba1d6d633b5be5143fc3ae99974134b2a585e27
- MD5 b87397ff7134aedb60ee97d98ac8be89
- SHA1 5e148306b320dfa70f7be3de1b1bf438aef487d2
- SHA512 25a149de08677592603fd6e7103e3575a8813208626ecb815a5ceebaa4ee47d9d51474525f5e95dbbadd90e27a5e0eae880befee2830a38aede8d9e6674d87a7
- SSDEEP 12288:wpsfEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:BO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1F465F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\1.exe
- Size 7.9MB
- SHA256 bb32afdf017e45b95f08eb2cb9e821632acfa81ba865aca2f0f74af092368f95
- MD5 a38f4edc1a43b1cc5e382af2a6c6242f
- SHA1 3220a5e8692c95c25fce5d84d84b90700a371442
- SHA512 f699b0c4f0fa017362f32a9f637156b574ad516703fd1e3e37b40a8c3ac7c2aabfe631b95de4f85e494de91aef80a490108e0ad713fccb8a5303a9caa35dff07
- SSDEEP 196608:UB5K+Qo8xspwLX76C/RsPJmbZrojoENlF9:O5K+Qo8+peL6SRBbZcN9
- TLSH T18686234277E18061FFA395730E27F75586B89D254123896F23E828B9FD705F14B2EA23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\2.js
- Size 343KB
- SHA256 c1001299c1a307b0f6928adc08644fdb27e280639afb71c0ff73f9d0425b75c7
- MD5 fb0108063e1e4a1c5878c22d58691238
- SHA1 2ad119519df16d77a33e46f076a2698e8d017f04
- SHA512 994756b7802ce8cc3c632135828293bc96ac3617da99a44741dc000adfa30298b7af77f0bf3723647f87d8598435190369d3170ad696eacaabaa47ec7f31384e
- SSDEEP 6144:3Sivq6lzRvHcxprYMfftqnWlHt0i/XNX8AZOQMyOgc1QiRG7OPKo+hP+4fP6ECIx:ZRg0i
- TLSH T1EA74EF38FEE7631F68774CB5E6F109439468728B621E574A084693D10E6374BDEAEC2C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.2MB
- SHA256 8af57d8be4aa68b0908e5ac42c47c3eae9efec2e6d347e8f7d567af76652f223
- MD5 f8f742f654a36742b545b31df53dc6f1
- SHA1 9c644bec1ab0c4f2b41faef78d60c3b469c99e01
- SHA512 d2fda5e9fc8f801d5a9f0398fa9458c576f659331b1c931131f0e3742b01bccde6e899c563adbfdf7e6cb4e1798cac8615dab6dbffefc428a358cc08f7f0ec85
- SSDEEP 12288:ncYqIBqIxKr3C7665w2Zk0mCpqvNkQtLUA6Mu56vBEnQnH:nMIvAri66O2kkaLz656vSnQ
- TLSH T12B4518117666DB4FC66980321E33D5CCAB707D41EE04AF0773C98B3F9576658BAB2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 4KB
- SHA256 9c427b76840a08cefba7364b07f0f92cb5a19acc74c3b8bc5a7906e1cc7696ec
- MD5 b8b21c800528cc30cf1b895c788a46eb
- SHA1 d775b072ae7d790c966fa81638814de55ca85fcc
- SHA512 56b61e2ce128042e53d95c4fd7f2f72868825fd7dd775f74d0e3bc5a457d986590a72835bf30b059b088a780f4e9ed410fd0fb2e00ec5abd976f68e84fa7d951
- SSDEEP 3:OlH/luxCO0+eUvyxJlll/a3mCllltq3mCllltGlslslslslslsl6yDll/:K8xb0+76p/8mCtSmCtEEEEEEEL
- TLSH T1238192A8CF0D67A0E18A343140338B8C1328C4CA6E0597EB110870268C042489C27E3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.4MB
- SHA256 e2a4744a44fcfe40d0eb99ecd44100a380ecc4aa606447696dbbc4cdbf649ef1
- MD5 cbe4966a73beabe4c5ffe92f83aa37ac
- SHA1 9ce57e346c0eb7968c9d2062f9d00e9fa92e92a8
- SHA512 0b32cfa2d14b0516f1b31ad5f40c8e98c45341bfb7f9034c7ff68967e03d97e68af4609420bf8e1f52ea2907337c0491dcc79924124c823d273d3a89d6874be0
- SSDEEP 6144:CoIMIgVyyHGP2KFhOh4ddTqXCKDeoH8n6v2PCKDeoH+hjYcOGCpEFJDemUKI1FsR:CCmPJQ4bTqXEs2POhSpAETW
- TLSH T17E65D741A136E78FD1FB6031072A6B8CB764EC07B7095F267389053ED86AB55A0F93C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-6RRXSQOWEZ.tmp\~ioaprod.tmp
- Size 4.3MB
- SHA256 6e9f2a83673b5b09f0cb99704dd112fdd00156e5d594261d411ca531ef481eea
- MD5 042eb52d8388716c60e59284208e5bfd
- SHA1 6510dd89c661115a2a35c551b5e896f2d5fbebe6
- SHA512 3217d5fc144b07330069b5414c2a09d0561c7da336c09ff646802cece7ec9cfadab543efd5953d428aec260cf6e28563781a2147eb311b4bd0aeb482f4cd696c
- SSDEEP 98304:CiDj+6GqBH6KwsvcHJ4c91usxgkod1scm333i:vjpG5ucZus5QnZ
- TLSH T1E4268E13B784653EE4AB1B3A4837A654993F7E303A26CC477BF4094C4F396806D2A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\uTorrent\PagePriority1.reg
- Size 604B
- SHA256 dd235fdd448411b4eccadf2550b86f37fdfede6d1380a6f815783d774050e9f8
- MD5 fad4c02ef899ae6c943031c92f2a2983
- SHA1 d01200b54d7d0687630037442db8ada20f30a5d7
- SHA512 d62376ec58df6444403b0b31fbd685ad7bf81e442e526c48b185f98717454c6c72ada83b464733c5956f552b74b640fe43ad570e5f0f86b89ca7fce43c657048
- TLSH T1BAF0B4111BFA5509F7F37FC08BF99A198A37BD988C36C0AC1290464D01B2AA1C96177B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\uTorrent\complete.vbs
- Size 199B
- SHA256 bdb8f77aaf85be49df0a409d98f964ebc0743fc75b643712ee4a4a69e2446674
- MD5 f385bef83712155ddaacedb6f0995575
- SHA1 ee595743bd0750b32656802ac52fe71b9ab0708d
- SHA512 2b5a4e6d638f2ac44df4a68e641a9271824380c45a3ae858b4068cf20ed9f4b0a91f3c26c0444a447641827d3e94f956edb5168ac88aa77c18e8337c419f8f40
- TLSH T1A5D01238AD3B88C3CA221374D4866B1A8255A497A2ADE8C52891D88E3A27C4926183C3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\uTorrent\flags.bmp
- Size 195KB
- SHA256 8018ed6b581535ca488d74d4fe6abf16ecaae80b11aa65989a6d8f2f4fc55a84
- MD5 a655e37c9d2c8d8654898a6489bf891f
- SHA1 6f2b003aa93a281266d2c43eaf54b730d344be3f
- SHA512 f14545f35bc6e2d2ba6129c6700665e3656e085324eb0c8db2d6ed37c04e95392331a3a89b88a7cae160f2c33cf27b695b8bc1bc71ab76bc755d15e0b2bbfbc1
- SSDEEP 192:uGYMoyLoNGonXD9AICZgIKHzcZvxQKRfZ8QbiU8+ClSlVguBUN40SWE9vTo8zFf1:uGYywE3KHaOKRf/1T7f32KP5Own
- TLSH T1A6148AC7AF0A3311C4521874EF0B26FEC63B6D586CE6C7B759A87A4EC9BA7016437214
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\uTorrent\flags.conf
- Size 172KB
- SHA256 26f5579d04993c21b7e07880895c3c400b6e5ac57db1265a2aae68e9fd686c50
- MD5 86ac09e81ae8e2c9a968c2cd16df5b02
- SHA1 d3c0a0fdbaf7cb9e9c3e8dc50fa8a3389cbacbc4
- SHA512 91112da4016877a412af009d59cfcefa66c6022873b1781c346a6b1e4ab7ecd8287ab6c3ff35f1dae37596ebf2c6ac186078fa2fd6a81884ab20b76dcae50151
- SSDEEP 3072:Ja2WwRNddXbyedGkkCVd0gmd5QHLT8DyQqVV3ExfJza5JVxR//Fg4HwrJwksLjFS:JHOkkCVd0g65QHP8DyQqVV3EBJzaLVxY
- TLSH T1FD043F14CA516CA813242FD728A62D01A533C12B44D7EAE767959BAFF3C5C64B3D363C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\uTorrent\maindoc.ico
- Size 61KB
- SHA256 663775c46dce1ca8b104642374f93215a1b1e5e2afd7618b69d6ebf056afa5f1
- MD5 b768b1f1a8c26babbbc31fc551336221
- SHA1 15d6d0975a6a09b4266a5c49ca0bb53a94bfeb08
- SHA512 febbf358420b1fa78dae54e03a8c7de167e9169bce292399f768e997dc8fd912d8177f3c12f77420ea2dc20816d4e2a10c054699195248eae1f728b0226f60ab
- SSDEEP 1536:XUyyxHafrMLEcKTqlGDBZGxtREwdKRjpY2pRnNWbnVRxxSjBMg:X6afcEcTGDBZGR/Ml/RnN6rS
- TLSH T1B653E0B9F6B0E4BFC0066636C83285F63766BC319C20139A751AF34D3D6B3439A1599B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat
- Size 8KB
- SHA256 d3df2ca8be59fad211f3ce0377cfef1fc75ee79f8cb207c08ff5c179d5ee13c1
- MD5 e1614ac85d4e28cb8f17617b283324d9
- SHA1 5d669be869d47a9d574e5723a0b96955583388fb
- SHA512 883cf6717034623863524b12017d82c9d87777222d8fb80678ce5a7852769bea9cacf03b739e2ffe79ffa90d7df6ea6ac12123308a742bc65d835068e7d2cf69
- SSDEEP 192:GDOXpEmK+8SBjzH9cLiMcrKCPUq7muDVZr0yBWviYg1qoke+VWLt1BlM:IywoOBu/7mirkviNsokfOY
- TLSH T1E302AB9E44EE7B6D3A387C0C516CE03E963C780ACF97EAF5C4D029B9695460510FFA28
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe
- Size 8.0MB
- SHA256 22356a769361e1447ddbd9b1b2c1e5a7d082bc744b95195c23c00de2231e7c02
- MD5 106989d7f4fc7ec7cda089f82d026932
- SHA1 026dd564bba44d0d5c553ac74cb81306ad628ff6
- SHA512 d0cab39dfcd7dceab0c9daa6f246930ce33e21b7ffd0ffa8614f90f5b3698d66989e7539026f1bb8dee626ad291c88aab477040496cf9022fa26baa90cec56b4
- SSDEEP 98304:9Dv1JFd9oqz3Syq1HOhZyI0aZXjBxUSRWvijv0XauP+y7aBG6Fhp2bDMl:x9JFzVziyqJOhoI0a7x/RWvIMqOi9F
- TLSH T12886CF13BF82C4B1D7D2017015279BBB5A76DE240B314AE393947E3D7A309C2A63E796
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.ini
- Size 29B
- SHA256 720faa274da42c68712540258a47a0de972e0d5766e81a443d3470cfe02504c3
- MD5 d9939cfdc32531d7bfb35c630aa44d8f
- SHA1 9089554cb2c2e6775721c9a9a53f9f0be5af4ab1
- SHA512 0305e8f5e6b94d0271750466961f308d26735a3351ab27613b73ddf715a2e9fb86d06738be54634a5cbfea044cbea0a1a098243bafc27e5396ca4014f82e1cb4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\uTorrent\uTorrentMultiple.bat
- Size 27B
- SHA256 6338a88f7e30536ac8f9861376b3b1c098d13b772100231431131378d7f11201
- MD5 f8213defd9ded3a88499861c484d7e8a
- SHA1 533398e5b7ea1ccf83403ff5e8152a4acf7812a4
- SHA512 17ff5cea697f9895a4bf0231f03079c30ab0d9e83a893293a409bb18d9ffb321576b961a0b65af70a61e06a8ff5c20d1ffbf97f7adb86b7901b519ca0cd27e36
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\uTorrent\unins000.exe
- Size 4.3MB
- SHA256 ba0f85e74b20883dc3d99167748de826db7633e6fbc4741e513aff019e5a113a
- MD5 1ab5c84ae1a88a456166f5583c1f47bc
- SHA1 9c70846cbcf16f20c873feb1771ffa8c45d99908
- SHA512 50ae5574e0f7d255e8af50691c7c852cc7defac8047971a6061153d6bdfe8b8e4b71ccb25893d2e079eb7436bf6677790490a325afc0f44a86beb6df818dde3b
- SSDEEP 98304:6iDj+6GqBH6KwsvcHJ4c91usxgkod1scm333F:njpG5ucZus5QnC
- TLSH T124267D13B784653EE4AB1B3A4837A654993F7E303A26CC477BF4094C4F396806D2A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\uTorrent\utorrent.lng
- Size 1.3MB
- SHA256 b0fe199b089db0537d0faba540b5f16c725a0fe67b6cf8e02128728c090ee149
- MD5 c183b57b714962d50cb7d98b5b69fea6
- SHA1 77e6b9d20d5bf4c70c6e3dd6bd16f0fb9d8c805b
- SHA512 d7a226dd0ff737e3af7c8da4eabdf672ad94fa4ec620b2a2ae83f0165c130280e3e0e74102a70e30d69cd106d1fde48208bdaacc1b9274a322c8137853ba0b68
- SSDEEP 24576:KBDXfwC1uoOrXpc1GM7Fo6vbPitN4dLBYLxEV9DY+ZYtp6uvsDnzlQ:GMKO7pkGMBouPmNkBRJrYAzlQ
- TLSH T12D5533451DD83EBCE92FCA3EF4E147D6B41C2246849A42E1E193A26D1DDB0062F7DE2C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 38cad08ea7c53b85298aee7cae086ee5ba5eb661cbdcba587773cb626b0275c6
- MD5 3d619c4efed430eb4217bb01318bb314
- SHA1 1b1db6789877988bf0a545cfcd51d15e53537172
- SHA512 a64a609a9fd735d84024bf00b568031c488da733e960ba7cd64c9a7c4dcf8a6629d9aad7fbfeb67bfe1a8a87b9e6b08b4607ac469c95f449233668d54bea28ce
- SSDEEP 12288:jF7siJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5W/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T170552393468D59B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA238FDACF38527
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 491199d7e900d600cd62079f8c2aa0d14f8338e867f6e175bff35bf8cd680854
- MD5 949843fb9a7b795872eea993bbeacaf2
- SHA1 445844fe85d85d3d3236a046147d5ff08fa71887
- SHA512 692b94762d0aaec2fe47784fd662cc5e1d975806cd19407bc990195919e7ab1741dd9118f85d0aa255c88e0d9fd191a43b71b13dff4b3ff1e6f64856b514c817
- SSDEEP 24576:Zgb6bmBIi49WNNFpg1rSvFv7bYg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Zgb4mBIBhGFjLNiXicJFFRGNzj3
- TLSH T1DC65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 e7f35cd2af64a5bca9ed33154813d5f13c111456eae79fc8be3d6850644f25dd
- MD5 f0b361ad89b996673fe5140f10805bb5
- SHA1 07439d06e8971f92d678d5fb0ce76283147dab09
- SHA512 e2941f053e267d7a004f9b9840b1c3e40faf3f7acf0b4c688b036359b8b558b15c94bf0053fd750e7cbb6b7deb296b7fbae64c2bf736f480c09a52ec8407d37f
- SSDEEP 24576:YG88u8FpJqH1vzria7/mT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:b7ZFPqVya7/oLNiXicJFFRGNzj3
- TLSH T13785F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 92c85c5954039ab77220a1052f6b89d6acda7565101d4138277d647fd1320538
- MD5 900b79c3e01c61afd459f657de990940
- SHA1 7969552263034a301afac6763da69042e96e104b
- SHA512 870f1c70740c4f0bb0dcb7f2b4e57192248224e847a7941a8430e4b16af0f31ea6d6ffcb31cefed33557224737b03190c7cbe9e9219c885e2047b5ac51ac7347
- SSDEEP 24576:gPUr+NQH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gJQHLNiXicJFFRGNzj3
- TLSH T12265F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 9bcdd3ff258b50b15a41840b5d9d5c69aa0066ab3c0b15556ca7e86d6e7ff013
- MD5 6f088bf798f4ed4d4ed7f1e403b2786a
- SHA1 195c824d3876c99ada1fc895bb8f0295b7ee47d2
- SHA512 cdbcab1d1063b0c8f9d210b55371b935c230afa16e9b7f1f8eae0881169d9ae7c3f4a937d08e41be8c55a1f5d04b3c640f11707098745cac397d5eecbcae08a1
- SSDEEP 49152:mBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj3LNiXicJFFRGNzj3:JG05lO43bC7wRGpj3
- TLSH T1B5D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 989de66315fdb7eb2fd5c43d5d1fba257c7700b1ac0c5c290aa0dcea9fb69dd4
- MD5 7317c92006bfdac9babc7dd6e8672fcc
- SHA1 ca5b61ea0263a174a0843519e1314c5cbe03e5d5
- SHA512 aa9f5a1a20bd95be4ee345e0352bcf8fe05938654d9870bbf62b0effd4aa646a1442ddd0af45b3ca7a603ee12340a7c967994a68d39ed13d6ede5fe7412548ff
- SSDEEP 24576:Nfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn5/TwSfVcYG3K/cJHlnFR+IGNe8jg:9a5POZ3lJt2pasx2+mPLNiXicJFFRGNf
- TLSH T14265BF5EA6FC00D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 30651e860c3a1d67a56c03e4f5b7efae904d8073c48d78ede034fedd068322e2
- MD5 e5900d6e9d05020cb2c161396e7faeae
- SHA1 2154aa7dcfaffa5feb9e3b85e71ac8a83e1b69a9
- SHA512 9ab3f15b518cc7d486520fe301a0eec03f3f9dd7abfe0e0a453ad30065e46935f0ff0ee6a94e735140fd5aeb6474d05c1f58a5c931a24629ba32741d3df029ba
- SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7Fkr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HNc/zEOVHFILNiXicJFFRGNzj3
- TLSH T1E1858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 07a94fd01a34960eddc6d20da0c9c88302cf97ce42fce376e1e7dd94022bff18
- MD5 818db4c68b520005d39f28251326c22c
- SHA1 c5edb7b7bf751d54e90c31a40ae4d397e18427c6
- SHA512 0d41c123ded059cabb69743d0531d5c91181a0aacb8d1f94cd2ef35fb695791311df6fde88fce9f6571a8be0142f508aa321d82b9451baa0672ef8bbd9c5fe29
- SSDEEP 24576:1zkNvNnaFeYhJNtmZBml/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1zMwBtOmlLNiXicJFFRGNzj3
- TLSH T15455AF6EB6A806E4D1FEC675CD238512F6727861073293CB9290C13F4E679D89E39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 2f14649f961ab469c5ba03ed18cb7cafb461a5885470b34d0fea34b57c725327
- MD5 adaf0c667bd3cfeddcca11bd0061cf7d
- SHA1 f05f324613ea83fe325bddf53288640dc1f31b00
- SHA512 7654048a17a118796151f5b2142cb166e893cbe026d03aa245c313aed77135e257232ec36fe5b8edf0c8ce45a10cee4edd98389ff90a633d320b7598f3ef9cdd
- SSDEEP 24576:0D3FHshBIYQgAS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0DVHeBIAASLNiXicJFFRGNzj3
- TLSH T18975E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
- MD5 SHA1 SHA512 SSDEEP TLSH