caf3790e4ebfe489ba0ee831eb9ec28e8cc621c3e3cad9e213ba9c08ddf6ad37

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/07/2026, 17:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260717-vwzsaagx3j
SHA256 caf3790e4ebfe489ba0ee831eb9ec28e8cc621c3e3cad9e213ba9c08ddf6ad37
MD5 1f1769a22c13cb4d89ee2dc6fd68a64c
SHA1 d0b0d28deef5fbc4be64300ffccf98d3a3ee6cb7
SHA512 df18f7c88765ce1f3eb09e383d320dff017a709f516f974a165ba1148ef6528f1404c070e2141d25c379115570cf2d7054c84d3750abd25a6400444ff4fa3337
SSDEEP 49152:yoQynEIJx6iEdOXdgh73Faz9wLXoDZoaLOGpyE5QeaXTMc8aTyuPjSTUEj4MYPV3:vFAeaAAVl
TLSH
T1E9267B1BE6B940F5C0BAD1798A57951BFAB27819873297DB4790431A1F33BE09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Executes dropped EXE 21 IoCs

pid	Process
2320	alg.exe
1228	DiagnosticsHub.StandardCollector.Service.exe
2132	elevation_service.exe
4880	elevation_service.exe
2148	maintenanceservice.exe
4556	OSE.EXE
4188	msdtc.exe
4156	PerceptionSimulationService.exe
4572	perfhost.exe
4312	locator.exe
3296	SensorDataService.exe
4940	snmptrap.exe
2464	spectrum.exe
4704	ssh-agent.exe
3276	TieringEngineService.exe
2424	AgentService.exe
1792	vds.exe
212	vssvc.exe
1848	wbengine.exe
3620	WmiApSrv.exe
1648	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6d39d64cf77cf242.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\UpdaterService\logs	2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cfdedee61016dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9ef10e71016dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f47839e71016dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009cd1f5e71016dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093f594e61016dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071c647e71016dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000098c2de71016dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001998dbe71016dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d6c50e81016dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1228	DiagnosticsHub.StandardCollector.Service.exe
1228	DiagnosticsHub.StandardCollector.Service.exe
1228	DiagnosticsHub.StandardCollector.Service.exe
1228	DiagnosticsHub.StandardCollector.Service.exe
1228	DiagnosticsHub.StandardCollector.Service.exe
1228	DiagnosticsHub.StandardCollector.Service.exe
2132	elevation_service.exe
2132	elevation_service.exe
2132	elevation_service.exe
2132	elevation_service.exe
2132	elevation_service.exe
2132	elevation_service.exe
2132	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1376	2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeDebugPrivilege	1228	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2132	elevation_service.exe
Token: SeRestorePrivilege	3276	TieringEngineService.exe
Token: SeManageVolumePrivilege	3276	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2424	AgentService.exe
Token: SeBackupPrivilege	212	vssvc.exe
Token: SeRestorePrivilege	212	vssvc.exe
Token: SeAuditPrivilege	212	vssvc.exe
Token: SeBackupPrivilege	1848	wbengine.exe
Token: SeRestorePrivilege	1848	wbengine.exe
Token: SeSecurityPrivilege	1848	wbengine.exe
Token: 33	1648	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeDebugPrivilege	2132	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 3524	1376	2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	87
PID 1648 wrote to memory of 2064	1648	SearchIndexer.exe	120
PID 1648 wrote to memory of 4600	1648	SearchIndexer.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks computer location settings
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1376" "1256" "1160" "1260" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:3524

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2320

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1228

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4880

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2148

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4556

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4188

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4156

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4572

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4312

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3296

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4940

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2464

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4464

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3276

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2424

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1792

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:212

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1848

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3620

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2064
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f8ba9afaf81eea0d0a8c547321f312a05bbe2681124e1b0fe010151b4d363d99
MD5 13179a7d2c382bee9919fb847b61bf75
SHA1 c8b86af096f198f3abcf36796ab8ca6ba3039617
SHA512 daee103c67d5cd0cd66ca41b4b08df52b25a888836a138a533d6e731ac5eae0e40bdcb5d4398f92e77c73b44451ec271ef6176a823233bd74c04210e653aae94
SSDEEP 49152:Qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnMj4MYPVyGLK:63q6HjBaV2
TLSH
T1B3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 fc4b5fa9b0feba40372ab5fe05180b56c23a0339038eaec84e69f94db61f1fbe
MD5 6c20ceca4fc36748f30a4cf4b8e6f1ac
SHA1 f9c459db14eb52ada06d73a56af7518a34871aeb
SHA512 47909089604391ebb64b682a2a885843fdae69eb189601faa297f9e7a4872257042bf0fc287d1b3fceb8f1f0cad8f14437ed9db7ab949daba1181434dd77978b
SSDEEP 12288:s1XLsswWkxy2lRq2czAF34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9h:aXYfDtczACSnnrFb4PM4MYgLxEVyGLb
TLSH
T15565F12977E408F9DD6B8278C8A28545E633B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 11a8ca72439ed057c6474cae9ac0ae366f9de14b0d922e90761dbe868dadddb9
MD5 08ce54feb53e5e72a1a4d4b41d440cfe
SHA1 e9b725a7c470e91a0d6bed0f52613a8f65f3b043
SHA512 e3be90070a87c6cdc4b79b28ff1d10160147acc86704706cec2297e7555fa80b1ca62977107123c3305444a2c341a0311ddc96ffa95c725a38dcd45e36ad4f34
SSDEEP 24576:x0Le5ji0hmxMrM7SnnrFb4PM4MYgLxEVyGLe:xPji0Aybj4MYPVyGLe
TLSH
T164859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1261d0b1b1e234bf5f4cb4e82bff886df4136a671354fdc08697b6f9345b58c2
MD5 fc65632eaf6fa170e7f719f181d1bc98
SHA1 e9bfb081d84266c9822cd252977a68f9542323fa
SHA512 496472a2532a3ed3446b0a678be194ca706982f74150e83063b5143ae46fcac1bcf9b99d60fcd503226e53a5569338991ed1aeb46164b0429993b8a6bcd7e443
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWE6q8wyuFSnnrFb4PM4MYgLxEVyGL/:W/ezSC6vUzPvxHjyHj4MYPVyGL/
TLSH
T192755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b445522e002d88b8623d68d1f3ab0bc9765e2dc4dcee708672689af6a33f7d6a
MD5 89d840dac96ba8dd94f24c883bb93e23
SHA1 dbd1b4254f726145e7a4b7093323f064c788205d
SHA512 11cba5c238ff6f4225ce37d221c49db45adf544ae8cf250a13ef09343228666f31b22553d35f2ed4fc0f17bcabb423bc15c96ad87f33a89fa0fe5bfa615a8b04
SSDEEP 24576:RVbqPb88hv/l+62SnnrFb4PM4MYgLxEVyGL1:RVO88hXl+Qj4MYPVyGL1
TLSH
T1F2559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1fa162129dbf747d9ebb366c73abc70599d14bd6d60ccc599242f55294329ec7
MD5 d591b8f1f8b78af58c956fb1b4078aff
SHA1 3dc4bf15987ae53d57fd1a2ecb43cd907f6142a1
SHA512 a6a283897a25c55f9970979f12e9793c49b3edd2973c8d21d736b596c8c371c48d87ddf0491c10401e3b509e9209d4012ad2a2788cd99fdd66560985d99d4e10
SSDEEP 12288:7e034XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il0:7e/SnnrFb4PM4MYgLxEVyGLm
TLSH
T1FC4523A71BDC10EACFAE15B0D1B96AC8E615BC61F875B10B6750785B3A3F20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 5f80a5bf58177bf2f7352e56d86873b3ab0bd0f4640498d7d3ace822b9be94f6
MD5 01ae48f47f9d196d356e7dc6361a912d
SHA1 0ddcf919ab4d56bae1173e06e161ad87940d77d6
SHA512 e7c1056a6dc0132147d836abcc3f9187b0df7a7d00488242adbcb55d5f6df25c27d195fd73f218ff051d627878c41f822ab52db1adaf53df56e0078e7f03b26d
SSDEEP 12288:YeBNUbTVO86Up34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilg:YJIUuSnnrFb4PM4MYgLxEVyGLq
TLSH
T16665D07BEE28FCE2C67E4DB856918740E77278308F62A3CBD164820E9E235D45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5d2ff0d3f442d191d4f16f1f171b6847f0845f0b51a1c391f66429d1df0889d2
MD5 3a71a70d6f55de7eedef8043d2edc0fe
SHA1 dccb9c2a48c3098b5b024e32c51999ec3f6295b9
SHA512 39b5addd6a1f640dc54bc144f2c912a58f81967b4b73d2be5ea2831139d0e168c1a9e5030ee25ddd369723f40eaa8b9b25c13bcd853c235d0c765e501d2ec9a3
SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THf:FQvGAdlCEL8c/yRNw5CvV6
TLSH
T17A267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 6c42be3a210f43b25492b1071dcb60e29856f8067d01626845314422feccd742
MD5 3b86e2ac1a7a6b24f5bb46257c803449
SHA1 8886e11373605521119fadc24eaf5ca8163b81a4
SHA512 db707713be6913c0c07b218b9b589aaf5f6e5c244fb737a3d274cf342f3a1617a73610563ed720adbe695060a532b22a9450cc79e507cb837284a76539e08cee
SSDEEP 12288:dAwSfxL/2Dc3eDLLmt0LDQewsAj334XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeA5:O3ewsAj4SnnrFb4PM4MYgLxEVyGLm
TLSH
T15675E031FE74E036C7BF0DB21B36D716542DB9204B612AC3E3A89D9E59342C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e1f9ba589c52db9c36ed16a94e9849687dc8573c46fea0e6ea164a721ef72ace
MD5 5457a2eee9f7105c5f80dad10fe5955e
SHA1 db0fb647d2f16718d418e8117442fe0f50efdaba
SHA512 ba0f76d88767109b5138fd68e85f9b5b10b110e4a4e32b7ad3236a29b9bce7ff7980663f1faa4a2b70049c8a9e37a767c0d7291f01fe928987cf5e5ad9a291e2
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:HUEtQevvqc2W1cpV2EI32
TLSH
T1B7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 333bcec6df0ee10c4e81b271c15944ae59ec25c09362c12dae5d0cd730a1fea5
MD5 c18fa5ecc8f1acf3c7dd365ac3d78f47
SHA1 0975c2d5d8ccbfd4e4ddf0e9220f85405dedd2e1
SHA512 afacb56ac62c72b46d46b1e91bab72a7bca50fe25721acd43e8cb4ba1c10884c207cf8b33ab79d99bc1ef619010c049f1e230e9b9b16458f848e8e92c620d37e
SSDEEP 49152:6CbRquA/m2yL5zQfFiV+XenmE3/zrj4MYPVyGLL:PoqtVjnmLVP
TLSH
T15CD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f3d1e4c102e71ec8bbaf20d0d05f9e48efb902492e434b611280f48edcac2557
MD5 c7dc78ef9c6151bfa7ad600e1d7fa0f7
SHA1 c69b492cb5dd6fa0a5f97a014d97c4f81f4377a9
SHA512 27a0c37f0e042e60d10de58c5a2c665f082df87b02489fdf93b60291c5553404315e8dcba8752de2741ca8768b633ed31d1adc13c3eafdfbb5237225d207f17c
SSDEEP 24576:SAhGLJIFoiwtA5l7S53RSnnrFb4PM4MYgLxEVyGL+:SAMyFoiq5aj4MYPVyGL+
TLSH
T19F35AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 b21ef3a10465d43b3c64abbdb41b779035eb5f876ccfe22ae3e79c1724d05b07
MD5 e81ec3bce61c41004f1366a182535f2a
SHA1 f9e96e34d585305e5fd83f76a1c37e6d669ead87
SHA512 175c489d625fcbd0df82ddd790d5d064761fc92626d983eb0708d135ecd77d497ec27bd20152ab8e4b686ed935f8842759533f204253f0f6878564338c00f9bd
SSDEEP 12288:dmw5HEjsChN8BFgl0WDm+Cu34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqN:YwuxOW0SnnrFb4PM4MYgLxEVyGLz
TLSH
T13F65F14637E81CF9EAA74238C5978535F7B2BC122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 7827e743cfcd5aecdee80fbb5e8b56ca9b780d14e49b0a5a1a094c4bbf950203
MD5 8afaa1fd07d64cf1205117e753df8fec
SHA1 dda575f75f169c90c1a2f6df01033e9307a82c9e
SHA512 a8036066a59057804131d34d825c9821191ab645756f5b260e62a95dc7329903a6700fef67ecaa2d6a74431c8d6086f5b35a5d6ac94151fdf313bae12563f1dc
SSDEEP 12288:74Z1Iyn34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilq:cZuzSnnrFb4PM4MYgLxEVyGLk
TLSH
T14755129A37E820FAC6AB4274C4F55688E3227862B77293CF1750655A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ef453f90b93a5854a504d8ffbf3f849856c8f3f938b66696a1861b9f4414ccc6
MD5 d0ca09f302924965cedda753a6a88ed5
SHA1 615b83d228de88c0229d4099fb3c15dd56d50146
SHA512 2b63840d71c7cf74a7997cf5abd146c8f1d26bea2c673029d5156ffb4c067b3c2fc8ada3925bbbf8666f0187b3ada1d71b37f822b68c4cf1b61fc1d70b2cb9c9
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UE:hQRQyi36YOcPQLvw2gAf+PN3uVh
TLSH
T129667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 66fe3fe13625e2edf0121fadc22d469c361748be2c0c18bded94b826f6c28a8b
MD5 37e0badbf8c52d6d4ad9f6f59ebcd9af
SHA1 b0167b208e261cca93b35232f3758f4ab959b3c3
SHA512 4b3e80410e49e9c30e7c87ccf2a5d38fd45648e6ed3938d71c4ce05071f3ec1ac7b5e10e57088cc6f7665c3a166cda59ae9e2899a16f3e2afe115e05f900e4bb
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:iQRQyi36YOcPQLvw2gAf+PN3uVO
TLSH
T17D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c12b36b0d0c1cd1489888b97fabd099a6a38669d77eccc7854efe5c979a760fa
MD5 4d5ea6fd6dcbeb1e34365c9c172158ec
SHA1 87560b20833d2ee1237af37777208705ce0f7b84
SHA512 44777fddff2235e84b0d2f1769e9705aa62d7058abcfc47deb82bbad6136294347237a4cd4ca5a61425a487e6b3a72e4d0eb07a1c4618be6c18e2de1a26360f4
SSDEEP 24576:UwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0DSnnrFb4PM4MYgd:a68Qg55nhheWu7PNU3/bj4MYPVyGL+
TLSH
T173B54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 89bdf129e6bf1637d7b271ac7144bb522625c61e0bdd71b2bec147b5ff43bdcc
MD5 20e28f41034daaaf71f36a8eb53c2269
SHA1 f376c04497e3016a2d1e6ea703dbcdd29b323904
SHA512 9bbcee60fb572dc2ccccaf4a9d96293023e0e75399dbb36a5c8b5c170c48e555e30a3160e0081fe057825099835177ecab7aa07c32b7f2e14bd462bc59ff8285
SSDEEP 49152:Q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99L:dy5112gYy5azzVvL69nLKnhZlVs
TLSH
T1E0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 381ad203de98061d3d25cedf7b65dbfe38e75a629f6831b65c8b26b8bed18bc6
MD5 7da4ffd484e5e416bd38672fd8f3d9e9
SHA1 e5e55e4307444ccff0bfb6e3966c1fcd8f8a918e
SHA512 cd962b4a2efb85fdad763eb99f3d35e057c63cb374cf49519c91974093df5814560bf36897484ea7e00038c7b4bdf72f6e4407a48ad9911b5fddd88a814ae26b
SSDEEP 49152:8B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glNj4MYPVyGL5:Wu6JmVxd2d2Vt
TLSH
T160D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 da7a9215e8cdca13cd00bbdcabd4d633a210f50859cdfaa79dcc00356861b39f
MD5 d4374a53fe0bc6f7f7e127a7d1885816
SHA1 77cb181bb932a90f57305ce8aa41796b4eefacaf
SHA512 9e25b26557318f4e2c2d76802238924c59b535aa40584de490aaaa2ed1080eaa80df31ec50fa540042d1fd96f7a11a3cdf24df2f030596920fc827da7258285a
SSDEEP 49152:61hpsNoJpF1A6UU44CwH7R4xpj4MYPVyGLS:6mifPbRLVG
TLSH
T1D2B5BE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9ce34bbe26a5cdd8ad861971663752af22ac8a3895d2bb33b0c36379801529ed
MD5 a4d1dbc0e8db812dac860f4cc69f295f
SHA1 d58e66a67526b1cac077206574b1d9cf0fbc6181
SHA512 8eaac1bb9cc1a2b1f4c58889e5abae257f764881907c32fccaeaf2a523c4e9ca19b7059b3f45e800459ec6299e4405c6bf7607ba48202685221349e0d7130baa
SSDEEP 49152:TSuZQIY0Be2KRRVtOnks6NMHq8j4MYPVyGLB:R5dKTi61pVF
TLSH
T16FC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a308ed2e69c5e752c5cf71efd6fa06edd032ad254ac517839e5c39a6ddc44c57
MD5 c27c55d1f01525d1be5cda16c82a8937
SHA1 994527491104400b8bb256d3ac527c3fe921e68f
SHA512 9c74ae57070dfcf1e7389f26c9d66f667acf7d20737f05f7df8336f083f273addf3d1d8a58078b37f415d95f641d2fcc1b1cbe64fbe9d00f075b34d2e1367f32
SSDEEP 49152:ehtSn8EApI0figngiDn0AP5w9j4MYPVyGLu:/X2iyphHVC
TLSH
T1C695BE13F2D900E8D05ED174C7568632EA62BC160B39B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1509340ac18a7e979e7d9bf8bd4223484ceadde51f270aa93792e7f03685de70
MD5 8603a15f887986085833f9c53746c94e
SHA1 c8897f37d6ac8d02be6d7d1094eccb9d2158a829
SHA512 c4fa29f616b1332e3a816e48a3c3cb77c733928ea882bc4b54e8fabbed0cdefd2c050c3130e9147434bda383fddc1145ab02722b8dc8f076ee9c4c7b81498317
SSDEEP 12288:NM34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilr:NXSnnrFb4PM4MYgLxEVyGLp
TLSH
T1884523A62EDC10EFCF5D16F0C1A966C8E2097C62F976B20F774574173B3B20D6892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 869b714ae51338ec6829a5c561718ebe4135fd58ea4f2b45da6e7a2d1179e670
MD5 5712ada0e2255aeab14d17c100b9b5fc
SHA1 0dc0e255a011667215a625f99d6b3646fb1c3e38
SHA512 93d10c0c58770a3e0d8bfa6d4266d8f5e9781b749e041e4e6d1ba4586ed039a5cc33f95e63853a6ebeae27613abeaad3d3e496a45126912e3cb612ea96abd0c7
SSDEEP 12288:Xj34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilq:X8SnnrFb4PM4MYgLxEVyGLU
TLSH
T13B4523A62EDD10EFCF5D16F0C1A566C8E2097C62F976B20B7B4474173B3B20D6892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ff5fd968ab326dba2bb5e70ac550a1affa2c6263f0a846b06cc62fbbba0c5ca7
MD5 948a95dad36150178441fa1fec087b82
SHA1 e439337ccfa327e0f0dbd74a8aef661552461b8d
SHA512 3f1d43faefed6f1e2407b596996efe072b9e617e4bf2ccf7cc8158f5a18a54c2035b4c45db120e07efdb8ad994faefaf554069ad6ef4c00546c972fb0ee617ff
SSDEEP 12288:7B34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilS:7GSnnrFb4PM4MYgLxEVyGLs
TLSH
T1154523A62EDD10EFCF5D16F0C1A666C8E2097C62F976B20F7B4574073B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 c2babc1834484773e8aa3e45ebf96ed06fced09211834fe3c36e5e092b39f23e
MD5 f0b9bb667dcd91ac5eacb3778561cd8d
SHA1 a56833d464278fbcb412494756c7a7bf2718d8d5
SHA512 2dd2ec80a989c42b2c3565575425b598a235965592fbd43c0300ddd2156e9924e705bb6daa079b6067c25f8ac3dbd56b1b5dc35fc4b8af51f99015d1209daf44
SSDEEP 12288:rVi34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il4:jSnnrFb4PM4MYgLxEVyGLm
TLSH
T1DD4523662BDD10DACE6A96B0C1B556C8E225BC61FA72B35F6740381B3F37348AC71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 43a7337f495d07a9e787d1bcc1be76c9845a7b2a12a762ea63901b481c3e8a05
MD5 71e2c92a65f775af829ad53c7a0f8115
SHA1 e9840a9bf503592d98a9600ee9d0ded1d1651aa2
SHA512 2b39fb820193d838c55092f2fa8025cf05b7614ef50bafab5ad64b6e18c1e975d86da341b537342f33a7234c692ef6ab59ff64ea680c9a62083e8503459c8838
SSDEEP 12288:lq34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilr:lZSnnrFb4PM4MYgLxEVyGLB
TLSH
T1514523A62EDD10EFCF5D16F0C1A656C8E2097C63F976B20F7B4474163B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c1e9857327522e395b92e8ee82c05809687fe0a8a1cdaa0524faf458ed1e199e
MD5 767748943591ca9d5db096998408adcd
SHA1 80a4e4bb4adb9247fb70a3e3663c6c23fd41b741
SHA512 b59c00591833472f927f0fa9cbb9e007b89d76d574e66c5415cb85a4babf80e15fc407d99d431567c9e7aa49cef467b1c6cf04bcb42777984b39b49684f36b4d
SSDEEP 12288:6P34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilr:6QSnnrFb4PM4MYgLxEVyGLB
TLSH
T1E14523A62EDC10EFCF5D16B0C1A566C8E2097C63F976B21F7B4474173B3B20DA891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 73ea346eb5c69cf34ff6273113fddbb5801d83650af2b069282e039181d53ab1
MD5 ef7084f58c831036bb5fce56ce16ce19
SHA1 e40aa08be4277a2b9e0bcd1cb2f33a3f3853383a
SHA512 016b57114b0f487bba982beeb2c0fd2a555f5dc95f6412a373e4d84bea00a10c41ecc7cd2a29a142a934db9f4896cd9bcc4d2f18c99cf795d392ee690a3507d2
SSDEEP 12288:3L34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilX:3ESnnrFb4PM4MYgLxEVyGLp
TLSH
T1B94523A62EDD10EFCF6D06F0C1A566C8E2097C62F976B20F7B4574173B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 638f40e0f06df34d123d6508a65bb972d81204e6a65e909a617f518b8f2aaaab
MD5 ce7b7b7f75e07d02cc4b96f6d33c9186
SHA1 560a5547e77e5b36fc05b28ee29cf525c7e58349
SHA512 086739ecba83404bb1c16104d4b2080396e4eab97d3455948ca98a35f6e6c0abfb934ace7e75f7fa488d80a8b9d3d177ba468982fbaab411e554fb6a2e8034ce
SSDEEP 12288:biZwbQzzFEoS2cPvyD34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2G:GZM4zFVSOcSnnrFb4PM4MYgLxEVyGLP
TLSH
T1E76502A5739418F8DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 874dffc08ab4d14e929e2997e4ba28cc59eab56bb9ef6e01b1ec39e12495a74e
MD5 bee681dc9fc8718f34181c34caa59676
SHA1 a2595df9502d3b489bad0043bd582f14273267dd
SHA512 5ec0e86987dca3f154d4dbfb884c951d964e8e693f96d4258e455f95b2f0a24b26ce89bb69b4ba7665b550a8b8e5c0d7f74d367db1729dfb9064a4246eea15e4
SSDEEP 12288:sQ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il7:sjSnnrFb4PM4MYgLxEVyGLN
TLSH
T1D14523A62EDD10EECF5D06F0C1A566C8E2097C63F976B20FBB4574173B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 77bc4a867366f71962054f8802d839aa868c375dac79e88df8f9ddb8662ac641
MD5 0dced1d3b21476c646330cec67ce86ed
SHA1 d9ee3716863457310c5a9c3d23e6ea213e51830d
SHA512 3f8bacec1953b0ebd1a6e6392dda7bd0614dc8b5ea2a57bd65c25222d405b12c63a47571100adf1349535c69be6b3a08f409506f1d337fa83878c89b1b0e36a5
SSDEEP 12288:nk34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ili:nvSnnrFb4PM4MYgLxEVyGLM
TLSH
T1024523A62EDC10EECF5D16F0C1A566C8E209BC63F976B20F7B4574173B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 99032b7c94a36d7d59d76b9b79809ec2419cfc62ac88dbb3ffea97245c2665ad
MD5 82b9e3bd297425d71b5e6c9988fcbc8c
SHA1 2946317aa1bbd18f502bdb5f2976fd627f8428c1
SHA512 48dc647005a7bd4e2626c84cd66c5ee493204dcbe48ac93dca983faf6f400feca4fbfe4a7d2c107f9b02401be9eae492e4c1dce8b05fe1c9539c7846e2dd34f2
SSDEEP 12288:myPz5L8n34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilo:bzyoSnnrFb4PM4MYgLxEVyGLO
TLSH
T12A55025737A530FDC67A8274C4A21A45F335B8329B309A6F27A016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a5414b01027fd4791d0b4daf9e1de720f25ae6e5a306b72397c245dac3cc2388
MD5 83031db983532cd648788ecbee2fd572
SHA1 f51c5ae37c86c0e0e229e6a3f91e83dcef643128
SHA512 48cb29434a454177eec038e618c02842e79bbeabe914522668c536ac41f967ccc25e2df44a26b56a2c9f5d5214674c7c90e7c21b25dc54a10612aff0288c0c18
SSDEEP 12288:hQ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ili:hjSnnrFb4PM4MYgLxEVyGLM
TLSH
T10B4523A62EDC10EECF5D06F0C1A566C8E2097C63F976B20FBB4574173B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 766b4e5d22ac6d12f9fa2853a8f7e2717f01bab631d6ca47c514ca1297702a9b
MD5 283a3199afcb5b834d3b3e4f6d74a146
SHA1 d81a58b6c2e7c47540e347161e0747c62158e71f
SHA512 4969d2161c9583c99763cd4e6c0ee0520c11b9665278b0d6b9f9d8b67520ed8cf71620f205f39f3e0dae3bbaa72e443a167e78ca9fc95588a5ecbe46ee1075a1
SSDEEP 12288:wQ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilC:wjSnnrFb4PM4MYgLxEVyGLw
TLSH
T1764523A62EDC10EECF5D16F0C1A566C8E2097C63F976B20FBB4574173B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 e12f321fd7c59fe1c9ae677b89b0e43bc4d303b68451465cda21ff9b047f30e2
MD5 45d9d0958ed84f83d50284ddf6158058
SHA1 4bbfda45d912a1ac217f67b042c2b2cf47eb72ed
SHA512 a6bfe2b4837078ff3a7b304ec9232d6b72ae87e523e1db3542e143f239be7b6cfbb322c2a58278631a8a7e5f35de2f135f27471ddd395a75a609153f9e1f5c30
SSDEEP 12288:cyPz5L8n34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ils:FzyoSnnrFb4PM4MYgLxEVyGLu
TLSH
T10355025737A530FDC67A9274C4A21A45F336B8329B309A6F279016773F372849D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 99d2ddd21f9267f5c68a49c4c44d0941aa502604111eb27f7e149b4816d69703
MD5 67c555890966dbbe58429e4c15d94e85
SHA1 d541464a28c6c63ae91ceba64f7c6ed4e29dc054
SHA512 9f83735e0b9007649aa4617b730b297cf7835b8d1c173f0fcf41e034fa5a4397d04edcb864ba552142cf86cc84dbc63ee71dff978afc7079f61f4636b310e799
SSDEEP 24576:4TpaLl3z0zDWSnnrFb4PM4MYgLxEVyGLL:4T0Lljej4MYPVyGLL
TLSH
T1086502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 39393ef3e78853f837f9134ecf827f25ed1a867b134d3b265aa257824a9d6eb9
MD5 98c425adced87c9b91002f856035ba88
SHA1 4aa19e485040c8fd484a3131cb0ddd46feb82fcf
SHA512 b12a896b211d98829270a8c4c73048cf39d7a043250fbac7d86470e801c10eb4f8148163e106d95dd1044be560e2968806b9532180c4eb433c26eb0ce72119ef
SSDEEP 24576:43+d9CHKy7GZaSnnrFb4PM4MYgLxEVyGLR:C+d9CHKyaTj4MYPVyGLR
TLSH
T16B75DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 c8e70c6a075f93ca313e9b252b9a7d26cf8ead13e0b452c6da8230dacd25e0ad
MD5 8b5fa923c79cb6ce81ba7d899abb86f5
SHA1 d5963aef1b931c4546a98020ce4ce90e7631eb8f
SHA512 daea47b428aac3260a45b3d4b03daf22186a9dbe7d4623f8c18be8cc0bcc8bb511eb1659137e27a1d56c6a653546196b6c56eeaa6ba7e3200168f4d8f8d6526c
SSDEEP 12288:jh34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilf:jmSnnrFb4PM4MYgLxEVyGLF
TLSH
T1B24523A62EDC10EECF5D16F0C1A566C8E2097C62F976B20F7B4574173B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 b45f5f9462b2d70682052116d3e22878d7bf994c5f9b935df2f9f54e97d56edc
MD5 5dbf57abaa834697064c515feef3733f
SHA1 9c532c0d28ced196dd354c96add304993c3850f8
SHA512 1472adada7f3f20ef2f7c2fcea86aaf5faceebf0399bf16e025a004b7fb5504d3c3e00254a8acd14a19a8946952aa8e61fac20a51e1dbc1c4668e9e7451c5e60
SSDEEP 12288:TH34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ils:TISnnrFb4PM4MYgLxEVyGLm
TLSH
T1454523A62EDC10EFCF5D16F0C1A956C8E2097C62F976B20B7B8574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-07-17_172109_1376-4996.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-07-17_172109_1376-4996.log
Size 1KB
SHA256 4f325d4a9bed2eec2c4faedc0de0e812f703a8eedb8a2f848021959133c15de3
MD5 ab5576b6ed46c4ac1cde6c73e5eb2e42
SHA1 245b37b6ee3761888c098eaa3535cd6b90f74a1a
SHA512 09612c9d8669ab8a35d9eda34fb0eaf397d3ac46aa1ae5b9831f71fd222f875f38209306a163ce01b87a4efa62f910ffa64d0506ae9498c11238548b1732cdee
TLSH
T10521B42A7BD40A15FFFBD9C155FA11539D3A79996C30C54C00A5424E4871F40EDB035B
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 381ecc5e11d92278f61d698be81703edbc715c35e0d6cc701d970f4f8f375881
MD5 52b76b579b6bc01c497598905c2a6428
SHA1 38beb22b6361fb86c5a641a49c82b84dc0fae56a
SHA512 3e83547a9729e82fea59498d0fc3804fd87de68ac69620d21edcf69d266a7b49f99f9cf4f62c67404164d32df99d97abda56d92ed1623ff031350cb713f83d24
SSDEEP 12288:Hysfg34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilX:pzSnnrFb4PM4MYgLxEVyGLZ
TLSH
T15755F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 9eb17b8f994f76f4df3a55a08555848582755a4dbc12b5e459098dfce4bd214e
MD5 51a1af4cce1f1e25b802dffed82bd8c9
SHA1 3383a23df78999ad7def0c867e85505b2e6cf58c
SHA512 02f4fc605525ccd6d152033cb6c35828f4917706beaf1873c1e392c89a3cbaffb2eb5c357e0cd5998e750806900eb3d0f3d22457805bbbc90ce43299756d11c9
SSDEEP 12288:aA34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilg:aTSnnrFb4PM4MYgLxEVyGLW
TLSH
T1D64523666BDC14EFCFBD16B080A596D8B20A7931FE71F10FB740741A3A3A6499CA1713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 0e43119447b4255fd7fa35cbc68718df69ab08008be6d39cb746a02c197895c1
MD5 898ba21df9228bcd0d3f2c560bba630d
SHA1 b57b4eaf10152f938590df8a3ad11bcbb97c2fca
SHA512 552b930ed142dede391088cee6a5ed4b5479a538f1b4596c679fee56aa124fff3155701f7234b75761ecd9385ff1dd2599d649cd20cc7a61f10d46d06dc718cc
SSDEEP 49152:0a0h2GEkuAe73q3pp46zwwQaj4MYPVyGLT:0a0hNYG4JwAVX
TLSH
T19085AF1E67EC82B5D0BAD278C9A6814BE6B2B4221B3156CF1151853D3F37DE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 dede1d96afc585d380a368ad681e23674d138ba4d85593215f66f0a494778c73
MD5 900a047e87a87290ccfde99ae0868291
SHA1 8ca74843292e40ab35f55f9777a7a34c6acfff42
SHA512 7b87297f7216ab9a4a403764b501e8313cc98098eac9f916f73a6db50bb0c28c952467b132372f7db5bfc32ef990ce7ef0ee90fff16b40a28b3625449355dcca
SSDEEP 12288:fhbHjfXs34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ili:fhbHjP3SnnrFb4PM4MYgLxEVyGLU
TLSH
T1A055127E27EC20D9E675A1B8C1968649D331BC216721A3DF23C1917E2F3BAC85C35B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 0ef8d3e412b6c565c3bbcde9811e111ee2b917993bf51d5ea521077320bb2617
MD5 d1453b44a2933fb8d883ac0577738309
SHA1 48430c321e247d293c58d8302836346c7280e2af
SHA512 c836475e189842a1b307df2befc3e981baf88f44cc9e9ad85cb6021da991bb84bb050e7fe0790cea8890ee59ac57eba02c3c85a9c6c9c6615522edf672cfa64b
SSDEEP 12288:+U34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il4:+fSnnrFb4PM4MYgLxEVyGL2
TLSH
T1694523A62ADC10EECF6D56F0C1A656C8E2057D22FB76728B76407417373B68E9CB1312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 f820fc3ad16ebbbaae7d8edacf3b36579430ac6a299a35803730b3121a322a05
MD5 387f9e319ac9230dcc15ff3f46c63179
SHA1 e4a8eaea6cfd7741e648cb582ca1cf949ea79349
SHA512 fd0a3a3d751490b66fdbe169e30ca5912041b9e8c6ca9beb65a87501fb17c739ec0f5d964001afc9dc6a71c44d213971cdb6ad28dce44e5eca081b86c0782e36
SSDEEP 12288:1Ob3A4LWOsvAYFTt34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ili:yTL3UTqSnnrFb4PM4MYgLxEVyGLM
TLSH
T166750155F7E800F9DD7B8138C5A28A16E272B85D1764E3DF03A84A662F233E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.2MB
SHA256 c456ac03d5d0f925dcbfce22a3058605580b9753ca41bd796145a9a70093e712
MD5 ddfd582e70d7d6e8cde9e44ff571e928
SHA1 03b303edbac4f51d3be51381357b5a800e689500
SHA512 0c2cdc08a231ba6490c131882890186c7a338598d6932ba9fca609af914cfd5d4de3a8ebb0cc00c6a0fafd29d4435f163bde680a9d0fb306d1a81b19a397adc3
SSDEEP 12288:opFtIOx34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilf:/O2SnnrFb4PM4MYgLxEVyGLZ
TLSH
T10655026A37EC10E9D579A1788592434CD331B8625B2263DF07D0907E2F77BE86C36B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a9575197ac889e52582deca0fe689d5252e2910c7918e1c8908a383108aed7b6
MD5 28fe80bab55823ae740f52fd214efe0b
SHA1 c357c41c9dd4b221db5a7ee54d483746ed4fc11e
SHA512 fef7ebcbac184f47df3f70a9dbc707578d30f76d7013a671a7960b4373f717d42fb896d0d4886a2afbe6453fbc6ac29f814a20e9d34355b6bf1c0fdbbf1af38c
SSDEEP 24576:V7NM9YqZqmWMUkPjZM48Mv6bEhsDSnnrFb4PM4MYgLxEVyGL1:V7cBWMpPjN8DbEhPj4MYPVyGL1
TLSH
T13F659E2E6BEC81E5D576D13DC9A28245F2B2B4611B318ACF1252833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 93e6b6af58e1d7de4b15cae9fcb71a08844fff517fc49f6ceb856f631da56c1a
MD5 e417fd634047fa33d4c204ea904fb547
SHA1 4f7574f03c72589b7d7a89bbc75cb2239316d7dd
SHA512 8371584143e1e9d87e9b6b3757b166281dd23e98ba36472e9ba847bc84efa7be71a5d64494aadfef46c6e8de5bd166919a119edcf38467d39328fff10d9b3643
SSDEEP 24576:8W6BApg2YuyuNDYTabvcdvNYf8km1lSnnrFb4PM4MYgLxEVyGLG:8F2YuHNETovAvNYf8kmsj4MYPVyGLG
TLSH
T159857E6927ED80E4E0BBD27D45B6D286FAB2B8511B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 84391dd330e0976673dbb349752780a9f7e8776b19dccc614f2261be4616174b
MD5 3b0a6a8b727f9e125b747419070331ec
SHA1 609cbcc2b202540fe52e99f1e749275894319cff
SHA512 e831dcda8464588c18ae0125a1942fc98a641ce0805c2950d41b5760d8aacbb44ff0efdc9b3d6a1536d3132476f803e54716cdbc2de545f8512b4e7d5684c5af
SSDEEP 24576:KAFs06+Omlf3NXEbToSSnnrFb4PM4MYgLxEVyGLu:TFs060lVXu6j4MYPVyGLu
TLSH
T11565AF2F66EC00D5D07ED17D8997C91AF2B1746307256ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 02526e36a34514131e2bef27b8b79321c30474595f762bb9540cd412368d1754
MD5 7e87487723f6128571b8716cf3afaf34
SHA1 ac831782d31ddb8ce5a62fe80dac2705498e47e4
SHA512 c85b90896cdfaada6e11b10b2f9b4d4ea54cf4f98fcffb31b886555586225b2729367f603c25c490c462830345574ec29e79a5a52c964ad9d6e11b41ed1cc6d5
SSDEEP 12288:0CJnJ5D3Vkr1zxQ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilm:ZJnJ5D3W9BSnnrFb4PM4MYgLxEVyGL8
TLSH
T11565D02DD2A810E9D4B7C2B4819A1795FF72383D2F226ACB28B4D4353F12ED09979F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a2e9e311fbd1c069a7e9a1785a5cc50e66de111105be3117a6e30fd0d072a32e
MD5 2bfd06aa02c99f49487f606dae9c5a7c
SHA1 3684cdf09c608ae11e6725a4e845a84ab4d4cf13
SHA512 6149f031ca546d0704c81699e8cd0f53620af6b044b669b5b3681430ec9d15fe189af116cb4e33bd3300ec660d304ab3fa336fc1551e3fd0a0c8ea58d04057ef
SSDEEP 24576:BEPghm6/7IIXdwcXrif7qQncjlP65i3VuUSnnrFb4PM4MYgLxEVyGL7:mg06DIKdwc+eQnSt65aVAj4MYPVyGL7
TLSH
T111956C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 04c9d6c9c3a416886a558865f84987c6282156661aabd11c975575efabe068b4
MD5 d03c4c7563f1584a2921d5c75564b00b
SHA1 4d3abfa6b83d35b8845605dffe220f21f6ca3578
SHA512 2e5edb4028646ae46c36ab0168ba51dcbecf9e6b7b81ea976ccdec4033b877d52ccb7572ce71f23da0eb6009778e86eda93ca707f597c1d74b3f24873f720481
SSDEEP 12288:cEP3RxZ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il4:XxeSnnrFb4PM4MYgLxEVyGLa
TLSH
T11D55126E2BDC20E9C62A9178C1A18688D332F4717B6273EF1690D13E1F37AD95D39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 5e67ba2e2bd7423e55371915b01f07bfb06652d9b8557e9703716aa830379ec9
MD5 62395aae882555d38bcc0dac30e1cfd2
SHA1 1cd28893db52ba87df801f4430e7ffb147b5f8b4
SHA512 d59bf8b7261cff12f2f952ca2e5f0bb3853843ab8a8cbbc6866c2f56653ecde630c2b1b2bf0ccf94eeecbd989fe70efe0011ff41f18b176e4924a7a6eb3d5e0f
SSDEEP 12288:pjkyz34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il+:pIyMSnnrFb4PM4MYgLxEVyGLI
TLSH
T15F55125527D860D9DAB90674C5A682D49A35BC21AF21A3DF6280F53F3F377C8AC31B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 20f8226f0cbf4cd24a87f0d77e29281f41339e9c560e2a5776d4e50f6f8ea4d3
MD5 fbdeaf45ae006f4cfaa2cc20f85cfd4e
SHA1 f5cf5c3eabb55a4b9a7d503dd45f3fb7878b2df3
SHA512 f6f59cf211383c4067a03656800c25886d0dada9923af7c121c568ab39ee4dd3631b20e425868ba3fe3aa9bfa7c494b061d5584ea46aefc18fcf3ae1dd089bfa
SSDEEP 12288:91B34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilI:bGSnnrFb4PM4MYgLxEVyGLe
TLSH
T1C545236A2BDC20EECF6906B0C1655BC8E2157831FB75719F76C0B4363B3B68D58B1A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 60be3257aa9e3023593daee36025fbc4f464f7da516794112274a1a0c84b6fc6
MD5 d29463963bb09386f36f6fc5442554b1
SHA1 ec6083fd1d157687e9a38adf049ddcb769c70c76
SHA512 8cb52f46295a1e2df328a34ed15304e0232a7eb679aefb7373228bf09886f18f75d5dcbc4501cbb588eeba262b002d7cd185e5e5957cff0696f17b000e5a79d7
SSDEEP 24576:gQ9MxZKdcz9dw3rSnnrFb4PM4MYgLxEVyGL3:gVKZ0j4MYPVyGL3
TLSH
T141557B2DABE905DAE177D27594A250C3A633B4311B31D6CF2448D03D4E7BEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 68ccc211259b4800107e75fd25cc742020e1759b6985c56ab51fb14b06a7fc87
MD5 f0d1c5a617b8a68fa809c134b6c0f84d
SHA1 064c8f570e121cb30c2f0331ebbc3ead798aa7df
SHA512 8011b15f90f2aef9386fad33dc21fd44143838ab830d5b38127f517020d6582253da49550fcab9e6ce0875bc25c8d1bb59f092fbc2a0969a619cae9b5941be8c
SSDEEP 12288:ryoKo2nRple9pH34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilD:ryocRApISnnrFb4PM4MYgLxEVyGLx
TLSH
T19D65E01F7BAD40E2D176813889858745E773B0306B6263CB6691C33E5F27AE9BD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d0577e6ab53ec3e357839a4252370e537022c7c00c0411bfe290c66dcf6037cc
MD5 1c75e9da3dbbc2a2b1a562c9334b5fbf
SHA1 bb6e57369f4ac0405679a751b2ea4dbddb0d95da
SHA512 24adb9853f0d6fde7d2e59b90e021fd86622357da0a7d1e6716c423ef6e8608d63297f99e0febc1ccbd12476d1d05696e9e55d45e78619aa7eea8bb01e89976b
SSDEEP 49152:BWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKbj4MYPVyGLL:50zuNI+V/
TLSH
T1E0A57B3DA2EC00A9D9AAC375C14513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d27effeb8a37b6c1a9369945ccc92348f7d9b98408b79e96759a4858e5997f24
MD5 9471b4db620a898692b6cc02e5f01cb0
SHA1 31b280e54c8de1f694089d48dde77b5199a09237
SHA512 21d59ddd88dd739cdab931d0f8a661ce4786558b4a9e41d06a2fdf45e0c1c55caf1481f6a5a7228969ad3307c24f35cce200a965b3fdfa0f7acac712dd903525
SSDEEP 24576:41QT7EcpfxR+N5AWAz3ooiYtjMqbeSnnrFb4PM4MYgLxEVyGLG:FTDxR+N5YzTfjMuj4MYPVyGLG
TLSH
T10455B02EA7F815E9D1BE85788A23C506FA727821133193CF42A0C17E1F6B5D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 5b092769fbdadb3d78e928b7cdce6aeec395425d9ce9b22acc5413b552a03274
MD5 d2820938d50e63b9333cfee373f4e376
SHA1 047ac602dda8280ce75b6914fa3484e003d592b5
SHA512 ca849ed722f1415f13d78631911029abf1dcb3d8bd7ce4fc68762bbe3294c1c311429b54eb812c9d980bae3dd5e6aaf55e8076ff0a78a7f8ee2b867bfe96fca8
SSDEEP 24576:J3YgnJcRTk4yti+R5dBR/fSnnrFb4PM4MYgLxEVyGL+:JIgnaTk46pBR/4j4MYPVyGL+
TLSH
T13545BF2EF2B910F9C8AAD236854147B5FB71782D1F2096CB0170C538AF1AED85E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/212-446-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/212-321-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1228-24-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/1228-16-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1228-25-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1376-30-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1376-0-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1376-8-0x0000000140000000-0x000000014046C000-memory.dmp

Download

memory/1376-6-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1376-35-0x0000000140000000-0x000000014046C000-memory.dmp

Download

memory/1648-404-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1648-371-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1648-372-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1648-534-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1648-388-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1792-317-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1792-445-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1848-325-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1848-511-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2132-37-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2132-43-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2132-46-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2132-238-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2148-64-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/2148-72-0x0000000140000000-0x000000014016C000-memory.dmp

Download

memory/2148-70-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/2148-74-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/2148-77-0x0000000140000000-0x000000014016C000-memory.dmp

Download

memory/2320-12-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2320-223-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2424-315-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2424-313-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2464-409-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2464-286-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2464-292-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2464-293-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3276-412-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3276-309-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3296-333-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3296-410-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3296-279-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3620-330-0x0000000140000000-0x000000014015D000-memory.dmp

Download

memory/3620-533-0x0000000140000000-0x000000014015D000-memory.dmp

Download

memory/4156-252-0x0000000140000000-0x0000000140142000-memory.dmp

Download

memory/4156-253-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4156-320-0x0000000140000000-0x0000000140142000-memory.dmp

Download

memory/4156-259-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4188-248-0x0000000140000000-0x0000000140150000-memory.dmp

Download

memory/4188-312-0x0000000140000000-0x0000000140150000-memory.dmp

Download

memory/4312-329-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/4312-276-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/4556-240-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4556-79-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/4556-87-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4556-85-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/4572-272-0x00000000005B0000-0x0000000000617000-memory.dmp

Download

memory/4572-267-0x00000000005B0000-0x0000000000617000-memory.dmp

Download

memory/4572-263-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/4572-324-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/4600-439-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-434-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-453-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-454-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-451-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-413-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-414-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-415-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-418-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-417-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-416-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-425-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-428-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-427-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-426-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-424-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-423-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-422-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-421-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-420-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-419-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-429-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-430-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-431-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-433-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-452-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-432-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-435-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-442-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-444-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-443-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-441-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-440-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-450-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-438-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-437-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-436-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-449-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-448-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4600-447-0x000001FFDC450000-0x000001FFDC460000-memory.dmp

Download

memory/4704-298-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/4704-306-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4704-304-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/4704-411-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4880-239-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4880-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4880-58-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4880-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4940-406-0x0000000140000000-0x000000014012D000-memory.dmp

Download

memory/4940-283-0x0000000140000000-0x000000014012D000-memory.dmp

Download