69e501f8e101577b261e844e35211c301b0f56334f33313e6a9ac21d73c63d5f

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260802-dk447assbv
SHA256 69e501f8e101577b261e844e35211c301b0f56334f33313e6a9ac21d73c63d5f
MD5 65ef4b8c69bc3688d0a502ef811e8fae
SHA1 e67047d8e6bb0312b92695399aa2022fe833344d
SHA512 2a548e0da35dbf181446fa4e95793306d94954f0d134fbafcab138d695a21479144df1f9c5c500f2fa9dad5c1ac46e4a258968b15d52e166f73912dcbcf6e4a5
SSDEEP 49152:B2lWq/pQd+MhtHMbjO/IOFBFileoU7ZtxSHLQcN5tUttkaT9YQ/lFTjN4:BqjHLBwLm
TLSH
T1AC267B4BE6B940F5C0B6D1798A579617FAB27819873297CB4790831A1F23BF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Executes dropped EXE 22 IoCs

pid	Process
2188	alg.exe
4872	DiagnosticsHub.StandardCollector.Service.exe
2632	elevation_service.exe
2384	elevation_service.exe
4820	maintenanceservice.exe
4776	OSE.EXE
4584	fxssvc.exe
4952	msdtc.exe
5076	PerceptionSimulationService.exe
3880	perfhost.exe
2436	locator.exe
3112	SensorDataService.exe
3184	snmptrap.exe
1764	spectrum.exe
2272	ssh-agent.exe
996	TieringEngineService.exe
4868	AgentService.exe
2416	vds.exe
3288	vssvc.exe
4412	wbengine.exe
3908	WmiApSrv.exe
3272	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a48300def77cf242.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\UpdaterService\logs\OneDriveUpdaterService-2026-08-02.0305.552.1.aodl	2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc21dbfa2b22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc21dbfa2b22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d7d78fb2b22dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000488b07fc2b22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fee4fefa2b22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081bc7ef42b22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4872	DiagnosticsHub.StandardCollector.Service.exe
4872	DiagnosticsHub.StandardCollector.Service.exe
4872	DiagnosticsHub.StandardCollector.Service.exe
4872	DiagnosticsHub.StandardCollector.Service.exe
4872	DiagnosticsHub.StandardCollector.Service.exe
4872	DiagnosticsHub.StandardCollector.Service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	552	2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeDebugPrivilege	4872	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2632	elevation_service.exe
Token: SeAuditPrivilege	4584	fxssvc.exe
Token: SeRestorePrivilege	996	TieringEngineService.exe
Token: SeManageVolumePrivilege	996	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4868	AgentService.exe
Token: SeBackupPrivilege	3288	vssvc.exe
Token: SeRestorePrivilege	3288	vssvc.exe
Token: SeAuditPrivilege	3288	vssvc.exe
Token: SeBackupPrivilege	4412	wbengine.exe
Token: SeRestorePrivilege	4412	wbengine.exe
Token: SeSecurityPrivilege	4412	wbengine.exe
Token: 33	3272	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeDebugPrivilege	2632	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 2396	552	2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	86
PID 3272 wrote to memory of 4408	3272	SearchIndexer.exe	121
PID 3272 wrote to memory of 4936	3272	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks computer location settings
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "552" "1240" "1144" "1244" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:2396

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2188

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4872

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2384

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4820

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:712

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4584

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4952

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5076

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3880

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2436

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3112

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3184

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1764

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3400

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:996

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4868

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2416

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3288

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4412

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3908

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4408
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 20cfbcd09d677882c043b47f246fe870e5a1188690ed1d738d5267df09e18743
MD5 3cd6c29e12868e2cebd7c8cc234f4acf
SHA1 49d2501b909e45f439816b86ccf3e562caae2e35
SHA512 71af44e67ec5196193f392fa4cae0afac5e9a18575250a138d4502ec9ca2a9f7266db5a88a15b08d3d77bcb939e1135ac8a9279798b80e81f8fb0a69a14a66be
SSDEEP 49152:rb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnpQ/lFTjN4:53q6HjB9Lm
TLSH
T13FD58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 d41702fa3dc60fb274477e97d741ecf872125dc73a4fe168d2845909db3058fd
MD5 4012b14f9efb1499d6043fc3bea7e650
SHA1 cd53bffd688f364fd24aaa0030d8778fc4f5b4c2
SHA512 510c959db37117da1906eb0d6cb3ab76cab5311c785593020b929086d8ef5303b9c328c6d3e4b4339bdec976aee7f52fe88b723dd7696338ef2aa0b0074032d4
SSDEEP 12288:E1XLsswWkxy2lRq2czA2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:CXYfDtczAWnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T11565F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 a3c9b57c8b0c24dbe1d8e7f7886119daee5494bade5fd8d08cc21fe89620e832
MD5 ebc5265d26383474a1b9bb64af56e654
SHA1 05cba29d8f351bad70f7f8650d2da9e45cafaf0f
SHA512 79dbfc6c29ba91017a2e4564674fdb26a670005392abf7789b1f81b41c3931e2170a342d292c85272c4526e399adbfd29e330411e3a6fd135e2021d450c25aa9
SSDEEP 24576:J0Le5ji0hmxLrMxnQ/tbw/2Mkjy6Fr7g0oY:JPji0Al4Q/lFTjN4
TLSH
T15A859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 462cb885a7be0841517f2d07e082883e144655839b25985d101822139b209f25
MD5 1584dd184d696564b34eb32a3f799904
SHA1 22ce2247bee32486e0ae3aa80bed864babe5c919
SHA512 2ac5e3b821014b0d0daafd73489876bfa04e67fdc00889f8b0a71121496e21b24c97903515f7a3169ac58468fb6bfcea8d96becc57d5b4c3f5bf5b76ecb25d63
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWE6q8wyu3nQ/tbw/2Mkjy6Fr7g0oW:M/ezSC6vUzPvxHjyMQ/lFTjN4
TLSH
T100755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2633f8e1e9e44a9fdba364d93739089dabd515537fa1a6a60b76eb1a941d2acd
MD5 169bbaf16f19ea9de7b49d2f47d87b6e
SHA1 86b3c460d2298fca386390c6a3b8d29718f24a3a
SHA512 8652115cc81a2c8c34ccfe2b3aa94cc9a6b46ab1f740d36ea18c4626140e1acbad57e4b71b1251c6b8bf486a078acdc5ff4e0eeb39bd4fd3c987acd02f7f554b
SSDEEP 24576:kVbqPb88hv/l+6inQ/tbw/2Mkjy6Fr7g0oD:kVO88hXl+1Q/lFTjN4
TLSH
T153559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2eac27e6eb30cbd0d4c0e4c75a5b7d697aaa555435e88a279a1c61a7012b2e95
MD5 a8661b216f78a8b3bf54b1e630ed0c80
SHA1 a9f6ff1c6a39a105e1c578fa24e45b63e4b6c6da
SHA512 2f29a97635c4d30b95659f056d861c7a25b2aff54ce1abaa3e3a202aa744dfbaa5ba5939af3ca47f2aacdd6e0a8e26f8e7e7db1723183a4a7f719c845eb34b0f
SSDEEP 12288:UztGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:UzNnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1045523796A24F897FF2B06B15CC284826B7B0EC1BFD4AB4E6744322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 2677a080cc26b6f5a39645c3979949bbb71ec28925cc75bfc2b87cb69532da0e
MD5 ab3a78a9126e0b0c46039fde319f96e0
SHA1 572fe7ef477c81e5508bac259ad8ca5744a0151c
SHA512 54fbdf502fe655372a5ff48c35abbf75bccf31d9278263d75c487e52c4a8b45827766b2385d47f602cad03013d5eeb6c6a05958f37911b98fc433fd2a8b8170f
SSDEEP 12288:GeBNUbTVO86UKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:GJIUKnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T11275CF3BAE28FCD2C27E4DB85A918640D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 12e393847cb2c3ed13b35da63d8d76e8c5a4dd3c7f13a175cddf4fafa8cc630a
MD5 79a746c85c6f979c4a02c090adec127c
SHA1 f903b5ccc242ee5b80ce20b88fb585a2e4864e1b
SHA512 258b354cceecfe0cd3b1d64b3a52cd769069455d94fde348b534135f346a5312a0d4b1ccbd245e93d8dec7538694b0a5c1614a24e61874c2d12f80a830c86f5e
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THw:GQvGAdlCEL8c/yRNw5CMLm
TLSH
T1A0267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 65b9ddb1ef1fd1532c2abd9273787f44c5bd99bb2d28c3e25f24d4c65c1b280d
MD5 6828d614bd09f37a1199cfac4499833a
SHA1 3ee38768bcc9aef73793d5d39f21f407d691b9cc
SHA512 f8e738f332e67fba4d639c776b3bc9e742e7e62e8b03d1f43712b257b06d37f92f7d05aec7214b340eb3547796c453367b5543e3bc74b03a03d905902fa369fb
SSDEEP 12288:lAwSfxL/2Dc39DLLmt0LDQewsAjoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgw:GQewsAjonQ/tbw/2Mkjy6Fr7g0om
TLSH
T1AA75E031FE74E436C77F0DB21B22C706593D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e32285f2f386820acf51795aa47893ed52164f9cca63784a2ba6cb60f198d56e
MD5 278a298496f36ea0227293fab1f06499
SHA1 6c2c758ea35c9e167ce0b920d2fea5876ed9107b
SHA512 e735d536e23bd624bc9074f2c4e7933dd8287d806b52f0ee3fd6a3e919f1f3824c2cd46dce5a69dc4eda989f85a9faa3ee2f5442c506949136cfee309cfe4179
SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHTL:oUEtQevvqc2W1cpV2EI32
TLSH
T1BD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 33f4d253f8df1f9b07dfbf96f9e7674bce175d435a42db36603b1b697b78915a
MD5 0c878a7f27b47a4f6b3c6cb9ff8e4a88
SHA1 a15ecfc7e2b6b612a57a818ff40941fad8e17297
SHA512 6a3eb4786f5d242fc5f2ab5e94ec4c328a1d7919c15d885d7911a93bbc6f7eea172ed40b5fa4ff5dff54fb4586d5c87f5f562fdf659bb6c8a368d044aa594e4a
SSDEEP 49152:BCbRquA/m2yL5zQfFiV+XenmE3/zIQ/lFTjN4:uoqtVjnmALm
TLSH
T1D9D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b13fda750498430d80aa0323d301b0534cd204cb8b68b175f67bb03b53f98b4e
MD5 bf821482e236d3d65d5911d586108b8d
SHA1 1c43d25b69a77516afba9c17056fdac7e87270b9
SHA512 3dca4297065ce935afefdc78de8288fc7b8569d5ca67c4d803823f7f65677385760525d1c14026572c8dbf266c8b05ef48c9a46b3a63cdb66eb44484431cc8ad
SSDEEP 24576:NAhGLJIFoiwtA5l7S53rnQ/tbw/2Mkjy6Fr7g0ou:NAMyFoiq57Q/lFTjN4
TLSH
T12635AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 ad235f1e28c0f002b8d6ea2a958fba64d96e5632aa37b70e828e6cfcb0c9b7a6
MD5 ac6096623994ae6b134e302e665257b6
SHA1 0ff0695171044d1a85726fa7b90c8c6636f2d92f
SHA512 5030ff34b173638f72cc1e98d435abb5c9bc69a0b08d5f960b7654a724ca242a68cb3ae51f94a97e759809afcd35e9e791368c6d50461b7a0c1b4338e062c922
SSDEEP 12288:fmw5HEjsChN2BFgl0WDm+C3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM0:ewuHOWsnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T19F65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b5a7181074895bb917a71ef424b5a7b834812ac32f91e70796907d0d577776e8
MD5 786c1670b40f62c7a588c8cf7db6ae0b
SHA1 1eb114d28644d555c401805d10d1b8d9f355227d
SHA512 13fc6a181f0711de45eca310ea3ff1cc68c5e6d5de78dedab2f4f1568b3222f75b6fc1dcb6ce9d2189e35f796d8851d2af200a18990ca3d1dff022862b948135
SSDEEP 12288:7XZ1IyYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:zZuZnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1FC55126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 981790311fac6aa580ff4568dc593cd9c7d6a104524b306d837d6ff276d1f8ef
MD5 3623d5091a7aa1d4d3e62cf5b40992ca
SHA1 d18fd5fc1a815b282c6af87967fdda8e00bd43d3
SHA512 19df1cace7eef354f76047290c34c7ab4ccd9c6ad10e8120b90c33225b793047fcc1a608ba2e503a3253a0413715b6a1664fa5559af92adc43399d8a92a01f0a
SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U0:NQRQyi36YOcPQLvw2gAf+PN3ZLm
TLSH
T151666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c68fe4323c5bb8eb4780e6e939c2d3f973fb70fff98065f79a60eedba7aaf1c0
MD5 2dce87884b1a6f35a6d4b90589ad8d7c
SHA1 90a1542ea35f99478fb28e510a233fbd082af797
SHA512 0af22158e5e15d85e5d024a376f73c92e13798ba7fc6c382421294e6a5c6dde0df37ff6e31ff5088556cd04071bf5c2263a70f9c4ce5f226ffd41c1e25055db6
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U0:6QRQyi36YOcPQLvw2gAf+PN3ZLm
TLSH
T1F9667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f3fc2c8172a0f5ac095ea8215a57a9b4fd90e7825950a7f444661ba94c6ca635
MD5 3d037f43a4b7362a8837666f62b29f29
SHA1 cb0bc92eb024ceada4cf0ce0acd6f33020903040
SHA512 10cd67788760d45b2a8720e31a88c790593d0d903448171e482e2a024c4352ff1e1edbc21017a59e502fe7be560f1c2c3b27b5bcc2462e0efb87fa5916767cd0
SSDEEP 24576:kwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0pnQ/tbw/2Mkjy6P:K68Qg55nhheWu7PNU3/4Q/lFTjN4
TLSH
T18AB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 47b62869070e4917ad8239f384c6283a0442a0c32adbc3a93b2de28e30347593
MD5 267bcbeaef2b55bcd4b026d3e3eee7ad
SHA1 0f0ce67fb3e3963033266ec19391a034ea61047c
SHA512 62e92b55463731c1f9c006f9ebf7981ac04c817e3fef406f007b0ad2caf7ada20b999c558b0375cb397e60630574ef22ec1c77b6fba6e816ae226a895723f267
SSDEEP 49152:g3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99O:Ny5112gYy5azzVvL69nLKnhZCLm
TLSH
T1C8167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 603a29e0bac9e801709b3751b7d408c979dccdeb065590f9cd58e91b122e7c66
MD5 5bf5c36d79de8a621be8e8a984525177
SHA1 48cd47bb4a6f01a8fb0d080b85ceb41dd96521a5
SHA512 2c10b52307c776c7853495d74f878f205c61df60b7d05dced0feaa9119e6cbd50692e51070ef0381dfdc605ec2354909353e6a9986f6830bcf1430dc3dd7567b
SSDEEP 49152:WB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glmQ/lFTjN4:ku6JmVxd2dxLm
TLSH
T110D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 60af3119a042d727ed42dc5650466e51074abf8b83dc765e7415f836f26770e0
MD5 9e7c6ce4cd759c9410d723ac1bdde453
SHA1 ea9df005481e505d678b1f39820e4ade99b4e7ef
SHA512 15124b1d9348f82558e12fd6e746d98c10f6cc373745b245926ebc7832c10b28d3ec5d8cb7ad68896772e2481e315f016f6a6d247c0f8e797eb1bd6aaf47ec38
SSDEEP 49152:O1hpsNoJpF1A6UU44CwH7R4xqQ/lFTjN4:OmifPbRALm
TLSH
T137B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ac03df3bb4bfb2d3c68d87d76bc37ff8475f79c5597984545fe1ea6a68e66d70
MD5 b850304992c2a4eec920290625172c37
SHA1 5294ef33bd1fc64d85f77fae471ea8831c3462a7
SHA512 37f3393f9bae8d0c058bd049b8d4e2566b540111223dae665a29733001cce351782cdb1de0b1820d5bfe8df24e1a995338586a59515deef37d983b53803f8393
SSDEEP 49152:JSuZQIY0Be2KRRVtOnks6NMHqZQ/lFTjN4:H5dKTi61OLm
TLSH
T180C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 785eca31d46ebc85ba408f5e14c58af40909674e4c45cfdcd7c134ecce526e01
MD5 fed2e0f4d03ca3de42d3bdfc3dfd35c8
SHA1 320a2f61d8fbc3345ed7810fa92ca9924d6ed288
SHA512 9eb40492eec906face1ff0a7303c6393fbc92267408cd19cc121bab94c45e7009558ceb458dbaa833a9281fa8bd74625d21123fcc97d0f18ed7930234981cf32
SSDEEP 49152:BhtSn8EApI0figngiDn0AP5wWQ/lFTjN4:QX2iyph0Lm
TLSH
T1E095BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8649ec2371bc2beb0226da47096a8d8d166cc5b6ee9b12c35a3e74e670b3842a
MD5 a6743c8d5e2dfa6b41c3fc7bbe374d7e
SHA1 ee9b08ad981438ddb28b02bb7e40676a6664fb12
SHA512 8b53dc73ef16dc6658340445e5670b977876e371a569e21308540b87760b7b5d6f38db3699b6e097e9cffe714bf56bc2e1d0084282498bf23d8aa3d0d389d3c1
SSDEEP 12288:WVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:W1nQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1985523697964F98BFA1706F18C828182973F0EC6BFD1A38F77482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f957834883af2433d95163f6f3d70e9a7ff355b6a6de459c0704b6efd71bdc63
MD5 47456a3b41f88b006c5edd25edd48877
SHA1 c2d8728ecb058f9cf5239c1dba83949c3382b43f
SHA512 1facbcc1927468ff9360ed53e751f29dbb9f751a99febcd551c54756000e1e33bcf29f2ded76d2042643b8218fd1b8c5df2ccda485b917f8d2ef906082de8108
SSDEEP 12288:+kGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:+EnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1035523797965F98BFA1706F14C828182973B0EC6BFD1A38F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 828a14c96626cf088c6761c81c33885d1fdff809eb49c8afe1e7a8ee279fb092
MD5 422f270d1ed8bea353f4cfc966d66dc6
SHA1 663ed0c8a216657f5256605148cac4dc74746f24
SHA512 2922cac7b8f998f639b40bdf698818d411cf70d96f1f5bcaf58337e4d3fb8150f6d76146e8c6277e47674df08d96551e7c374985adc47df5ca3ee37b3e7a886c
SSDEEP 12288:WyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:WynQ/tbw/2Mkjy6Fr7g0oM
TLSH
T17F5523697925F98BFA1706F14C838182973B0EC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 db46d2b540ece6d8fa3a61486cbb4adad269339b6196a2f4be1c48425a0c109e
MD5 6d2e8a7c37d4fa9c439caaea7d45fe8d
SHA1 9c67cae56450a409759d0bccc60d1f7a84641da7
SHA512 2abf1577973823208c10169f72eaeabfe06efed80f854761f24210689a8357ddc3b7dc747de165ff299abeda457b646f5da422dbf51be464967fc5c6f286f47d
SSDEEP 12288:GVbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:QnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1DF5523693B69F4C7F92742B4CC928142E77B3DC5BBA1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 bdfc6bf889a36b66269903caa63c7bc3166f6020d032acac8ecdae4f30e14d83
MD5 176bf16493e4f041d86dc76d89386a71
SHA1 5cfb232ea84015598364773aab1b6da00b40d1ec
SHA512 d089437b075653b82a941f21942c4a3811c4e2db9817c099d55b793fb605ac8cc8860865ad47744c5582ad8ab4e1529282e4b44becf6bd048184ebdab9ed47d7
SSDEEP 12288:YzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:YjnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1355523697965F98BFA1B06F14C838182973B0EC6BFD1A38F77482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 2713012202ec13e51e07700493708ad01cfb85c858a4763ce701a3b401010c50
MD5 00cbb289e1bfaf0f951798b477674885
SHA1 25a2b4e5da6bf5db9c7db73e44fcb75b68872dc2
SHA512 543fb48f1aedd60bbde3e87d49e5a4cc21519025aaf1832ba62afd027a85035c214b8bb578ef12d3c98922f358346fd95c5ed0c15b3b5d59e507dc9075eeecef
SSDEEP 12288:5QGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:5wnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1905523697964F98BFB1B06F14C828182973B0EC6BFD1A38F77481129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 443221ee61d68011f94055fb69137d913a03e894762d5e433f182f5835d0cfcc
MD5 78616471e2ce0203e47ac94aa65be48e
SHA1 222de8198ee29306c0021ee8ec1c843cb4a37980
SHA512 63309be9de09eb35f30d1b1a47c2e60ab12b79f70c532067d8987f9d3bdec9f05f787c109aa86fab5749dd61bdb20c56391fa54b5b2d1ecffd3d0f70772be105
SSDEEP 12288:g8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:g8nQ/tbw/2Mkjy6Fr7g0oB
TLSH
T16B5523797965F98BFA2706F14C828182973B0EC6BFD1A38F7B481128967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 5212c6411f1cc5089db5627561e067bd26f87ec6eab3127ad14473eee6346f0d
MD5 1cec9b63b8d492b2adfd3db10952256e
SHA1 169d276b06c6d1e5cab568f0be0d8704a8ccf810
SHA512 4707415768a1f79f01a8966d84cac27a6abbb7ce5693e17c09e88adc06d86f11be2ee55139f66e1ec5ab08ec883b29d9e7b1d916a0cec36b93266b909830b7a4
SSDEEP 12288:ZiZwbDzzFEoS2cPvyEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:cZM3zFVSOknQ/tbw/2Mkjy6Fr7g0of
TLSH
T1517501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5aec8d845c2e4a96aeecc5f51a0feed768fe696253b903a5d6acdef2d175231c
MD5 ec796771530c637e89dd1c90bf369c2a
SHA1 c3f25e6e3165bac7649306022ad81fb66f81adeb
SHA512 f3b3d65ffd26ae45bb1c38b75d3ae007ef065d30913053b7283840aa49ef8c368927cf0871625ee0acfdd67a673c5b0a7c0bed2db6fa84882845a8b2532e83a0
SSDEEP 12288:F5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:FJnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1425523697925F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 936b59a33a4bd921d000e70a85308c392645bb0c89d2b8556cd1a2d3e293f8db
MD5 ba769ba8b38de2627148fce88bb02217
SHA1 57e2ce43664b6e1753f9f5f74f566f5f529d19e2
SHA512 4368a183dc3ffc9d5d1d8e9ebeef65417180c049c16ae0af23aa908cdda752a4731767c4affa004ac5232076f37637d2ce7d8612a00a7312e02842848d3e7f12
SSDEEP 12288:adGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:a9nQ/tbw/2Mkjy6Fr7g0oS
TLSH
T19F5523697964F98BFA1706F14C8281869B3F0EC6BFD1A38F7B4C1129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 80ce2b7315099579464faf5e0b953b6ecc869b7db511bff3554119ffba12db3b
MD5 1cf8ea62829bb7c6ecd96588caf9b5ed
SHA1 15fc48d7ed4b33d2a3c82aea890dd3426d82ff52
SHA512 307e02153e0be3a2cc5214afcf7385fe94f643750903f67c843a9fc54dd1f00fec7e5e5690646232b0ad6a3b74f66c444720ba0872bf4e9f1b88aa00336f7866
SSDEEP 12288:lyPz5L8YGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:szyYnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T11865021777A170FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 163b7d6048154ffb96b8743ac0dc57bcde05e63a65f524b0f0565391330c0535
MD5 4033d043b6958c3698389e4d066bafcc
SHA1 214c5408b78373154f5d694551a40b0d33ce05e4
SHA512 02150fa092627899e9a8c494ef6a50c2e84f2ec7dbd65acc1ac68f12b663c3b5fc27d882a5c8ef0cef06c0efefde33cb6540033d735b447485624b0b7633f83a
SSDEEP 12288:K5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:KJnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T12C5523697925F98BFA1706F14C8281829B3F0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 df5f89d63a5c404f8b6dd643a67d8885d391f74a9f042c9dd11e4328103f536b
MD5 5a59ab18b96101c6b96c5c28acc45ed0
SHA1 3303a1ae01759d1dac756cf60259c3e1e93950a2
SHA512 66fcd82a03001469dbbef88ec373b2d7e38530ccc0ab6872197d214c25cbb4b99c0cfe1f4c18c67601156627cbaa01521b5317a17016e8de450f8b3c50f98953
SSDEEP 12288:35GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:3JnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T18B5523697925F98BFA1706F14C8281869B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 cbfba97a18d0d05a7c8ced39a2af0372d440bed4edc4eec3a7fec5e905556423
MD5 384534280a61fa0ebca302651b8cdd50
SHA1 36ece6aa212ca2727871e973f02ecb6919b1d2e9
SHA512 928e08eee1c0c626456a069fdbf24cb2574193c5c4f97448c219e9d1d549eeddc89e962ff8dd26364c49d449725ef752fd4a3425bf91d209ddd912891b7e3103
SSDEEP 12288:MyPz5L8YGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:VzyYnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1CB65021777A170FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 bfcf245b2662424014f7cae09474ddcbfcde5dfff468558b74732d7ffc08747a
MD5 767ca08ac3bf9a78764cbbd81d5c0cc3
SHA1 a28a7d539f7e26de681d53f2403c35075cd65009
SHA512 cbb968093039cdd3c4973c192225d06125912ec02326420f6c30f2130449ce0cadca9577db16cfe3e5550c391d03e91ff63e7e5af69b1875727911b8941e0531
SSDEEP 24576:lT0aLl3z0zDCnQ/tbw/2Mkjy6Fr7g0oP:lTDLlj3Q/lFTjN4
TLSH
T1777501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 73cb683d4178dff88ac8440f03accdb6589ab5c0bed0c72b395cdbb5a1369d99
MD5 e1c81975dea84971d20390ed4bb97f4c
SHA1 54a71387f41d0c28700886ecb341999665988588
SHA512 c88804b0913aaf512765d8317f9858edd90b965d2c43a68bbd38e180a52e2ed67e3cf463d4c8ea6b289d1db697fae93439a00aa1f3465f8b0bd34e8e30f2562d
SSDEEP 24576:W31d9CHKy7GZenQ/tbw/2Mkjy6Fr7g0o1:41d9CHKyagQ/lFTjN4
TLSH
T1D985CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 512dfc1eae26863bfc9230bcb959e6750d0b8812425b29f6c93a16c56584c2d5
MD5 bf502db8470c498b5c81bdfd54df7473
SHA1 b835b8fa68ed1f8f164417cad10e09f869d7e5df
SHA512 92e56dfa975bf669db231e232ad4c4b88bf597e9f57f56dab0af1435eed247770fb603974ad4ebb3ba04111c164c6ed3e157feeff8361d292955c2657381d4f8
SSDEEP 12288:MSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:MSnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1B75523697965F98BFA1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 bb35f6e7feaeb3d096d0d5498851ee31839569eda70e70af5ccd440ebd7a477e
MD5 4a61ed0285ed96a3e9ac462e35eb2283
SHA1 539366029b767ac87684ae9d92041562396703a3
SHA512 9910d804a115fb575a29168b9bff5618fe5085632a9ec02daeb6def427a115d1edfe3b0dbb76ef3a28f88a77824dbc1e6efc1d5a2655023b7a134acc0a49c116
SSDEEP 12288:D4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:D4nQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1465523787964F99BFA2B06F15C828182973B0EC6BFD1A38F7B481129967D39406D63C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-08-02_030503_552-3740.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-08-02_030503_552-3740.log
Size 1KB
SHA256 8f62fbf836e672237ba20f570d986b5cf8473e51af5ddf7ef2aaa4c4f26c8a9b
MD5 145639a5eaf5be30cd68fe1e2b1c73a1
SHA1 15d9c404800770149f7ffd3eee06a65394ab46a6
SHA512 d2f507c191999886d304dd705ce622fefde8f31fef188b68e16efa28fa8d050636b6649c1b0f55484a972469cd49aa4df6fd8c599afdd1793ddc5e27f58ecc12
TLSH
T13C2181596BD80A06FAFB9EC298FA15539F3A79936835CE0D00A5434E4871F40EEB0727
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 a3da160f6a1e23ffa0c851b5f9db46e5b25564a6233ecdf98c74dfae73d0be68
MD5 462bd47c7f473a3afa0ef7370cfc7ebf
SHA1 8bb1ddd35ef1bc23eb2c7bb3cc610516df8bedce
SHA512 18b17985251b51fe1ade46e8f9b7b09a67c6313fd540ebb5097f1fc1871e157ec8282497eb8e50114f290be81f5934e400bacf6ee7d55c67317b3c7f74ad30d9
SSDEEP 12288:9ssfJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:NZnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1AD65F119E29852E9D02E5275CB824A41B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 5d94dcab99e16b3769f25563d973f702d4bb8706af9bd568083b1d3a375df30a
MD5 bca12a5e6d6d66c50b28416ede7ec841
SHA1 a29e30215fd4f652b3eb877a96f3beac500936df
SHA512 ff9e1778d303ee6019d54526a6bd181bfad1fee907b6333970b7d950254b821c3298028320f4dfc46ff6ed6c08fb5d3f988b6f51a3d7dcfa90c4ec7eb1c2430d
SSDEEP 12288:+3AGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:+3gnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1F75523696768F94BFA3B06B05892C151673F0EC5BF90D38FBB08222D967C3D01EA6745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 146ed3055dc847a87c9d6f4891630911dee98c61117d1fb2db17a445947e932a
MD5 e56821c305daaea98fb3691940e1b494
SHA1 7a6306b2e5c8ed1f72a388e129547c19f24c0a15
SHA512 1c096521c8e21f0452a17a5b1786fab61741657d9f7daf6ed909a6baf940da1205d44fcf2d7ec5cc57b884f9280b98e7e7404563c61289c89b864018db028197
SSDEEP 49152:Aa0h2GEkuAe73q3pp46zwwQ5gQ/lFTjN4:Aa0hNYG4JwiLm
TLSH
T163859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 38c3d9b1ceee61ae9dce09380fa811b6bbe7c7ab6da05f32eaa115cc8a16178f
MD5 5f51749b9782bb860362874c1fc9e9af
SHA1 526b2eb6046b4aeb743f710342f5264196944d72
SHA512 1cc7bde0e364a628c8a1eb4c1013d8e8c3090a643ed03605e47623b2ef2b9d82f47362b8a841991956d6ab2478b9ef3fb64bcd6301926e8d003cfe09f9514d1f
SSDEEP 12288:ChbHjfX+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:ChbHjP+nQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T12355027D26AC20DAF63692BD88928546D7327C552B11A3DF2381827D4F3BBE40D79F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 f27140caeb539c068decb47635390c0c812aa9ef655807d6ebd8acac682f7c03
MD5 dbf473f527cacb7190077a9193b740d2
SHA1 b017e8bfc12d9b0985c2cfa4cbe709ffdc0fe079
SHA512 0c62fb986a4bab7948e194059ec9c36090a62c8decae0905fea49bc5f7c23ec267baae33c25f619b877482d971ac6962d0bf3700a4ee080de214c9691ad73a0a
SSDEEP 24576:M3YgnJcRTk4yti+R5dBR/OgnQ/tbw/2Mkjy6Fr7g0oz:MIgnaTk46pBR/OgQ/lFTjN4
TLSH
T1F045BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 24da12863eddf2710e45ec2f67283958fb4a812e7dd473e8f1e26d39a86cd5b8
MD5 4fad40737e939ad75fb2fe4d34fa15fa
SHA1 b552bf58405ed42d693d6449dd68dcb2781d928f
SHA512 bc883d6812c2d156b8418653f8e88613f6feb1e84f8fca15637c247ff652862fc374822910b70d4c61e3f345b7a92e83f7edac891ee3b0ab673e9d94783d75d8
SSDEEP 12288:sLAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:sLgnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T19F5523687614F98BFA2B06F54C838146673B0EC17F91A3CF77482229967D3E40AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 1ae28aa847bf50df2069b57ef8ae71baa448780172676aaa9ae371b24ffcfd7e
MD5 f189c6489dd3ba7c27de43295196e66a
SHA1 525ba33cdc008e7479818e32774c074618683185
SHA512 d14774cf7426a7074ba19a7f754642a1cf3c5562d9f97ea89b6ed4aec2612bf41f9247a4171c4b233d76e22b92f3ff7c0e1d2ec6286f19e7c8204ab3f71f2564
SSDEEP 12288:SOb4A4LWOsvAYFTQAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWxw:DwL3UTQgnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1F775F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 16a2cf06dcce164fe291c8bbe83f1c3b5f93d6e52c691239d607e1e828dd39e1
MD5 18e68a1ace485d3ffa248ac64781ab5d
SHA1 8b757f6573cc5f605ddf7cccd90fab88733528fa
SHA512 8f3962e41040700aea75a511a500ba4025b6a5439348e3ba664effc38d0026101a171d42d3e56423c13db19a63f8cd5375589d5c75c7c97e3c1e6b292205acf5
SSDEEP 12288:JpFtCOEAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:iOEgnQ/tbw/2Mkjy6Fr7g0op
TLSH
T17755022D36EC60E6E536527C89838209D37278961B6253DF0780817E5F7BBF81C7AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1dfce98e33c80d675b0da968c130af0cbe6b58fc39663f6246ea4506d2b76e3d
MD5 4c0e86e52e55163bbb4e215e1cd67565
SHA1 02f90c69005ac9fae80f0aa79aec9b149986ac62
SHA512 c14a7040ed1745850c14caae5fcd5eaf8167955bad76dce971735afea575b92ab9f84a2bc2c2a3fc856a87cf3f1685e3b34b02c8aae8f515dedc284bf5dd478a
SSDEEP 24576:77NM9YqZqmWMUkPjZM48Mv6bEhsHgnQ/tbw/2Mkjy6Fr7g0oZ:77cBWMpPjN8DbEhWgQ/lFTjN4
TLSH
T1E8659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 f65dd5666a79c4e296e1fff2913867c37d5a187cd2c380fb7e1d278f6f2002f2
MD5 e98c727304c8cc61fd7c1d89e9adbbb6
SHA1 0acb4a24553013631039b53e16213b5a00a29ee9
SHA512 4baff149faa02fe03144d3de8302016042e5a461cfc59152d0618d4bb04ac36520b65d55a1bb47c4b3b6a866726007610464a21ccd731154bb50248d83e7dae9
SSDEEP 24576:3W6BApg2YuyuNDYTabvcdvNYf8km11gnQ/tbw/2Mkjy6Fr7g0oj:3F2YuHNETovAvNYf8kmngQ/lFTjN4
TLSH
T1F9857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 bda90299309af205eaf99ba2dfffc70e837a8ce0c3ad4e8cfefd5cca81ae78c4
MD5 f1e0b71503584a703f763c7d15304722
SHA1 fd982f08732e800f713c8e4880a3c31a1dc1633e
SHA512 e603ca92d84bb05f517662b7a198f0bb1132e42085f7ac3d35946a9fd3793d4eff49e9cc7ebb72c62c9f09575304959719f25b1e2a4f9600cdda294c46cbb2a1
SSDEEP 24576:cAFs06+Omlf3NXEbTo4gnQ/tbw/2Mkjy6Fr7g0oT:xFs060lVXuZgQ/lFTjN4
TLSH
T1C265AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 01bbe7ff6050c537f2a78137b71629214923a81b7c0665da7b49d3ab2a20feed
MD5 55fb53ffeb7349a2b9396f5a1e3e474c
SHA1 f928e14999aaa8bbd0ffe78fcc3c0e25463cd2e6
SHA512 23c21d0276c68461dace12861124cb4145a2543c612d372808a0daa5fa51d265291d11865663f6e8d0946c4638562dc46c02a15b13f811f89c1516910189fb59
SSDEEP 12288:eCJnJ5D3VkrqzxnAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:vJnJ5D3WaZgnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T19775D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f14a491c71fd2a048dfe97fafed03d78026f98d8a777269973c196d493e16777
MD5 65ce280ef077becdb9b029ab183dfc14
SHA1 ec3c5b735ee327dc572a931e1500cf9045325f2f
SHA512 9151e920d1459128bbdfec47276a29653b420d165d9a83b5529ae1c9f9913e0ccba00927bc44604a0abee06f8e65b861d359280a05e7498ec563fe081dc5b407
SSDEEP 24576:VEPghm6/7IIXdwcXrif7qQncjlP65i3VuOgnQ/tbw/2Mkjy6Fr7g0oQ:Cg06DIKdwc+eQnSt65aVzgQ/lFTjN4
TLSH
T1D4955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 3bb49beb933cbc49a2d6a6fee881e66a8b28787721f051a151aa92e35654fe5c
MD5 ba80b55cde3dceea1350ad4d3b1c7eec
SHA1 5e5ff98f434ffda8ac1efee58f6250c2bdf2c315
SHA512 d86dcd3254894828fa7dfd157adfd66ef4bbccc84a3bcea720af87393c7385a922f9e28290dd48b9fff4dcc0294337572d0dcdc8122670f9e9fe7fd34f797d44
SSDEEP 12288:xEP3RS1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:iSVnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1B955126D37ACB0DAE52A517D88918145D373F4A12B5267EF2680823D8F7B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 82825e23c3823776cb6e2cebf24b1ee7619c470d44f34e655fad1cae480ffa3a
MD5 4716c81b9dce8ecd419801e161ca45bc
SHA1 7af40d4aa2ce529e3f565cae43afdb130cdc8775
SHA512 407240e20532d9e4a1f9cf9bfc5cdf7d42776bc5a01fb9acc46462dba8ac00acf13a01b6963124cde97fc4258eddeb09cab1b5c6ec34e5e1a2a6736e41c4d16b
SSDEEP 12288:zjkymAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:zIymgnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T11A6512182398F4C6FA7A06789DA381919B367C506F2193DF6280F23E9F3A3D46D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 ea266a0a79c91b2494db5fa59b2f6a0c48ce40943d2dc27694226006ffd730ca
MD5 7fc26bf867fb2cda2a0f5c2f99c1547f
SHA1 2045b6484ff9e13c8cdca80482fdbe15a6ea069f
SHA512 5a95eb2550380506b673d3b035ebae193f0e92914a71f1f66b40a8b96a86bcb7af0461cd4de749f8741caed0f955024af799a7104d53ff718175789516273242
SSDEEP 12288:r00AGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:o0gnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T10D55236C2624F89BFE2706F448928542973B09C17F9163EF36886239CB7D3D416F6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0df440b2bd4d18c48603a3fbdbf5dc4477d2df11b6bbc8dbe9930493eacec406
MD5 164947446264faa59735e828ff516d5d
SHA1 97abdb87542f535cfef18b818a69571d19536163
SHA512 1522b2c6f8a7a03e3c6fe9521cdf3d140e927f20e2db861958ca738d130aef50ce34de47a1224da395f5f170e5986b13fc1caa5fbedbd32236e65c688e966984
SSDEEP 24576:aQ9MxZKdcz9dw3vgnQ/tbw/2Mkjy6Fr7g0oq:aVKZvgQ/lFTjN4
TLSH
T15F558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 e5552b445ffadda388dc588509351d3d375422939e300f3f352af8ccbcca5da7
MD5 faebe4a12e2a4504f7d75f2ed38045e5
SHA1 684d698faa972586403362f352572f75644c5f9f
SHA512 1023a02c834594210cc28b4e18d93b307770bd948e127869529b317f780a5df4b1f8a47a69aae20c85ccfebc57b7892a41699bf2832a26e53867719ffcf53907
SSDEEP 12288:OyoKo20Rple9pKAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:OyocSApKgnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T11B65E01FBB6990A2E136813C88818745E773B4706B6263CB6691C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 78f319816a0ffa2afcc494fbec18c39f8358006fa6c15fe8bf32dc5c87c80636
MD5 f09eba28cb0b0cde018c35b44c20c72b
SHA1 30aac1f893e6ef7169b8342defff0befa69cb733
SHA512 86b3007340a23b4c8fd25ac44cf828d461cd9dabb3c4128a1ee3fb5f4e8e95cc8f11cd023345904a83165c227a4e6c416b6d803edeb102f41e22b29155ee21de
SSDEEP 49152:sWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKKgQ/lFTjN4:m0zuNIkLm
TLSH
T1B7A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2e5ee5daaf60180d53abf15fd3c2afa499eaae5610988dc8d4788209b5b3c96d
MD5 47356cf445469514ed72e39f2bfb641d
SHA1 b18e27fe1bacc0cf405934e3c369932d42493bf5
SHA512 f0252c2658638a11641fb090bb6d62d85ca0bc9e1fed2b6176c5b09a11bc5eb91a5e17404065fd8dfb1dc7d9d999603f66136ea1bddb3229b53071f20a036fd1
SSDEEP 24576:B1QT7EcpfxR+N5AWAz3ooiYtjMqbVnQ/tbw/2Mkjy6Fr7g0oJ:ETDxR+N5YzTfjMUQ/lFTjN4
TLSH
T1CB55B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/552-8-0x0000000140000000-0x0000000140471000-memory.dmp

Download

memory/552-39-0x0000000140000000-0x0000000140471000-memory.dmp

Download

memory/552-19-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/552-0-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/552-9-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/996-312-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/996-415-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/1764-412-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1764-289-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1764-297-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1764-295-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2188-236-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2188-13-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2272-414-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2272-307-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2272-301-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2272-309-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2384-238-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2384-61-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2384-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2384-58-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2416-416-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2416-320-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2436-279-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/2436-332-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/2632-49-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2632-237-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2632-41-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/2632-47-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/3112-336-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3112-282-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3112-413-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3184-287-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/3184-409-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/3272-420-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3272-407-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3272-391-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3272-375-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3272-337-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3288-417-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3288-324-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3880-328-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3880-275-0x0000000000740000-0x00000000007A6000-memory.dmp

Download

memory/3880-270-0x0000000000740000-0x00000000007A6000-memory.dmp

Download

memory/3880-269-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3908-419-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/3908-333-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4412-418-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4412-329-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4584-246-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4584-253-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4776-239-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4776-88-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4776-75-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/4776-81-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/4820-63-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4820-91-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4820-69-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4820-72-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4820-86-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4868-317-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4868-315-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4872-31-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/4872-22-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4872-28-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4936-431-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-453-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-457-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-458-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-459-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-460-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-437-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-438-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-436-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-435-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-434-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-433-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-432-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-461-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-430-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-429-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-428-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-427-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-426-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-425-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-424-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-423-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-454-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-462-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-452-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-451-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-450-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-449-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-448-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-447-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-446-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-445-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-444-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-443-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-442-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-441-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-440-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-439-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-456-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4936-455-0x0000015761980000-0x0000015761990000-memory.dmp

Download

memory/4952-250-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4952-319-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/5076-323-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/5076-256-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5076-262-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5076-255-0x0000000140000000-0x0000000140156000-memory.dmp

Download