6fe1a06baedeb5f3a73fa6617a5b7598ded93507571301c1974cc42c814e6c02

Analysis

max time kernel
105s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 04:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260810-exewhaar2v
SHA256 6fe1a06baedeb5f3a73fa6617a5b7598ded93507571301c1974cc42c814e6c02
MD5 9a1dcf540e4b9573e0c4295481e97fdf
SHA1 61d2d4d7b06d16ad20e045e04c1da18e5707a06a
SHA512 1d17fab4582eb367e0f37ad651512043ad11d624a45cb75d257f6cee6dac39e87795a54879ba9c9ac83a79c3edee36ee2fd844c12fb18672b8fd6d490e981003
SSDEEP 49152:eQdP9wBQI+/sKCM6Gt084hwcEIm4QlhEha/c1AWpMSEHs8/2TxUBaB0zj0yjoB2:eWsIMqloB2Yyjl
TLSH
T1DA267B1BE6B940F5C0B6E1798A579617FAB27819873297CB4790470A5F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Executes dropped EXE 21 IoCs

pid	Process
4700	alg.exe
1296	DiagnosticsHub.StandardCollector.Service.exe
4608	elevation_service.exe
8	elevation_service.exe
1896	maintenanceservice.exe
2628	OSE.EXE
3228	msdtc.exe
2288	PerceptionSimulationService.exe
2484	perfhost.exe
3272	locator.exe
2320	SensorDataService.exe
4296	snmptrap.exe
2300	spectrum.exe
864	ssh-agent.exe
1332	TieringEngineService.exe
2052	AgentService.exe
4220	vds.exe
4028	vssvc.exe
3472	wbengine.exe
3760	WmiApSrv.exe
3492	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\54c32c4868b29bb.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a822c6977f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076d2f5977f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000615fc1977f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb6e12987f28dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000765a1e987f28dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000804368987f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006e7e9977f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000029be01987f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056d3d6977f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1296	DiagnosticsHub.StandardCollector.Service.exe
1296	DiagnosticsHub.StandardCollector.Service.exe
1296	DiagnosticsHub.StandardCollector.Service.exe
1296	DiagnosticsHub.StandardCollector.Service.exe
1296	DiagnosticsHub.StandardCollector.Service.exe
1296	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4508	2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeDebugPrivilege	1296	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4608	elevation_service.exe
Token: SeRestorePrivilege	1332	TieringEngineService.exe
Token: SeManageVolumePrivilege	1332	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2052	AgentService.exe
Token: SeBackupPrivilege	4028	vssvc.exe
Token: SeRestorePrivilege	4028	vssvc.exe
Token: SeAuditPrivilege	4028	vssvc.exe
Token: SeBackupPrivilege	3472	wbengine.exe
Token: SeRestorePrivilege	3472	wbengine.exe
Token: SeSecurityPrivilege	3472	wbengine.exe
Token: 33	3492	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 988	4508	2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	87
PID 3492 wrote to memory of 5220	3492	SearchIndexer.exe	129
PID 3492 wrote to memory of 5244	3492	SearchIndexer.exe	130

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks computer location settings
- Checks system information in the registry
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4508" "1260" "1164" "1264" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:988

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4700

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1296

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:8

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1896

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2628

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3228

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2288

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2484

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3272

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2320

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4296

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2300

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2508

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1332

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2052

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4220

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4028

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3472

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3760

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5220
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 551566e67effdf890b41d16fed20114d691b8f3a06a6427dbf8af54d64634fbf
MD5 62d4c08d74e198c91ad8c20e4167d309
SHA1 cfafbef934b6d77e52728043a68f3cb7e2fb30e3
SHA512 76f637a003f7351bcdc4785f6db78b57b78dc4b6737e549af631d24cb42f7e9f9788ba2ec799f70aa76b78535f414ff57053e08b1f0100b7756724196f3e83f7
SSDEEP 49152:0b+632BuPkFKRrdE6ohmstBhuXjfS4LWxn6aB0zj0yjoB2:u3q6HjBqB2Yyjl
TLSH
T132D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d48d6f71c256233bdae1f5a920c2d19f024e7a39c75d76ba89ede350c2827c48
MD5 1fdc7e7f19ef1aaa8581ac7896e347e8
SHA1 6ef6f593f6483a64e56b98d46469157347c67f5a
SHA512 05bb8753896eb25d6992657ae7135b42c23883221feb6dbd619e6d18d8aa31fdfcdf9355117eb40c99d9d648677a7dd6ed35297aebe350d670fbe00edadc0ac5
SSDEEP 24576:3XYfDtczAjatr0zAiX90z/F0jsFB3SQkT:itcEaB0zj0yjoB2
TLSH
T1F365022977D504F9DC67823CC9A18506EA73785147A0E7CB03E4AA2A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 b4c6db60116e5b8b1d05124fe708f89c4427e98f3414e27b8b847955119c7407
MD5 35a36adaa4178647c86ecda9261b54d5
SHA1 70873b25927dfc2cafde7cbb843eb8419d7d31bc
SHA512 bfde3649acf2fabd696dc58e63e8d24d6d1f60d26e93fe8bf21390964ec3c1bde2ac88d4fd423ff3109803760de083ff80caf127065166b8ac165174cfeae887
SSDEEP 24576:I0Le5ji0hmxirMCatr0zAiX90z/F0jsFB3SQki:IPji0AcxaB0zj0yjoB2
TLSH
T1A7859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b56ed6da7f8f414fd3c3ea744f7fd589192d95dc7a497446ca886eb5c687e14b
MD5 58e6499b272f98751552a47ece6655b4
SHA1 cde4e230049238a218a97fdb8d1bae8f2231a43a
SHA512 01825a1c6e33a56c0a8847c92a2db5bdfbad3655ed3e0eecbb158698dc6684d62cbd415e9469893ef34958eb0945e9f407618a243e8eb5cd8c7042d3192d7dea
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWE6q8wyu0atr0zAiX90z/F0jsFB3SQkg:j/ezSC6vUzPvxHjyNaB0zj0yjoB2
TLSH
T13E755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6eadd156fa9e6eba38952f5a452322e66f69939a9fee14086cdac4196279078a
MD5 34e69722d4e3ba589b92bcf744230ab1
SHA1 ea9fa8720042b98d2ba319f82361a5717e572132
SHA512 5932fc497775380997bf4c2fb8ab4028e8ce37dc5dd38130b8f4295387f3b3113311685a19241bed6ec7f6e994ca955ee66add443e4bb8cab0b37664ff6d8be6
SSDEEP 24576:+VbqPb88hv/l+6natr0zAiX90z/F0jsFB3SQkL:+VO88hXl+eaB0zj0yjoB2
TLSH
T1C855AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 dcfb6415df0389418a0e7ea93f82a38e5abde2a1b62056d7bb9fa3ec6f7edb4d
MD5 90b8a3882359964f25f061a7cec09b17
SHA1 22a65b962db87f84f8f3b2bb0d749b907a13369a
SHA512 a4d93c28a9720ba805e789a46574147be9646ab740a7a218dcc133d059bf909b45654d066560d1790e6d2401097d3a4aaea53ec3952b6869d85cb51a7ae03182
SSDEEP 12288:ZR2UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8R:ZR2atr0zAiX90z/F0jsFB3SQki
TLSH
T13D45230B340E80F2CDC32B3566989C4B1AB99EB065E2AF85E2D13F4F9D3C1C695656C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 970232a5907d3226085d1db750f83c6694bb6da10ce1fbb691f8e6a6a243672e
MD5 dda7aed7f5a6d07a84433b64f7a622e8
SHA1 624c6889db61ffb90abd4df19283ea3bc1b5d7da
SHA512 7136289215a9f6454ce2bd7b133a717ee84402ad398b668558333f4f526ca881589c1c9e2958ed24c2634266ee72a912007ac4f0938fbd36149cf09027ac0b25
SSDEEP 12288:meBNUbTVO86UvUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik86:mJIUvatr0zAiX90z/F0jsFB3SQkj
TLSH
T1BB65CF3BAE28FCE2C67A8D785B90C600D77278704B62A3CBD165930EDE235D15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ab2d73bfcc2ba7236d19bf0ffa49adeed9b17a6572335d296be6efa691d14b7e
MD5 4f0e099a1ddb2276deda93b72e7f1608
SHA1 8011d1b5b703d24c5821a6f96640fb1cf0fd971b
SHA512 f037701db614642ea6a18067eb71c469577b4b8bc15839f9223079c22cbbe7948c7a0da6abb6a6393664e6c7b995eedfd7249a6256296b5073ee18a917aab2ac
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THp:AQvGAdlCEL8c/yRNw5CbB2Yyjl
TLSH
T1EF267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 4f989b6cacb80ec026084bf5c6d911a613c61179127ccaf07832b8467a295657
MD5 1095811b2f2c4aff24f75df3a04983af
SHA1 23ddd0a60103a248cf539e4d821238329c089728
SHA512 1cda1a950336a623c88468397e48165d7a8fb224e9e07991187f24095f6fbd62ecc12a64525dba29edb44a0d79dfd93c47e31172b132eb63a9cb25403f3b9d3b
SSDEEP 12288:+AwSfxL/2Dc34DLLmt0LDQewsAjhUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkH2:jdewsAjhatr0zAiX90z/F0jsFB3SQku
TLSH
T16E75E031FE75D032C6BB0DB61B25C706147D7A204BA21AC3E3E86E8E59342D22776E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8dd6dd6df4bfb629c24473b351590640b3d50fbb1d40c6d71d56a9569dc7ed04
MD5 48cfb1bb3c570b0e18d9ea62dfe22870
SHA1 81d5121d6062ee86132f7fd62eb4e69d393b6c92
SHA512 dd400f538c4a6626adc1357b120b8cd71d88a2c7e1bbcd12bd6aef5dba99f12aa1cd7c7e296fb6d519737ca13fc0b6d9da42cf753df5f39da6970105de2e3723
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHgZ:xUEtQevvqc2W1cpV2EI326
TLSH
T181474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9e63ba38135402ff0ca15a170b470f3ff797ac42f97e1001274989dc8dfeb222
MD5 f8289a2260a80ab950215b3cfb2bad72
SHA1 707b35350a936672df984abca4106b1396f92056
SHA512 4b5764f91cce9a348cbc557d4a9f4fae55b1495823b53a2ed612a3abdaa16b57466e6ceb08cbcc3459328c8c17d37346fdb6724a78f462482b0ffe040d20d084
SSDEEP 49152:tCbRquA/m2yL5zQfFiV+XenmE3/zBaB0zj0yjoB2:KoqtVjnmPB2Yyjl
TLSH
T1C2D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b93e127766a043038630827ca1164172d9e8751194a6f1fcc040e9d2b30b7ed2
MD5 e9f644ce5b5f401f7df9fce2b071777d
SHA1 5f2cb02b978c63120f749c55b61c590204e1dfe4
SHA512 2331e1dac619675a3caeda1e2e60286899b81d7ca777345833eddd6a0a19bc80e9be20f5597b89cce96409cf4cfaee1a608cbc5c4c2f4ce22a9f053b457e6caf
SSDEEP 24576:NAhGLJIFoiwtA5l7S53Qatr0zAiX90z/F0jsFB3SQkF:NAMyFoiq5gaB0zj0yjoB2
TLSH
T192359D81E7F955D4F5F3AA7899B68571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 02ba0da9efcc367108e9387c00a89041bf48a31069aece5403076438d0ab1548
MD5 9a4f30f998b30e44f5b04614bdc6c4b2
SHA1 0892bd5630c3c182a8637194bb934d9f2d32775e
SHA512 e277a7066821883f79fb5fc13bb0df1b4f9b69c978c92e03bb564474584a43a4a685838f62ad3e7ce8cdaa6ea3cdec9cf30e10d306f24a264a4c0041a0e1ee2d
SSDEEP 12288:Dmw5HEjsChNVBFgl0WDm+CUUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8J:CwuoOWtatr0zAiX90z/F0jsFB3SQkY
TLSH
T1E665F14A32A90CF9E9A342388657C536F7F2BC112A61DB1F1360CA5B5F37351AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b22fa7ba91ed9d509d6229d7ae191bc8e5bed147efdd53629096d4e80d08dee3
MD5 4397292d02b764ff981aa4b9d88778dd
SHA1 8c154f102a5afd6b74e70f4144fc05aa3a06f269
SHA512 ba53f7b2f7297a781b945f2815d9bb2c14ed24895527a92069aa4b55bdf7be6f60c0ecf53538ca467c48245cfda68c49f97e92e014b1cdc596c976cdd6d02bf2
SSDEEP 12288:XBZ1IyRUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8K:xZuqatr0zAiX90z/F0jsFB3SQk7
TLSH
T1D055124B32A960F6D5D3523C89E4490AD7B2786123B283CF12607B5F5F36AC25E39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e1959978f338db91160519053b3665e91cb28fab592e1bbd77d580d696831323
MD5 e12dadbc0527f38ed2a79c98d35c9278
SHA1 5ebc5431191306c0472e610a2fd38cac44b19da5
SHA512 dffcb693599aedd8c1c5d2bebb0831683bd47063ac7e68a2d41c5006e18bfc2fd47a03f0cb952c806e6ceb22eddb8b3f1039cc075fcb0715a993fb21c0df2f85
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:cQRQyi36YOcPQLvw2gAf+PN32B2Yyjl
TLSH
T161667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0151244d802c95213641c77d77fa47aca1d11164f16f5c4f5694a057d99220b6
MD5 dcd09129ce952142fb5b80623943a618
SHA1 7574ba9a79449ff3c10cf694dc9f7b1a699816f9
SHA512 fb34c9a9400d18c40618adb914bcbbd54336f872fbf4bf02290eb3761de02e59bce9e46cd4dff15b0b2045f58e362ce1b27c51aa47cb3240df9c9aa49f7d247f
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:XQRQyi36YOcPQLvw2gAf+PN32B2Yyjl
TLSH
T1F0667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9941f0448852ab5ce3b975531190e4d8d92281c272546444e7c23b51a4d428ed
MD5 6d2dbff36a661b3cf1fcff851ef4a2a7
SHA1 f2746fe827207bb694cdaed01076ac7f06dff97d
SHA512 792d2ab8b64cedccc3ccda0ae1d0f56e61e2a6509c3aef58808653ba2e0f9275c1bc767fd0f6e55a8d929970a4e770c1fe85a4e46ad560efd36673509b06e723
SSDEEP 24576:dwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL06atr0zAiX90z/Fy:Z68Qg55nhheWu7PNU3/xaB0zj0yjoB2
TLSH
T192B55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 37a672ec8f7dd17accfbdabf234012934d39a306365835d736ed8ebcf219515f
MD5 9595065cd765625259f64362ffa1a4ec
SHA1 532acb2819377446bbf04e5af9b2c67e1930704f
SHA512 842e9d3f1ed07718b8fafda80f50907b6ea2c5029973fd27646d91d979afadf16896ab3a5b89bd997d595c11e6e2ed7778c48b3a6fad62ebfaa6928b30e9ccc8
SSDEEP 49152:t3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99H:8y5112gYy5azzVvL69nLKnhZBB2Yyjl
TLSH
T15B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0829e99be1defb5153d09cbc24f49318c1ccce6fc11be79c8044f2f23d5efaa6
MD5 5e36640c766f8e387683405716faac2f
SHA1 ae949be6f0f13fa0e871e8a9e512cd166daeec23
SHA512 eb4ba1f440e35e9c2f631fa1f3eed2b8911e49bc9ca4fdac9e2a6f08ccedd8cca1e941bfcfe34e5c73e89ee90a9522cc5fd7784a6568d5669508e4102e6df3a0
SSDEEP 49152:/B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glzaB0zj0yjoB2:Bu6JmVxd2d+B2Yyjl
TLSH
T1B5D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 966662846eb30941bf7bbb2405b5eb37ce11946122c187a611b4deaddc41c5ce
MD5 132926c37316ab03ea38617b375b4066
SHA1 17337e43cf462accb23dac4dc339c0085e90df72
SHA512 c912db728b2a14f5f4f68a42e2bd3608eaadf4b62dd4a47b9791c8a317f6d2f0e63b8125b9fdef57425de9560900b22cad6bc6fac2871fdcaf86105bc749f426
SSDEEP 49152:P1hpsNoJpF1A6UU44CwH7R4xPaB0zj0yjoB2:PmifPbRPB2Yyjl
TLSH
T128B5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2f94db35185b310fe79b1c4d0260746cef6b7c3ea12adf42506676970e2a17aa
MD5 e74be4bf6a59ac724c3aa3c479b2bf2b
SHA1 c1f36fb1560df9f15c43a7b2b2ab031075a83bd8
SHA512 2a8a88c28c966f897d29a1d0b1d82a38f1471eb07e81eb4190c60e58cf4f5a88f71e4b2a43fb3aa735cd3f7db07ed5c2e52e49a04b9fb9e4e9cf40d380ff572a
SSDEEP 49152:2SuZQIY0Be2KRRVtOnks6NMHqqaB0zj0yjoB2:Y5dKTi61tB2Yyjl
TLSH
T194C5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 803bf13a57c38f87c0e579c7e84d5692992ce397bd0970cdf520cf73e3506c52
MD5 78bac9a4d3aa3f2b34eabf8d20431275
SHA1 5a0f52d8050bf68049ecd388e057beaab2b3ebfc
SHA512 a1b4aa5d9c403817c7f1db39a8ecf9c43cca8f5bca1c26a4698c742cbc0f66a75f7a036c017cc1f8019b31c2d8168313b96235c58247d39ba9a1463598c1b538
SSDEEP 49152:BhtSn8EApI0figngiDn0AP5wjaB0zj0yjoB2:QX2iyphTB2Yyjl
TLSH
T1EC95BE13F2D900E8D05ED178C7468632EA62BC150B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 282e31d947a23159e1050585284878886fc8b22494b397335d82b52619f8948e
MD5 e0beaeb20a39b2587e6b4593133ea0f4
SHA1 6cb0e47b9712693bfd2ac4bb34fbde7b24755ed6
SHA512 0d22ab1697508fdf4a83345938cd87a019a3b4de2e0bef91327d2e5776d8a4c3708d622c210e4cde75be02bfd1abb7bb5abf8b7a1dc201045300f06048891e9a
SSDEEP 12288:MeUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Q:Meatr0zAiX90z/F0jsFB3SQkJ
TLSH
T12945230B341F80F3C8831B355684984B1AB95EB4B6E36B85F2953F0FDE382C615656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 29dc14004327a8093334500858786a46c268775684bbcda133321e40b3958639
MD5 8e77b4190f89220a0ff6cc5da65d48a7
SHA1 261a22e18e58b936939124c622f540ddcb180e4a
SHA512 5a2c9535b43bba8631c3e49cda71e2f1f29a4042c0d5401aed2dfa1a3fd6f900f4d59355e4e46e724e7b1c14755fd5d24653d18a1894afe9ead0dbe6bec4650d
SSDEEP 12288:IlUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Q:Ilatr0zAiX90z/F0jsFB3SQkJ
TLSH
T10845230B341F80F3C8831B355284988B5A795EB476E36B85F2D53F0FDE382C61565ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 971ff505ad4bd00bec685dd2e4758febcb1b8aebb9cde5560a524f5fb8184a30
MD5 19f74aba475d7b0ebd7e1c492cb20dcf
SHA1 47589733782fdff642d2d85e5ae9a44df50aa013
SHA512 2dc3c191c0ecdbfee52e4d1455a4049ae4881cb12945f30a0f5b2de4490ec2ed8e93db83cb8c2bb8e2ab890813f4d2ff93ee31c4ffc493e3ab72895ebc4beebf
SSDEEP 12288:k3UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8L:k3atr0zAiX90z/F0jsFB3SQki
TLSH
T15045230B341F80F3C8C31B355284988B5AB95EB4B6D36B85F2D53E0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 37bbadfab651d6fb8dc989255246d12238073d14c5dcfcabaa47bb4e5ad369f1
MD5 6984c3371c0e4a63f3b8ded265025bab
SHA1 9f348d9a8824f5a372c22995b0441a3e946a4a28
SHA512 089edee425094aea9a8994acf880e3cf8ae64ee6db3750be5b18194f029c5f39b62dcfaaf26940834fb793df9bb5711e10ce36fe5ada0d2a2ba46908d572929a
SSDEEP 12288:NVwUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8w:Iatr0zAiX90z/F0jsFB3SQkl
TLSH
T10145230B351F40F2C89397358694884A96B5BDB4A7F3AB9FA2413E0F4E343C56934BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 191fdfc1a4b6c1acff8e3fc27e2e5c444c931b991a24dccbbeac4b815a97c8bc
MD5 84de1e5fdcfb6a0eeb23bf1355d9224b
SHA1 f08bed22cf4310fbc263496e4da312622b44177c
SHA512 bdd920d70e1f04e18f4746efc65f7c9779790c60d90f3f3f8b7cdfa2eade78833e6d97fdab051cff14be4d725590955aef29067a79db598776900d22627e37eb
SSDEEP 12288:aIUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8F:aIatr0zAiX90z/F0jsFB3SQko
TLSH
T1F345230B341F80F3C8831B355684988B1AB95EB476D36B89F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 db6ae4ec8d6fc6504df110cd655d81576f5c7a3a422105a9d27bc5b00ed07acc
MD5 63b15bba50afd36cfbe3edb9ffb5b01a
SHA1 3697554cef70b69798e05af88d47c95fb1d3b694
SHA512 799c28fa188d16d3149225af0109abd27162d61ea0a5f85a129c184f17481fdf3900b1bfa2bda22345f62aa6859afac9838791adf164f5f5de585401bb19abe6
SSDEEP 12288:DJUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8F:DJatr0zAiX90z/F0jsFB3SQko
TLSH
T1E745230B341F80F3C8831B355684988B1A795EB4B6E36B85B2D53F0FDE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 55b0132391f0ee4a7d9821015444cad5c589186c56fb14e9e515cb24550fe0b9
MD5 b3bd1c9939170939c0da2a1bc29af652
SHA1 009f0dbe019131353785cb09dfea1d1b692d3902
SHA512 024b02052814fa89dfbe630659db5db763561cbfcefbf3c758b94c68117389dfe1ce1c55608ec96cdf896dc90eece1a136038ffcb5227349e8deb74e7c506849
SSDEEP 12288:h9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8B:h9atr0zAiX90z/F0jsFB3SQkw
TLSH
T1D245230B341F41F3C88317355244984B1A795EB4B6E3AB85F2957F0FEE382C71525ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 e01e4a857f0917431a558eb4de12206f4da7f4ea23b2811ab962d10ff3ff68ec
MD5 a4d336cfcdb0ad204c8eab3c0376127b
SHA1 389317aaf739375c476b35c6e488111999d101c3
SHA512 dd9a27f54a3387e2f57cecc33009114dfa54143bd2ad472fd517bfcb156755f8ac5ebf1e974e7826b47e4a9cc6b963ade2113e4355d2d4c6e3782d27166d7030
SSDEEP 24576:TZMSzFVSOFatr0zAiX90z/F0jsFB3SQkm:TZMSzf5aB0zj0yjoB2
TLSH
T18F65019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 337fd4d5e198f3a04b7e673e21de19897e7a13b997ae983b937a2f8f415726a7
MD5 4133e6a06c6996b8376937202b246283
SHA1 39003bf163bf63a37dc824210b37ea7889990292
SHA512 11841b5ec3ac95ed845122bb391e0eee78e58441ae740103d3cc45136431916b0d3dd30198e3643b753469753e8d4fd4c5c40e3980b1a96b591088fe66f36a1f
SSDEEP 12288:CaUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8k:Caatr0zAiX90z/F0jsFB3SQk5
TLSH
T1CB45230B341F80F3C8831B355284988B5AB95EB476D3AB85F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 81d7f5471cab5e8193f6cf8d4d53f97b4d4c6c1b8ddab398a81323797568c32f
MD5 e2bd7acc09e135440574ee1a12a5e3a0
SHA1 1cb537db703744ab6331277b8a2723b3e959b94f
SHA512 a9b06db954a049dc99dd7938a8d67896e94391218709bd4dc23ef35723942b4c585da8e103ad942c56f12ec45db29575afce9fff228c078d79b93535db6cf42f
SSDEEP 12288:rmUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8k:rmatr0zAiX90z/F0jsFB3SQk5
TLSH
T10645230B341F80F3C88317355684984B1A795FB4B6D3AB86F2953F0FEE382C615656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 464d98faa1cfaee014a88c50e6553ea7f069d866b82c49cf1859b46c949d1d37
MD5 f36ce5590926730f40d81b5a424d867b
SHA1 f84250a85002ee81331ee9b99f52b5690e7e8797
SHA512 9f74e37d4f56e090e9576f39eda8d547a4017bd6b12f32915b336c704a25e5137b9604ce21576c95e0dfd472f495b5237d79ab8ef5125ee03f6553f32adf9616
SSDEEP 12288:8yPz5L8RUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8k:lzyRatr0zAiX90z/F0jsFB3SQkh
TLSH
T166551207326620F9C4639238C9911906F775B83117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 daca1031440a809a013c0b40636afd2c785aad390d4dd167dbd6d665945282c0
MD5 7137775b99491948a2fe49d05168a552
SHA1 82d1724b1a433cfd84f31b343d33378dfbfda050
SHA512 04de2f0103395f11cd5171b344001c8856a4349fc92e11a99972f39c140282ec7b1e6fde63f497c510cde89dcadb3fba5e5de2706b017ea703b6a85e4f957b77
SSDEEP 12288:6aUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik86:6aatr0zAiX90z/F0jsFB3SQkD
TLSH
T11045230B341F80F3C8831B355684988B5AB95EB472D36B85F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 cd17246276060216dd3ece06ada757777c7e83bdd937c92998c93415b751ad02
MD5 b21629e3a01325eafb9897b3f59e1abc
SHA1 bf825669f8d74aa71bfd64be7f75f1665d33f081
SHA512 b97ce0aa2d7fed330d803161da698424578a46dea8302594077452d2f15736325651b059ad6569c9591c9d38510c15f5a09b2bcdc2f3c07bf53ec5f24399bb5a
SSDEEP 12288:naUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8w:naatr0zAiX90z/F0jsFB3SQkJ
TLSH
T1A945230B341F80F3C8831B355684988B1AB95EB476D3AB85F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 6ee96b4b1f01653acebb1be255fb72a35ca7d1930582981de7fb036bbe10f664
MD5 0af6ea19eb90775b547f9303647daf1d
SHA1 40833e1debced76f3c1da69dd652b441ef5f67f3
SHA512 ccbed45d22811d13861daef355c6a803339699894995908dc0d8751c37c7fb74f1d1105d09ee6b445803ce392d6a64714176263eeb7c8cd4bbfcc1744e8bc561
SSDEEP 12288:wyPz5L8RUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik82:BzyRatr0zAiX90z/F0jsFB3SQk7
TLSH
T1C1551207326620F9C4639238C9911906F775B83117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 81cee41d1dbd6a1e12ed0286100072be619de592897f6e2a927bc3c1f43cfae7
MD5 a1b53223b22a29440314457a48b4ce2d
SHA1 0a2cd57304935f176399b8d0f2ea380b8e3a88e8
SHA512 a1d9ba251562bac4231f2dd1c7a0e136851a08658bdc56188827be92d9fb3aaeef104b30309e1ee36fbcdf518e9fceabe3cb7a9edfa72f785f0479fb25d8a95d
SSDEEP 24576:ZTHaLl3z0zDHatr0zAiX90z/F0jsFB3SQky:ZT6Llj0aB0zj0yjoB2
TLSH
T1E4650199735018F8DCA3823EC9558906D6B27C6A07B0CA5F13E43A5B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 ef5bbcc9f51f514967069528f2e49a22ed61b7463a0f6566dca25cbb88848d3a
MD5 05b216e449a2d80d2918c2df8308f84b
SHA1 9c79946bbd504ef5d8fd91abe4b26a9f29322379
SHA512 80301a7cc6c7606a05ad430e3e90764b3a148e9dbe4a41c61f9c481be98d1f0220fea2d408893322febab38be92f6a7267ee905cdc84447a7de841c4b251faef
SSDEEP 24576:X37d9CHKy7GZratr0zAiX90z/F0jsFB3SQkU:n7d9CHKya5aB0zj0yjoB2
TLSH
T1F275CF91F3E810E5F0B39A3589758512DAB67CA91B71DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 159fc906fdf181bfb00bcf282d49d5cf14eeaaeeb9c556a0fb0c9093f5174306
MD5 71e3854f4f43d7960774c0ab38dce72e
SHA1 f8145e0d739db764dfd92b94b026a71fb199b876
SHA512 0dcc04b28f34c7b5f878158a7b87e2c763595a2e2bd8d0ff1275e21e4c2629091cda021ba164744d02803a8e9d4cf47d221aeb2dc8c861c91585def688b8f43d
SSDEEP 12288:XXUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8M:XXatr0zAiX90z/F0jsFB3SQk5
TLSH
T14745230B341F80F3C8831B355244988B5AB95EB476D36B86F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveUpdaterService-2026-08-10.0418.4508.1.aodl

Path C:\Program Files\Microsoft OneDrive\UpdaterService\logs\OneDriveUpdaterService-2026-08-10.0418.4508.1.aodl
Size 10KB
SHA256 4b89034f6713e623fceac3b63ccac05027643c323e6568fc689ebd5cd45f1d4f
MD5 85dfdc83256c2741f7c6ee7bfbac6e89
SHA1 ce0b101181e5a709127fd22e2474e47902b75692
SHA512 05134f285e718b9387f813d231591820a68ad46cabdba23c61d8fc8881dcb0c49666ee643a9705783be7e597bda714f804cf052d41fd8f0dfef141359d5c0f13
SSDEEP 192:bjdRjXby0TAYSYillQp4GpGu4zJSPv3hun:LTMOYlh
TLSH
T12732F3EADC45E021DF66103F5470CB4E2EF9C4AEE4DAB42E22D16C82965771A37FE112
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-08-10_041859_4508-4952.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-08-10_041859_4508-4952.log
Size 1KB
SHA256 2cbe91557e981f7e7499bc61d6a8d8be763d64d1cfbd80bd9fbf1c399bc3177e
MD5 dda9fc5c2f719aba873e4f959accf874
SHA1 c42eb2ec7e62158a06e703d410b0bd4b29f5bb03
SHA512 3fc8c9a4baa90ad5334bec6a42b3542f18a920966608fa9d14f8ad99570446c55546265f5954b7c7f47d1f02e98d59c7d2506e272d229fdf39fd74f82d66476e
TLSH
T19D21D6153BD40A45FFFB99C2D8FA11539E3639912830C54D0064538E0872F41DEB432B
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 76a3ff3bc3ec52cdb1bcf4cc1876719e469e24b7401faaad2f523f5045d5d854
MD5 497120e291af83693b80b459c21f7d44
SHA1 3d9e6015330f8d81c02129ecad56e8427df94bf5
SHA512 f0790c760e8b19e98db9b73f5392dd2d874978d4c4aff520e8e2c3b11e2adb445da5e83ad4aaa24306553e0562ca2baf169c24ea9d29dd091ebbc06f090cc276
SSDEEP 12288:gNsfqUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik81:Bqatr0zAiX90z/F0jsFB3SQks
TLSH
T1D155F00AE25801E5C4AE6239C7544A41B7377C6493E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 0e5e377a4a80526634f7937a88e579e162e143e7082e34a0d1b1bb673b441be9
MD5 b89be779825e15d62c2c8aec0e0f3344
SHA1 af4dd900ccfebb2687b7005242d7475f3b83ad01
SHA512 d41853c414611428b3abfd901580ccdf2281853afb6e6790ddc40a45aca440da096faaa3221385eec0bd07a0278472362c08bd48523b0432663f7d77538a0a7b
SSDEEP 12288:qbUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8i:qbatr0zAiX90z/F0jsFB3SQkZ
TLSH
T1DD45230B351E81F3D8E36B301658881A167E7A746BE29A8BF1813F0F9D385C65D356CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 47267d480af96c0e7fe5414038a05c7dcb1db2405573b1cbc2a716e1b4797557
MD5 d68259af650eff522d9419d427c04952
SHA1 6fcbc9987db78d41d81279aeb1ba5f85fd3f64c0
SHA512 1f330555edd6b969d1a9c9746291b4ca2e144acc99ed08a789a5dc69b8d674c7d912e94ac7c60ffd4d3ce6b742b66acf746b6a75656c68c57b44e5d287a84d09
SSDEEP 49152:8a0h2GEkuAe73q3pp46zwwQpaB0zj0yjoB2:8a0hNYG4JwrB2Yyjl
TLSH
T1BE85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 2d39f681780013f612b1f3e8a513f365eea70f36083fa06316e1e2308254e33a
MD5 e810e2070317de7c7fc116cfa323831f
SHA1 a9ac3ef0d46f5d0270cc2a62dac66fdca40a6ec4
SHA512 20b6ccd4f1061c98494305e4b8c7831abd65525a3fe44f0a585d63a4d3868cb29611f9239f93a9f8b89d7a804f05d8bf57b72a388840109edf1382d6ed634dfb
SSDEEP 12288:ohbHjfX1UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8g:ohbHjP1atr0zAiX90z/F0jsFB3SQkB
TLSH
T18755126F266D10E5E4B2A27D8584850BC731BC351762A7EF22C1A27F4F3AAD51C35F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 020001008b29be0038102ebd1466f761512374f35db4ec3e1bd73d7622b39108
MD5 b17b4311c97a2bca23da7745a977c741
SHA1 ed4fd8d0fcc157be6ad2bd99229c2d036b1ab61b
SHA512 59a007937863db3259f79362c1e5978c320d4104360060751798369495bd3d4710a5e4fec8fd7d6e1b9beb8eeef34ed1190f2724c232c9c6f85dbbaea175c533
SSDEEP 12288:fvUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8g:fvatr0zAiX90z/F0jsFB3SQkR
TLSH
T1D145230B340F80F2C8936B755688884B1A796B7063E36BD7B1917F0F9E386C766356C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 39ac1cb03743e5a6e8eeb2427331ffb43127af6a48b87be5e7456b4be1ada4df
MD5 a45a2e00bab10131513023d4e3b93c89
SHA1 be53e77711eb5d12bba5ddb1767c5526fc692380
SHA512 10833f6c88d84c4ae407a1446d5e4a5de8150888612bce303dddf07eebdf52da097f07b56ea7c23873b3bcc90e2c9063c7a8c20c59b411e439d46255d4ffe954
SSDEEP 12288:nOb9A4LWOsvAYFTGUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8g:IpL3UTGatr0zAiX90z/F0jsFB3SQk5
TLSH
T1A6750105F69500F5D867923CC9A68917E672B86C03A0E7DF03A85F5A1F237E24E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 bb1f6b416619a644703db5a1ee44c791621223ad0ade813894911106a1e50498
MD5 01537902de89b2c4095e1f64b732eaf3
SHA1 aad0aeccdca7fcbb3b09a1ee94858fef1dfdf900
SHA512 22d663cc4229e0977cd23f02dbbcd96696159cd104ec1394e4825e021296cc167d1e516a7943caee6a5aaf9272a1d86f1829e45fad27e249a5e0fa0eedfc4016
SSDEEP 12288:KpFtpO6UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8v:IO6atr0zAiX90z/F0jsFB3SQku
TLSH
T1C655121A329D10F1D473A23C8A81820ED371B871176257DF42D0A66F5F77BE86C3AB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 42c8d9a587346e3d2b9a2bcedb35b22298eedce4d0b75ed1a8437deb49975250
MD5 8ff308a02671ae7bc94f68df945a2d4a
SHA1 f59fec0de5a3c0eb5180a48a7c346e84cef635ce
SHA512 3a48757a15d3c1f0adee7306deabb998c6be576c5663d63dc54e7549e6a74cfde89551533c96c6f74535ac153d094693daf95f187d43479b2e8e979cc33d081f
SSDEEP 24576:E7NM9YqZqmWMUkPjZM48Mv6bEhsratr0zAiX90z/F0jsFB3SQk0:E7cBWMpPjN8DbEhYaB0zj0yjoB2
TLSH
T1C665AE2E6BAC81E5D477D13DC9A28206F6F2B4611B318ACF5152833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 e231f953d6a7ff45a2200e0e51671c9293c4d6a866eab3484051835df1374522
MD5 e1d48325fcf681f39236dc58bb2cfae8
SHA1 384135be327797a622af1c8e160c3e51f7181e53
SHA512 9a5fff2da180aa09cc8c600ea01c708b4a10db2088da7f3cb9111855a277ca8bd2780020bdf0c69abdd918208cbffd2a8310a190871d85e3a9a7a0b18281bdcd
SSDEEP 24576:YW6BApg2YuyuNDYTabvcdvNYf8km1Fatr0zAiX90z/F0jsFB3SQkB:YF2YuHNETovAvNYf8kmLaB0zj0yjoB2
TLSH
T11F857E2A27ED80E4E0BBD27D45B6D146FAB2B8511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 2093e6f32ecd75e655cd729106344208b4eac6fe54ed763151f76318193770de
MD5 37f1615a1292c9b9e9364592a6e46081
SHA1 c665dcceb5d6c0b587c832b8c12c9e850b5da27c
SHA512 65a05e0c0bf33728405beb6c4928cb7a2f66888b60aede8e51040208bdb7da102f2b8c461ae9863db68a17d525029811e12f0d1aaf99d6701291a66c5a54f80c
SSDEEP 24576:HAFs06+Omlf3NXEbTouatr0zAiX90z/F0jsFB3SQkO:gFs060lVXuJaB0zj0yjoB2
TLSH
T19E65BF2F66EC00D5D07ED17D8A96C91AF7B1746307215ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 e6f5ded77b418bc246a2e2fb415491de407dce93dbd430cb4302414b44b9a989
MD5 7758ca120b8b485a7f2b2b5ebbf930ee
SHA1 60d053674d1ede86065584bb613e144b940a56b4
SHA512 e1328147d7653ff4d9f6e0eb7f95779db57191842449a8fce4fb346f444958c50f5c41c515edeaa78fb38be0956aeae94eb6f72dcee26a964bf17ed615556814
SSDEEP 24576:nJnJ5D3WXJatr0zAiX90z/F0jsFB3SQkZ:nJnJ5DGXJaB0zj0yjoB2
TLSH
T1DD75D02DD2A810F4D4B7C37482591B46BF72387D2B226AC724B4E5357F22EE09A79F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 291f2ede2614691ed83e82177fb29597becd563296f46c4a761058fde3310ea7
MD5 4180beb1ded3d50e7227bcfe3a6fd78e
SHA1 e30c98677347adaab9722914f5f43dfb79d63f81
SHA512 ee308e6428890ebebf8c36624b56541159001d24f4b919522d3a23f99933aecb4eff25ef26c21b2c155aa0142a0ff33ba5bf1608c85af6956c1c826650691264
SSDEEP 49152:Dg06DIKdwc+eQnSt65aV3aB0zj0yjoB2:cUB2Yyjl
TLSH
T142956C06B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 2da65adbf00bf2684dcce09e1ca052a985760408ea3891a0de7b2a9a5fe3e5c3
MD5 0d5400561e93295c85269996306d44ea
SHA1 54ca8568c9ef5512d1cd3256570cc1c3cb9af4cb
SHA512 9d82585ac12039ec67ae7c0559171c56c4fb5859d07025a4f5149d8e44d975efe03f7f957318f3cbd1437b38b926028f15dcd80fc47d9e68f8cf47032ac51f95
SSDEEP 12288:6EP3Rn4UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8J:Zn4atr0zAiX90z/F0jsFB3SQkY
TLSH
T18A55125E365D60F5C463A13D85908506D3B2F07027922BEF52D1E63F8F36AEA2D39B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 5b1a6ed8b494e1bb2044ed0a0beed8367c7083497ef54b0c9feaf8376c5c20c5
MD5 4362e0de6bff2d86255aab942f47c87f
SHA1 5355f84ce659a4d0bab6bb3ccc9a9fd7fc8bfacb
SHA512 1d406db65d5eb44194088d110a064e4aa7d847d8ccc8a68b22429b82f2ae05900fb1e7ccbda5e6635cec87de059e642f74c6614b883325a28b41d62550507b10
SSDEEP 12288:gjkyoUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8D:gIyoatr0zAiX90z/F0jsFB3SQke
TLSH
T14255120A335890E1D9B306389A6181855B75BC306BA297DFA0D0FF2FAF357C56D34B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 34a77faaa6ca59d1213348379a73eb5e04f0b4e08f8f6afab8845b6dc07f047d
MD5 f58678ca0d7fa57ac53892b189451ad3
SHA1 851031d201369356267f742b4f6026ad8452bf67
SHA512 b87814ca7e8493d17bdc5fb7415bd579c781cb6479eb351e85abd259fdae324c33f2c8eb52e8a5ee40a717dc8f9ab26a0b8adc4b315d83cd02ee3ea473d4f130
SSDEEP 12288:ryqUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8K:Wqatr0zAiX90z/F0jsFB3SQkD
TLSH
T15845230F341B50F2CC931B3952588D4A16757A7027E26AEBB0D1BE2FCF382C62575AC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 8ffe14b11d478ad69b16dda90f7ae0f84591977b60c382ee67af84de57c2d2ba
MD5 ab61d094c9809b93d0434298da156656
SHA1 5e3fe23c269d95c396665e82e102eb46f2b3f908
SHA512 f699c1ed65b1b644ffe8f1bb586cc98ca46e0e62a7bd74fc8b8c297fb3cca47f442af688d14b788a8f190ed008a3824a9c507e1783718c5c2185b8efbf605e69
SSDEEP 24576:RQ9MxZKdcz9dw3zatr0zAiX90z/F0jsFB3SQkR:RVKZzaB0zj0yjoB2
TLSH
T1EA558C2DABE905DAE173D23995A250C3A673B4301B31D6CF2448D13D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 346f21d76a5373edbfb97358b8eaa9af4c807a032ad5bf3874437a0b535ea073
MD5 4eb9585aec9bbf0d0ed2a64d35021ebe
SHA1 b2bf978d7b6b954504faa0279da5ed79644b6e36
SHA512 18efc4a03c7baa09367b22c9839175827f5db21c9aeb4b869e40997ceeaf67a31641db1f73b12e9dfad6528917525f55b590a9a54653833d349629b42a8a18d6
SSDEEP 12288:SyoKo2JRple9p8UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik86:SyocDAp8atr0zAiX90z/F0jsFB3SQkf
TLSH
T16865E01F7B6E40E2D063923C89848645E773B0705BA257CB6191C73E8F27AE9BD34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c5f79d5d5fc1137d095b2b2eb0dc37d8b0e3738cca437e11cd70421ae6be0b36
MD5 9ef2e0b3d76b17c2adfa3ae7956b3791
SHA1 7e57bc5425888d5e46dbc6610974e4a2ffac4709
SHA512 e2784710e91e1817ff342f7cf945bc5b7ef6c84bc0d2d0809aa75cc6bf25dc0383cc45084b71f261164394afe10a9e76800ca721f39f51aec77153b6e49afb05
SSDEEP 49152:/WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK8aB0zj0yjoB2:n0zuNIRB2Yyjl
TLSH
T1DAA57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f0a609492b0e81ab382d73c24e337adc49cdb06aad90650953ab616b7cef3e0a
MD5 cff61699bd0afb9c6567d966a332ba0c
SHA1 a453b083aef3549475e6b17fa0831ccbd64af20a
SHA512 f295fa473a2f11fa9c9aedbf3c37561f13725063faf63df26602fd5370c5be58eb6d8e63fc9c8dd1e01453051f7230f3a0487914ea8e001518eef3d86c4b4d6d
SSDEEP 24576:T1QT7EcpfxR+N5AWAz3ooiYtjMqb4atr0zAiX90z/F0jsFB3SQkS:OTDxR+N5YzTfjMnaB0zj0yjoB2
TLSH
T11155B02EA7F905E9D1BE85799A23C502FB727821033193CB42A0C17E1E7B5D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 f2afc532b7202a9c42f3a6d3819c05df79fb157df366de8d186a9d50db839a2b
MD5 4d948e7bf68804903cfcc94c604767de
SHA1 af639efb597f905965ab961c27e435379b049ce4
SHA512 67e442f2442a3328a96a4a6c7f4f0cbbbc50aaf90aa5216ea052246917d7452b33c7ee806c1d54a31f9a44c47b75f7fa2589b65c247d34ef4780675c49b2313b
SSDEEP 24576:03YgnJcRTk4yti+R5dBR/9atr0zAiX90z/F0jsFB3SQkG:0IgnaTk46pBR/9aB0zj0yjoB2
TLSH
T13545BF2EF2B910F9C8A6D236450147B5BB71782D1F209ACB0170C639AF1AED85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/8-166-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/8-57-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/864-303-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/864-296-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/864-409-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/864-297-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1296-23-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1296-17-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1296-28-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/1296-237-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/1332-308-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/1332-442-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/1896-63-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/1896-82-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/1896-86-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1896-69-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2052-312-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2052-310-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2288-259-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/2288-318-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2288-261-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2288-252-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/2300-408-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2300-284-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2300-291-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2300-285-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2320-331-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2320-277-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2320-524-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2484-264-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2484-322-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2484-265-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/2484-270-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/2628-80-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2628-74-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2628-165-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3228-246-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3228-314-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3272-326-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3272-274-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3472-526-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3472-325-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3492-406-0x000000000C9C0000-0x000000000C9C8000-memory.dmp

Download

memory/3492-369-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3492-528-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3492-385-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3492-401-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3492-341-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3760-327-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3760-527-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4028-319-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4028-525-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4220-315-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4220-523-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4296-403-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4296-281-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4508-59-0x0000000140000000-0x0000000140471000-memory.dmp

Download

memory/4508-0-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/4508-8-0x0000000140000000-0x0000000140471000-memory.dmp

Download

memory/4508-31-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/4508-9-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/4608-238-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4608-45-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4608-60-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4608-39-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4700-236-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4700-13-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5244-435-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-446-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-434-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-433-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-432-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-431-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-430-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-429-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-428-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-427-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-426-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-424-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-437-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-423-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-422-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-421-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-449-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-448-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-447-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-436-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-445-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-444-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-443-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-420-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-419-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-418-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-417-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-416-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-415-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-413-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-414-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-411-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-410-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-438-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-439-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-440-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-441-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-425-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download

memory/5244-412-0x000001CEBF330000-0x000001CEBF340000-memory.dmp

Download