816aaa5eb7753ae195eaf6e93be9f7370aee299aaaa02b5292e64c4529f80612

Analysis

max time kernel
150s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_3d6c0c9ab41d5fe8e9ed3b8e4304bd28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260816-nbpcgswxfx
SHA256 816aaa5eb7753ae195eaf6e93be9f7370aee299aaaa02b5292e64c4529f80612
MD5 3d6c0c9ab41d5fe8e9ed3b8e4304bd28
SHA1 a77955ad8cf1c42190af2c27862844b0f94802e7
SHA512 c3fc5e5043ffce7beb35c1830679ce8ac06b8d75b969fc681497a2b8c17f34636f14396b168f53aff50a0fb4711e06416338bf08a2528d2141987a87a9d9f980
SSDEEP 49152:34VlZuN4fQE+27ItYZuOfVZAx8hrywGVW/NcCn0W7p4jU9dsTd3HB+kn3Hnx:3DXPi1fq+k
TLSH
T1BF267B1BE6B940F5C0B6E1798A579617FAB27819873297DB4790470A1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	2026-08-16_3d6c0c9ab41d5fe8e9ed3b8e4304bd28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Executes dropped EXE 22 IoCs

pid	Process
3540	alg.exe
1392	elevation_service.exe
400	elevation_service.exe
4072	maintenanceservice.exe
3428	OSE.EXE
2808	DiagnosticsHub.StandardCollector.Service.exe
1276	fxssvc.exe
4452	msdtc.exe
1564	PerceptionSimulationService.exe
4480	perfhost.exe
3448	locator.exe
3732	SensorDataService.exe
3844	snmptrap.exe
2108	spectrum.exe
4772	ssh-agent.exe
1852	TieringEngineService.exe
1280	AgentService.exe
4432	vds.exe
3368	vssvc.exe
3088	wbengine.exe
2492	WmiApSrv.exe
768	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-16_3d6c0c9ab41d5fe8e9ed3b8e4304bd28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-16_3d6c0c9ab41d5fe8e9ed3b8e4304bd28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-16_3d6c0c9ab41d5fe8e9ed3b8e4304bd28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\42af88ed3a3ba122.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009ed1bf80702ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002dbab81702ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000832e180702ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f159e880702ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b83b180702ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008fbbea80702ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1392	elevation_service.exe
1392	elevation_service.exe
1392	elevation_service.exe
1392	elevation_service.exe
1392	elevation_service.exe
1392	elevation_service.exe
1392	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1224	2026-08-16_3d6c0c9ab41d5fe8e9ed3b8e4304bd28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeDebugPrivilege	3540	alg.exe
Token: SeDebugPrivilege	3540	alg.exe
Token: SeDebugPrivilege	3540	alg.exe
Token: SeTakeOwnershipPrivilege	1392	elevation_service.exe
Token: SeAuditPrivilege	1276	fxssvc.exe
Token: SeRestorePrivilege	1852	TieringEngineService.exe
Token: SeManageVolumePrivilege	1852	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1280	AgentService.exe
Token: SeBackupPrivilege	3368	vssvc.exe
Token: SeRestorePrivilege	3368	vssvc.exe
Token: SeAuditPrivilege	3368	vssvc.exe
Token: SeBackupPrivilege	3088	wbengine.exe
Token: SeRestorePrivilege	3088	wbengine.exe
Token: SeSecurityPrivilege	3088	wbengine.exe
Token: 33	768	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeDebugPrivilege	1392	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2884	1224	2026-08-16_3d6c0c9ab41d5fe8e9ed3b8e4304bd28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	87
PID 768 wrote to memory of 5416	768	SearchIndexer.exe	137
PID 768 wrote to memory of 5444	768	SearchIndexer.exe	138

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-16_3d6c0c9ab41d5fe8e9ed3b8e4304bd28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_3d6c0c9ab41d5fe8e9ed3b8e4304bd28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks computer location settings
- Checks system information in the registry
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1224" "1256" "1160" "1260" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:2884

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3540

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:400

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4072

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3428

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4932

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1276

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4452

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1564

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4480

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3448

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3732

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3844

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2108

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1812

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1852

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1280

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4432

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3368

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3088

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2492

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5416
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6393069d846dd0e6f99aa6e258e09f42b092f979aaf3125a761cd16a0e22de4c
MD5 a2d40212ca0783452d642c85c5106c07
SHA1 461a18d407c22ca4496cc1db9f3e83e2af451780
SHA512 2ee252e9d3eeb06a20af9241383b6aeb15806d62a271489ed7f812f9cd9f324b93acb5419bf8ca8e23dbef57a1a111015cef149e9b59824375d1d9cf8af737f3
SSDEEP 49152:lb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnDB+kn3Hnx:73q6sjBK+k
TLSH
T1F4D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 4028b3fea46d2b22e18f342ea9bb25b19a8eed677b4d2a4fc48cbd3f5bcb4441
MD5 7de14a55524e917f11210fcbe81870f0
SHA1 6cd031d7ba5f6b4aa120c958a85b8c7af2b40c7c
SHA512 c3a09c9074a808448f2d3a9023a19bf9beb3db3fe9e2365b86152bd7faaa0121b401a1f5d6fa9c2d7d381801fe139894adc061e55e16a4c4d45817552d73a27e
SSDEEP 12288:M1XLsswWkxy2lRq2czAiLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:6XYfDtczApNyBo4kx929bL3Hnx
TLSH
T1D265012967D409F9ED6B9278C8A2C511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e2fbd2d1175793ed5f37f3aae34fdbf78af6dc97b9578e261bd79d5868451ff9
MD5 0d83aec12cc54c22dca222403ad463dd
SHA1 13a9d38144c25513e89bc1b9f3437b28162cbaa1
SHA512 fb4cd0a67ecf37d37b446f232c206be7ed99365599ce51351f00631aa645907a151dd5831c99d74c00a120aeee0e4f70e0dbcfcec2e2bd2deeaf695aef8c8eca
SSDEEP 12288:+XZNYVLeyUji0h90ZD0wxpGZIVuArHsbLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:S0Le5ji0hmxfrM4NyBo4kx929bL3Hnx
TLSH
T15E859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 82b29c0adbdffb2e551181d2253e5354956cef4018edbc8c6abe24c18cb5021a
MD5 515f304b5b9aa1a950dd23eae2dab5e8
SHA1 b73ada68076ee9d25a9b91c918657da3c91fdd4a
SHA512 20c087a95c1d351e651c3fc2daae0b9a14014778a5c08c6b066720894bcd4a298af607d9665772c89db7b8c89b503a0ef722f9283e5dcf9052ce561eb0992e92
SSDEEP 24576:va7/ezSC6vUyD/aqgrvWn6q8wyuqNyBo4kx929bL3Hnx:i/ezSC6vUzPveHjy8B+kn3Hnx
TLSH
T148755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cea899ffad83281d90268fc0fbc4e7bb51d7b4fad6857bcf95268cfffef16373
MD5 43261d976b93fe50cecbce1a96353679
SHA1 76c0cda4d9de4d606a51ed995138de6ca2d8f46e
SHA512 dd6d09d310aed2c68e3d91dbbb0bb68f5be61afcf7061b08f72aacb898ca7164577503a054f7ad694466b54e3e7a83b152d2a621f9b03eab044ea9952c94ab99
SSDEEP 12288:bVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98GLDAptNyvUgXZ32dT4ePc7N29CD:bVbqPb88hv/l+YFNyBo4kx929bL3Hnx
TLSH
T150559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f06d826f51f944b8e38281c831dd6aaff8bc8a1b146a3b2c7e70a44279b4d950
MD5 2396b5bf972d48c5f3f962750bf3c51b
SHA1 79fbf096457a79ee3b9a4634ff459be361493379
SHA512 89d4ceb98f0485b802a49ecb4a610c2ea75a5c232a6fee0f3827394a7c7218f97e3fa666498b9d153c7dd6b744351835c44e75782cb2e93d2fba59b4039c86df
SSDEEP 12288:UmvLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:UmUNyBo4kx929bL3Hnx
TLSH
T1C44523124B0C627AFBBD3E70745E8455CC35FC8D0D95DB98DE62ACBB48BC9A2DA21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 ea28df932bde2aa50a5278e1b95439b8c04d8b062966b5a072a1599fe8935d5b
MD5 4f35d3e51b9eb8b46a24fdecbca21e78
SHA1 d4617e57792d0d012b39d66ebb8b21818c1de88b
SHA512 3d02afa6c84c6b5579c336f9b9fdd6127a149fed0666272a514930878cf565441a2c317d00a9fd838ecfdf28770e23ef8fd11b222727661fb8b4bbbaffdad78c
SSDEEP 12288:heBNUbTVO86UeLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:hJIUtNyBo4kx929bL3Hnx
TLSH
T16365CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8f030b17e9ddb307eee53a059bc29267f17a94654b0847057efc86f90f9f202d
MD5 1d102819004c9d878a578f85f74123fd
SHA1 14a5d070b22994dffeea566405fdbef36933b7b8
SHA512 4474a56a0db193721f88b6508b31ebc6f075581ea572625897cdd72ece7742a0fbc7266b4bb5db83a52247b2b7b8d15e03ae6f7e55fe8006b094bb2abd96368d
SSDEEP 49152:uQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THM:uQvGAdlCEL8c/DRNw5Cf+k
TLSH
T1FA266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 1ab65b8fa36fbbabd119d0e265a63ca70c26dfd591f150ffa387cbc5a4ab2c70
MD5 4b17802a8b530df68cc4e2062e356b05
SHA1 aa7aab654b68bd9e6de3b7e542526647132be1ac
SHA512 cd04d2b10f3040069948b392a2304a04c65cddd613349a3d293834d3e969a4188eabe129c89627fa3638e7d97c7b93872fab9dee39ebd1e98cf7c82cf3ebf7c9
SSDEEP 12288:CAwSfxL/2Dc3XDLLmt0LDQewsAjALDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:HOewsAj/NyBo4kx929bL3Hnx
TLSH
T11475E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3f08ae9c8be25d82aa0a216e3cf43a9e68991cabfc445937cb0cd32c572b42fa
MD5 da85fbb35b9d062a95dc068a5722692d
SHA1 34e6fc6d4817c3f96b498dd66024acae1e5a022a
SHA512 cb12f802195b8d6c483b080d142f34d5cdf56a17264ab7f522d7a551170d9cac35e416cfc54c2c2148226955b150bbe3d752ebaa9b07cc6c2f1f18733f1923e8
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHE+k:mUEtQevvqc2W1cpV2tI32E
TLSH
T1BF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6a94988148c0fe0e98ccef61f4c442fb8eeca460f608297699ea431491fb2f16
MD5 e39b24b64eb1b057a0e2c74dea8cec6d
SHA1 4419c6277e228bc18ff234513383f9fd3aba8c61
SHA512 9470d777560ab0b7114a370b93a8ac2008055cba0df97b421468b122c93e85ba00131a610201096b063821fa25c2aa7f31835a2f68a1aff93456159620f7cc51
SSDEEP 49152:CCbRquA/m2yL5zTfFiV+XenmE3/zwB+kn3Hnx:HoquVjnmT+k
TLSH
T159D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3f0993d763a9e0355c8a98c576b4ef8161b3bc02b4efb1b5c9bcb618179ff78a
MD5 b274ef2b52e905ef45dd3c938d7e6019
SHA1 0f4a0bbd5af9298c00f112d083c49c82feaf1ce9
SHA512 487f9392449220e739b50eba98576796fd247af1f567c156ef8cce428ffca19d187372f0f62adfb4074a1c0d8e65e41f23dd66c31ce8b1170690bd9380ad2a61
SSDEEP 24576:MAhGL3IFoiwtA5l7S53ONyBo4kx929bL3Hnx:MAMUFoiq5VB+kn3Hnx
TLSH
T11235AE81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 532a1e04b389a23b1efc2d8a24c5bb8e2c9d236c0361fac8f927b755ccd90313
MD5 1deae9daea14921a994a80fe54cbb869
SHA1 a235b3795516622749b2235bb93034ca2449a39d
SHA512 540fd428d76cae207c77b65c0d6e9b05c365e7e077b740c1904569a97ff7e58b24b5455d7a2cd51b26846766cc584ec8a8b205c4f2e4eff914840011da4eb81d
SSDEEP 12288:Fmw5HEjsChNzBFgl0WDm+CVLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:gwu6OWzNyBo4kx929bL3Hnx
TLSH
T1AE65010677A81CF9F9A756388547C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 1a1bcdab03426d40d291874b7b5d7deea6da361ccb7ce84beff134e8e4bdff18
MD5 f577f5a54573c739babb53bb7e4dea50
SHA1 ace39613b425008b8aab57be233c3abf25b0b6d1
SHA512 1ef88e2c189580d163910421467a79f84e9fb59e0d0126e407de9d8e73110bd901fb9c28c7ef29b9d752cde28d379e6d43e3a3e328304cd98106a16a7aa0b038
SSDEEP 12288:tgZ1IyQLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:WZugNyBo4kx929bL3Hnx
TLSH
T139551216239C31FAF2AB2678D8E58605CB32BC461B7183CF5A2145BA1F76ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2bff9d8140b9f86df6dd285dac7a72c390f2c82dab41662373a8967a3524cc91
MD5 b3930318d3907d332869e6c70e81cf86
SHA1 b30a2300f52729395cc9fc8a71515ba1d5c4f7f4
SHA512 ff7ca6caad69dea8becc319940b819190888a11d3fa24be0a9a7e6ecff399bcb41d94fd0508f8baa712329e52a22e4ae88853fab96471b307671f0b3fff98ad2
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UQ:CQRQyi36YOcPbLvw2gAf+PN3W+k
TLSH
T17A666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 92bb902755b871216da23cac97952f3200d029da522269a361aa28e03b79373a
MD5 3c6d7b68bb361a0e5f666ac83ce3d464
SHA1 8f0b1d299cda5a71d0e48df8d28dac7145447ae7
SHA512 86bd67cc7f7c07849777c5ced87fda640a9695333a763ab2338aef96fd2d416e809dfc232aad9907df9ed1be6afcc60b0ffaf7a0ee3336f7ac23a196300cdba6
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UQ:XQRQyi36YOcPbLvw2gAf+PN3W+k
TLSH
T197666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a10907c5039f8f02a75dcb5349c2436d2d1fbe5d8bef3a58509902fce51dad0e
MD5 ff70e5e318d8130c9a24f06a490693ba
SHA1 732ef7a35476f18e294e3681b58730b8a64a2f10
SHA512 ddba0c68eac460a7ef05d537c9af5751f280e4f58af473367278382131231f509676d5eb6b0df2ac97e8fffbb11ba4cc09fa57cdcd369e2a1b741e20d4cd89c2
SSDEEP 24576:vwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0wNyBo4kx929bL3R:368Qg55nhceWu7PNU3/AB+kn3Hnx
TLSH
T10DB55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 50ee2f5c69b4cd750de17a34ea9c3e1d85add800e5de757187be32782e07fe6a
MD5 a567836b1b48f3b1e4141f08a3bd9955
SHA1 bafb47a5491424860fb2d01a344ef40a16fde18b
SHA512 6379068c051a66088659db812da321a8a7973a61e101e1ae42fb324f98ec112dc8efbbb1bba64d55d579a3c19388b0ba07c7bf1423b3a611a9e8ecfd52f83cec
SSDEEP 49152:13aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99C:0y5112gYy5azzVvt69nLKnhZ5+k
TLSH
T1CB167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1bb19c4d086699e53ffd936c07e35e1211639858ab55d85cc2c4a1c165ca5ac5
MD5 ed7db80ae002bc0ef0b9e4db2901f81c
SHA1 bda1e128e8e692ad7ced25f6b7c072d80ddb3e5c
SHA512 2979681c023e3e95c6a0e6deb6b4010a437170e85f04a5000a5259a6c8a94891ca398df0619ac06e35027e2948a9111807e9c2a4968885c1851fcdc2734b0dbf
SSDEEP 49152:IB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl+B+kn3Hnx:Cu6Jmdxd2de+k
TLSH
T1E3D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 05cc2bc75e629199433047f89f0cd6405db97f57c293590c94bdff64d421960d
MD5 325f63e1b4c966684c365ec2554a341f
SHA1 3cb7d84ee5d0483a999ef5676e1da8618acb291f
SHA512 1d49ef9aa3f65dc595d66e702c099b3352b1f3cba0e4b9554de0881b7f2d8240d4a842abd693ecc5dd08f7683ac5310a253686fc6459804da1a6c1616653fee8
SSDEEP 49152:41hpsNoJpF1A63U44CwH7R4xqB+kn3Hnx:4mifPWRT+k
TLSH
T1EEB5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8d2997ed5693f60d7ac4fb465b7786ccdf266615c0ef4b03e1e8eb043c56d17e
MD5 1b09a482ef65cc6102df11e6021226cb
SHA1 ed763b2d01c182fcdbdb586cb0f8348c1c40d28d
SHA512 06135c8783dc0218fcd7e5424aad94a91ee7a1618165988b28ad1334c3b5b75bdcfce6889851ca8c7deb2df40bc9da49c2c83dcde5a1c1acd2eabd00e655965f
SSDEEP 49152:GSuZQIY0Be2KcRVtOnks6NMHqTB+kn3Hnx:I5dKii61V+k
TLSH
T1DFC5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 835104dd1f82497095180d150b239089e485392baf6722a06d2b35bc2cb01525
MD5 a0f21675fb064f5b43399b8b7b523c24
SHA1 de44631b6e79bcdab236032f154ad27e602cc6c8
SHA512 da6c41a54d15051c78997885baab9c3212380bf12794f191a137b864b0f94f6ead82a9512bba7b25d1019b4613e1606d4a67856e662dc4ef7f0b93dc5eb59c4d
SSDEEP 49152:ShtSn8EApI0fig3giDn0AP5wOB+kn3Hnx:TX2imph3+k
TLSH
T1F995BE13F2D901E8D06ED174C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e51687176eb21f390a797659f9c3a77f1b246f5d2d88a230f5f3c352ba7a321a
MD5 db64896fafd5ee5c2ea602698cd7eff9
SHA1 e1818bd6fda8878cba407ccb4303e2f39c455359
SHA512 b3db5c05d3d1dfc36d532b01c0995fed7941d3b713f140699a20777be9b66d9385d237d76fc24e556c15a659fe86ea047b443337701311894df07cfc5a3962a0
SSDEEP 12288:JnLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:JcNyBo4kx929bL3Hnx
TLSH
T1834523125A0C627AF76D3FB0644A8598CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 3ef0a749609a0cc93473ae87ad07a560e1fdfc639f07a46c61cd89c7bb749701
MD5 a2d65e299ddb5607652e53ad485e01c8
SHA1 3ce42dd9707c1df027142a70e300c2b05dbfd14d
SHA512 5ef68d4e1ab68478cb79608b3d8aa9e9da829917b3f74bd1bf1e133889ad50d0f81864a849251a428cbc7b8c452144f328d140c4fa2518e210eadcad7905a609
SSDEEP 12288:DULDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:DLNyBo4kx929bL3Hnx
TLSH
T1BC4523125A0C227AF76D3FB0644A8498CC34BC8F1E9593D8EF67987759FCEA25B21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a8f30673edeb192131bbac3eca6ba6ac1dec079c0bb1e4355eb098d93b58707d
MD5 91e87ab29e942cbc09921a328648d4ac
SHA1 eb762b0de13b8ad0cc1ee8803622954bad33b026
SHA512 162eb9d25444a232d2524427bb66b56cfd0cff284f9be9670e4d10f0d5b70d06b546aaa4a7949b458cf819102134bec7797f73901c06f51c7dabba7452ab286d
SSDEEP 12288:X2LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:XVNyBo4kx929bL3Hnx
TLSH
T18E4523125A0C627AF76D3FB0644A8598CC34BC8F1E9593D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 a4a9f551ea60553124a04b22f56399dc92ce372009ee0fd2879c88f348b5202d
MD5 a9c00de09b8b2f3fd16e7ee5334e03e3
SHA1 55e5d4d9074cac05e05f9b0f4dd83f2b54a557a9
SHA512 41f077485a08d2e53f081aaa0ce4211a3ad3f52ad9197f6c0b94280a8a72993d378d50506cf2ccba519fadcd28214e0c6827e805ea1de679567dfbb582f7c5d8
SSDEEP 12288:oVRLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:VNyBo4kx929bL3Hnx
TLSH
T1F24523125B5C12BAF97A7BB0D85A8054C835BC8A5B7197DFDF124CBB0DB8BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a063476690ca31e5ea8c748530882574aa615fbfe1c1d6b4835bbb708695fd20
MD5 0cf0d6e6a9c4d5eb9b186761f65d8ce6
SHA1 c4091ccd28dd8ddc5c7a3cb4b83ceef1e0143b3b
SHA512 f296b9373cefd210df69d7c32e926d9693589c67c488f36b1b2f66752cdf6f3b746008125c90692e83212eac8414f12e183604292d2a4173f112284814286cbf
SSDEEP 12288:4ZLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:4GNyBo4kx929bL3Hnx
TLSH
T1214523125A0C627AF76D3FB0644A8598CC34BC8F1E9593D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5c8cf3ff7115266e2221b02cbce5e84d285139af285ac5074336d07784d9fde3
MD5 2909c272758d775b48d44e308713c661
SHA1 c275403b426b3957e66656570727b18dba2c692a
SHA512 15fdecfe75c6b5d3b8edb646e5928f7b30b28ca76f60d04a271982cd85dcd46a7b84c8e8edf8c7a0a0287e8f1dc059f109a313ca28b47b5a3297add9be1fb669
SSDEEP 12288:yYLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:yHNyBo4kx929bL3Hnx
TLSH
T1484523125A0C627AF76D3FB0644A8598CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 96c2c2906cd72cd9395352491e945baf9b6832d409a41b520eb373453d9d99cc
MD5 63bad017805c71e9403224b6f1c54eee
SHA1 a8b94468376d997d6059f4addb126a2027120a56
SHA512 79502e1887d5d5eb9328ddb92c591312140dcd7ddfbed03cb60ae9080762811173de41911e5054873e1d93a279cb6578b5c25acbaefa24853fea626e90c0a373
SSDEEP 12288:8cLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:8DNyBo4kx929bL3Hnx
TLSH
T13C4523129A0C623AF76D3FB065498598CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 6db439ee79cc3f26fdc3177007ddceb4c386c5fe61e22560b1d28594f848dfce
MD5 a61b9977f560351be862ebbe60a581ca
SHA1 e794e60c2b31cf29b5326be0a329c3c0f5c2a5df
SHA512 1145f560ebfa973dd3d9a33ddf795a66e214fd5f6d964f9a219499d6e3540268ccdf27b333be286708755c00c293ff0bd06b4eb404eead0b5fd022a4b7387159
SSDEEP 12288:GiZwbjzzFEoS2cPvy0LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:JZMXzFVSOrNyBo4kx929bL3Hnx
TLSH
T11A650195B39418F8EC67823DC8158906C6B2BC4A0BA0C65F07B4367B5F773A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d979e212ee4ff47d59b33dff64007000fef66ed4d64db42c14eefbd2c61c8256
MD5 939b85bd90d09869614643d9288ca6ae
SHA1 2c3056ae2a7964fb243adf20b9a44935390774cc
SHA512 dc3bbd9e88216b46900fa4a1bd584efdeb47b1fc40598e04acfbc8402bd1eaa57f461bef38c0008233f3dadd646d5af3eeea1ff88a96817d4034f4fda06a23b8
SSDEEP 12288:2DLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:2QNyBo4kx929bL3Hnx
TLSH
T13C4523135A0C627AF76D3FB0654A8598CC34BC8F1E9593D8EF27987759BCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 40f9051092a5931ba399ff5c507aecc3ec3a9e33c34c0faa828968a312ee3f32
MD5 a3777250102de5c085476a286bc2c887
SHA1 247271a534ffd216bfffb7762da9677bc036f123
SHA512 4420ca0d58aec5d08bf42c6b9119eec1024a9982798eb54f34f245566736d4b205ab1f9a0ecfe4e09614d0bb4822f00b71684b0c943f0f3604bceee0e89a0cea
SSDEEP 12288:V/LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:VENyBo4kx929bL3Hnx
TLSH
T1304523135A0C227AF76D3FB0654A8598CC34BC8F1E9593D8EF27987759BCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 0239fa8a99c3ebb42fc5910730fb557737fb0a07b2dc2dd38227804d534f96ce
MD5 cdf7b13d1c9ec3296ffef39aa3e90733
SHA1 a01becf4343b7d80c69da47e0c9acadad99e8aab
SHA512 0e886d89e152ec6d738e5cda1155ba001e3738e33511831c5733df6e0510229280147ff47bbd162708b83bfa90027f7b11f6b32696c4422aa4cf0749f29fea65
SSDEEP 12288:8yPz5L8QLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:lzyvNyBo4kx929bL3Hnx
TLSH
T17C55120777A831F9E17A6234C8960A05E731BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9089e5b8adc591d736975101a0d811a45ee41d15845411582b3ae4ea149ab35d
MD5 99e93b760f123eca85aadabd1dd2e45d
SHA1 388f2c1ea4d98c0d44aa4ccf47db963474081dc1
SHA512 3d4a3da34d05dbbdca64475be70f3707723eaa8a69d25a541a8c5d03d47d7c093ac15af6a7400d940801756b21b5badc2af232b223f6d9b5f2abcf2dccd4b34f
SSDEEP 12288:KDLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:KQNyBo4kx929bL3Hnx
TLSH
T1E04523135A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759BCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 60dd41c2b67bb220a36008e0661f562823c88328e2b64ffac83efd91a6786163
MD5 798c618a013be3ea1a9b439aadde12f1
SHA1 a1b74bd6481f542635fd8071ddd313306e842a5e
SHA512 68d4eaafefb230124d7c841629cb6837c8dacec2afc6dd2eb8bb245352bf73a673047034c626e8a5cb4bb25dd4f013eadb5af5ecb7bee00a42556b370e089261
SSDEEP 12288:mDLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:mQNyBo4kx929bL3Hnx
TLSH
T1AA4523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 cf4cfddfd8d0bfcda770536e4256dd62704ffe5285683f67a33dffe23700e4ac
MD5 d0be1e7f46934fa7582aa764403e90d2
SHA1 79a6c1bf85bc1bd051cb236c31bf0df68ca0e995
SHA512 851b96d75bcf3eecffac39831f5da6820d9ac8827255d44c506a787b5fa11154fb9bf88f49c42e87cc369a53c494c328ec91e6572a9ce440b2fd4bffe429b854
SSDEEP 12288:cyPz5L8QLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:FzyvNyBo4kx929bL3Hnx
TLSH
T1A055120777A831F9E17A6234C8960A05E731BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 2abb045076309f320852edd33792fb01d52bf76ac9a3256ac15128ebc6fa4650
MD5 83b88c268728950a0694f206ad8db8ca
SHA1 71656ef54f85c9c6b87d2e9adfced3be3e52258d
SHA512 5c5df5c1b38f184d1a081b343ba4168fc0b38eba81a0b6874e6a40b3a0ed9ae5408c793ab6598e13ea82e59312c3d279c2cd7e514924091b9f0ab2b6f23a0834
SSDEEP 12288:hCd98WYoaLHF3z0z04PDvhmLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:cTtaLl3z0zDlNyBo4kx929bL3Hnx
TLSH
T1816501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 2ea90c59457dfe691d4f95087f3da81b068d61d54a1528ef2b2ce8b7e71e4d8b
MD5 c1fec5b9f35ef9ad8cf6da29b78c88a2
SHA1 bc7ea48cec19015832ee0302fe68fe85b9d4ca9a
SHA512 11ceaeab528add097ba9e04f65448667955a5d3f4145f063422ebf5f3920edb8f41e2030d246acfba784346e6d2e089180b70c9aedbdacfd90fb70da0081b354
SSDEEP 12288:Bi4e7ARdTfgwCHKy7GLbbdIvdLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:B3ld9CHKy7GZRNyBo4kx929bL3Hnx
TLSH
T1BD75CF90F3E810E8F1B79A3489764511CA767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 c4f15170de6e5ef4d5a284160aaebb7aff7f77a0a9b0abcabe8e0794854d781c
MD5 aaa0612f1f155f0df7f1e4286605fc85
SHA1 17e8ef074cd7b288b1cd6f01186faea1f09d0587
SHA512 5b1ea33897d838cb92ae5d606c0edcfa1f91d6bde37970d740f06ba5a49d2debf623589b57b6710091b8c5d772fdbf38f336833918431ab93ae0b541d16993ff
SSDEEP 12288:BWLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:B1NyBo4kx929bL3Hnx
TLSH
T1744523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 98865248e52322c2d5415a3eb78b1c68f2655935859d56c63951648c33e2782d
MD5 709c257d20aa22fc0b164178e96bb387
SHA1 7e71d9af400bc76f4516ea70c75bf72214e5dc49
SHA512 5853c2c22099ad0ded71c8e33e90465e3d16859741aef275b9238cd5f4078af99c3083f9f5fab17543871dbe1ccb17ef23092f3e920f79bcc896d4f7968ceaa7
SSDEEP 12288:KwLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:KPNyBo4kx929bL3Hnx
TLSH
T1794523125A0C227AF66D3FB0644A8558CC34BC8F1EA597D8EF679C7759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 fc04956ca19ff9e3d1066f5bf1fa9c18be3d1cce566149b51df17517d93f19d7
MD5 e16ab3009916db33f3c2653aa9c1faaf
SHA1 8f54e3fa0f5883d9dafb88f3b1f64aa58b6017f2
SHA512 9a5bf5c7444a9ae11304317645eafe9f30d83c2c3fc617a3fe6b900c1514ae3105190b6545c134844a28f4281ff17cd2aff9056ff102fc31893b46c48ff564d3
SSDEEP 12288:4dLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:4CNyBo4kx929bL3Hnx
TLSH
T1C2452312590C223AF76D3FB0654A8598CC34BC8F1E9593D8EF27987B59FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveUpdaterService-2026-08-16.1113.1224.1.aodl

Path C:\Program Files\Microsoft OneDrive\UpdaterService\logs\OneDriveUpdaterService-2026-08-16.1113.1224.1.aodl
Size 10KB
SHA256 58483d2fecb2b67a120ad12a94d595e0c4d6c3605cb5f02d19ed0c58f56b8d8e
MD5 ddbccc51b11d89c217d9842c43a6a749
SHA1 de3d244a46e7c0df7ef95edfc711a6b73130a8ad
SHA512 cffe433415eab53a2af0fb05bf2514ea01c634c4f438ac411716bcaab15a82290c61f498e5d0dba95c0a1462d38519c3f922f54d8e0bb165e2fa5da1bfa58258
SSDEEP 192:YnkBm1Fh1t02ZHqyf9804Pp3NwzDSPv3LEn:s1Ah2vF
TLSH
T1C632B1EBDC414024DD82543565E4CA4E3EF0C8AEE0D2B42AE2C76C8A666771D27BF533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-08-16_111338_1224-2652.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-08-16_111338_1224-2652.log
Size 1KB
SHA256 0ebdba97a898b01fbfada57db7c955d60a9bc27dcd4599cc025030357f91629a
MD5 f08a66719a5005900df1bd94dc377524
SHA1 9a5a62528765856a492c3e16bcaf8bae529c31bc
SHA512 2fefeb142c1eddfc24d77162f4c6bca6d134f1d5960162f2462c5acc1e10157c1b40ef81f61f63b1d2d01eb152b497d7fa096cd7887f8904b3083733362f7156
TLSH
T1B62166193BDC0A06FFFB99C1D8FA15536E3639927834C90C0064524D5876F85EE7431B
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 4645837a4ba464d00ddd96e889805fadbd60f401a492c77bfd610c12c92959a9
MD5 4fc9a0e31a05381ecbf48587b39db044
SHA1 151fe87cf04fee6c82f90018fb94ef5def5dc51d
SHA512 f2dc6710463753f887ff53d303002d8c8cb167757887d656532fdf802954ee9ac4188fc68ca2b17e3c79d35b8c93b14197f3e7386cb316f4006b7fb4abd9f519
SSDEEP 12288:RpsfzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:mgNyBo4kx929bL3Hnx
TLSH
T19E55F01AD25812E8D06E6274C7468A40F7337C5A47E1D3CB97D0F87E0F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e0d76c6390381d6066f6fb9ce4ab47f18e91ca6cba42b7b782ad9c532b61aa96
MD5 dce1b542a304dc7cf9e5766c94aab522
SHA1 57e8bba5fa7de887f59b851bc2ce9a3d6261dee7
SHA512 9a9539348037f1ec27e6c55792149d78f8ea1da03970cfae6b6a1518ec3ac54eea38641986f8524e4eb51b37dd44328941fcecc9a67b2ed85e913d7f51ba2573
SSDEEP 12288:X1LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:XqNyBo4kx929bL3Hnx
TLSH
T1EF452312974C623AF6BD3F70645AC028CC39BC4D0F55D6DAEE1658BA59BCDE29E30207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e65228165e28c9005e8a051c27f7d9b744073b4b187004405e1730dc32894b0a
MD5 af5875e8d5d560353cfca5b54508baa4
SHA1 16841660bc7c12f924e2da442819dffa574a645f
SHA512 69105b2a19426b4779d3f5acc19d343c5808333a0ce3a54a36fe53e4ddfa097be0e4d9bba9529e21df43facdd08e72558fbff8af3c0457c9001c04a2286e56d3
SSDEEP 49152:sa0h2GEkuAe73q3pp46zwwQvB+kn3Hnx:sa0hNYG4JwO+k
TLSH
T14D85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 c605853ce6cf229531ee29859b6a57f03a00335e135077ec4cdc8b0c6b270717
MD5 decfebfcef226deaa250d0e9ee4f0e1e
SHA1 b330e2e29f23fc8c0df1d837eb9ebc97397598a5
SHA512 9b72920f7dcb1110115da763780eeb3fc9d94b7d6b1f23e833d0e25370a6c59a4ae598836523c62eb1db98cb2b515441ae6a8e4fda6c28435895dcca4fef44ed
SSDEEP 12288:ihbHjfXuLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ihbHjPdNyBo4kx929bL3Hnx
TLSH
T11D55123E16AC21E9F275B67C9546850AC730BC1A1B2193EF6792817E0F3BEE10D35B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 413277cd4eacb42595ef27998fb492ad9c21a85695ae878ce17f444fee1c4e10
MD5 4c04c5baf22fd31cbb1cc58b38a3a47d
SHA1 aa744be444381c9726d687f960434040e1c2c588
SHA512 00d8991fffa8c79eb849146eb7710f6b187f4ad035cd26f3c51c8ef2fdd3840151551471d20908a3779df8b1b45f837f350a06617222bfa01c9e135eb6cab621
SSDEEP 24576:Y3YgnJcRTk4yti+R5dpR/FNyBo4kx929bL3Hnx:YIgnaTk46ppR/SB+kn3Hnx
TLSH
T15945B02DF2B910B9D8AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 830a6584dd9c005e0bb5fefead53518b93ce8cf826010c4619b2240ed575233d
MD5 19d9ca435f92fdb766aac6dd9cfc311b
SHA1 549332457037b79a8d3592b65e175089ecd98ed3
SHA512 ead19be0b27664fcd745914b8192e63762887a047bb86f835a3ca073316a96d7130ea3a41fc77e51a7d7eb2c0962c99182dc7893b8a98d3a8e48eb0ff161ad88
SSDEEP 12288:YxLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:YONyBo4kx929bL3Hnx
TLSH
T174452312560C623AF67D3FB0644A8558CC34BC4A0F6597DBEE6798BB59BCEE34A30103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 e30508bfa45d0c3e1e4828af6ea9adfaa548f6e80daf2a571270e4453a7d4b40
MD5 2f20f84b51acc06b9c244b3e6f1b4688
SHA1 8e968dfd6165d0d1e21b4457a3eceafeee2d0bb9
SHA512 eea06d06d1fa12f0ddd2a5226c3e548cbf756ed2761a01dc3847cfe8c2aad5ae69db7bdf4e2e3b6d5053ccee5467b37144dbc37bab5f6adf0a8876157d6c21ea
SSDEEP 12288:PObFA4LWOsvAYFTwLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:QxL3UTPNyBo4kx929bL3Hnx
TLSH
T18C750115F79800F9E97B923CC8A68916D672B84D0764E7DF03A84A661F637E24E3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 8bb3c4a71915c51c5f5c50aa8cd6e2f084a159e79cb730e881a93b99a6e821bd
MD5 1a054a830f671d1ab0c92dd98f8effbd
SHA1 01b85aa82312effe633bb413385ae67e74fb53bc
SHA512 e81cfc311770bcfc2c1b9d43ae0a682e6efe6c297ccc1ec94b4b6a2c18f98384b1f3aa6d19833b8fb85401121f8b753465ded1fd2523c1f4779fcdb5fc756a42
SSDEEP 12288:3pFtuOMLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:0OTNyBo4kx929bL3Hnx
TLSH
T12655011A369C20F9E579767C9986820DC731BC560B2257EF46A080BE0FB7FF85C35A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9bb5382ede69ecdf33460968a3d9baf855bbbdd0c8f6934a96df055f200befd7
MD5 c214f02eadda4d1993d890cf3557e690
SHA1 ee3fc734c0e1cb35c5d382683b9f0779c1cbac1c
SHA512 e33ddbb23644b0cbd6e89c26e657cbb468a33f57fee8eff9ea0d4e24094e5079f5d18813fde82a57d33a1a61d4c172cc5cacee7fed867b8775c30e5a0b9bdbb6
SSDEEP 24576:37NM9YmZqmWMUkPjZM48Mv6bEhsaNyBo4kx929bL3Hnx:37cBWMpPjN8DbEh6B+kn3Hnx
TLSH
T1A565AE2E6BAC81E5D477D13DC9A28205F6B2B4611B318ACF5162833E6F37AF44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 d65dc0c8f0d9035519c3e7d68753511ea478cbc92915cc37c3ef42542d073a7d
MD5 41333395ee441823bf4788bccac8803a
SHA1 7176d690e8c6f4b4cd890bb9013f32aeaff2f305
SHA512 eae143dae110b302d8835c7b45191ec99e85ea968962dba5e1c0b1c747a446f811ec5580ee9a09f816b9a33631b7a874e2c5bcf747cd5feb206fe33fb036d19a
SSDEEP 24576:RW6BApg2YuyuNDYTabvcRvNYf8km1wNyBo4kx929bL3Hnx:RF2YuHNETovcvNYf8kmpB+kn3Hnx
TLSH
T100858E2A27ED80A4E0BBD27D45B7D246FAB2B8511B3056CF4255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 a36d0998a2e95fdb6e26c2bbce4307815b831952c784f7546ae62992fb8a51e8
MD5 001b3df06190f8619433482fd78dd9a5
SHA1 fe2d6b018390bcbf8f7bbbf757db929f26600b5a
SHA512 50487b90f5f73acadb3d2cea19068b812fe78acf140133cf8f92155acacb2d29a5446f01568ad162a06fab082eb8402e53bd55ae840af1f712e9e47a5c1eae2d
SSDEEP 24576:HAFs06+OmlfkNXEbTonNyBo4kx929bL3Hnx:gFs060lwXuPB+kn3Hnx
TLSH
T1D565BF2F62AC00D5E07ED17D8997C91AF6B1746707255ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 4a7460584dc39c4765bfee80cd5a3491a73be936e65c0ba4440672b384df8ce1
MD5 a415c4626b57eba290aab8c3e4ac9bd6
SHA1 9cd3021a5c02d5a9a867f1d83f7ce0d423e35391
SHA512 fc4aaa64a98c2de249480b51e3f55701c04e4a35bb48d1ac1929efe1c734eb58c4863b9fb7c7262e66175f08bbbfa500c5f0a13aef272d323640e7cef40dc9db
SSDEEP 12288:nCJnJ5D3VkrDzxlLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:CJnJ5D3WX0NyBo4kx929bL3Hnx
TLSH
T1EC75D02DD2A810F8E4B7D2B4815A1755FE72386D2F226AC76874D4353F22FE09A79F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 9a85c615de02fbe8081f5ff4618053ab37c993eb6688047c27853b98fa08c442
MD5 b0bd97506c9cab6a363e769e9ca73a72
SHA1 a4eab27d244f658e00d5759dc4528e0a18de9e9d
SHA512 8745e4d64df61ba27b4c20146e80eb9f673514f45555a8369072eaef1066822146c502141e3479bb8ae380531772c0e1b196e8ff15a67c7eeb0e79c18f1a60c6
SSDEEP 24576:9EPohm6/7IIXdwcXrif7qQncjlP65i3VuFNyBo4kx929bL3Hnx:Ko06DIKdwc+eQnSt65aVNB+kn3Hnx
TLSH
T197955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 e69cc1a9c493bccb805eff08129e4d0635a23f2689b816d80579855091ddac80
MD5 4b6d42c0bc16d696d9410282d534ee72
SHA1 4ca9818585deb262e31063ad79628b8e70a105e8
SHA512 a8c63884d3d3f9061fde41439656178fb17d594df2db05c234bc1b4c0a65cdcc7203670317af2eb5894e4f726acf902b629ec3d46f47b51c9840aaa18229eb31
SSDEEP 12288:IEP3RlCoLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:jlC3NyBo4kx929bL3Hnx
TLSH
T19355122E279C70F9E13A717C94918104C732F4651B5267EF9AA2C17E4E7BEE61E38B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 6528d8251901d043fd070ed23ce56b9d52a8c94657ac52f781fc1abd13250229
MD5 b7ec917b44070ef8e9194d185ac41337
SHA1 12d5e4cebeb0de49f9d8ba5acda3c96bb5c9eb14
SHA512 a0a4cb330460cdb4d144bf685e2f733384743790c763febc1642b9ae516a2c539dcc06854b6a1a93f3316a7bcc8e264c56c65d05b1eac0bc763ea332f50d6b56
SSDEEP 12288:SjkyeLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:SIytNyBo4kx929bL3Hnx
TLSH
T146551205638C61A9FAB92A3899678194CD34FC101F2193DF9591EA3F5F7AFD16D30B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 f9bb1ab30b3fa0ebc62b7890abe1a8bac97d91f8f3d096a60692143a78157b01
MD5 9e75306f4ca0622e9e003ed460d86086
SHA1 73380fad439845330fdd0b60076b9097b35ad6d6
SHA512 85b991ef3fa6f57434c60c22b72f218cb6d35db33e86227e54257f12b3eab1fe04de55efb9dfeb85876176633a82a84f230d464dc42516aabba083a1e99dbe4e
SSDEEP 12288:9a8LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:8jNyBo4kx929bL3Hnx
TLSH
T1D4452319161C327AFA3D3FB0641A8554C830BC4E1F51A6EFEDA2D8778ABDED25A31503
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 772decd5e8e2443a34ff20f3e9d81bd35ed9ceb3dc47b62c4c17c1778784aa24
MD5 5d0e658de8633b8a76ce50f858449be7
SHA1 11bce453f77b817f97ab80925e21e21b4541c8f5
SHA512 6fffbfaafbcf65b4816e8f54db7d9800e26a1fdd5a88ee03e3b35d34c698f068ff53fa6c800d1905c9b9a2f718289faa761e24414188d0dc4b51d2177d178fbd
SSDEEP 12288:PLQZb3C97GYnZMv5zBcKY97MD3tLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxfJ:zQ9MxZKdcz97w3yNyBo4kx929bL3Hnx
TLSH
T1F9558C2DABE9059AE177D27595A240C3A633B4311B31D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 5518c2fed11594c9d1034c212e88e4c09c29a41059614f5aa12f36e43bf70769
MD5 91cba28dcbd4899ce4fdc58f538eed91
SHA1 5b3498b8455afc4b2813dd598c2686da8d004439
SHA512 cd2003283a7a6750abe7263b4f3a9a242761d55eb1ec5f37ff6d33d206d2140aad854f67de4be61a7f26bb2ef06c9075373c5a4880c54195001b6da72fbe9767
SSDEEP 12288:KyoKo29Rple9pqLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:KyocfAphNyBo4kx929bL3Hnx
TLSH
T16B65E01FBB6D40A2E176923C88858245E773B4341B6253CB6691C73E4F77AE9BD34B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 80428ca6e37b11463316383f72de8a42b6ea4bfc4220f4b20f678ab26b4ef1fc
MD5 e11144814cb03c37b3622a41c2364d60
SHA1 c586eb1f2636103bc4af4f18a24b32a484d123b7
SHA512 7f4c5e549d01fba2d79c11f5115b40fbad7d1ceece1247dd28850826c681102fc4f53a51324af7028e0f3275f494e301cabbc7d62202e26aeb366c2a78b011d8
SSDEEP 49152:dWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK2B+kn3Hnx:90zuNIK+k
TLSH
T136A57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-233-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/400-46-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/400-56-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/400-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/768-516-0x000000000CD10000-0x000000000CD18000-memory.dmp

Download

memory/768-687-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/768-473-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/768-489-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/768-430-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/768-429-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/768-436-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/768-505-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/1224-9-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1224-0-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1224-8-0x0000000140000000-0x0000000140471000-memory.dmp

Download

memory/1224-20-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1224-32-0x0000000140000000-0x0000000140471000-memory.dmp

Download

memory/1276-252-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1276-253-0x0000000000EA0000-0x0000000000F00000-memory.dmp

Download

memory/1276-259-0x0000000000EA0000-0x0000000000F00000-memory.dmp

Download

memory/1276-265-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1276-263-0x0000000000EA0000-0x0000000000F00000-memory.dmp

Download

memory/1280-373-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1280-375-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1280-377-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1280-371-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1392-36-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1392-54-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1392-231-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1392-42-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1564-280-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1564-391-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1564-286-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1564-279-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1852-359-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1852-584-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1852-362-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2108-330-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2108-515-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2108-338-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2108-336-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2492-415-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/2492-421-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/2492-424-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/2492-686-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/2808-247-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2808-361-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2808-249-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3088-412-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3088-404-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3088-410-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3088-683-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3368-398-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3368-682-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3368-400-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3428-79-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3428-81-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/3428-234-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/3428-73-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3448-302-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3448-296-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3448-423-0x0000000140000000-0x0000000140133000-memory.dmp

Download

memory/3448-304-0x0000000140000000-0x0000000140133000-memory.dmp

Download

memory/3540-30-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3540-232-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/3540-22-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3540-13-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/3732-308-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/3732-314-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/3732-518-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3732-307-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3732-513-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/3732-428-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3844-327-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/3844-510-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/3844-319-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/3844-325-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/4072-70-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4072-58-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4072-71-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/4072-65-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4072-64-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/4432-379-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/4432-388-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4432-681-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4432-385-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/4452-387-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/4452-274-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4452-268-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4452-267-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/4480-290-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/4480-403-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/4772-519-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4772-343-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4772-342-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4772-349-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5444-525-0x0000016D59AB0000-0x0000016D59AC0000-memory.dmp

Download

memory/5444-535-0x0000016D59AB0000-0x0000016D59AC0000-memory.dmp

Download

memory/5444-534-0x0000016D59AB0000-0x0000016D59AC0000-memory.dmp

Download

memory/5444-532-0x0000016D59AB0000-0x0000016D59AC0000-memory.dmp

Download

memory/5444-531-0x0000016D59AB0000-0x0000016D59AC0000-memory.dmp

Download

memory/5444-530-0x0000016D59AB0000-0x0000016D59AC0000-memory.dmp

Download

memory/5444-529-0x0000016D59AB0000-0x0000016D59AC0000-memory.dmp

Download

memory/5444-528-0x0000016D59AB0000-0x0000016D59AC0000-memory.dmp

Download

memory/5444-527-0x0000016D59AB0000-0x0000016D59AC0000-memory.dmp

Download

memory/5444-526-0x0000016D59AB0000-0x0000016D59AC0000-memory.dmp

Download

memory/5444-533-0x0000016D59AB0000-0x0000016D59AC0000-memory.dmp

Download

memory/5444-522-0x0000016D59AB0000-0x0000016D59AC0000-memory.dmp

Download

memory/5444-524-0x0000016D59AB0000-0x0000016D59AC0000-memory.dmp

Download

memory/5444-523-0x0000016D59AB0000-0x0000016D59AC0000-memory.dmp

Download

memory/5444-521-0x0000016D59AB0000-0x0000016D59AC0000-memory.dmp

Download

memory/5444-520-0x0000016D59AB0000-0x0000016D59AC0000-memory.dmp

Download