stealc | f6ff18b094444f907befd550ed4f6200a36ddb4214e53d62fceeb14ebaf0984a

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
Size 1.8MB
Sample260910-e4l86axfpf
SHA256 f6ff18b094444f907befd550ed4f6200a36ddb4214e53d62fceeb14ebaf0984a
MD5 83b0cd09c1dadf896b6257cbd15b9092
SHA1 5e6099f0dc9cccde861f6283c4f3574e9950fc37
SHA512 d99c9a5804fa1ebb5ad0d38dfb34756a8f1a9ff4e21ced345953e305badefcb236280ff457d258068fc2d6156328fd0ebb0d4726aa40935e363c3c961a5e401f
SSDEEP 24576:lpt+UQ8AqLSLjvMyxknw4FYnshx8OfVe247:crIEnx4x8EVep
TLSH
T1F485E015E7E400F5E1BB86788F729502EA367C950770D6DF03A499A66F23DE08E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc ransomware spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral1/memory/3200-345-0x0000000140000000-0x00000001401CB000-memory.dmp	family_stealc_v3

Executes dropped EXE 22 IoCs

pid	Process
3080	alg.exe
4380	DiagnosticsHub.StandardCollector.Service.exe
4672	fxssvc.exe
1596	elevation_service.exe
4516	elevation_service.exe
4200	maintenanceservice.exe
876	msdtc.exe
456	OSE.EXE
1204	PerceptionSimulationService.exe
2188	perfhost.exe
3328	locator.exe
1732	SensorDataService.exe
2820	snmptrap.exe
3940	spectrum.exe
3820	ssh-agent.exe
2436	TieringEngineService.exe
2764	AgentService.exe
3360	vds.exe
3644	vssvc.exe
3228	wbengine.exe
5024	WmiApSrv.exe
1492	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\51b7dac479c0b0e8.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\UninstallResolve.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\UninstallResolve.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\javaw.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3b0700cdd40dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6496313dd40dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083197e0ddd40dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006f44280ddd40dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e627ff12dd40dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef4b8d0cdd40dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a83e50cdd40dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
4380	DiagnosticsHub.StandardCollector.Service.exe
4380	DiagnosticsHub.StandardCollector.Service.exe
4380	DiagnosticsHub.StandardCollector.Service.exe
4380	DiagnosticsHub.StandardCollector.Service.exe
4380	DiagnosticsHub.StandardCollector.Service.exe
4380	DiagnosticsHub.StandardCollector.Service.exe
4380	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
Token: SeTakeOwnershipPrivilege	3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
Token: SeAuditPrivilege	4672	fxssvc.exe
Token: SeRestorePrivilege	2436	TieringEngineService.exe
Token: SeManageVolumePrivilege	2436	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2764	AgentService.exe
Token: SeBackupPrivilege	3644	vssvc.exe
Token: SeRestorePrivilege	3644	vssvc.exe
Token: SeAuditPrivilege	3644	vssvc.exe
Token: SeBackupPrivilege	3228	wbengine.exe
Token: SeRestorePrivilege	3228	wbengine.exe
Token: SeSecurityPrivilege	3228	wbengine.exe
Token: 33	1492	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeDebugPrivilege	3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	3200	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4380	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1712	1492	SearchIndexer.exe	112
PID 1492 wrote to memory of 4188	1492	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3200

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3080

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:460

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4672

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1596

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4516

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4200

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:876

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:456

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1204

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2188

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3328

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1732

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2820

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3940

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1464

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2436

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3360

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3644

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3228

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5024

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1712
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a3c201b1c939edb31db2a380a13ec30fb36591a4852082b0f5e1d5c6cb19b6fe
MD5 dcdffbd169121dfdd1d2874172f8dca3
SHA1 a6534d80ccf86663508b4752d1ff9146ff0cb9ca
SHA512 ab74bb600249f1077f371e6100061c948ad23be6c109e7d65033f21912c87019a04ef278243900b2d85cfb4a5e0d88ec5378ac91eb81c963412ed8a99d65e7c0
SSDEEP 49152:2b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnTx4x8EVep:o3q6mjBQix8EVy
TLSH
T1AED59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 a1a50b222351436847485b8542ea437dda1f4750409341abd43f2496d038040f
MD5 d470dec3e4db64265fac218c861a232e
SHA1 bf6e42f8e00237e902895fa5f904dcc6763e6739
SHA512 6fc3d234b7e2c82f3089f6b4b82799c17e5c5aac519c28eb1d51f081ea878f3cafc85d10760e9c3b8a7838e0917199693eba4e393170afd4cbe6fa71a0a724dd
SSDEEP 12288:s1XLsswWkxy2lRq2czAp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:aXYfDtczApyxknw4FYnshx8OfVe247
TLSH
T18775F12877D548F9EC6B8139CDB28112E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 df2e8a32137bac53356105307fca3f98e8da2e34610da6f52e77a3674a32bf78
MD5 e5873f042fc6744798e9691ff3ccf87c
SHA1 6d6a9e944221ec72577b2f1bb8a3aa53ac192f04
SHA512 b1f50a58b57bce27e6f336e295c825d814f86bfd36a81febbbed48979acea0775cf626ed36854813206301c5745cc7040ae11b6d943777a396c02bff79a46946
SSDEEP 24576:p0Le5ji0hmxSrMIyxknw4FYnshx8OfVe247:pPji0Aoyx4x8EVep
TLSH
T14D95AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8b351d58cc458477b855a12d171874f9628f76a49e9ac66559315dab6e689e36
MD5 f5ab52e33fd4b69898dea1f231c79498
SHA1 d3e50b97c13900802b78232edb8b6c4fff38abe5
SHA512 7b512d0b98c94a19ca2e12a3a8024e522246f599fb8cd38f6a654c9fb4c2b97a0a175ce061e12ab3b3315fdc24744839df532c8522d0073e002f35685ae995b8
SSDEEP 24576:Ya7/ezSC6vUyD/aqgrvWj6q8wyuCyxknw4FYnshx8OfVe247:f/ezSC6vUzPv+HjyOx4x8EVep
TLSH
T131756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6a7a03963f69897526b7bb7e5a5d618403f37245efd1f77b57297f4a4b365596
MD5 c2eb8dc6311e7a01bd1a5929ce63e22b
SHA1 e10a16a0abfb31401e2091a7fad247da9d70a64b
SHA512 cdba6375a6fdcc527bb035b8fa0363eb745c6c93657e5b7cd983fd311ebc6f98f29bb7fd4b8c5f8c5b853d10acfeba3617baaa98b632cb48d0bdc5c2796a3f6d
SSDEEP 24576:ZVbqPb88hv/l+BVyxknw4FYnshx8OfVe247:ZVO88hXl+Sx4x8EVep
TLSH
T157559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 3127b4ff45f4ed1dbce8c4f4a3a25b6f00cb91cdfaf43e6d295836b7a63075d7
MD5 d2b34abe49975966ffd00cfa6b59254f
SHA1 b132fcd6e21ce68e5fbece1c05d2954ad499dc9f
SHA512 0f76e6fd47efabbe2d3127beeca17079bce42401072a91b0ff34bc310661b9733d4299d144f3e140201c1bf94eab903f61c6725ef6fe5abd749fbd144f85ca30
SSDEEP 12288:OaU+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:OaUyxknw4FYnshx8OfVe247
TLSH
T1BC6523BCABDDE4E1F65E15331A7572223616F9A0DAB0C11BCB78B54EE0B0C54E06E613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 e189f135e15d363aa1b2dc0135662eaf145a135bf59f7337fd3faa83df20e34d
MD5 f517b3dc8ad7847e22981db5c0d1d618
SHA1 bfa4cb60de7df736579e7f8bee2747236d988d9d
SHA512 515a038b1f0ec9b2cb1692eaed9fb9cb2ad286421f69fb5c1f883f01faef78c8fb1221638bbbfd31e108811faf27a8478379240ec8b218c1b712e5665a6a6b42
SSDEEP 12288:reBNUbTVO86Ut+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:rJIUtyxknw4FYnshx8OfVe247
TLSH
T17775CF7BEE28FCE2C27E5DB95B918200A77274704B6193CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 34dc4f662694ee4e5a45dcdb460cf2a8d92ca6e0c972189dd87ab3f41e00e87b
MD5 cf596434b6c51df7a9a2628b447034c0
SHA1 81ab1a3e923c30e1235dd89d495707960ead9e6f
SHA512 9da07e480b7bc87a012519c130bdba7d006d1121cefc7b7fba09e2e37fc7bdec3da90c436ffded079a041e70ab580c65302d843247e4b0df1999803d27aba083
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THO:EQvGAdlCEL8c/WRNw5CNix8EVy
TLSH
T121267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 a72bc34d666285dafd401c3034e9f50e740a659843d30ea27fa4aed4bd7b2a42
MD5 c6017f1c76d2a6aa8c6139890c956c53
SHA1 4de03563065e1a5403a314c82133372b9d3da20c
SHA512 025f98a1268de21178e68a48ba1a9bd1adf53df47ce2f86e0fa0a9b82bdf49d106990a62e90786f6bd9365d5d3e04875a4e90aeac3f9ec4e0d48a8abafa4f5a3
SSDEEP 12288:tAwSfxL/2Dc3zDLLmt0LDQewsAj3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:e+ewsAj3yxknw4FYnshx8OfVe247
TLSH
T1C885E030FE74E032C67F0DB21B36D716142DB9604B611AC3E3E89E9E99705D2637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 90e1c92437830389f6cc4a75b19cb25b017535c2822776cb8946a5d002250e95
MD5 9513418f5ffe7360d81da152d9535bb2
SHA1 fc6106eee23681ec88d0f6eab00866aeac47d8bc
SHA512 d962aa349218ba5e5236355cc598e43ecfa595ba9cd8b66356b2431346fcb051ec06dbed1c68aae62c07d056da1a13eea5092113ab0b0f1bb1db8100c4c3c576
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHP:LUEtQevvqc2W1cpV20I32
TLSH
T14F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 797e68af3ce4d388b837ab7ae5251b05f6b07089fb8435a39256943b53d6ef45
MD5 d6abd3c38f04943e3b9467d0adbbb048
SHA1 494f30b7b332c6dd5be26c06f5b08096524019a3
SHA512 7522729e6faa2d57f5edf2536bb2c39036200d9c6280961ac6d7bf22e9eccb2bd645567c2c9d01bf66a9b87799ab6ea7de99c99e0879e1d995d398f0eafd941f
SSDEEP 49152:GCbRquA/m2yL5zLfFiV+XenmE3/zix4x8EVep:roq2VjnmZix8EVy
TLSH
T1BCD58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3186d5199c240998926c18a8f27eedd2da9e36333c091241a5a6afb041f13b75
MD5 0a6fbe3c8c30ac4ddc7298a2dc1656fd
SHA1 54ab68dc5f23f2a81d1de72ac2e6f2c58d343c7a
SHA512 d765648622cfa301c8885208bb71491b1fd863c35ad2cd6e0eaf29f941f482c18175d76e61ad083b782c3bc290b187f130a7324d22b94da44c1774b2f9e618a5
SSDEEP 24576:WAhGL6IFoiwtA5l7S53Gyxknw4FYnshx8OfVe247:WAM5Foiq5px4x8EVep
TLSH
T1E435AE80EBF955D4F5B3AA7899B69171EA76BCA65E30C20F1260D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 2d05b4040510c9081dab3554bf9b46b0fbf8322cf96859de3bdfefad16eb5942
MD5 ceb3b0efda3088cc16b95d1f9ae9ee76
SHA1 085da375b8218d65c82594a065858496686d8fac
SHA512 a2a6e79ed5b0ba939fa9b2893616778fb5c4409ff5e10629f1e95c81f4b4c091b81b19d8d37dcf0d4ae0adf1c458d90077dd560c909a5632ab2e6043dc7514a7
SSDEEP 12288:smw5HEjsChNrBFgl0WDm+Ci+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:JwumOWLyxknw4FYnshx8OfVe247
TLSH
T1C575F14977E81CF9E9A741398657D136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 314d7943251d9bd05927cd37c3e0a36a0c7c531c844fa81d8424dd04b2970ae5
MD5 639d1d5350eaaec05dbcd49485352ffa
SHA1 f971d9c3e00bb9efcb15121409ad51e22a4dfebc
SHA512 88cb1614b52af2b697d21edc6ede9f179ea7c39027ef7d7a8135945f1a6f938ebffe31e024f5ab867823ad760e545fca5843ec3562842529b7fe9f2ad5f0ba43
SSDEEP 12288:gvZ1IyH+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:AZugyxknw4FYnshx8OfVe247
TLSH
T10F6512AC33E870F1E1A7113A89F15205E762B4A2677183CF4768625EAE72DD09D3D723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 00d85b36c386a22b281855227f24e3ef7f53d0dc79dffc9d40f1231b9660d122
MD5 f445800b589f5e954c9067a5a662fcea
SHA1 d3867ee0d4a57fa01f31f82368fe835b8beb6c33
SHA512 c12f44648bac473f8a1d733feec08a94794ce4998861eb12f10e018f7d51d9cf6e3ce9980c63ba50e9e15ffd22fca97c521020f4ba243d9cb6c1807055cfebe1
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UC:WQRQyi36YOcPDLvw2gAf+PN3Eix8EVy
TLSH
T199667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3d151d3df1b3955112cb8ad5b91cc9b4ccefaab806a789974a5d4cf8272e7699
MD5 223957c9aea3db280807276055600ecf
SHA1 bb938bf04946f620d2c9be10a14894028efbb7b5
SHA512 b738f5266de742096c8827dc9dc3f6280c04d90c2d49955d0bdac70d86719828b8d973550c3d0df7992fb94b81f8eafe9489284e76d22bc52403abc28cbe856e
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UC:RQRQyi36YOcPDLvw2gAf+PN3Eix8EVy
TLSH
T1EF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9addd3b7192407f2f1ebfba828a4020a8e40dd2bdd5ae33271b8502d4dae39e0
MD5 4d0e66713f310640793301dbab71dbdb
SHA1 44ee923ac4f84396d8fbf93431c660c5f1a609c7
SHA512 51e1d5cd517b3a3d1fc8675bab21acc7adab9d8d506d9af1a198ba812bc32c01a8da98bcd912086badcc226f13b5575967fa33e1d8f17095ba5c4765aee1054c
SSDEEP 24576:PwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0Qyxknw4FYnshx8Z:X68Qg55nhkeWu7PNU3/yx4x8EVep
TLSH
T1A6B55A33B2F600A9C44DE1769F4A973196D17C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 064288637a66c978465171f0a5427a492e51d6908bfdaa3cde6b4abb71fb27e7
MD5 1ce6d6d6458131ef1367c3d075287693
SHA1 8d4e944d74f998bec0c3e6b2c822d56adbfb281a
SHA512 31bcce6b0ab54e95e2e1b5b25e568f259826a29065e13933f3302e6a5ca06d58cb33402e2bcb127fd371a67532b553c9d380ee6366edb6695f74cc8b48723b23
SSDEEP 49152:l3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99g:Ey5112gYy5azzVvU69nLKnhZvix8EVy
TLSH
T132167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2129cac8907dce7c6b01e4ad8efd789009ba7935eb6dbf4ec61f0db2f2254ed6
MD5 d643b8096fe78f1bf0064925f70f9350
SHA1 965a159cd8dc9f9fd25e87930c4cb31db3af5b2c
SHA512 3f7c00cc6400a21e05321247834b96480e380a1ee1ca2a37adbc5e0f272f448160d6b26cf9123c6bd021325c9508d5e7fbd4caf7e2567656e4e2105cf05d8503
SSDEEP 49152:RB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glcx4x8EVep:Hu6JmIxd2dcix8EVy
TLSH
T1D3D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 35dd9234601bdcfd4f43ad7c83751997f9f65d56590d7007f33074f5fd116fe2
MD5 2d0902aba94e3c6d185cce825dc4b120
SHA1 d6e57a1c8d8a744f022531368dc15ff3eba34bd6
SHA512 587b0291a2fb9b094cbc6e24c5cfea3d6fe61e6f74a2647666dc19af5702ca3c7b7c2face581477305419cb74d670f48312ffab49fd1c5eed82939b9dd552583
SSDEEP 49152:P1hpsNoJpF1A67U44CwH7R4x4x4x8EVep:PmifPqRZix8EVy
TLSH
T1D0B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bceaf26d13ae7abbf50f8d6985b3d9055eedcb523b3992e0ce07af72323e4844
MD5 bba536c5cda69557f6d8c8728bd624bb
SHA1 dddf97ae638aca69382ecc00e2416de50bf63ec1
SHA512 e7f6e9b877755b11bf54ca8151ee949d889534beb8c466839de7a84037e478b029b358465bfc13bce50fb9262826b2976e6604735fed64c07839d25250012515
SSDEEP 49152:TSuZQIY0Be2KkRVtOnks6NMHqjx4x8EVep:R5dKqi61jix8EVy
TLSH
T13FC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4b42366dd499259ca28cccf19af6bbd55e2fd7efd4ace9d97de1c9dce32c6f2f
MD5 402ad7ab979ff9944c1034d9429c3db1
SHA1 485db8be5667433bfe1e9970fc52b15a863603cd
SHA512 dcda257d056dce88467219c7a783302429fe8f634829241f3a79bdbb43c338695dd6172a08d111bf7a15ad08bc28b0bce2d8aaecc5fefe3d377e433f49e45965
SSDEEP 49152:ghtSn8EApI0figjgiDn0AP5wsx4x8EVep:xX2iWph1ix8EVy
TLSH
T19595BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 1b98fc1898a6e808b7bec01b76a5177ec6a00144b4e9f1b744a8750adc00de95
MD5 3cd56d08cb13a807be03e8f3ea8430af
SHA1 d5e4b510648006a3432605303512629ce1021ea0
SHA512 cfa4ff98f205319121b4d21fa0b1fe443912477ef674585989ac41d01c099739c8f06441e93b631e85ffcd16f9f060c953644c6d0ce17c33383486bb1f86aa94
SSDEEP 12288:Es+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Esyxknw4FYnshx8OfVe247
TLSH
T11B65237CBBDEE5E2F50911734A7133566609B5A5EBB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 5692fc834f44e672be04c4759bae5f34246c5f4acde14a2358461050c1860c0f
MD5 d78ac6ba5c4dd108857851f0eb11b4cf
SHA1 37a8da1ba031e20bc41facb54ed87eb36eb933e4
SHA512 eeda71cfb13354f4be20bbe34310c7951082bf8bc6501b3525405837524dd19a53b40f4d87ac5690bd9c1df57d0f0ee6d1183acd9109396d63c27e606e444b4c
SSDEEP 12288:IT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ITyxknw4FYnshx8OfVe247
TLSH
T12965237CBBDAE5E2F50D11734A7133666609B5A5EBB1811BCB7CB00EF1B0C94A01E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 7a0883095c443c7b357a1c45ad5fdc36bd885f81655475d5263e64c52a6fc665
MD5 2222b143b9ac69fb18bec09fdc0b8cb0
SHA1 5bac966b57e2cf4c1881f197610869ecaf2fdabd
SHA512 1ef23dbe2f901d2b7a9af7f9d14c141067422e991ea9eed1d06dc6ce0403fa731df6de7640e2ce8fe1e04cb926daa3b160b801feab6bb4ff15cca8d87f2eada9
SSDEEP 12288:7F+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7Fyxknw4FYnshx8OfVe247
TLSH
T1F265237CBBDEE5E2F54D11734A7133666605B1A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 d88fe29075a500162e750b2ad6daa8f1f860946539f6da127f682f8ac6027114
MD5 1f588c50186641bb9ee0dbdf85d7cd2a
SHA1 2878ed91e454072d787cdc318ae245219c66457b
SHA512 d56949292a5ef8289e1faa469f70862fed5a1dbdb7c1df81f53df8e71de86093c9935505bd40866b0d2399a962126fcd940e6a2a6f071058913d8fbc4139dd36
SSDEEP 12288:GVm+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vyxknw4FYnshx8OfVe247
TLSH
T1F365237C7BEE90D1E45A51738A716222B365F8E4E731C25FCB24740EE9B0894A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 1b0d20c09bd705337b5766cca41e5c6c274d4171fb17e1b9186dc09039966619
MD5 ffffaa7a12f4c358264325561d59cc0a
SHA1 1a5a407f6bff3457ffca321c0e915408e5f2da32
SHA512 f171faf4cae1ba15a8672294b8984485a71436cfd6dd911bbf0e63f49b0ea74d2a34aa41a1ef38559008f7407ca83882a9352666a9825e21030daaa3b199f9b7
SSDEEP 12288:5O+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5Oyxknw4FYnshx8OfVe247
TLSH
T1E165237CBBDEE5E2F50D10734A7133666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 501e91f2fedfbbf6b1b1366d3cecf49c8ac6ee1fd5544fb8534528757a47ac7a
MD5 73a7f5ce784bfe2f711a0110db0addfb
SHA1 5160814894bd09e7eb12041754a6a48cd0d25011
SHA512 cb2dfd2476bd7e5168532bbf2f1b895cd75ada25a76f34010f26c81afabb311de911f44a32133a8088dfc08a626074adcdfe8384c02d8e01cdf7f443f247fe20
SSDEEP 12288:PP+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:PPyxknw4FYnshx8OfVe247
TLSH
T1EA65237CBBDEE5E2F50D11734A7133666609B5A5EAB1811BCB7CB00EF1B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 80e58ec1b463a103ac9eb382ed304bf38b393d0a5d3f6427bdf6ba73f8c495e7
MD5 b231dca925c937b6d4c6049e6af3df13
SHA1 6c9b919db91b6685d0a117d7391a91708523165b
SHA512 cab897e1dba2ce0fee188f2c65c456be74f262f13bff957d2c44924721c63b978bc87ef1cd8a1d17d3897123104f08480fe2bd0def7636879171c230cb2b72b7
SSDEEP 12288:B7+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:B7yxknw4FYnshx8OfVe247
TLSH
T12A65237CBBDAE5E2F50D10730B7173666609B5A5EAB1811BCB7DB00EF1B0C64A01E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 4f038ecc9cf19a3054efdcc36837a6a4a80f0a1de3a9a7d532586a30790a88d0
MD5 972d3ed8bd34b2aec2fc1c7649d6fa23
SHA1 26f7d2d984b9e0bff103d6cae03ac1cfdbe5a9c4
SHA512 eedfa9991e7d6e0b1ad89fcc474ee0287ec8c2788abedb04d5f2c4dc229d465dad0bb1b454f5633c3fc6c50af91f1084c2af6d0a95ad4a03a34ce376077f32a2
SSDEEP 12288:DiZwbyzzFEoS2cPvyz+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:uZMqzFVSOzyxknw4FYnshx8OfVe247
TLSH
T1317501A8B39018F4EC67413FC9259916D6B27C694B70C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 82dd4462c07277c01cbd13b7b7f9717207d42d9524e169af76af6fa9df034819
MD5 cb8dd003c715b21c99237b1154e150c6
SHA1 0593684088a8daf2324d3155531333ee84378e85
SHA512 a7f6a6636910b81ef039798ffb58e2a9e6e0182e53d3038733e9f41f1f9cc0143fa377209cbb8d1ad4eb5c29c1a8a978bc0fc66c470a97639b61bccab5e87cbb
SSDEEP 12288:uw+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:uwyxknw4FYnshx8OfVe247
TLSH
T12E65237CBBDAE4E2F50D11734A7133666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 1fbc9d927c43c064e08f0fee4830b39a4b07e0bac15da6c65941e46c7edca60e
MD5 e11de305a70aa12161c1127d75304676
SHA1 5b23ca924b0e065f8acc63981c9d68fd3469e258
SHA512 fe6db39a994c35e5d57b2581c71b116d2998a8f9ba603ecc525a40dc965cb224ef15d2199ee4f977b225f3a55c2c35c3918207b2b83bde65dfa2d6e2d80f15c8
SSDEEP 12288:Qk+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Qkyxknw4FYnshx8OfVe247
TLSH
T19965237CBBDAE5E2F50D10730B7173666609B6A5EAB1811BCB7DB00EF1B0C54A01E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 efd0271df05884498f9c92313ed19ba0ac04576dff3bbc62be055fda6b55140c
MD5 3cd3a10f9dc1355ab31bf4fdff4a9cb4
SHA1 d9741661a9934ca98f58dd32966372d80464f6f2
SHA512 0eb478a11bf339c8a0028dfb771d111ae2c563d8e7a920e755e5b5d85273f82d79dc31ce806e22fc311fed83d6f0bcc003aa16d3136e728c597791a5b589148f
SSDEEP 12288:LyPz5L8H+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:mzyHyxknw4FYnshx8OfVe247
TLSH
T10075125B73E530F5E13A523689621602F372B8724B3086AF87A4537E6E725D09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 89c9e8bef93fa9f9f859ccff5b7abcc14719e68d9eef288318ec2055dca9a452
MD5 ffc28e76c221ee286a438b01eca97ce0
SHA1 de4282596532b19411bf1a7f1a88c4b56c68745f
SHA512 fe592ed47ba5327fde6d14d61237ce3c89467c7a212112163580a484ce9dae698fb1ded0d1189592f77f9d3107377fe0c90444e98d0292f1b27653be0bb8c753
SSDEEP 12288:tw+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:twyxknw4FYnshx8OfVe247
TLSH
T15B65237CBBDAE4E2F50D11734B7133666609B5A5EAB1811BCB6DB00EF1B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 b18033a52b1f8559554502f908a0cd4f2ddc744a95a6b3e6979311d26432770e
MD5 fa489c4c133dff10e26093b8dbe1b258
SHA1 0bc083309d7dcee23bc0abdfb4873381e42d363c
SHA512 c86a3496975e67d4953b91adcdaf76ce2b9801f9410823797c35df31b3acccc1e36318868d201a452f564344f7414c47cf5fc50911d71d7a1c70a4bf0307f0f3
SSDEEP 12288:Ew+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ewyxknw4FYnshx8OfVe247
TLSH
T1E565237CBBDAE4E2F50D11734B7133666609B5A5EAB1811BCB6DB00EF1B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 4709b6c2858b2aea0e03d45a45d5bda17df4d55dec489ec1e3bc610eee92e286
MD5 22ceef24aa6abf84cf817b9f1850a672
SHA1 db41507ac06fcb71f8054376984bccd8c38fead7
SHA512 08269be44f7e0fe358b0778564b5a978199e08e1bc95eadc89284b8f89d7a9093b8c61757169d00e39b26458dade8891e9a91fb2b49a3999543bda2ce437e204
SSDEEP 12288:UyPz5L8H+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:NzyHyxknw4FYnshx8OfVe247
TLSH
T13975125B73E530F5E13A523689621602F372B8724B3086AF87A4537E6E325D09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 0dc91e02b5995d8c7017efff1c9ef45164765bb9431fa3955eb67cd54047e678
MD5 c56d841a7abcaae89ae1b03b9f9d28af
SHA1 b0a9b8d1c6f801646d4d17cb8bcef7873c0aded3
SHA512 2e4291509fbc0b56700c55881810865b73406d3a6cb6b0c670c382f2103673d7eb69321b2f4207614776bc50d6dc2d69bb70c36f1cd4d9837cca84b239f78362
SSDEEP 24576:QcP4mcvIjkGOxhKP2l71nNKbrh/8KB4yxknw4FYnshx8OfVe247:7P4m4IpOO67W8KNx4x8EVep
TLSH
T18965BE2DABDC0096D0BA913486658A4AFAB1742A1F3286CF1160933D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 9aa6b4f181e28bcc08ca7a8307cb5eeef5fdb34410caf9cad74664652fc4716d
MD5 0eced771ecc88397081ec89ddb4888ea
SHA1 2a781d8171aeebdec593e5908f570e721966c253
SHA512 89c1d7d228507699c68d5644a30ddc5ea64ef5577f2f849068fb36b4126850a9053844175bb124791760e6b01e9d70866308618f32956429a266c3a13ec051a4
SSDEEP 12288:m0sfg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8gyxknw4FYnshx8OfVe247
TLSH
T1FF750128E29852E4D06E2236CB625641B3237C6597F1D3CB97D0F53E1F71990ADEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 7ae8178c0073f4167d7d7b6022540eb4cd08695466ae2f92529617850078203d
MD5 ae9123af67afb4b3faa0a0c98fd79e3e
SHA1 be0daa173f2516f8351ed0957fe6ae04ba0fd328
SHA512 e7c4ebbbcf939d8fb3d321cd1417863df4284e6239ca6fcb21c37878c7701bb7214ba68a184612970416dc1661f7975cf5dfadb16fd77d6e891260a6e72f5667
SSDEEP 12288:MA+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:MAyxknw4FYnshx8OfVe247
TLSH
T18B65237CA7DDE5D2F56D25330A31A225361AB2B4DF70C14BDB68B11EE0B0C90E82DA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 cf3647c2b3642d3797278241239c3cbbc3c1ce3c3f68b40e4241c15ab217259d
MD5 c188a6392e7a301beb389b51eaccf61f
SHA1 d1a998e1ceb3b994c8963a20efa4bf5aedbd02a6
SHA512 cf9d0cfbdb6cf3bc09a4af5a6bdeb06dc4121bc446a65ae8fc6927aa03f8a99a64b98dc2edf2123cc16b6f2d5df0745461b7b279577039333dc695f43323dbd7
SSDEEP 49152:Sa0h2GEkuAe73q3pp46zwwQBx4x8EVep:Sa0hNYG4Jwqix8EVy
TLSH
T16F85AE1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1190853D7F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 0f2ced3427ad9a8510be730bc96ed665e43d57e7b08aa2e8f600dca5a971f673
MD5 5f115a4c2ce4e6568014a48dda77c57e
SHA1 89f470dd42485a000d144adc1ee377308d2cdde8
SHA512 ced30b528c08b1649b32600f42852ab7f04cb9e954f341b4fd38083eead06819c5449e8d5bb50367a7fc7823a763583b2731e1f6c03ea6ff09edf66e03615a26
SSDEEP 12288:BhbHjfXD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:BhbHjPDyxknw4FYnshx8OfVe247
TLSH
T19165117C27EC20D1F175A17A86A29206D331B8251B2193EF93E5923E9F36CE45C39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 02339d52ee7a65f8aa952b9becb143f0b29cf915ad0fcd176c46d719660a8d8d
MD5 30843fce10335ff8ea9547d7ebdcb77a
SHA1 2a48bcda18fa65627d9ad9bcdf2fb91ae373f28c
SHA512 5ab079e034bb0c5ff55340257999fb64d2af848bc17cb67dbf86280782eb482fc7cbc5d82b4d6733f0e2d0816bd20b7c182695ac5333d8d8888829b274bf9608
SSDEEP 24576:13YgnJcRTk4yti+R5dBR/Lyxknw4FYnshx8OfVe247:1IgnaTk46pBR/ux4x8EVep
TLSH
T17D45BF2DF3B910B9D8AAD136450143B5FB71782D1F2096CB0174C538AF1AEE89E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 8cc9c26be0601fbb12fed76dad57092f2c404c3d505198fb6b12339f9750c270
MD5 b958376739c7618a11714231d944e5dd
SHA1 b12da5e4168c4afa210da5b4d19469430a3b0f5e
SHA512 4042b11528eb9e6be2a4ce9a544c8c6e626ee6c5e245a00822630bf6d34d9153e9c6528c4b767928e9c547c6dbd6c77476d18ec0ecf391e729af4739cc4ffed9
SSDEEP 12288:p0+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:p0yxknw4FYnshx8OfVe247
TLSH
T1716523BCB7DEE4D2E55D15730A7162263605B2A0AB71829BCB7DB11EF1B0CE4A03D613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 e1d3240ac95f50fdde49eebdd713929609d890f2f4591fa916f26ea499d0cc2c
MD5 aa2ca0bbe96fcc4d7a7bbbd9434f5be5
SHA1 dc02dba76ed64a48e712265d92dbe0f288870de1
SHA512 253b063bc3b5d541e99819145b0aebeb7e19c7c6dc0037087ac4c191715b6c1736e67f1cc8e5b28a603d6547a562bf9348cdb6053dd70426e6f85808ce8daa24
SSDEEP 12288:BObFA4LWOsvAYFTp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2xL3UTpyxknw4FYnshx8OfVe247
TLSH
T1B4850158F7E400F5E86B813DC9729616E272B49D0770E3DF43A84A691F636E18E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 5d2dfb6656486bb30bf5b7abfd543c199fad06744f56a0402c147310c58b024d
MD5 538aaf08c3becb97c9e9e291aa0000f8
SHA1 60e347139fc61e68fcea5d0937337020b8502c2a
SHA512 2e2e6722e460f155b99cc4b98e5d11cb3a275dc7dcb992e29566de04e81200bed3946dfbee376a66ee361fba3c12e9119712c08f3200fe670a35f12f44738c2f
SSDEEP 12288:IpFtgON+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:PONyxknw4FYnshx8OfVe247
TLSH
T1DE65022C37ED10E1E179613A8AA25309D371B465473253DF43A0916E9FB3DE8AC3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 77d8c3f787dea339447f531152c4a4e8bcfbc88178f3f3d3b07371be5c519fbc
MD5 c2493da96ffecf05f058b0d663605238
SHA1 1116af17c68348e22986830edc5c3cf88ee2cdfd
SHA512 f9fc7cf6dcde01a9d068749956f2a3a5f5e4469b13e1947efbf82988ca6f2cfcf4268ddcc5a000d8526d2eecbac9f24f988f16b936d9167c1c86e4419bd04e98
SSDEEP 24576:U7NM9YqZqmWMUkPjZM48Mv6bEhswyxknw4FYnshx8OfVe247:U7cBWMpPjN8DbEhmx4x8EVep
TLSH
T197659E2D6BEC81E5D476D13DC9A28205F6B1B4611B318ACF5262833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 64ad65999e7bfbb482732ab4188323c12e25c9d99ad1c75361a01127336b0227
MD5 74ffac6821899e3b86a2d2bdd73ce7e7
SHA1 fbf84bd203fb46527831c3600ef6a78e19506bd3
SHA512 0ee4f9da7f1030a5f26f1e784d29b9856ace29f31a6bca5257e036bdca1ee301f17f4a8846e4a3270fa562e6e5191c914677202d48b770c4732bc14ba9f0ea13
SSDEEP 24576:jW6BApg2YuyuNDYTabvcdvNYf8km1Kyxknw4FYnshx8OfVe247:jF2YuHNETovAvNYf8kmTx4x8EVep
TLSH
T175858D2927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 957060a2a04c9fbbe36ff9c6186d46168ad18bb5ecf139aa2f7662c10a7820a0
MD5 1d79ef9878e24d8628d58d1d20fa4ea8
SHA1 9843de7468516634855a80dc936c7a771635b99b
SHA512 607b775d14a485d1d53df524c37f64c189617827d156d2d425608f6908086212a039dbc179d0f99ef875480a76dafcc572145f00aedae4610d8eda2cc596135e
SSDEEP 24576:MAFs06+Omlf8NXEbTohyxknw4FYnshx8OfVe247:hFs060loXuhx4x8EVep
TLSH
T16E65AF2F62EC00D5D07ED17E8A97C91AF6B17463072556CB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 80d461a4fc0e8567f82cac9b2efdc619e64e408ff118e3b110a72b45c88ea5eb
MD5 d2710d99fd1d8ead45b98479ad08d81d
SHA1 626c8dca081a98c188ab15125781ec4bed956a0d
SHA512 bfeca4bae46306daed810e221505e93189a52991fbef1bddc100af6e6666c23a4642a4d1d3dbfa916fbaa20e18ead89b553639073d2ce82b7fecb9c216e61bc3
SSDEEP 12288:KCJnJ5D3Vkr8zxQ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:LJnJ5D3Wouyxknw4FYnshx8OfVe247
TLSH
T12B85D03CD2A810E4D4B7C274825A2756BF72343D2F226ACB58B4D5397F12EE0A979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 dc30e774873d88a5a698b231cadf929ed0263fa373859815e9f243a097fef690
MD5 dcc74b535def0b6e7903d42bd20bb655
SHA1 81ea37456409ec809bbb5d9a90c9ad6b96e43c39
SHA512 f932f156e34f8f8b8718e18602d3ce5d81f890d788ccce1bdb90bb38865b5a67b1818cd13817000c84b54a5828eabc80a030e732350a7659bd3de6325a1e4b27
SSDEEP 24576:1EPghm6/7IIXdwcXrif7qQncjlP65i3VuLyxknw4FYnshx8OfVe247:ig06DIKdwc+eQnSt65aVHx4x8EVep
TLSH
T163955C15B7EA5294E8B3CAB1CA62A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 aa3695cefb3d132f1aee8f2d6d1a18e964be35494f9019a29ce9dfc0bda0701e
MD5 2b51e2e7d549a88245e664cb2a98af6f
SHA1 3e98b09e6397a68bee379752ed7293f81608036f
SHA512 9d983a941b84293e0b7afb8bf6f5b54f353e1d89cbd78079abc4f83e8d9475909b849c6105aa23a87584ec570663f41ebd5c7719c195691cbbdb6761fe676071
SSDEEP 12288:PEP3RMi+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:UMiyxknw4FYnshx8OfVe247
TLSH
T12465026C77DDB0E5E12A503A85A18205D372F0706B6253EF87A5D23E8E72CE46D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 d595916a0baaa3ba760b6878e0bee941fa9286c0b84a98eca2e86f5f3df48ede
MD5 46cf1c715862599f93214e2b3b1e2970
SHA1 c5513d895e0094fdd55e4b220a504da51794a0b2
SHA512 e5b77be1d0c0212656c6e5d05e146352763a6eaea0b4854bb4a3c341516848dad9e36287c6f34a6ea4f912b8e934fddce18bbf3a0a6b359f50060c56b100c7a9
SSDEEP 12288:TjkyT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:TIyTyxknw4FYnshx8OfVe247
TLSH
T1C975121C63D8A0D1E57905368A7352A19A35BC309F3183DF9290F63EAE71ED4A839B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 96a5128833dded5b80aa40888ef4e4fd12b5b98405bad7257640cf92119cb5dd
MD5 eb4077ce8e7ff252b1697d4d69674885
SHA1 e5be06b6491938226cea92697f90bf92d1fd52bd
SHA512 4310919b66fe361172964bcb05c7c5f486ca50d10b11e30cc2059e150d6447c32926fa9e41d8bc2dde7096cce2866fd65d84b2aec569866466084ebb279f0a0f
SSDEEP 12288:cGd+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1dyxknw4FYnshx8OfVe247
TLSH
T10865237C67EAB4E1E9191173063163616215B1B4AB7191AFC7E8F13EE6B0CD0A03EA53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 628cd27e2452b04bfca267a555eacd46ca369ee5f5c0cfcdef9ceca9c15f997f
MD5 e64b8635a3caaad61f03bf1f1a684b5f
SHA1 37bc4d2d46759756e138c39c4057e09877acccc1
SHA512 0420475b4dda91bd1b6791e348368a1f1755ad58209d62b2fc42eea5fbe0f3e00ccaf465196f5d6e6bbaf30249b5daeef4fe803673c1aeb04b19d0b84e6ff9a6
SSDEEP 24576:MQ9MxZKdcz9dw3oyxknw4FYnshx8OfVe247:MVKZLx4x8EVep
TLSH
T143558C2DABE905DAE177D27595B250C3A633B4301B31D6CF2448D03D4D7AEE8AA78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 5e71bb9a12e9074ec9b10cc56bc30af8ff9e1f8ff26c92a41f96bdf26f05a17b
MD5 21bb602e5b261faf63e002282a75257e
SHA1 afb12f5074b520f9ed8480b39a9d0c3fa8428f41
SHA512 b30606108d43ff62b4eed354ff5262a00d211eb37610838811ca8f55a0ee993b687f7e31c8600c944cc34266bb1a22d4347f795a94a0dd0d0835cc74c64ddbd1
SSDEEP 12288:nyoKo2SRple9p3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:nyocgAp3yxknw4FYnshx8OfVe247
TLSH
T1E375E01FBBAD40E2E166813C89958345E773B0705B6253CB9691C33D8E739E8BD38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 88c7b8df3c6ef162652df1e6d4c650562fc661bacace03d9be6739d1c9a3c4ca
MD5 4e1c7f0480eea32d67331e542b7ac8db
SHA1 855f0fe07776271de559d1fe33a60827c02eac9b
SHA512 e3faccb1efd4736ab8caf3a8cc0859efd52f4d8d4824fa4b50685766054213215d0a84f1bfc29f589f325a940c11a035cc841fb1715ec337d89303760d02d848
SSDEEP 49152:hWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKCx4x8EVep:Z0zuNIsix8EVy
TLSH
T11AA57B3DA2EC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 42ab822ebff400dd7c1ef0a53234c1447349c3ca8085287d00e4233b39293152
MD5 b817a3f5a0d553988868e97d3f2a5b23
SHA1 9106a42ca3b9ba06ef5c6445479a90bee10863fd
SHA512 236412c85a1ee1e582469d2436232d14652c22fbdcfa5d8b4f21cf86c24d5abe7ec13bfef37f8e824188f927ca4e42f24dad69374018d0b09f0c424e667f2f7f
SSDEEP 24576:v1QT7EcpfxR+N5AWAz3ooiYzjMqbiyxknw4FYnshx8OfVe247:STDxR+N5YzTBjMYx4x8EVep
TLSH
T1C755B02EA7F815E9D1BE85798A23C512FB727821033193CB42A0C17E1E779D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 6d0aa501136e4b5e6392ff7b0adb3714a59e9865a0526c554fa5afa8359e7d53
MD5 845e984bcdbc0d6b6539541a710450f3
SHA1 76ab76c46d2159e7b9b9e9a2a257bf8c3126d65b
SHA512 ac4522586a273658a99a829f05e8d5cdd872fbb8823cdd11f077806de5fe3c698b0875ac41c045380463748f34af71f731ab1f109cd90aac4d19b6e5f9d87d13
SSDEEP 24576:lTMdOz0FFS+TmSLmyxknw4FYnshx8OfVe247:/0K+TmSLZx4x8EVep
TLSH
T14285F13DA3AD14E5E47BC17D9A538906F67234610322A6DB06A0C07D7FA7EE4793EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 71ac355adfdfe8dc6a1a836537d2a35b9d5a5916d21776d694e4b551c2fceeba
MD5 779c1d640e0f89ade107976f3623d210
SHA1 ca2f15f0deec9ba2b121a1c71fa2b9484363c4f5
SHA512 cde0298a549e622efca8846d32e21db492e01e92be0e13558dc4951e2e156a797af30292afcf9e0bc260f15939be82a0313e6ca42b576b5fe27d51ce3ccd80e3
SSDEEP 12288:t4pp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Kpyxknw4FYnshx8OfVe247
TLSH
T11365122C23EC70E0F46662368A3252169630B875673192FF6AE8E57E9F718D4D43DB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/456-246-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/456-74-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/456-68-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/876-184-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/1204-247-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/1204-84-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/1204-78-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/1492-162-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1492-263-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1492-399-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1492-348-0x000000000CDC0000-0x000000000CDC8000-memory.dmp

Download

memory/1492-146-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1492-185-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1596-265-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1596-31-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1596-37-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1732-250-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1732-346-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2188-96-0x0000000000770000-0x00000000007D6000-memory.dmp

Download

memory/2188-248-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2188-91-0x0000000000770000-0x00000000007D6000-memory.dmp

Download

memory/2436-256-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/2764-131-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2820-251-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/3080-16-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3080-347-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3200-1-0x0000000000180000-0x00000000001E0000-memory.dmp

Download

memory/3200-0-0x0000000140000000-0x00000001401CB000-memory.dmp

Download

memory/3200-345-0x0000000140000000-0x00000001401CB000-memory.dmp

Download

memory/3200-9-0x0000000000180000-0x00000000001E0000-memory.dmp

Download

memory/3200-2-0x0000000000180000-0x00000000001E0000-memory.dmp

Download

memory/3228-261-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3328-249-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/3360-258-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3644-259-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3820-118-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/3820-124-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/3820-255-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/3940-107-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3940-254-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3940-113-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4188-371-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-361-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-383-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-382-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-381-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-380-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-379-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-378-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-377-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-376-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-375-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-374-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-373-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-372-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-385-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-370-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-369-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-368-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-386-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-387-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-388-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-367-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-356-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-351-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-352-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-355-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-354-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-389-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-357-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-358-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-353-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-366-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-365-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-364-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-363-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-359-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-360-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-384-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4188-362-0x000001BFAB420000-0x000001BFAB430000-memory.dmp

Download

memory/4200-51-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4200-63-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4200-61-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4200-57-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4380-17-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4380-23-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4380-26-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/4380-350-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/4516-183-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4516-47-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4516-41-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4672-182-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5024-262-0x0000000140000000-0x0000000140192000-memory.dmp

Download