stealc | 55e3141081efcc404a9d18caef1416b37aef822cd020d80e3409fe84d7acb052

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260910-ypqgtaee53
SHA256 55e3141081efcc404a9d18caef1416b37aef822cd020d80e3409fe84d7acb052
MD5 0fff14f24a7a5256a83b138f58ce9ccb
SHA1 cb64a20c838b8db10532194c869976508d479f97
SHA512 0c634d98ab02177772a8190371fc8ecff25ba822d6e1daed0ccb917432c5f6d3e94536234867d1c9ac48e132d0ad4b2d900922bd51628998b8778ba3f7b52d94
SSDEEP 49152:G3Bi1+JQlhKtjzk0hrl8FXkufybl6v0Ve7bcN3kFrLszsETdKXDmg27RnWGj:FmmocfD527BWG
TLSH
T1FA267B1BE6B941F5C0B6D1798A979517FAB27819873297CB4391434A1F23BF09E3E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc ransomware spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 2 IoCs

resource	yara_rule
behavioral1/memory/2316-9-0x0000000140000000-0x0000000140475000-memory.dmp	family_stealc_v3
behavioral1/memory/2316-30-0x0000000140000000-0x0000000140475000-memory.dmp	family_stealc_v3

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Executes dropped EXE 22 IoCs

pid	Process
2996	alg.exe
1952	DiagnosticsHub.StandardCollector.Service.exe
4372	elevation_service.exe
2340	elevation_service.exe
1584	maintenanceservice.exe
1344	OSE.EXE
4728	fxssvc.exe
4752	msdtc.exe
4004	PerceptionSimulationService.exe
4988	perfhost.exe
4284	locator.exe
2008	SensorDataService.exe
3756	snmptrap.exe
5088	spectrum.exe
1432	ssh-agent.exe
1824	TieringEngineService.exe
1472	AgentService.exe
4748	vds.exe
2436	vssvc.exe
4488	wbengine.exe
1680	WmiApSrv.exe
2728	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a46e36a579c0b0e8.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fee161f05e41dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000531abaf05e41dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000028c0df15e41dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a4e423f05e41dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a06a7f05e41dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f3f9f8ef5e41dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9a666f05e41dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1952	DiagnosticsHub.StandardCollector.Service.exe
1952	DiagnosticsHub.StandardCollector.Service.exe
1952	DiagnosticsHub.StandardCollector.Service.exe
1952	DiagnosticsHub.StandardCollector.Service.exe
1952	DiagnosticsHub.StandardCollector.Service.exe
1952	DiagnosticsHub.StandardCollector.Service.exe
4372	elevation_service.exe
4372	elevation_service.exe
4372	elevation_service.exe
4372	elevation_service.exe
4372	elevation_service.exe
4372	elevation_service.exe
4372	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2316	2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeDebugPrivilege	1952	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4372	elevation_service.exe
Token: SeAuditPrivilege	4728	fxssvc.exe
Token: SeRestorePrivilege	1824	TieringEngineService.exe
Token: SeManageVolumePrivilege	1824	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1472	AgentService.exe
Token: SeBackupPrivilege	2436	vssvc.exe
Token: SeRestorePrivilege	2436	vssvc.exe
Token: SeAuditPrivilege	2436	vssvc.exe
Token: SeBackupPrivilege	4488	wbengine.exe
Token: SeRestorePrivilege	4488	wbengine.exe
Token: SeSecurityPrivilege	4488	wbengine.exe
Token: 33	2728	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeDebugPrivilege	4372	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 4728	2316	2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	85
PID 2728 wrote to memory of 5100	2728	SearchIndexer.exe	120
PID 2728 wrote to memory of 2688	2728	SearchIndexer.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks computer location settings
- Checks system information in the registry
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2316" "1260" "1164" "1264" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:4728

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2996

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1952

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2340

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1584

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1344

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2304

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4752

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4004

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4988

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4284

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2008

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3756

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5088

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5004

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1472

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4748

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2436

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4488

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1680

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5100
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e5e98ec7fd13a84b1bc5eb6b19e6d5443bcd8c0c7cf0e66562a7d199e17f97cb
MD5 47a0d3df53555f88852948ab7f95ad2f
SHA1 629d786fa35b167590e7258d49457ec4fd224b22
SHA512 c20124d73ad8a951b8be563f8e3694e8791f3a72e1c18d5799b4e33e145f0ab72244accd19efdf78ec15fb3a2599f92f68d134bf6e1c1c801076fe651fbbb288
SSDEEP 49152:ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxn2Dmg27RnWGj:E3q6HjBBD527BWG
TLSH
T1C1D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 c7e7d4663624fafb1274fd327b9f910089294e88da80f5760aac03bed0806ed5
MD5 6c2f3e7c61816d5372fe762f091c1965
SHA1 5974c725d5cce4e528db18e68fd87911fe24f60c
SHA512 3cae90ac20aa2a1bf243e5d4fa5da82ae8ece3c41b331d5d42d3928a4b7379e8dc24fb63fab20403dcef1824e2ea9be2b7f786a720df25388cc274b8e613dd90
SSDEEP 24576:FXYfDtczAxsqjnhMgeiCl7G0nehbGZpbD:QtcgDmg27RnWGj
TLSH
T112050129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 18e7fc6fd479cd9862247360932c0f8403ffd39e5dd8a0b71f6933182577c92a
MD5 ff6dc31c3cc35dd97404f030d2302d56
SHA1 e82b07bccb383ed90f9989aa76f9ebe69a826e0f
SHA512 cbbd675a74c43039b8ca578fa0616005324501bec85efbfa8e6938c441725f3bf7ca4d8e93ab9e190edc2043a9117a69a0cedc05f7087ed414c6774d05095893
SSDEEP 24576:W0Le5ji0hmxirMasqjnhMgeiCl7G0nehbGZpbD:WPji0Ac7Dmg27RnWGj
TLSH
T19F359E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c787bff20bfc275a8e6c03a2c911721341ac1166440c449da15708722678d201
MD5 086055cfee94db470b9644b22b8d9763
SHA1 a0b52c5b9228a7572b197d6a8728932e27247f7c
SHA512 8d9678d7cea7852122aea1c32090edaa9b31459138f01af06fe181910d03cae0a4cf10dda4f15b1142326450e2f98342cbce8926b86f0aac209f29dc1917552d
SSDEEP 24576:Va7/ezSC6vUyD/aqgrvWE6q8wyuUsqjnhMgeiCl7G0nehbGZpbD:c/ezSC6vUzPvxHjyvDmg27RnWGj
TLSH
T1A4755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a7f443e5978a0116c7a013faa45173a680f857c9b74f6e3dd2aad66c40843bdf
MD5 18f7490c68261f78ebfa65f936eba255
SHA1 7fc3eac39cde05928280486780749d5c946de22e
SHA512 a3b5b6ff80b6cc7bce62ea2c6f3f71a2b4e21c3161218c9fafcd99ae268f3e71ac0eda6185ebc9877fa9dfcb0c4f89b3a985a3ce2189fcc308b48a5e6b854f53
SSDEEP 24576:QVbqPb88hv/l+6tsqjnhMgeiCl7G0nehbGZpbD:QVO88hXl+iDmg27RnWGj
TLSH
T11A559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 086b35cd192d62aadbd82c197480ca5a22abf48d8adb558d2217964232872c13
MD5 b2ebc089a43f8878032f23e2a9272878
SHA1 ded50e50c72adbf3e6e3ab708c4c904e9c123154
SHA512 d9c1687509940055718b141a88811c850287bca2256a0966d1e7c3a1ecfa85bc41bdfe9a49a6dfd798ea8daf0a2c7a3f42f552b9324e24afc17fa6a8bf92302c
SSDEEP 12288:dRGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dRGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C9C423BE824C10D6EA7608B5C3E9F55DAC173E5698200843AAA37DFDE6F5464CB39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 6fffb4f49bb152f12f12698756b7f6b76d3a389a71c3801f011c2925632fb499
MD5 bfff502563c4bf793946159a29498d30
SHA1 bc2c3dfe6aa3ba7867ceb961a031695f8e1ebfb1
SHA512 4fbcf53bfed3e04a1acdf4a336fdb1ae617749b61eab391e2c318d6e8ccdc5cd3e08e36008cfd29cf28da497a2010b5b1c8fc190bb01c0b4bc91066be9a18e8f
SSDEEP 12288:IeBNUbTVO86U1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:IJIU1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E05CF7BEE28FCD2C27A8DB95791C600E77278314B21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8393404f21da7102419785fff06fb9afdc6bcfe4e39a03243568a64674f1e23a
MD5 dcc0da61ad80a0ee92155aebe0f0c999
SHA1 ca1309a608e2506380b7724be3593d84cd8e6832
SHA512 436c3cb6e82342953ff98699f0ca5ecb25ff7f1ccb589f57d7984c6b711da514a57c9a41edd5afa693a1494b4326b5935d49277ccd3e6ea7edb871470aa58dd0
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH8:WQvGAdlCEL8c/yRNw5CAD527BWG
TLSH
T168266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 c651ec7c5f07103a6608452378f27a52bde1bae04944992ac287eb0ae5cf8a00
MD5 2447fb64610267f2abacfd89c990f651
SHA1 aa3fd5a13d8a8487a6a469264e016447aaa38ae2
SHA512 9910c2ab1440deac663d11d00e6d6e5f62f84ced62dbbf873a05d3f2355eb16f488acef9c191ff156223a179bcb950b3cb327a529dd5a6c194ea8422dc9f6dcf
SSDEEP 12288:+AwSfxL/2Dc34DLLmt0LDQewsAj3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:jdewsAj3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F15E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89E9E99702D12776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5bad0b9e52dbaf70bccd0a94a87ecb26cabd3853f0096a5772af74e5e6fca585
MD5 4e66cf7b4ee5c29154871750a216a933
SHA1 8bb3740a7f1757d4b77532fb6b01a14c2897fe3e
SHA512 00845cbecb7ad8cdd17d9a88527b21b7cd5a78d40fc55fc6ea5a2f24b3767fa90fbc94a79bc6675c096912a42579767b198a0e2f0aa39d9df232b2ea6f528c74
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHTVQBWG:HUEtQevvqc2W1cpV2EI32KB
TLSH
T185474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 16dd23ca4338fde3848921e081ec59c162cb6d03623d4ee948998a9571849eb9
MD5 00a73d62396bfc17924a5d685e16cdcf
SHA1 4c1adc472cb4d55fdd3e4e46a5c33d4454c01f83
SHA512 2e5f24e8872f3443b480c7e963b4c09dd51a771c325f9fa319eadea936efe0412b4a41c5d5eadcee6baa855046bc67efa0991315dfc2b6fcf723729d6c04a21e
SSDEEP 49152:JCbRquA/m2yL5zQfFiV+XenmE3/zrDmg27RnWGj:GoqtVjnmED527BWG
TLSH
T1F2D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6b59db1082f3e6208785ffff4ca961600cd475ef6871e3a11b1099b868e2ae99
MD5 b9f17a0e21a5d59edc2500345ab052fb
SHA1 b3820bb8f98aed1027f2623f5397c5b6f4eb437c
SHA512 482613b75250fa80ca100fbe4e3c341a7781dafa431f48ea0f84f2669b3f965022540b409d187437797b199d8b374c87021f1e10f9b19bb3c39417b9a5b5f6df
SSDEEP 24576:fAhGLJIFoiwtA5l7S534sqjnhMgeiCl7G0nehbGZpbD:fAMyFoiq5UDmg27RnWGj
TLSH
T122359D81E7F951D4F5B3AAB899B69171E977BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 3ba7058f249a9e6f69b9335217bc07c9968ff86a47f9d098cc1af7a18351b7ff
MD5 7b60df2c7a726db89cdc2229ab0776f8
SHA1 e84a07545c4ae5396a964157c09b1c7c0c4eae1a
SHA512 5c7bff51776b8b20994b78e277d9b4d3a467add5239c04cdd00f7cd3473186fcfea7c9709861f5bfe6547b7d4c0a32af7cbde610d6b2d781013e9c187e0be0e7
SSDEEP 12288:Dmw5HEjsChNVBFgl0WDm+C0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:CwuoOWbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19605F14A72A80CF9E9674139C697D136F7B3BC122A20DB1F1760C65B6F73260AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 13836df54a10f085f7921aebb32974cfe96f0d7398438bec2ba0c7d96209c073
MD5 55620dc9c85c2342964db4d7e6f71660
SHA1 c7468982bd994d0f88c699ddf16fb2281ce36796
SHA512 fb77251a17485a059c1829c1ca779812a19786505407659a54df48fd75c6b05a5c188a69b9b1888803164b60c09b901496bc4f5c9d59210241b8f4421d76b71d
SSDEEP 12288:pBZ1IyHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HZuCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T104E412AE239820FAE563417CC6E5D609E7333C62673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b5ef326fd6133293e59a720a2c3a5a423c453636deaf47968843fe1285b915b7
MD5 7020cb9cb5541f9be125910b2e5b59f4
SHA1 b4154d959967a8158ffb6ddf32e3ecbdff74b0b8
SHA512 1e59976ea322e7116bd9051cef82cf6077fae4f66c3894ee8a784cfdd4e9694b0d0c3be1df7b5321a7c7822be236cdf784df14554d506f12401b644d17448069
SSDEEP 98304:mQRQyi36YOcPQLvw2gAf+PN3dD527BWG:NQyiKayX+PNNVQBWG
TLSH
T19F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 df5b330f735f87132cfce084a9cd8bb81dea40e2506474ce5676b343403482f5
MD5 5f5975d81199bf896594e11956cffd0a
SHA1 2d6d810b6a723de4ff977ba31d54b4aaaf24f75a
SHA512 52a4a63d1550a97719b7c236c947d83670761849e33bf3a37e28bfe1cffae6d46f8eb641017692c42802cba16f51ed8a05a1e591a76d688e11dac1a16ad7d86f
SSDEEP 98304:QQRQyi36YOcPQLvw2gAf+PN3dD527BWG:HQyiKayX+PNNVQBWG
TLSH
T1C2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 15e854dc73482b3db2cb6faeba95ae22127ce5eba1a584c9d5196ed65bb5672a
MD5 26ba42e050bd70bacbb4d53675230b53
SHA1 f02a13ebec517428e4036acba943b6c308b35f43
SHA512 3ce6223d69c5d0513a60d23c1fce16eb4051c0e5ba6aaea9e1c8535f70af6f4dbeaf2da2adb1ed28f6d0defe4ec4c464b0ffba47a0a9d7f62b59bc7aea95d2af
SSDEEP 24576:qwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0ysqjnhMgeiCl7Ge:E68Qg55nhheWu7PNU3/7Dmg27RnWGj
TLSH
T164B55A33B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 57e8c9c1478124272b80fc317d7175cb50dd661d93358478218fedbaadac27c1
MD5 bd0833a49049f861e95074763545ca04
SHA1 f5882f9017cc88124e476ea417feaf0bc9cdedfb
SHA512 bf998201c7767d61d00f5806e7069b74a917a1cad89230c80882ee5cda981f8101557f4de63ca546011f7cb8d6b096a6a5a2a2cb04ad71c068438f80b2d17b94
SSDEEP 98304:/y5112gYy5azzVvL69nLKnhZKD527BWG:yLIHmWhMVQBWG
TLSH
T1CC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5f8ac5c185bd6bf205bc6e9cc6ba56e06a1a6199d946fe5e0bbdca278abe7d9f
MD5 02638a6e5b4cf610bd2d084eb79294aa
SHA1 735a9fb66dec721ac15e70a5be6393989fc2d831
SHA512 05a79aa74d72265eeb23d69417e8f50fd9c3663cd69b5d0fad05e7c502777d8225382404a6e3dd59307abd277d281201e4ee36eeb0f943bfb4621ffcc3b76559
SSDEEP 49152:SB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl1Dmg27RnWGj:gu6JmVxd2d1D527BWG
TLSH
T173D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 966effb2ce45770af79dd6471207771a907d5a5171a721c184aea42f3d5a04f0
MD5 c8307a0ddbb97cdcffe23c249d1d31ba
SHA1 baa7058162c50138ea5757838238aa62db3a2dbb
SHA512 2e1b2c4dcc9f07e3c8e6be57bbac3e849bf33413fe9541e59e88807bfafafe150df078181dd9c2c14ee7fa46e2287d7e0b723c730d759098a08189a4aad7fc61
SSDEEP 49152:i1hpsNoJpF1A6UU44CwH7R4xJDmg27RnWGj:imifPbRED527BWG
TLSH
T192B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 93f80865ba47855462d917a1a64ed90f77152a560f2662407f6237cd2374186f
MD5 783a6a9b3e9ca8438346c11ecaa681bd
SHA1 081c0418609f6c085d3110c330bba605f94c277e
SHA512 eee4feca35eeede8da5422261ea9e9a4667e43edd7523bd9ef53a172bb431e27b7a6e545428e31cbbeaf7a6f78e50bb873158c8673f6e8294178cbdeb7e0667d
SSDEEP 49152:/SuZQIY0Be2KRRVtOnks6NMHqGDmg27RnWGj:F5dKTi61GD527BWG
TLSH
T123C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 113940e8b67cd61f62acb5a14692b3d3876842d93a61ff2d22a255351841003a
MD5 e85f6421c4cf109cc6f866ca64302734
SHA1 8df2921dea9d114815d319271dcff2258d55fa51
SHA512 1db6b5c35ee80508422f4071726299ce83aad1ecbc1b4709c8127613dce1ae6e26183cae0088c19c66269e70bcf4c6358fd2808a7c9dd961197265b4dda27203
SSDEEP 49152:bhtSn8EApI0figngiDn0AP5wFDmg27RnWGj:6X2iyphoD527BWG
TLSH
T1A095BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 ca504a9d7a94985d5cf0df043d013c011088bac61e872b96816061c81ad7e608
MD5 78b4f00ded89df464c26999a2f21d5e4
SHA1 547126a85a56e4f236f1d9006991fb6e5a161a36
SHA512 030950f321eabcdb82e1d446284cbc629dc89e315d4a870c7105ba113e071cbbe3ea3beefbb25bd578178365f92841352b9c93be690357d7b1f73ddba758e781
SSDEEP 12288:WOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13CC423BE914C01CBE92244B5C3E5F15DAC173E57E9200483BA5B78BEF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 875e12061fee81f63cf9530c27002866bc5df70ee8d96740c1f70904937f502f
MD5 a9b8249f68892c7cd140f789e6dd8b8b
SHA1 e075156c62f0e1871f21456f429ae405e4d659a1
SHA512 75c6908502b8ae715254355c5d7b9d483cb1763672aad930230eac2d493e0b8c5674c7a6d9000dab71358f78b68eecb775a153bd5aeb03e37be61df027fc38d5
SSDEEP 12288:nzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18CC423BE914C01CBE92644B5C3E5F15DEC173E57E9200883BA5B78BAF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 aecc3a73c57feff82ac59c38df9445c4fc56fedec6f4b82c9989935294804d27
MD5 a0a83f35785547e6d2ea19aa9677135a
SHA1 48b3a6ab4f3fce8a726f448b41a407d9daf16b4a
SHA512 e6fa5258141ca8b1fb1463851924ced9c7d140d1890e4b1b5f2892ccfa3c1061cb48546508aa095bd58803d9357d7980a811a9109a835242e255267d94de60f7
SSDEEP 12288:+dXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+dsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FEC423BE914C01CBE92644B5C3E5E15DEC173E57E9200883BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 c132c4e94112ac5f9438ff56f9479cde765f33c9f07049793168626b5548726b
MD5 550bfa2b694ef723ed808546758afbb5
SHA1 4e96c6bfd298a371d5b07c7a17e79afe77762ddb
SHA512 13b5066e515b4f7bf5133c342c4d439ef73d971c4dc17d1ce488e8a929e140224e7723a23d931d6d8e9fafb55b36b6b7e0ca88fa50dadd307f906eb0935397c4
SSDEEP 12288:oVYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10FD4236E535C00C6D87285B5C2E5E11DE8337D56EB3005DB6B532CAE9FF26948F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 2f655365c9f7e3d2cfc331d81265fbb93ff440945b23b9f986ad96e0d80552d8
MD5 2c92fe936e64d6ca461c189c2a3a5760
SHA1 5ec351763299022cdb37ed291f406c68f6e976f6
SHA512 2452601a128053b910d4154f76f331b4134d217ff85b018b82b8e1d816f52312d7df9b0c01f1c9b5d9bb0df157fbb3be44b227ec2ba8e02bd59f4d7f1987598a
SSDEEP 12288:xwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15DC423BE914C01CBE92644B5C3E5E15DEC173E57E9200883BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 9c0159789acaddc7c67cb3c7df9710d5fc1d7ac3f0c0c51eb29dd54a3eedc1de
MD5 1500b88b8aa94ae783a7112d629c08a4
SHA1 5df0b99e82c19136522c31da9eade8a87547b049
SHA512 029f17ef7339c04df7ccb76db588282a850b48192aa75047078dde69a888d5eb94efa3563201cd19ae7342067837ced0ae2d2f9121f8f084da42e79323c52acc
SSDEEP 12288:o/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:o/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12FC423BE914C01CBE92644B5C3E5F15DEC173E57E9200483BA5B78BAF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 4f66a243ca64c16dde3aff210eeabbca2227b2c7ca164b8421eb45215f6ded7b
MD5 a63cdfac283bb26b9bbde44dfc259dee
SHA1 7a788f5b330f64e761db3a0dcf5e07175df997c2
SHA512 5baf9922e499de83343f21aab6fc8ff42de027bc9cfaefc7fb5591edcf44fe30c39d1f4d8ca3358416b7c6e55928d5357740e8074879c7d5ad04e9186adad363
SSDEEP 12288:yLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C2C423BE914C01CBE92644B5C3E5F15DAC173E57E9200483BA5BB8BEF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 630b9a2db16e88acd5d65cb08af107cd1afceee7f9920850c6be9ec781d2180d
MD5 2fa49b2643d661a66f41305b9a560c0e
SHA1 572a676d744f394fa96a0483e4a6d920bc0e7ee8
SHA512 b8186b134916030c4dbaeeef183fc0d8edbdfd26b7e5ba54bcf033a584f851a6a9d90d79538470f9057696a8f176fad3617c7f335f5bf1fe4960e209917371d5
SSDEEP 24576:TZMSzFVSOTsqjnhMgeiCl7G0nehbGZpbD:TZMSzfzDmg27RnWGj
TLSH
T1190501A9B35418F8EC63813EC965D90AD5B37C1A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 da90999a769395990ea5c88387f923c689f9c6b4b2e5acb21c4cafabbd06c9c8
MD5 f4462558f1242c5090ffb22150152feb
SHA1 9af76849516095a4a4706b1fde68313eebf1161c
SHA512 d6d14522659200fbcaaf2ea2dd887aa98307f9d4fe8c557c2693cb0e338caca3ecd6cb0aec27514457d089d444a9755a2a453ab8252eff09f9bea8671e805892
SSDEEP 12288:iSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BFC423BE915C01CAE92604B5C3E5E15DEC173E5BF9200483BA5B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 1ec4c6ac55dbf40bf16a5ae65c28eddd424cf4681449f4e8f12f994a52a3ab95
MD5 157477fea2b693f9edb860a145f0be43
SHA1 b0a49bfad289fef2678fd37e952db85369933bb6
SHA512 5ee32a820fe2fa1628594ccab0958aef1a432b43d5c4e37dcb1fa85e7acf614a6b18f6ea48c52fac184555b4a85278677163bbf83e9f10d502f5dece35e907a6
SSDEEP 12288:ZWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T124C423BE914C01CAE92604B5C3E5F15DAC173E57F9200483BA5B78BEF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 eaf60e136cfc9e0aef4da837b51f9a024a66673e19362be6e00b36822b1b1ef3
MD5 b2dc30f1e9cfdc42e0bb62de55b6b5fa
SHA1 a2a13127e8cd156448a5901a389f49e085d79f81
SHA512 0219cf4c19ade4b51fcbcbd72a8a8d680cc2f88fae128215226785bb4990750918cd97fa83a5566c5b4f3e0be19ecf4b31033f7cb42fcc4298d74a5fd0525ae7
SSDEEP 12288:ayPz5L8HXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HzyHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T181F4025B73A530F9D5378138C5A29A06F7337C3247204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 7575a9d4ad60f41ed34ce3aba0c09f67e508467b93e53eb924fead8d6590f45a
MD5 7711ae3768acc5b02dc86fa8d1edf935
SHA1 a4d44a6b57b2bec55af8229ba6f112eef13a1c0f
SHA512 47c2ea203d35e7295808c92c031b28afe60aa8927f0eae348a176588fb952a3c3f0ac6b3c4927f24381fbeeb8bfaa3fc5aef90dfadd594f219725cb5c022cb80
SSDEEP 12288:BSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T144C423BE915C01CAE92604B5C3E5E15DEC173E57E9200883BA5B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 97d09a95e3a8a414305158d9063b38a51d1211641b8f8795edd97d45734ad8e4
MD5 89b2710ab288c8d323d1c8645d6879ec
SHA1 71ed07159389178cd2a6d64d68ffbe2f7551efde
SHA512 2fbd68455efd7536a607ca9696a25b94e5d4dea7de77cfa145dfc385fd96afdc02412eccbc84780a2c0de312133c015fb0b1abf146e0950ff506745c4d3d892b
SSDEEP 12288:7SXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7SsqjnhMgeiCl7G0nehbGZpbD
TLSH
T141C423BE915C01CAE92604B5C3E5F15DEC173E57E9200883BA5B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 12ad888ae176fdee4a3e15832f36961a04205d02a5f0d4167545587f554bd4f2
MD5 e04e315ae525780cc0ff4d7dbb934671
SHA1 a0fab0ea916a6bffc57b6ea1783f63d8765ba07d
SHA512 cfb35b20bda16547ab4d42c73075537f9e77ac238e801d8797903c1575e21b4040f53e85bfdffe3ecc1bc642af7ae4903615deb1c10a28f26669e3f80e2bef17
SSDEEP 12288:zyPz5L8HXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+zyHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T163F4025B73A530F9D5378138C5A29A06F7337C3247204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 1d13ef6c28c2ec86844986e5ce249e4b71a74ac5274a121e0aae7302277f403c
MD5 d4a9f777e54ffbb1ea8b0f94693ceb8f
SHA1 fe4a1a13b27802d03a7957247a03987a7ab21229
SHA512 99bdb151a04fc5b8a0a4c8ff735569e4222eb918dbd0d15dd963480b0b098260d922e63a3f550d1c349ca3c0b88288a5b3a5999ed66bedb648426d1e465297b8
SSDEEP 24576:OTHaLl3z0zDNsqjnhMgeiCl7G0nehbGZpbD:OT6LljwDmg27RnWGj
TLSH
T1720501A9B35018F8EC67813EC965D90AD5B37C5A0B70CA1F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 00c87ace715f57473a2ac3df7e06ea4d8390c76c4da073f1acedbcb86a1aeae6
MD5 13c404f9633e87eb251a46e804203b61
SHA1 7f4fa3f36c833ff72c513c09a724342bb615661f
SHA512 bb1bcf842593b9b5902d19bce0d3bc082390a49634a584ea854996827e7fd0ca863b5162f1cf1ad83ab2e8e66bde5cb1957b3feadf5a1e944b659c0e41369a19
SSDEEP 24576:O37d9CHKy7GZ5sqjnhMgeiCl7G0nehbGZpbD:Q7d9CHKyazDmg27RnWGj
TLSH
T1EA25CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 ee1944e3be1f9fb39601c0489bfc12ae81f5d55a209844b66a3ff15fa47555fc
MD5 c9858bdc0de82551b84bd3ff36a0947d
SHA1 0810a59db70b9494440daa13fedf035e24647a8b
SHA512 702186709bfb9fec3efc0022e598057df5c87e4a0f366fb7d3f18840014f2adef015de95a1efe96ce8bd6434970698252487fd05ecf314c5cd144a963a528084
SSDEEP 12288:Q9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Q9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C5C423BE915C01CAE92604B5C3E5F15DEC173E57E9200883BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 3f820c12b1cb0ffd1a52a257b5070f9f5e61ea08a3c7f1af83aa1a0b6104d9e4
MD5 6352846dd1692ce5c36c5ac4181ed392
SHA1 643fae7ac5e46ac195f8f67c2167103486846f83
SHA512 294b068d39014b061f521a8f27d18cee15a3199b6b967e0591bba35a6a5958660210c901b42906a3b267864bcd44ce151c0ccf9e847ed7b327558e8c7cb2d20d
SSDEEP 12288:knXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:knsqjnhMgeiCl7G0nehbGZpbD
TLSH
T150C423BE915C01DBE92604B5C3E5E11DAC173E57E9200883BB9778BAF7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 6dd6ea6f32349e7910cf5df212c57f21271c5840f94cf81842e0cbda8de9156b
MD5 149ecd5528efcc71603a0048acc6c870
SHA1 47b8354aca9b9d41152be2ad006f8f61c24affae
SHA512 960841aea681f4299434e3c81aa6dbab1aa77be3da0b9bf73b53c3ce4784023f5cd2d58219ecaee020bfd2a5a9419b6b039b9650d12587ddd530a605c58bad70
SSDEEP 12288:kMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BBC423BE915C01CAE92604B5C3E5F15DEC173E57E9200483BA9B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-09-10_195758_2316-3188.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-09-10_195758_2316-3188.log
Size 1KB
SHA256 f596d5791d7aecce5e3998b280b2bc344e901cd61dc00a456eb622d048c20d4b
MD5 f918c8f0c9dc0be1248eb8872b6ca8d7
SHA1 e7f0ff6fc4df53a2403b1617d03327f8c7fc9e95
SHA512 95a80aeb0dafc480aeb2f91cadadd8b92e213e555852c889795df674f98138e0890a710110b0b76f2cbacb403d974f3aa5c0dfea32b1eeda7ade7b824fea0875
TLSH
T1D421901A3FD41A55FFFAE9C295FA14539E3638912835D90C00A5534E0972F44EEB432B
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 d46ed3dd09eee24cdc7d03adc3e55bf4ce36613adbb007691c30095ab7965ff8
MD5 92486aa1f71925531f4bc02be0786807
SHA1 d932d5c65de01e5977cf6a5f61432389bf18f536
SHA512 2a9eb2a81c7af457718cf81f0e3e1b5dddd1f77817459d73fac06c73bc674a495131f31cca5a5d359b6f27de6147eff35e95ce2fa8b57fed4408c9e323a5f024
SSDEEP 12288:wNsfCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ACE4015AD29802D8C06E5179C3969605F7333C2697E093CB67D1F87E1F766908EFAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 8d08e50dad26b43ee306b2ba9fdbf343284a7f7ecf1cd5a91f5f2e262b2e6cd7
MD5 8ab6fc16e094493123739998d7ae52c6
SHA1 bed645ec4b39f7934b52b0d26258e932509299eb
SHA512 6e0d4b325bbb26aed0d39e14235ef7257735dc39f9ddc073d4dc0d7a514ecf4c712a14d2cbbe01b4c7588ef8224796cba8bb24a426d98901f83e1e1b735c8243
SSDEEP 12288:OrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11FD4237ED34C118BE97605B083E5E12D681B3E66DE204483BA4778FDF6B18A48F39527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ba4149d50f2b8f067356e844093aa941eefbaeca99acd6a100490f51aacf9069
MD5 90abbe3e4282f205cd75cd136c473f77
SHA1 fc27c01e32802f00b7bd158575451d753b82b6cd
SHA512 a9fcb897e62539e50c3c5862c1a9cbd12193ddfa6b2a4b340b614d2000f7816bbd1cfc8530058bc3e52c8d826819b3f0195da099825ac4733e0bf04c5911dfb7
SSDEEP 49152:za0h2GEkuAe73q3pp46zwwQNDmg27RnWGj:za0hNYG4JwuD527BWG
TLSH
T1CA85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 2574ca48cb115ed292e34295333b7a626160c047d7649f25abdbd79f092d6e72
MD5 7786d94211cba58a2e073374af22cad1
SHA1 232585e1e2e1256b4a459c972754ea3f300cfb7a
SHA512 97276b282fd71a0b5f132e1d39fa38fa3987673065f141707f5e88750d13fa1c6ea183b71a05e6f52d9a3aaa217ad3428caf1d0ded2bb8a11de68eea741d3f6b
SSDEEP 12288:8hbHjfXeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8hbHjPesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DDE4127E12AC20D9E57291BD8296D10AD632BC261B2053EF23D281BE5F37DE44D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 218a8b9c96f19e029d96795359c2b2d1a1b6ecfbdbc2e143d9e9860d1bb9aaa4
MD5 29cb796b205a6825aa8681e653773920
SHA1 1b94ceb5454e0edea21511cb6ceb1cfe9c335bea
SHA512 c499bc26f0993966d372027927ac852f6428aa44d4668d1dbd4100e38985c11d0d33faec3ac3747a734d81a1e1cc173c1ca887be5659cf545e7170e3fa4a7d35
SSDEEP 24576:U3YgnJcRTk4yti+R5dBR/WsqjnhMgeiCl7G0nehbGZpbD:UIgnaTk46pBR/aDmg27RnWGj
TLSH
T19B45BF2EF2B910B9D8A6D136850147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 31797f1094e532909e4631d03564a92438d3ecef4f6d10efacb08f57f0a19952
MD5 5e293bfeafa4ee780b82164feb449b3f
SHA1 2e94b25cd68466d3faab6376e8de43c689e5765c
SHA512 b83b50a057a2c035e5a1b7ba5794864e04636e678b3435b05ac38b9dd9d529edf8134ede732cb3a9e6d441229d8b30c3d779e6b174ce198e1d8a4a0af37373e8
SSDEEP 12288:HvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T101C423BE924C11CAD93645B5C3E5E11DA8173E56AB2008D3795778FDE7F28E88B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 ce8675b563e5f6d18cd9969791f18ceb5f70d425ba536dcca90242d81631af30
MD5 4aa73c4638c24508e2660b2c5cbbcb47
SHA1 de89aceccdc15bc0fd290c96f3ed2fb275c67752
SHA512 a97ecaa88bfc4e452d9b3fc80c8a7101ae75339a798d79d9f8e40e1c0a1c975207a039c1abcfac97ea408d25e95c785a111ce7998ee2e7305c4c2445d47ab8db
SSDEEP 12288:qOb9A4LWOsvAYFTkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:bpL3UTksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BB250159E79800F9E87B813CC5A2D616E673785D0720E7DF03A94AA91F637E04E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 cb12c90529ec673637029050f6d6a696d536ec166b75078465702f2c12b05e83
MD5 67b03a5a56c3419b48d9bbbe14319199
SHA1 1faab54e53c6de7e43159b529bd3d37dc941be8d
SHA512 6918773edcb342185a1bbf18724ad5cd39666d3ef683f6be16a0ed75b5c6bb6f616d5f22a0cfd86de9c1facbc90efabb4a90fd4364668eea36483cfb24e98fd6
SSDEEP 12288:lpFtpOoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NOosqjnhMgeiCl7G0nehbGZpbD
TLSH
T124E4026E32DC10E9E536A17C8692D20DD6327C661B2117DF06D180BE5FB3EF84D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b9a5f017d5aefc32cb34c771a3886c2dfa7c6156d5ecc0ccad8bba365d890f1c
MD5 0e00bb7d287d429ebd6fbc5981cc981f
SHA1 517695f4881bfb634185aaab48a0eeb5cb54c63d
SHA512 170eb526ad4dbdbd2ce005ace0988aef68ac687148f9f1fb284d6716028ee204b5fe3742fd96c9164860fc0b8d475aaf52ed45c4c807e3166c5137f205df223f
SSDEEP 24576:p7NM9YqZqmWMUkPjZM48Mv6bEhsbsqjnhMgeiCl7G0nehbGZpbD:p7cBWMpPjN8DbEhCDmg27RnWGj
TLSH
T10265AE2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 ab0e5aa1fe7158d3f8cfed8f99c1072b78ea02f36903ba7662c795a240ec13fe
MD5 919d581cdb3c1df4e4dcf9a93d6e3acf
SHA1 f8cb9d3b2b04bafeea79f48dd6121757a0b53b78
SHA512 579b598899c6f3e5d7578348c6e0794a42e41846e41d38b52652f637055394369b8171e974e39dcf0f6a56c519b377cb7aaf1208660e5b52b74331f55da493a4
SSDEEP 24576:yW6BApg2YuyuNDYTabvcdvNYf8km1FsqjnhMgeiCl7G0nehbGZpbD:yF2YuHNETovAvNYf8kmvDmg27RnWGj
TLSH
T1C7857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 2f6ac457fedf244fa257d208b5d74197be2d1415c1c0cc02e42eb311395d26ea
MD5 3eb42beb86f5f2c5fdaf66f5b5a79716
SHA1 67f39fa709af1d3aedcc42103a871ba9ed76716f
SHA512 9555138c5756ad53b5d7410c10c243ae2f5034539ff2e56bb566b7925c41c491afafe26b97630a9c436acc530e7423fb344d9ca99c6884d019b56c748a7adc68
SSDEEP 24576:IAFs06+Omlf3NXEbTocsqjnhMgeiCl7G0nehbGZpbD:NFs060lVXutDmg27RnWGj
TLSH
T10965BF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 d22e7e7515ca5f2f439e4e80ea8a090b0a813603a85225746df3def235775805
MD5 4d7457a7616fc748aa06e057dee76a0b
SHA1 4671c8d79389552a8e37e6593b3a63d72ea22e81
SHA512 17bf03fb5ec294b3e2564ce14d4fbfa354dbc8e695d615ec26051b35e2e15531ba0366ad977104f4747719093eb7ab5a8c51a0581e99e49b6eb851e0b71c0d51
SSDEEP 24576:vJnJ5D3WXpsqjnhMgeiCl7G0nehbGZpbD:vJnJ5DGXtDmg27RnWGj
TLSH
T14F15E13DD2A810E8D4B7C2B4829A5756FE72383D2F2169C728B4D4357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f8ac92b6d1d36d4d4c9c082509d0807d3da0c00446f79358288e82df145ffbaf
MD5 9fb4ee7eb539d395fb703aec77f5c1d6
SHA1 3e2eab3b0bf97b93efb924ea784bb95e197ee93c
SHA512 aa7d36f2f1efe8b408bad1cdbad0c0fd54733256b966db88fd5df7c3e5cd4a55954722ca692ac5f3b931c9a15153e6b37097446c5e94989a3a3c0d2d8fdb1edb
SSDEEP 24576:pEPghm6/7IIXdwcXrif7qQncjlP65i3VuWsqjnhMgeiCl7G0nehbGZpbD:Og06DIKdwc+eQnSt65aVbDmg27RnWGj
TLSH
T14E955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 6e54968a044aacf04ddf69f186eab960f4839b2b1e0669809ba49e27cf68caa7
MD5 861831c3454ad90b717d5a4124a05bc1
SHA1 3cdea792f9e63b88198a7b767cbdbd6af48850f8
SHA512 fced9da9a2e7aa3fe2b3f0b341a481618dd7ea85a9cfc385ac85667d1d5ffe3637a482c72f886b7d5d4bce77900a2d9f2b37aec4e314dc39f6724dc7c7cd7b93
SSDEEP 12288:PEP3RnJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UnJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D4E412AE679C60DAD536907D8291C209D733F4716B2127EF5692C17E8F739E80E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 d3873e9296b4c5abf2407e0dc4491cbce58838ea048ceb1f8bc9dc5c8af4afb2
MD5 1ac88cb2ac8cc2e7d16e31d6bb842ff7
SHA1 775257a56584d1b1958009b24bf8f71aefa5d06d
SHA512 24d69ecb5ef93cf0c08639d16d7847c1c77d7a681eede147ad1530eb563ec3e6b0daa55965a7277d37e6dd1ffc1c3dabe244634ec53b43185d894649ed361d39
SSDEEP 12288:ajkyeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aIyesqjnhMgeiCl7G0nehbGZpbD
TLSH
T175F41259639C60C9E9760578C6B3D1589C32BC31AF2046DF6191FA3EAF73AD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 1d06b59bc9df43b97a9955956f23a8eb24877dd31264289652ec26a775d7275b
MD5 3b59775562a917df855acf294f0825b9
SHA1 a20d17f37cd7d5b71570ce8f9e17aeed491c25ea
SHA512 750633f5d6a4be235fd4849371e094e2929e9f455d47f0a28e30d52c0ebf914c2aa734f93d018016c0ef065a0923bb6eb6962481832dc8e322678f914c3ff534
SSDEEP 12288:vy4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:64sqjnhMgeiCl7G0nehbGZpbD
TLSH
T103D4237D521C21CAE92245B8C3E5E11D98233D36AB2018E779E7B8B9EBF24D44739812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 70ade8acfedbbbc0f64741951a64ee13ff18405c7c8574740b732f6f951c836b
MD5 bb3ff4acf58f5e527141d05f3bfc7479
SHA1 66992c9cfb198e9013c77d42ded1ac67fb2beb50
SHA512 93cb87f6947e15da8240deb7c82cb26fc40ce3dbe9e5da0b2463890632f3e78817417665cdbd9f8ba468c472aa9a46c1b957d8bc264c82f6d2f51ede242d1f67
SSDEEP 24576:GQ9MxZKdcz9dw3TsqjnhMgeiCl7G0nehbGZpbD:GVKZXDmg27RnWGj
TLSH
T1E0558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 971fa911affd4de5a763607fc0dc8a36b26e698a0e7e090b3fbb9dbf967b9fa7
MD5 b921593f2642df38accbafff7fd17e96
SHA1 f6b4d29a04138d39c667884da65752e41291f309
SHA512 3369ed43c5bd3bc8db75cb4e20baa98d81180d149a8e8fc7fc4b055214efff58420b4d9cc6a65ee41a52f26a31092de0df7e00c00d1b916f779ef7b3ce7e5b4c
SSDEEP 12288:HyoKo2JRple9pSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:HyocDApSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11DF4E05FB76D40E2E176813C8985C249E673B4305B2157CB6692C73D8F639E8BD38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3ebda24d5d8a21b9113e2789f40668857882593e0e39cbd25d6e2809c42ef077
MD5 20331a421dcc7ecedf87060aa8e8bf71
SHA1 07074e3b0954554846b8b5b8b078c2edf8bb1596
SHA512 cdf9c354237fe41f6a1da978574be99935c20093879f45b6ac938f17efc91954a145fb9437362207581c90380a5440fbc4959e37b84133789235dff874f07287
SSDEEP 49152:UWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKWDmg27RnWGj:+0zuNIAD527BWG
TLSH
T179A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0156dc52576e47ec239f0820b0bc57178d958c507926c9f3cd7e8f478a21f8e8
MD5 62faf35069adceb223cca9a67791e9bd
SHA1 dd486a9c3b2d3d8e9c5720297b5b8b934cc8bdee
SHA512 786b91fddb33f9b94b06485f2caeafc232bedf191d0af2ac00038d5c80f4d5bf4f37a8a816ea5cf974298f1aba20be8ad6706d6e3d29460a24845b94d6e455be
SSDEEP 24576:a1QT7EcpfxR+N5AWAz3ooiYtjMqbJsqjnhMgeiCl7G0nehbGZpbD:nTDxR+N5YzTfjMQDmg27RnWGj
TLSH
T1D255B02EA7F815E9D17E85798B23C516FA727821033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1344-78-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1344-72-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1344-150-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1432-299-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1432-305-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1432-411-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1432-298-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1472-312-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1472-314-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1584-61-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/1584-86-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1584-81-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/1584-67-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/1680-341-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1680-419-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1824-414-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1824-309-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1952-27-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1952-29-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1952-21-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2008-415-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2008-279-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2008-349-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2316-0-0x0000000001F00000-0x0000000001F60000-memory.dmp

Download

memory/2316-9-0x0000000140000000-0x0000000140475000-memory.dmp

Download

memory/2316-19-0x0000000001F00000-0x0000000001F60000-memory.dmp

Download

memory/2316-30-0x0000000140000000-0x0000000140475000-memory.dmp

Download

memory/2316-6-0x0000000001F00000-0x0000000001F60000-memory.dmp

Download

memory/2340-57-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2340-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2340-149-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2340-236-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2436-417-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2436-321-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2688-454-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-459-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-429-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-433-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-434-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-436-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-439-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-441-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-442-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-443-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-445-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-446-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-447-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-448-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-449-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-450-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-455-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-456-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-457-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-458-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-460-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-451-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-452-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-453-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-444-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-440-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-437-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-438-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-435-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-432-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-431-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-430-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-426-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-427-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-428-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-425-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-423-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2688-424-0x00000221B9A80000-0x00000221B9A90000-memory.dmp

Download

memory/2728-412-0x000000000C930000-0x000000000C938000-memory.dmp

Download

memory/2728-350-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2728-377-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2728-393-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2728-361-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2728-420-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2996-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2996-234-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3756-407-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3756-283-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4004-252-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4004-258-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4004-260-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4004-320-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4284-329-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4284-276-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4372-40-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4372-48-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4372-46-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4372-235-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4488-326-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4488-418-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4728-243-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4728-248-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4748-416-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4748-317-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4752-316-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4752-247-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4988-324-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4988-266-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4988-272-0x0000000000770000-0x00000000007D7000-memory.dmp

Download

memory/4988-267-0x0000000000770000-0x00000000007D7000-memory.dmp

Download

memory/5088-286-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5088-410-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5088-287-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/5088-293-0x00000000004D0000-0x0000000000530000-memory.dmp

Download