stealc | a0ef1b2a80c6fe4b2b51a6f9825da59d7e66e9c9edc64de022d511fa3d69c8ab

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/09/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-15_6924acb8910ffb8dc8379a0a1bd83ef2_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 4.2MB
Sample260915-2e1rksdr81
SHA256 a0ef1b2a80c6fe4b2b51a6f9825da59d7e66e9c9edc64de022d511fa3d69c8ab
MD5 6924acb8910ffb8dc8379a0a1bd83ef2
SHA1 ca7638278059f972f363516a2c8c34ef211f6361
SHA512 e10afe39c49ac7ea080cb6c80fe2733f0033f97ea24b6e07b8c0575cfac81c31689fce9fd049087a23a1085340ed55e1ee924ffbbb833d7cd131988b18f1cc23
SSDEEP 49152:uIO5m8FtSN/j/Zg/Buipg8sND3Z9jtXSmWof0VFPW3KFzOc7ztCKwsTv7t4RVLNF:R8cT3JXTqzph4RV7wRGpj3
TLSH
T158167B07E6B941E5D0BBD1398A569A0BFAB1380A873197CB4791475B5F237F0AE3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc ransomware spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral1/memory/2256-83-0x0000000140000000-0x0000000140432000-memory.dmp	family_stealc_v3

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	2026-09-15_6924acb8910ffb8dc8379a0a1bd83ef2_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Executes dropped EXE 21 IoCs

pid	Process
2404	alg.exe
4196	DiagnosticsHub.StandardCollector.Service.exe
4768	elevation_service.exe
3516	elevation_service.exe
3572	maintenanceservice.exe
3320	OSE.EXE
1932	msdtc.exe
4484	PerceptionSimulationService.exe
4048	perfhost.exe
4132	locator.exe
4352	SensorDataService.exe
896	snmptrap.exe
4944	spectrum.exe
4928	ssh-agent.exe
1256	TieringEngineService.exe
1064	AgentService.exe
4900	vds.exe
2504	vssvc.exe
2608	wbengine.exe
4332	WmiApSrv.exe
2616	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-09-15_6924acb8910ffb8dc8379a0a1bd83ef2_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-09-15_6924acb8910ffb8dc8379a0a1bd83ef2_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-15_6924acb8910ffb8dc8379a0a1bd83ef2_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-15_6924acb8910ffb8dc8379a0a1bd83ef2_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1cc3b95b9b11239b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-15_6924acb8910ffb8dc8379a0a1bd83ef2_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-15_6924acb8910ffb8dc8379a0a1bd83ef2_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-15_6924acb8910ffb8dc8379a0a1bd83ef2_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_126703\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_126703\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_126703\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003726bf0f6245dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061aee70f6245dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002f11ea0f6245dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a3b28a0f6245dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7f752106245dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a513ac0f6245dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000daf1ce106245dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4196	DiagnosticsHub.StandardCollector.Service.exe
4196	DiagnosticsHub.StandardCollector.Service.exe
4196	DiagnosticsHub.StandardCollector.Service.exe
4196	DiagnosticsHub.StandardCollector.Service.exe
4196	DiagnosticsHub.StandardCollector.Service.exe
4196	DiagnosticsHub.StandardCollector.Service.exe
4768	elevation_service.exe
4768	elevation_service.exe
4768	elevation_service.exe
4768	elevation_service.exe
4768	elevation_service.exe
4768	elevation_service.exe
4768	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2256	2026-09-15_6924acb8910ffb8dc8379a0a1bd83ef2_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4196	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4768	elevation_service.exe
Token: SeRestorePrivilege	1256	TieringEngineService.exe
Token: SeManageVolumePrivilege	1256	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1064	AgentService.exe
Token: SeBackupPrivilege	2504	vssvc.exe
Token: SeRestorePrivilege	2504	vssvc.exe
Token: SeAuditPrivilege	2504	vssvc.exe
Token: SeBackupPrivilege	2608	wbengine.exe
Token: SeRestorePrivilege	2608	wbengine.exe
Token: SeSecurityPrivilege	2608	wbengine.exe
Token: 33	2616	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeDebugPrivilege	4768	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 4044	2256	2026-09-15_6924acb8910ffb8dc8379a0a1bd83ef2_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe	85
PID 2616 wrote to memory of 3024	2616	SearchIndexer.exe	119
PID 2616 wrote to memory of 1760	2616	SearchIndexer.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-15_6924acb8910ffb8dc8379a0a1bd83ef2_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-15_6924acb8910ffb8dc8379a0a1bd83ef2_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Checks computer location settings
- Checks system information in the registry
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2256" "1260" "1156" "1264" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:4044

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2404

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4196

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3516

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3572

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3320

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1932

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4484

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4048

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4132

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4352

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:896

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4944

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4788

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1256

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1064

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4900

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2504

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4332

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3024
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0827c92e82f053595274fb7ebf0734ea9ea25f2ef25d1b287edd49d5b0c02fac
MD5 bfd6c41d0e0d1dbc56313ca58429e5a2
SHA1 3bebb6115d14c93c9745650d468406150d050883
SHA512 76db291d3a5be8b291d30a79b5b0d9783465daccabe87801184a3098cd3dd8155fc6a9d4c34ab9e820e97894ffd0bffa01747d01934dc23cdb787d9221955ebf
SSDEEP 49152:Eb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnuLNiXicJFFRGNzj3:+3q6mjBx7wRGpj3
TLSH
T1F9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 e2e070e6cae775eadd6bf86ca566d13e9eeaa866f1b0f34e296cc202b34dc988
MD5 5f34bd096f5d019427a72d29f25b8aec
SHA1 38477efaba37f1e60ee8c8a4fd644ac51403b891
SHA512 28d0cc98209e8f1c0808a905178de912e1d3be27c1de7de41e9b1450f4cf4985fe88e9218ac87c7bd7d000889d2c35648fc623753932db317431aca8ef177e44
SSDEEP 24576:ZXYfDtczAt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ctcYLNiXicJFFRGNzj3
TLSH
T19F75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 dbce50cef000a5a82f8724c59a0854d9a521a0491ffac89272b68ecedb8059fe
MD5 89f461473a39a3af8e27f4974c058f13
SHA1 d761a521243a39cf12060b178985e2a6370436c1
SHA512 5be6c8fbd7811b88c4d1161da92453372c4842213e65777cf2f2d698da2d3d81a103284c98365adee47e8a60777ca789d32bd157a2d3658927a7508de18db411
SSDEEP 24576:a0Le5ji0hmxhrMW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aPji0AzDLNiXicJFFRGNzj3
TLSH
T1C4859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 42dae82c90eb02792f4865bd71d039cf8e1f469df2f64ffb4bcc54473afe0654
MD5 d3ecfadb35cf197f2988a3d14f8a8289
SHA1 dca8a69b88bdcfbf97c1e7874e131fed987ef5b7
SHA512 bb0793689b3d6cce44053692d0f4ee8de1b3aee5e31ec05391c80aa760cd7e8c3c431631743573cfb2bf4bca02f624259aceb1218f2203f1de8deb12081c68b6
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWj6q8wyuI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:a/ezSC6vUzPv+Hjy/LNiXicJFFRGNzj3
TLSH
T13D756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b7b5e0a871e81fa08da6646e5fb6f23b5e9dc6295375fe97c168f5f312ab1115
MD5 3ed6573a6b8f3611e1612b68b7ec2ec4
SHA1 4fce52a88aea5c36e652cef686cf1a570025a24c
SHA512 db9c6ca57312b14bda27275e233983fe3a25f58031cd237e54219137ae509771ee41846e558e47b6c6a86ea4182689158ba672b542af872fffd1558cdfa2ab19
SSDEEP 24576:oVbqPb88hv/l+Bh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oVO88hXl+jLNiXicJFFRGNzj3
TLSH
T1FB559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f09fd6114b79d05145e6755391bed6c4375d9d18bf9575c14e3b1c1a63a55c44
MD5 d946a6ddb95c08ce03682901ccabfe53
SHA1 5700b0c39046daa5b1610d291aa97e497c708fcc
SHA512 686eaf3037c53cf861ab022010ee52f094c7d2678b09e9716667eda5b4cf3d5cbdbe106cb4f99cd056ad435665b5702aa1911ac668cb6668f7a4b3e8b3ff6634
SSDEEP 24576:qGK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gLNiXicJFFRGNzj3
TLSH
T1035523D3468855B1FBFD003A867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 ab7e30735711d3cc78cf6b64a498ee69b1d9ea75ff4bf688183f2df616450757
MD5 3e225f0717ab0561a4d7ed16661b47c2
SHA1 7d3b965f8296e7682143644c532bb8468cf9e0d6
SHA512 ad1d7ea1c2ac1736696bbb86448c621ecb1e9d62a22c1e4ac81f37a19dc0e90115942f5bf80a03b7562ebcea1f3c17785bb79e386bc1346df91ce150b1387948
SSDEEP 24576:lJIUp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lJIUpLNiXicJFFRGNzj3
TLSH
T13C75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1c1847213d4d6c77b1ea8d86e3ab8e0b70dbeaa421782f0a6eb5e720da068fdd
MD5 58c483cfb1f27091bd073e95e73adfa1
SHA1 0f7a58fddabd428f1387c0d70bbc46893158b1c6
SHA512 ed807caff1a115df903d56fdbd4701d6719b6c0d04be7957094f8ee0d2b643a6dfe9303cdf517b459478f6510666955cef1cf0fe2aca54117198104c2aab18b9
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THZ:cQvGAdlCEL8c/WRNw5C47wRGpj3
TLSH
T161266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 162dfacd9ec8d436310b6b38ba2d8ceb649b3e1fcc1b0dde267179deb6ce4f59
MD5 7ef7f19fbd354ed331765098f7e5fd46
SHA1 653fb2a8a42d899db28cf7adb9ad87d7c04d7065
SHA512 3827ef3464e9375dc22c91643066602732cfe66f709e6e6788d4098d2c2d4dd909f3473de9ac9901e6f43d7230aa42c799b85d3d70be13416272e62a520a7e70
SSDEEP 24576:9fewsAjz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BljzLNiXicJFFRGNzj3
TLSH
T11F75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f41b7bd9c4f025179ef6037808134014f8b2a8cd5d9cbf1bd5fb56a7adf4daa9
MD5 8fe8ce75f7f785e08048669548d0b37e
SHA1 2cda6ad8b9cffb5319bf4f6dea5f5092e7f7c474
SHA512 2df97a5d71824c56b0b67b1ee771e0ae10956f0d6fab1ba9a402029e24cab2dc397d3215af36984628623d3ca7966ad790833b64049432588f0a8eb36ad2d11f
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHvF9:JUEtQevvqc2W1cpV20I32d9
TLSH
T167474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 336e26f5cf147c6e2c0e14a14d040ddbd8e9787832ad7484326d0dd1fe4bc91a
MD5 a3709449d50d9bf985331abac466be3b
SHA1 320fba97b8bcbb170d9ba77a45dc5942021175d7
SHA512 f24fa2f890c2a7dd62cfb56dfaf35e4186da1c58cce9977e8e60ea268d55e76ee916c3f0492621dc7f0c56afb0c4fbb1b4bccc66adda45d04e1190c07d12b065
SSDEEP 49152:yCbRquA/m2yL5zLfFiV+XenmE3/zTLNiXicJFFRGNzj3:Xoq2Vjnmk7wRGpj3
TLSH
T116D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3d33cf1dca3e3df55592bc85f41e6b4cf955312b3dc4dba934ce764a99b5f256
MD5 4a94521a0c73b633e68b60643f89ba06
SHA1 8e55a361c0a2218f373ef51bd6495e58890415eb
SHA512 fd6f01ad01f9cc12bf666266663c1e885ae6c643040d5b40fc0b7c15dc060294aecb778e589242e358a4651103ef03606aa9c62286eaa6639769dcdf4ed37dce
SSDEEP 24576:vAhGL6IFoiwtA5l7S53E/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vAM5Foiq5ULNiXicJFFRGNzj3
TLSH
T107359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 2f400dcb05ab63db1663346dc04b81b2095363f1830b47797c529602335c8d62
MD5 66fe2384240ed3588b0a8ce229886ef7
SHA1 358e1bb39c95f80c8031290b24c5c9be30a3659c
SHA512 1e8e8cd8bed65f87a43248c3d8260aca8a6473b29298a9f413b4e0c2824a5de7a516b132bcac94e5defef390a45772d6f83616113223433d747bb60aa3543329
SSDEEP 24576:OwuROWf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OwSOwLNiXicJFFRGNzj3
TLSH
T1EA65F18672940CF9E9BA41398657C036F7F2BC152A21DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 054738e2a23f366a76626614c7bbcd0054ccb1eb8767fb9923f5d4043b2eb850
MD5 b1328b132a6ee57f938a0950471ffbf7
SHA1 920c45c448d5dc5a1edb015d048af759304596ab
SHA512 d72a40ce31b519a2b9feb1708f10cdd1ec649081425b7f99a6838350889caf15ae8ba08d733d5b6c7f225b43860ceeed9427075cb32313a4c9fd719b0602c1d3
SSDEEP 24576:PZue/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rLNiXicJFFRGNzj3
TLSH
T17255129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 63d135cc3ea233a11ff0523cf129fff53df11fbbe2ddd094b3fd106784966458
MD5 6298287a45d2347ea830cd6f771521ac
SHA1 8bef515f67fa897ffed06b0c7aa302d5ccd9d9dc
SHA512 3bd627cba7113576bd6272c2c7eb47b028e226d3ce24ac21fc4d905953dc04da607c2fcb7e8638edb9f2eb26c51932066523f9413a9e1386e4311692d521ee7a
SSDEEP 98304:SQRQyi36YOcPDLvw2gAf+PN317wRGpj3:JQyiKanX+PN5F9
TLSH
T12C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 02f87ac609f3178d21cfdc9cc6ff5e12ee39965c6d8e47ded061e39a547037e4
MD5 91f40d63469ccd426e999bfc157edecd
SHA1 7344c6942e7fb4733f87db106f9fa87df1cfce3d
SHA512 94f354f0341d4b0791c04630d26940b22471cd974a888838843b02b6ebb537a621efbcd8896480b0776216de8b0d96ec63cde26ceec4f2a6067f399794021e7d
SSDEEP 98304:CQRQyi36YOcPDLvw2gAf+PN317wRGpj3:ZQyiKanX+PN5F9
TLSH
T1BB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 21f549cf4235619ea827b16bd894136366a05339417237e5e2141120b4f122c4
MD5 21d1d9d27f50ea809650e9d19af1e2a2
SHA1 00180116dcc5abb1533005a6cd64984d2903804e
SHA512 23d29c920d3cee09634e85c3f809bc3f8cd35e08d08e28b80d7f20fd85fdffe52184174991b1100fd1b3679208b58f62d69dab80dd8766b2507defa89a1c1bb7
SSDEEP 49152:z68Qg55nhkeWu7PNU3/DLNiXicJFFRGNzj3:tthTRc/D7wRGpj3
TLSH
T165B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8168981d1c60f3046cc6f71adb3a16c5d87717187719baf122b4bc6bcf1f9f75
MD5 c65cac73dee4131c37bc65276088f966
SHA1 79ec9f14e0c98c0aa2cbf68fb46f089345d33861
SHA512 b1a498104532b978412a39b870660ba7be130714072584d218dd69dbddfaf605e9097fa295bdedf82aeabdf08179d3b430467c1b76b497deb3e317f323993977
SSDEEP 98304:8y5112gYy5azzVvU69nLKnhZK7wRGpj3:9LIHRWh4F9
TLSH
T1A9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cda3b97f5827caefdc0e8d201c6695be886fa30d653838a1f275a70582c26935
MD5 9db5531c7221c27a18e25e246e080020
SHA1 3deff8ad99d77d94a366a28fa4f4864e766dd546
SHA512 2d1f0af920ea2274fd7678c4d9fa1d4b99354c711cb2ee8cc1901e6efe6b1f335946076005388c921385a6cec36358fd43f047b966e769431a06401f0be7996e
SSDEEP 49152:KB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl9LNiXicJFFRGNzj3:Yu6JmIxd2d97wRGpj3
TLSH
T1E8D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1be70a338e7f04a82c90b0224ab7a508b0133ae0be83c0047b0511084cbf19fb
MD5 e934948fe15628f7081f734c6d610bc7
SHA1 af8ef95c22ca03e8a12cb8599e77c3f54d75ba31
SHA512 54412a49a10a92e7df284a4de450af33386e56ef22ff522689ef086a3a898dfd93bb7a77e2fb4844e9284fda153ac4dd8abd23b121883fa03e268742c8f9f600
SSDEEP 49152:G1hpsNoJpF1A67U44CwH7R4xJLNiXicJFFRGNzj3:GmifPqRk7wRGpj3
TLSH
T1B5B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6a2a1ddcf294c04543b063d914aabf5d9c0c281eadbf4151d5a486c1ff732c51
MD5 5440ef0f0ba337cfa1632ba25e1c8a2e
SHA1 06ba6ccc491cdf8185d3631807fe3df4fe10b7ef
SHA512 fc2d37c71e9d91c0f7d2c1f6f8d7f8fd9579f52ffafe3798b6a54cc1a3c9e9310ce618322229dfb4ce57258e7d4544ffa49f2f35ea000e6148f3d1b84a6408d3
SSDEEP 49152:JSuZQIY0Be2KkRVtOnks6NMHqeLNiXicJFFRGNzj3:H5dKqi61e7wRGpj3
TLSH
T142C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3c66d458522b57c01f20c3893bf193142032a64e332feafd23e267e5ec5e0e0f
MD5 88fbf37f5691fe348287a9e148b1bef0
SHA1 68bc094bd9fdf4cabd32f842f1f8e63e308ed233
SHA512 7cebfb37ad4cb546b6ff9e9118a238f3bdac26c01ce53a2ec9e380d4e7d8f2dd3f5a285a2c8edbfcf455b9e861493fdc0d955daa4f0310322c061ad0e312fd20
SSDEEP 49152:QhtSn8EApI0figjgiDn0AP5wtLNiXicJFFRGNzj3:BX2iWphQ7wRGpj3
TLSH
T1A695BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 cff59d599ed27a3f088e1ee09e738f4dcf3a208cf098fefb816f95a490ac2a51
MD5 cd53e0c0a7c29c8e42e86425d15e5981
SHA1 413f6fd5c8421866f6acbaeb385a9e178b1eac1c
SHA512 f2b2a21f2537b056cba144c979e0ed68a3e84b9ad772a8314972b12bfdf5734e63d30673c61f091f706cc3bfe7555bf3fdaf110886a50f1407ed2cde17dd79af
SSDEEP 12288:CAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14B5523D3548955B1FABC0039C6755428F5882E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 331b0e97fb13914ed1b4dabbcdce5875f5323e2c1da35d6f614d4be664e79f07
MD5 8e7a89d68a5fd6d1463fafbc19d8f6d4
SHA1 1f034e0fcedb9fb798cc004462c73695c8b1eb12
SHA512 899a44556b761ab04e482cad068d91f9c230cbc384152fa686b6957c9129e5e9aa1fb8bdd93eb10fb60798c6a8c1541058852db3acde43568459fd8cc5a1b5d4
SSDEEP 12288:rjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DD5523D3548955B1FABC003AC6754428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 9b10aa0f70514a5b64c6f87a33cf53c95342c3c7296720ce6e85ae3b997b338b
MD5 c2a24ed67f1b7b593542a96ae65b03a7
SHA1 e348b90c72983d57fce80702c388f25da817ca44
SHA512 e6f011eabd0bbabc1a060118cd708961daf12d6dc27d9aabc7b488698834a03358cc8acfaf58b04bb0dfd366b9a3f3f23ae725727757a6cfa03f4397911a93e9
SSDEEP 12288:8tiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8x/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FD5523D2548955B1FAFC003AC6754428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 8c369b5ace3fd16f007a7b0d3df37b4438a14b9d571c88f5156580e69004cbc3
MD5 7b8824b2e2f36e396749b588c8344240
SHA1 b8f23944f485c255023c5d73f723927d49b3a468
SHA512 0ba88a7d73993477f0671424911eaab17c9a3c33ce4fdb953b8f08dbb1486af150e10522dbd1e32c0ebb5556451a6a226628e782dbfed3b194482d45e1e73058
SSDEEP 12288:wViiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:p/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T141552392168901E1E9BD803DCA764428F2E47D6CD7325AEBD3003D1E5674FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 fedb802506246f2a6f06c18e6c82ca55821937a8c70c059f30ca620b32696315
MD5 500c99d66da200c41dac7c7744119f92
SHA1 bfe5d5fbb6ebeb089b1d705bcfb96b2a94d51733
SHA512 f8e11eae4a86d9639ddfb2bf9f799b75b4ad2bf356cb1c57795d64105995c4320b5bd55fc8cc0757741a721dda8a14ba199facf29035f139e64ce4f89f6a9255
SSDEEP 12288:8aiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:88/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DB5523D3548955B1FABC0039C6764428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 64654327f3590968a9d7a38a8b1b039082d6cb6001540ed685b83b755fe7ff51
MD5 244558b014ef40a545d397cd564655f6
SHA1 0aa109cd8579e8b17f29fc89e207a25ba540a21e
SHA512 7c6d75adaf4dad0ccda093ba6ae957d65e361f6d6d011c5138c2acf0b5206346985a7ebd40ef4fb6e0a0dfb1d09bb78635ddcbeffccdbd79ca5ba80e22d73f19
SSDEEP 12288:ePiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:e7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1775523D3548955B1FABC003986754428F5881E2DEB5619E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 27f832d64d4ab137ecbe6c20d9e53a38964412f4202813b419d0f67c9e62beef
MD5 ae223f34d4fa457542edeb46c68076f0
SHA1 9cfd6e1c42c40e2c366bbcdd1db83f81bd7bae21
SHA512 e9b2ca47ef67d8edb41584cd2c75d8b1082258952907c1a4ed40d8ef8f0d08f5ff076a296cc372ea805a059835a457213d2b78f8f92f102f39e0a497c04afa6d
SSDEEP 12288:B7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Bv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19F5523D3548955B1EABC003986754428F5882E2DEB5659E3E3083D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 a395b3029305e3e36cee96791559c24fdbf83ee5678b1d19b0e7782dd9e74142
MD5 b42e4a7d0ed58698f19431123a30cd7a
SHA1 3fec285b3574a7f36e28f1080a3c5fca6d4590e0
SHA512 7f8e3a6da00e481557cb0ec8516eec4f265cf2e2e47dcdd08881a7fd87537aa794551d4248524da65a08ad3f3d75bd375d04fa954168865cb871caa61b27240e
SSDEEP 24576:AZM3zFVSO3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AZM3zfrLNiXicJFFRGNzj3
TLSH
T177750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 fbd2d8be8f28b0117ca250b5a5815d0d17c7250dc20b4939f8a7f053e4880c1d
MD5 ca728d65deec54b4284e34816f712012
SHA1 5af61b95acde2bfc8e3e473595152a7829da3faf
SHA512 08e82aeb4bddf48202e1a50428dd4b0e2a947eea80027012f26cd2f2e3a273f9129641c4f80cd46a815debb180d2546fb7918e9caed33f5d7ef3909d6a0f708b
SSDEEP 12288:/EiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/O/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15C5523D3548955B1FAFC003D86754428F5881E2DEB5619E3E2483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7113317783ec8560e1f504044d973a4ca0012d707186d763be08a01f8d80b50d
MD5 c6d1de3d6e89669d77144737a03e9738
SHA1 77d66aa500cdce4981f6f4ad984c425ed30b9a99
SHA512 6e40c2b4dd59012c0b6a0ca84689055edc0610a12ead97d829b3473d753061372ce70fa16f9eed6d7be6403d8f3471fb07b099fdbf34f4eb09b6289792d4b783
SSDEEP 12288:QIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Q6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1485523D3548955B1EBBC003986754428F5882E2DEB5659E3E2083D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 cc91a3d4506d31d2341e5da8ee00625ca5787cbaba2ce53976ede4c71b450e51
MD5 999192c4c1b6387501a437cb7c7f49e0
SHA1 c1df78c93ad471933264ce488ef99c600140622a
SHA512 fe836e9f2d857628d04eee41f7c85eb225bf74f76198de08f7ea22e89e95a104918608bb5279d5ed0e26a7ce1535038b3be32a600017c6cde65953c7e9002729
SSDEEP 24576:Izyj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IQLNiXicJFFRGNzj3
TLSH
T170650147729530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f5c8cce8e237522e0c03471fb3e39e24c39f80a32b5831a5dec7bde198f207a0
MD5 6a371f5a4303e2caaead0199bffeca1d
SHA1 d0498dcfb39788be1907d37746ec7d486fe0cc24
SHA512 972bd23c949e5317b39707ace44d7764dd08bf9022c0678b8568c1882472230b2c452c4e7d2e9eb543afac91d54d7ce52586496bd500274ce18ae2e615f087ac
SSDEEP 12288:SEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DC5523D3548955B1FAFC003986754428F5882E2DEB5659E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f4d42453af94923026fb332c7a043f4d084591170f69781174218d5a40a0be56
MD5 630dff7ebd009c92d8e90de9ceedd341
SHA1 9e246faf9daead6c13ba0d4e68223619be3d6f92
SHA512 2e187549ef5775455f49799aad53305b1b91031c201d73a6f113dcea7402f3c871d99707a3c20b1a25d1d42574ec5d31246163856ffbf6fb02ca7e71cd5ed792
SSDEEP 12288:zEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1335523D3548955B1FABC003986754428F5882E2DEB5658E3E2483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 0e61fdff7c24020f45ce24be97062155d8e727d766ccd13dc6324a9974cf37df
MD5 7a3e033759647346348d471c84f9e1a6
SHA1 b39e8c57588591500eb5a6489cf3250308c0bffb
SHA512 fcadc40b33a91117a022a031904cddf7672f7f7ebabe4f664e5ad58eb793fa5cc6fb51f26f758d6e05d11ca1fbf465464bd333eae6484dba5246f7d25c97ee31
SSDEEP 24576:Ezyj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EQLNiXicJFFRGNzj3
TLSH
T110650147629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 ee3eecb9b6811757f3b21a991bad00b388410de38027091ad4d5eef3abaec44d
MD5 687959def2aa0dc09c64a7b4afec07f8
SHA1 66c1a44b28c9607d10c6139ee53b78b20dd165fa
SHA512 e692782913e010d5818a795145c06d8b2feb475cd2e11021cd3176a6bec7282d1ce10e1e0e966279b44bb1987d8cdc3430de0c6fba58f13ce904f5da43c9bd65
SSDEEP 24576:jT8aLl3z0zDB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jT7LljILNiXicJFFRGNzj3
TLSH
T16C7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 abbbf5daec146cd4a366fb31b2ba164b51561ea1a8dbdc4646b9cb4d2675940d
MD5 f59b92a6a28fd45af33b7c447c868b0b
SHA1 968fc1798a1cadbb55a8aafc992ef2cd54353cd5
SHA512 314c1603369bed4aed3fde64ec30469288091190182f0616d187d74717b002961fe59602743a01d357c44760ec8a6e835349531f066a65bcd1f70d6bc9bc44b6
SSDEEP 24576:s3rd9CHKy7GZV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Wrd9CHKyarLNiXicJFFRGNzj3
TLSH
T1E485CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 f0eb2e7647adef9eecd47e799f0b23783110b6f4d3be64910d85e60e68e557a9
MD5 1b6805dcafd7f44e2df48cea2c3dc079
SHA1 da6f91d15d58d2bf50b0fdafa59b70fbae76fd31
SHA512 0382b00c8bb7798246a817c94d7aa188cfb8b480fd8e8b732170d3a7106813fb12cdacc634457a5b8f2abfe8997ffe5952e684c79da0455d76cdb9f009949f21
SSDEEP 12288:VNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:VR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A55523D2548955B1FBBC0039C6764428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 fb28bd48f1dbb37567f9c248cabba0083bff5e4c9d094d691c16a977aeccd2ee
MD5 ae9e303d667ddcf049c322ea7050266c
SHA1 3a68a010595625a065397dfe9d2eae11402ab5e2
SHA512 442aa86686ae8b560e47dd375d3b8472e4c8d017cbdb50dae62df6875cbe54d3bf0fefff630063231eb9476887e064c793c5f31a73cc1ebd97a4daa809ad951a
SSDEEP 12288:73iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7D/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15C5523D2558955F1FABC003986764428F5882E2DDB5619E3E3483D1EA27CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveUpdaterService-2026-09-15.2230.2256.1.aodl

Path C:\Program Files\Microsoft OneDrive\UpdaterService\logs\OneDriveUpdaterService-2026-09-15.2230.2256.1.aodl
Size 10KB
SHA256 98e43a3145e88e88898e056540a2ecbc02386a351e5bcd67bb9efb7f55e95d4d
MD5 843c2bcafdee29e1aff5c37c94a1eb6e
SHA1 6b444adaed34fb527a9649162ab74db9b78f6832
SHA512 3f4298e32bd9bf9d115c14bfb246e258b94c92bac93893924677b388952a1306ac40550b4b8ebd6439707dad620d644d66e24656ff61f9582f7e5d782f665b4b
SSDEEP 192:evpngqIIijwSAunVlY3YntZtAL8WGsWNEN3NdNpLrBHWWWpFU6OOIBZi3/LSPvcB:3F9YDb4x
TLSH
T17B32EFE5CCA841D1DD42203544A0CA9EAFF5C8ADF2D6FC2677C26D4244A7B292FEE103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-09-15_223032_2256-760.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-09-15_223032_2256-760.log
Size 1KB
SHA256 ecd665b78e2a95cc3844eaeb71f6bce3d51eae621e6553dc91836566b1f587e2
MD5 673a84c7bd9d1dad52d963bf1f36f89d
SHA1 b9c8a0ed04f23eff7e6eb395e0636e86d195c51b
SHA512 4fe0522e606f5587d405c757ed86d21ccabdbec1638109fb7e843497488cf557481b5d04f838914508a11150792e8d8a79b35f3475edb15416d0ab62ea37291c
TLSH
T155218C092BE80A06FFFBDA8258F611439E3939926831CA0C10E5924D0935F40FE7432B
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 0db8bd6336af9ae31622b63e8104951e5547846f761a47e9c2653b42538cc2be
MD5 4b02790e25ec6c1319e3f1c42fc976e0
SHA1 d5741bb9e198a5d2c872e0c3c12229f257ecb434
SHA512 04b38a0dbcb56d9133c72ee5b06db7f9b8e6682e3629e56f4e35b44bf5cbc657a60817501d0371a581a49027ffec3be9ad39b3a85edc8f502247a4e962b11589
SSDEEP 12288:Zpsf0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ae/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D965F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b3fb21ae6411301d976b2e5022a49e9cbfef4bea1202bb0f663f539ba67c26f4
MD5 8b6f3b641517d19a754c5ce5a88c0c32
SHA1 d5bd230efe459759390c8c7ba1f27743183754f3
SHA512 eed329622b6aebc53a2ded4941041d268455456649faff6a597c230c36a3bd572a1d0e7240727f71dc6324d27f46f803c9d1d627363b6d0a3fc7e8288f0ade5b
SSDEEP 12288:oHAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T140552393568C55A2F6FD1039853A8438B54D7E2C9F5598D3E2043A1EA238FEBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 dd13041b09cdea8b1b1c7c0b7c3576bd5b60ef4dc14563d05960430ae16baa76
MD5 c7c71db1a08cf140e52caf39cf0257ab
SHA1 fee8bd9526e02f4f4e55190abb3c940324768f9a
SHA512 c6fcdb580a8d000ece46a7d018140b27b5de82c0f39cab997a5a387fbb863f840814e7fe6d2f542e687fe47991830092d1234a2148ed834c2fb12f7b4a050a94
SSDEEP 49152:la0h2GEkuAe73q3pp46zwwQELNiXicJFFRGNzj3:la0hNYG4JwL7wRGpj3
TLSH
T15E85AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 d5b854598071f2d095ccfaeacbcf34d022a5db4044e0d6fd32dd9b4f23fbb9bd
MD5 618cf7b29e821e4fd957ced7d81a34b0
SHA1 bc87ec803125428b243a1b517ec98322691319b5
SHA512 8baec5b5fef1c27751481d66d97277b924815d863feb1bdf4f10f2e069f984749a9193962af20dcb58106f92b097c15e66ac010a7c09ecbf634a2ca2f295e025
SSDEEP 24576:5hbHjPH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5hbHjfLNiXicJFFRGNzj3
TLSH
T1D95512BE169C20E5F6B5903D85668409E370BC29172197EF6381523E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 032b487f5c48968ee3d402cb419c06e8ca4e862bffaeb2cd39077ae4d6a124e3
MD5 0743a497afed83eed24c26675509bbcb
SHA1 7d22eb4a8a8591c75ee606df57eea012b05b70ef
SHA512 f2ee36efb81984f8bcdd2aeb170f9deb6413a9f46912b158d7548381ac51334c4b01d7dd3d83a5c7e3e7e7e8f513295b1031f17ee071de04e058a9f8e57c4349
SSDEEP 12288:/bAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/e/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11A5523D2518955B1EAFD003D867A4428B5882F2C9B2619E3E1543D1EE27CFEFCF38562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 bf882f0155802f898bada7570fe85da8c85a89d51808ebf7306fb8f0ac6c36c0
MD5 cbfb9717adeabaaabc235fe581fe809b
SHA1 7bc00d12966ff780695f0566a13c81517e755503
SHA512 26e685e27204de494967024d6f66702fee21dde63fad67272af190d66fb98bb0d48b4c1a1e183bec789b9097356993b1526fd20591585a06e4f6f370ba4245eb
SSDEEP 24576:GAL3UTR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GAL3UNLNiXicJFFRGNzj3
TLSH
T1F2750155E79400F5E97B813CC9728916E2B2785D0364E7DB03A84B6A1F237E68F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 07dad2903636409b6d5cc83f601a3490086bbfc4433dd3b2a3f1dfd650b63a17
MD5 a174e76f6e313816284c68ecd3b26a72
SHA1 5e2ac2ad19dc2bedadebba4ea1d01608d35c1134
SHA512 a534cf4c33eb79f311dd12b222c699707bf6c85eac94ececff12a424e1b3de8b36dae8b810dcb5314f6779431d9988aa76cc04f925df00301912401ce9cc7cc1
SSDEEP 24576:kOt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kOtLNiXicJFFRGNzj3
TLSH
T16C55126A32DC10F4E579503D8AA2820CE3B1BC29072257EF4290557E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 597aa2f2c30a74228c2203e68a4b06a289623c822f485156f088783f449de4cf
MD5 00f58eb97aa65ba03c69ea7ffe46dfcb
SHA1 85ed1b449bbbeb4da94f3c5510f0e673be4444b5
SHA512 54ff3ccbbafe9522e73663a1a998a9666560b1e63d0d3f1c5b617185ce7e8b7510534784eaf27353104478c909a73a018598cb94713450179363b9bb1ad3f004
SSDEEP 24576:T7NM9YqZqmWMUkPjZM48Mv6bEhsC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:T7cBWMpPjN8DbEhHLNiXicJFFRGNzj3
TLSH
T15565AE2E6BEC81E5D576D13DC9A28205F2F1B8611B318ACB5162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 f82d0ea71326b57da4b4d41e944dd67983e234efbd7181c48b7fce211888f469
MD5 6316a2569d97ae6ac1d8640af5dd2dc0
SHA1 764ce4b55e116199aef86568ff3dd9986c62c4f7
SHA512 dc918fd4dd2ae063b91d022afbae942ae3d344c1d8a77e331ec1d313cb6e82d6077e89884ffddca3f1b7df2b0c81021542166d493a1c2160ea6564d3af03c7e6
SSDEEP 49152:IF2YuHNETovAvNYf8kmiLNiXicJFFRGNzj3:N6BCf8kt7wRGpj3
TLSH
T1A6858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 52381e85d19fd50319fa88eaa0e33f8ee6a2c619691bd045264204c1e2dac7b5
MD5 b953739258e928501b63234f0a462690
SHA1 2aab7abbbcaeab95ec76bf74b3d46a9db254c15a
SHA512 870f90d5ccbf2a1af582c55277aeaf77278a416bc3b831596e42c39762aab1645e048e881adc563cbfb7a79974445737da9d22e975e9945be09d3eff5d7139fc
SSDEEP 24576:6AFs06+Omlf8NXEbTop/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DFs060loXukLNiXicJFFRGNzj3
TLSH
T1FF65BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 79573ebb6133b495f25b4e6d54243c788e7fb36128d8aec14a5425842ad0ea10
MD5 5f876d06bd8a27e54cdfcad75007247c
SHA1 809d5fb89f96b95e0810950219f882965deea0a7
SHA512 80d3f63df8a258372423553f7b2d1319d692a8234d5b3d0f63ab83ed947f3bd80ab0ca84d409dd72aac1ace2f7c17c3833649597564ca3364d1485e27a83220a
SSDEEP 24576:oJnJ5D3WXk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oJnJ5DGXkLNiXicJFFRGNzj3
TLSH
T1BD75D02DD29810F8E4B7C274825A1A55FE72383D2F226AC724B4D5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 3b67deca26df8fd5633c48e59ab6ee5c9c34641e5d5fcccad7ce7ef03be21165
MD5 7726a1fb32fb534d91cc594404d0e29a
SHA1 a3a690ccbc88a82a0e23447072d4e7ccacf44aed
SHA512 93df7e8ed9732c81e526a90877e16d6e1321471b0c70d47c1e2a80becc3fa5dd1a524e936db1e05155806a7644cfc16945cccdcb0c570f7b563f2f3f2b8195d6
SSDEEP 49152:cg06DIKdwc+eQnSt65aVWLNiXicJFFRGNzj3:No7wRGpj3
TLSH
T156956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 385affb1ff347c320c11d4713320bb07c514dc5bd6e8da6b5cc1eac16ec6fa90
MD5 c03fc1b1a152a051edf9f8749c22b44b
SHA1 fd2b27f81f017b9e3a7a29e561971bb68f7431d1
SHA512 45c1b97621ea5589a02d2ff8cbf4e63babe41e46c4529d1e4f01b905059b533fb7fc54cadeb1c5bebbf08f88dfbb5ad2eaf00f20aa727732d0b1dfc14fbe22c3
SSDEEP 24576:Fns/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FnsLNiXicJFFRGNzj3
TLSH
T1005512AE278C70E5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 d16b7e5306dcb6676903b57675c77d2b6589f36767eb57d0b1f5006fced01395
MD5 33b6fa67b16d51250d7a94c43cd1ccde
SHA1 4903c2a869cb01bae8752eeab0d5458e90b940cc
SHA512 0d9b89f0c16bedccc0e064c818faf7059c7e1f7db1df4a832e02d2a87b3e171ecb2cee5f05668aa67c4399699c15423fc7f4998ecee7d5e1c5050efa27b2f4fa
SSDEEP 24576:7IyX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7I0LNiXicJFFRGNzj3
TLSH
T17965124553C860E5E6B9013CCA778064AA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 da05b6f88a2dd999854a40ee8cfa50daae999eb967e0f4434d67b5ad4894b94e
MD5 0f66226f8a8ebba3319aad397ecd7986
SHA1 bd7a0de335b26f4c891f9bb4168fbd050399c6ba
SHA512 4b7abd52fe5bf13132200fd2a40d7f9448da4b4bc2e956f22041a144ac40782529f7ec0e169298723712961607138d594e43d9545b2ee1d1332aacb2356f1e49
SSDEEP 12288:syEAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Zd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FF55239A118964B1EABD003D86394824B1943E3C9B1628F7A1947D3ED339FDBDF38952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 205a71893d0e7800c20a78312541c81ed2fbd8f8f6c82552ecd50d53c0438d70
MD5 8fb0d8e914e567b5bda93dac087727b5
SHA1 7b15bf9db70a9cc3934d9005c0f49009f13edc89
SHA512 af21d835b96afc30fad4bca2aa1154f92b693d7a66061e12ce4b18c372a112b923ff52528d97272cbf63fa1abc9d59a3dc565b6c985be2d6898ebbfb92e79c4b
SSDEEP 24576:bQ9MxZKdcz9dw3a/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bVKZaLNiXicJFFRGNzj3
TLSH
T19F558C2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 4385a68613bc6baf4b5f40b602560a0c6e0688fa34d0a82842f83e334814db5f
MD5 4e081b1a2ba1cbae76db03328a227e8c
SHA1 80d7160434b450946d8f9e18fdf81022bf743371
SHA512 42e7ba723dce3a6299979e9207b196b59bfed369772753b8ca5badc03f9895097cb4b72e4069f923457e945fe73c2a746f9a00ae073b865f9cc1933331766db8
SSDEEP 24576:ryocDApj/TwSfVcYG3K/cJHlnFR+IGNe8j3Izm:eocDApjLNiXicJFFRGNzj3v
TLSH
T1FF65E05FB76D40A2E176813C89858204E7B3B4345B6257DB6181C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 0582cd67bb2afd81c698a7b79ec42d8657db979eee8945e33b7846973838a272
MD5 45543391cf18ce6e1956082e04d35917
SHA1 d54ea307668bb08c1fe3f58c9689fc32db057b03
SHA512 b02fb991a9f2f9bb9e016c4793b140b5094ef98e44f10066c066ef763fa1366ca139eee70f80f644098726b5531525ffc5e5ed41edfdc1ccca6eabc04b865299
SSDEEP 49152:eWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKjLNiXicJFFRGNzj3:40zuNIR7wRGpj3
TLSH
T1CFA57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 97f05b76e36518b587f6f1d620bfccb46262552a5050f8b640c8717e67ab0448
MD5 f268b2382e6f3af973d75bd0edfa41be
SHA1 0bcc1c7ef4d9ec2324618d6610b30b62fbb5edcb
SHA512 d55a3679c1628f221c713f9427cde22ec6c2eed5a9174ce86319cb0d2f02c35f4fbfb3b681e07f8e802c4db97dd415d93d15445eb316ed3c937ee7479a18d157
SSDEEP 24576:s1QT7EcpfxR+N5AWAz3ooiYzjMqbs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xTDxR+N5YzTBjMpLNiXicJFFRGNzj3
TLSH
T16355B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 15d1c076866ca3e16e5b4b901c803cc268db9ed47fc7d8fe47f312abd4764c69
MD5 3c81da216cd548a04af3cedd25efe69b
SHA1 b183b2764f2c2658166b4766a3493bdff8b85a2d
SHA512 09435088fba99be071d2bb9097472ec005efc8cd57796f31a9cdfaa378539ba8a0db55844ffc1be1329dc76b8f3c6ad246a70d9de7a6fff1eddad48756b4e096
SSDEEP 24576:Z3YgnJcRTk4yti+R5dBR/P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZIgnaTk46pBR/PLNiXicJFFRGNzj3
TLSH
T1AB45B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/896-279-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/896-330-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/1064-310-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1064-308-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1256-306-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/1256-410-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/1760-411-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-442-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-418-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-419-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-421-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-427-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-428-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-433-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-434-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-412-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-435-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-436-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-437-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-438-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-443-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-444-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-445-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-446-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-447-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-449-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-448-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-439-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-440-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-413-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-441-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-429-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-431-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-416-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-432-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-430-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-422-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-424-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-426-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-415-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-425-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-423-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-420-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-417-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1760-414-0x0000025584C00000-0x0000025584C10000-memory.dmp

Download

memory/1932-244-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/1932-312-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/2256-35-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/2256-83-0x0000000140000000-0x0000000140432000-memory.dmp

Download

memory/2256-8-0x0000000140000000-0x0000000140432000-memory.dmp

Download

memory/2256-0-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/2256-9-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/2404-13-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2404-236-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2504-317-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2504-556-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2608-321-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2608-557-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2616-348-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2616-408-0x000000000BA40000-0x000000000BA48000-memory.dmp

Download

memory/2616-401-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2616-559-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2616-364-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2616-331-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3320-205-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3320-81-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3320-75-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3516-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3516-57-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3516-206-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3572-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3572-71-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3572-73-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3572-67-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4048-262-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4048-320-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4048-268-0x00000000008E0000-0x0000000000946000-memory.dmp

Download

memory/4048-263-0x00000000008E0000-0x0000000000946000-memory.dmp

Download

memory/4132-273-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4132-323-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4196-29-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4196-25-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4196-19-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4332-558-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/4332-326-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/4352-325-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4352-407-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4352-275-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4484-249-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4484-255-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4484-248-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/4484-316-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/4768-41-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4768-47-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4768-204-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4900-313-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4900-491-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4928-301-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4928-295-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4928-294-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4928-406-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4944-282-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4944-290-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4944-288-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4944-403-0x0000000140000000-0x0000000140169000-memory.dmp

Download