stealc | d7d5f62065d15685803169c3f3d0b8724349e4304b91d9816e6ef0e5138ff31c

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.5MB
Sample260930-c6e7hs1djf
SHA256 d7d5f62065d15685803169c3f3d0b8724349e4304b91d9816e6ef0e5138ff31c
MD5 3dbb73aa647f955de77e0b95cf8b789b
SHA1 2071c9e69295069d468886ac4ffefec87a77cbe3
SHA512 9f9f5c3d1cf6f6228cf9f93853c20e9b72992e8f52b257f1b4d2bb8409032ad4549df8a9b6a67cddcf2091102f2270e782b819989b35916c118f3e37ada14d1c
SSDEEP 49152:tikTMyYL/XelJpFrm+NEUAzyABqAh2zMlX5boOwcZMzR1dIgdV9fJ1BTvgPe30jz:PI6uiOVMNLFZoU023W
TLSH
T12C266A07E6B901F9D0BBD1398A979617FAB27859973197CB0290465A1F33BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc ransomware spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 2 IoCs

resource	yara_rule
behavioral1/memory/2576-8-0x0000000140000000-0x000000014047F000-memory.dmp	family_stealc_v3
behavioral1/memory/2576-76-0x0000000140000000-0x000000014047F000-memory.dmp	family_stealc_v3

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Executes dropped EXE 22 IoCs

pid	Process
3840	alg.exe
888	DiagnosticsHub.StandardCollector.Service.exe
1960	fxssvc.exe
1280	elevation_service.exe
4140	elevation_service.exe
224	maintenanceservice.exe
2256	OSE.EXE
4608	msdtc.exe
3620	PerceptionSimulationService.exe
2180	perfhost.exe
2488	locator.exe
912	SensorDataService.exe
3668	snmptrap.exe
2500	spectrum.exe
1592	ssh-agent.exe
2612	TieringEngineService.exe
4196	AgentService.exe
2368	vds.exe
3916	vssvc.exe
548	wbengine.exe
4352	WmiApSrv.exe
756	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe
\??\F:\	elevation_service.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3dd510fa5ef7726b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d1ce1648550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000726db1648550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c8467648550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000077fc4648550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a7c21658550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d27054648550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000035b279658550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
888	DiagnosticsHub.StandardCollector.Service.exe
888	DiagnosticsHub.StandardCollector.Service.exe
888	DiagnosticsHub.StandardCollector.Service.exe
888	DiagnosticsHub.StandardCollector.Service.exe
888	DiagnosticsHub.StandardCollector.Service.exe
888	DiagnosticsHub.StandardCollector.Service.exe
888	DiagnosticsHub.StandardCollector.Service.exe
1280	elevation_service.exe
1280	elevation_service.exe
1280	elevation_service.exe
1280	elevation_service.exe
1280	elevation_service.exe
1280	elevation_service.exe
1280	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2576	2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeAuditPrivilege	1960	fxssvc.exe
Token: SeDebugPrivilege	888	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1280	elevation_service.exe
Token: SeRestorePrivilege	2612	TieringEngineService.exe
Token: SeManageVolumePrivilege	2612	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4196	AgentService.exe
Token: SeBackupPrivilege	3916	vssvc.exe
Token: SeRestorePrivilege	3916	vssvc.exe
Token: SeAuditPrivilege	3916	vssvc.exe
Token: SeBackupPrivilege	548	wbengine.exe
Token: SeRestorePrivilege	548	wbengine.exe
Token: SeSecurityPrivilege	548	wbengine.exe
Token: 33	756	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeDebugPrivilege	1280	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2208	2576	2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 756 wrote to memory of 3680	756	SearchIndexer.exe	134
PID 756 wrote to memory of 1236	756	SearchIndexer.exe	135

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks computer location settings
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2576" "1240" "1144" "1244" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:2208

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3840

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3984

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1280

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4140

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:224

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2256

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4608

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3620

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2180

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2488

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:912

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3668

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2500

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1592

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4896

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4196

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2368

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3916

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:548

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4352

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3680
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f03c2f0283b7bdaee398be3d53120aeda9329c73cb549b637f9316b1f39fa376
MD5 86ab763e9e41b298eaed6e4b0be1b591
SHA1 578de185b39e5d604af305a152daa17d44c5fa26
SHA512 0d2090728725700a5adee59f248d1b1d8982f7103930248ee869579782cd9a425296337b2c249cffa07698445e71d4e511f4924c495a4caa4ac5d3b15feba2ea
SSDEEP 49152:tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnle30jaNf1TWbdz:z3q6HjBAU023W
TLSH
T15BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 dd2ceb99dd0120b9067566cc774392fe5208a6b757f4542a6f1cd0b5ae2ce252
MD5 7c03c99d632e84fce45ff5345c7a6c8a
SHA1 51baf7f52a170e386acc2aecb21f0bcbed14b353
SHA512 6c1316460e59ec3d377b97097613bc513a2f3147a221be3ea7903712088df81da2e1fade4ab1915d98c3eab9e525597ac06ea7c1ab56ab8a383f6d5b0ed43133
SSDEEP 24576:eXYfDtczAsgXe4i7ojhsP5Lgrk1TWb4AN5:9tc8e30jaNf1TWbdz
TLSH
T1F465F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 c4b06c2ee256dde7dc78aa10b32cd4d93ce740c5c8949d69cc00089226e966e8
MD5 0160d3f2c80df18347af71d5e227295c
SHA1 0950945681b29f0ab599c614182a36b76b4a6872
SHA512 d5e83d80c47650276d05427ec2adedc048824f903f3eec54b6d9e79a49d0c910b2cdd5a429c1a7744e8f793432ecb0d9e64503df378d9c8372b173e5f687bbb2
SSDEEP 24576:U0Le5ji0hmxirMLgXe4i7ojhsP5Lgrk1TWb4AN5:UPji0AcBe30jaNf1TWbdz
TLSH
T12785AE26F6748775D073C0B9C5D2A78AED71308217308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3d523c5b52e3b036292dec074b67deef59e3a600b3a94e181bee09aecb8e441f
MD5 511f5c4fffda52885c930db4106b8dea
SHA1 d8903fb6818ba72ba640210099b103fd9d1f7e42
SHA512 65d4784634eb289e852c10ac0b5aa48a3429b714032bed821df1faf862445106bb56956e35074a1c6021b70336ec5d8fcee8a6cceeddd02fce7714de8ca202eb
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWE6q8wyuxgXe4i7ojhsP5Lgrk1TWb4AN5:1/ezSC6vUzPvxHjyNe30jaNf1TWbdz
TLSH
T1B4756D25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c762db9bc15e280183b7d6340c4c57f1247c19d9890903d624c6defccde35004
MD5 6a53c0b33c9906b74f4458eb781c4960
SHA1 f49e481486f565e25aee49cf872cd75dac2fb716
SHA512 73a53c2b070f555e1d008391e6cb43d63eb587c8c3fac90d9c28e8e620adc589c64eb89d75e50209e28c1bdbb87041bec361c75312ad61b1967b53c900b94494
SSDEEP 24576:6VbqPb88hv/l+6AgXe4i7ojhsP5Lgrk1TWb4AN5:6VO88hXl+ue30jaNf1TWbdz
TLSH
T183559E66F5748331D073C0BAC4D39A9AEE7234425B318ACB0246D76C2E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 17c3fa26e3c7b3004127c3e31faa4316a4ff57b8a32f376b3ffbe00e22bf1b97
MD5 7c852e3c96ad9958b0c63cb8779c03a4
SHA1 a7ac45e6b91bdd40d44bf04a78215af8a5a36bc2
SHA512 65e093f419821436ce9c03ee510c8ea80a4431dd6755b3e1095d807d80e07e7d0e84d03516a0b1c77fd57d4cf40412e8db06a5b77198d01b5a311e11c9bfbd3c
SSDEEP 12288:tRG0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:tRfgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BC4523919F5409C6E38BC3F4A0F7CBD1F9E11EC025448D6B47E0BE9358BC899EAD8469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 d9f96fdd582e4fd79764fe54dda684efdfba28745bb1e01bfc319ead0b415839
MD5 f2944ad32e6a33db3a312ceca6f95a40
SHA1 383200e7dddfa28157eb70efcddea296f0f5a228
SHA512 62378347ddbf88280314f65c780892b0d8aa39354968ac61d2f2a7069507e007309481c96aaf3ad6c6e1512e93351249e29380cb462995356ca6dcd9da7be029
SSDEEP 12288:HeBNUbTVO86UL0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:HJIUogXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13565CF3BEE28FCD2C27E8DB85691C740E7B278704B5193CBD1A4820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8202d49c83ae5502768d536bcf7d30eca8e9731a26fc8eecd3ca8e2a3388ea84
MD5 b9cc2d9c8bf2563e555e062c6851cbe7
SHA1 966e6551a73d0fb3c031ff6776e06578b7ac5680
SHA512 fa9eab4b77bcd31d656f5689ed1b70f59126fb513fa31100bd0089c9cbd6164b248f879b2b338f1825c8271bca5011a34768118281c148102b2596cf7c78562b
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THx:KQvGAdlCEL8c/yRNw5CcU023W
TLSH
T1E2267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 dc41630ed9f7a29d214fc1628512fc790cf604e6420d07562c117c00620ccf84
MD5 116b85dec24b72a25fcec95fffe4954c
SHA1 6c4553993ee78a7718ea305c62e0f28a6fe5dd18
SHA512 eca24aa2bdba8ec926dde54124fe2bf47eda51258a782d1327819380ee56bb62b58d3aa48fab624a40fdf6a3095fb16c782d7c601865ce0b529c53f7a2e742fd
SSDEEP 24576:NdewsAj+gXe4i7ojhsP5Lgrk1TWb4AN5:jljRe30jaNf1TWbdz
TLSH
T1AA75E031FE74D032C3BB0DB21B76C716686C7A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d1b41cbeeef479c5024d5a34df62261d88ccdfad4927b2b72852b69dab3b3b7b
MD5 56769350b0e055fc93d724f1775215f1
SHA1 9836eb16f287a3616da4e17b1632dbac3e100650
SHA512 be7e06cb40fe7e6ca3719be39ce9946fc27b2a95a7ba4c11967302b9474ed8826fb3710e9c783bf621cb42b9e7d5b63a728974e325d992c13d27303ec7ebc530
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHZp4W:EUEtQevvqc2W1cpV2EI32L4W
TLSH
T16E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 47ea9d522fbbd3414de275e2ced04ac564c1fa0d3df32d6c0449aa23301c9442
MD5 da31882a4bd04d0aeda53106b28e7593
SHA1 3a978cf22fcda2916ca5a21e235610d066c37663
SHA512 44482833465a39d4775ba418b475ef6aa69f2eb1057ece192104d85a1ed1db028038e60d5c5c0117c54207ae2fc6800aa6361f61e8684dfe4fa776340f037e09
SSDEEP 49152:LCbRquA/m2yL5zLfFiV+XenmE3/zxe30jaNf1TWbdz:Uoq2VjnmIU023W
TLSH
T1E5D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 995d42072a2465c564e6b6c35473d536175530b49bedec42868756fb5b1005f9
MD5 978b32ccde4b5154abd243762ebd1f86
SHA1 9f1274867b8edb39bcd1b76f7ba162d5342336a4
SHA512 d95c8c3f4f5fa8a4695dd11fc447f1bb02986dfdcb757d688ebe4d4ca3e372b10831e709b253eecf4941bd21026bc2f21be0cf307d3efdad86e29475abc13c30
SSDEEP 24576:lAhGLJIFoiwtA5l7S53tgXe4i7ojhsP5Lgrk1TWb4AN5:lAMyFoiq5Ye30jaNf1TWbdz
TLSH
T174359D81EBF955D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 ec857a18254bf62bd7286dcf547cc4a6743988c5243282f7404a2d9fa4d16d3d
MD5 5edb3012c8d8ac5df7cfacd3e8eb435d
SHA1 602775628e268e3dde589b70bd1c35934a03f5d1
SHA512 84ec8da6b0f7650d1eac75fa3f3cd5bbf7e3d7b397bc61f8ff398d5a9ae3bd8e44a14c90624c6b6c3dec51c866a8e57260117e3f3c8e0394a0c1d6442a59daa0
SSDEEP 12288:Cmw5HEjsChNVBFgl0WDm+Cw0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:bwuoOWKgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BB65F14676A40CF9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 587f4c74bf9f6fceb3556e01ee8bfeaef314f5519ccd5265d3ecee9350850144
MD5 5bf02290944948c3e1f52410000b7e75
SHA1 9ad98878136076579b206982d9755c0757ed4c3a
SHA512 ac6bf9589cb25d13de0545609039f44b19127638dff23dad31ec2bc3582f07de12df63d6dd487e44889abf1954f687c2deb1cea8cb45402dab592f5ad764c42b
SSDEEP 12288:rBZ1IyB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:FZuzgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1FF55129637D420F9E29782B8D4F68741E7B23892233147CF02A096A71F76ED65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cc169aaa419b30d879238a88c80fc17972acb892af72ef5cebeace21f0d42ef5
MD5 44306c2bc39a8a26de01f9b8855bd953
SHA1 fd3c96ac529903ed7c3aaf17b19c227ba665115e
SHA512 ba00771a82bb40ba8eae5381aaf752d3400c91ee456685cc9dfa2fc682f8c247e7a42de049b846841e518a01d2d02b4fc8d2be8f385a8062f2eada6c520eef7d
SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UF:NQRQyi36YOcPQLvw2gAf+PN37U023W
TLSH
T19B667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c016f03fb85eaa7cd534a81c5b8c70baf9b4e43c9f68d3da36e168e26ae94815
MD5 f75392445d8df27fd8ffb90ea86dfe39
SHA1 ca23f6253bfd8ef8f16596af116a679e1764a339
SHA512 6fdf728c2438fcce1d41ed86868f9e94434dc618f166d9cced424884d5e863c9fffa2b4dfc6bf93f35a21da62e9157c866e069ec8a2d608346d536bee8910002
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UF:pQRQyi36YOcPQLvw2gAf+PN37U023W
TLSH
T1AB667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 38ca40659e06db36e00ebd50f57aa1c9852ea170a216739e3bcfca150f2088cc
MD5 3a92f526210b6b77b24d885eb2f2b1d7
SHA1 e4dc928b4c64118e157617526b9f624dae046964
SHA512 65b926a3e9b3b1b8fac1f96d7dac4961165db3ac872760b89ed268ab206a1e35a711d9d24eafd18497f8ef3ed70642936eaddb423d4362720b1ee21c129f27e4
SSDEEP 49152:668Qg55nhheWu7PNU3/Be30jaNf1TWbdz:othWRc/BU023W
TLSH
T1DAB54933B2F20099C04DE1769F4A872196E27C758FE0E7DB855172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 555b786eb081a91e89275ba3e4dd8f81bc67bcbf5934a7a1c7abcb94f5d57065
MD5 206cb8a77cfb569295545aa6f1d195b7
SHA1 00f25e4f6a70e199b62e9cbed0118ceb16e3152e
SHA512 7fcc4ce216977dafc29d0636fbdabdeb253a371b7d1aae295585bc708e6948c7bac8d3c65376a29609b2cba50e3b6599603f004e20512893498faeed35a772f5
SSDEEP 49152:+3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99r:/y5112gYy5azzVvL69nLKnhZ2U023W
TLSH
T182167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 41169d80e8ba9322bb13dd151244e0b653ece80c70e0f536ded443bc32cdfcd3
MD5 786b7dd3307033517fd675215ae5ae51
SHA1 2002a0a0e3673bcb57ed5cfe9504345ab04b343d
SHA512 b9d464a37022948e52da7ac15c1eaef9922639ed3f7850e553bd4bd12fa128a603bdbeda63925ad4bd8f1217eb52eaff15cbdb43b7e78509d8551950ca097a2d
SSDEEP 49152:gB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glUe30jaNf1TWbdz:6u6JmVxd2dUU023W
TLSH
T160D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9b9669706f4c28443649fcb83074cb6234262cc76dc5ae23184c87d6f64a3572
MD5 729a9080d5d9901ab83632a93597f9f6
SHA1 4eaa7af35447000530f847e9e17c28f19651b875
SHA512 68b8217e3077f4be0c75b9386e42abf03bfa8545b94c0913591f78b62324195c4067a4910504ab5d35440b839da3459223b36122c6a11a47f6931cb7805e3171
SSDEEP 49152:71hpsNoJpF1A6UU44CwH7R4x/e30jaNf1TWbdz:7mifPbRIU023W
TLSH
T15FB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0b5cdb092be9d3f255752171b530da323b0e93cc35868bf7627e598f48cca7ab
MD5 58ed1e2d7460ce36778a0cde3f78f920
SHA1 6524f9fc063ff0e42c27e789432e257763f33ec4
SHA512 cef295d9049aa95a2829d3962771c883aa2dad74969382ef3d7cc882244c31cef0e4374287ddb6bc68c0d6dc7ba1be976ec3fb3e57fc35dc3aca5d01dce87052
SSDEEP 49152:WSuZQIY0Be2KRRVtOnks6NMHqKe30jaNf1TWbdz:45dKTi61KU023W
TLSH
T117C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 761ffe6ae136433c71345738c549acb0e0ce7163020ef5bc0e7cf2d3d21f191b
MD5 85bd576b7836470de643cd46007901a8
SHA1 f86c433b9ee7d714ea9e694791e3c9c1ededea71
SHA512 266c0b434584d8d71d089595eba837bbc9bf1bc8009bd1b61d24152e2914183242c93b9a5e3aa29bc781010f0e80860f1e487050311a349da52d5211b49fc06b
SSDEEP 49152:khtSn8EApI0figngiDn0AP5wje30jaNf1TWbdz:lX2iyphEU023W
TLSH
T1ED95BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 82b8e8b75ad978cdb68f28c248f7650926a5da721a3aa30ef0bcb11e9e02e6f6
MD5 f73fd5f637ab59f40f5849497de752cd
SHA1 ebae9291474c67b5f7f0d6ce7c8003c7985fc468
SHA512 e13ad7d73ec53c92880953f51814a8814f328485e856e40a2820cb21ba08b6963ab4a7f0c6d367531595745ee20e6524faa762474386dea293595fbe630554f7
SSDEEP 12288:8u0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:8HgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B3452391AE5509CAE34BC3F0D0F787C1F9E01EC272404DAB57E0B55359BCD9A6ADC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8d89c62a04d8844616ace70ac81e4522149c167cd8b64e170562a8c76457a0c1
MD5 fd864b464cb3ce4e53e0214d57baffcb
SHA1 f612e566e931aa333db0d3d3644be6ac32e204a5
SHA512 ff2e9cd5837fd9379a4b99a08a4d621f314e1df53c3bdc83ead3f156bf02306083d3594795b0bb623e6d3f72a38377d1c10843b7247d65ad18dfd7c37ff81264
SSDEEP 12288:310DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3CgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1384523A1AD5509C6E34BC3F0D0E787D1F9E01FC272404DAB57E0B95359BCD9A6ACC868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 33f85a026860735306c3cca1cc43f3846a84936e0878dabe244d95e1c721099c
MD5 f7bf882c28166cc601e56b24625978ce
SHA1 5e29a6730b515c7fe04b25fe91e8a1d887276531
SHA512 0f85a3cd971dfa2ada63d06e783f1e2cc0798dc4e0c78bbd5442abdf9437590d868d1cd26c93fa10ba4138f9b86a9cb67a15995754d7ca6d37be32c0425f56b0
SSDEEP 12288:JT0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:JQgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13E452391AE5509C6E34BC3F0D0E787D1F8E01FC272404DAB57E0B95319BCD9A6ADC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 3bb520a56a6a91d998a5bc21374d400c9a925ec60c7bfc0827c9f8db5216cffe
MD5 9ceee99b753b894b537523c96a30e5f1
SHA1 d6207d7fb885a131449282629932af79cbc95de3
SHA512 6fb4108344b74ec1a79085b7c046fe89cc45e801dbab141357c50f6f225cbb6681e717a07cb45531997232f0c934d78c3f1469fa4168e4c0a24dfdebf122a283
SSDEEP 12288:XVs0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ngXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F04523526F5505C6E28BC3F4C0F38791F6F13EC173114AAF47D069530EB4AD9AEA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e68d2da1b6012dd32f98853b063bc0f600013ffbd02e0b6bbfbacc04a3a8300a
MD5 1cf4f4ea734e1d608472ba162b947d75
SHA1 8dc6628a944e9b3fadb29e5824e1bb1acb05bf3b
SHA512 1620496e5735efaebe5b0e2948368770c0cda43106da91b11d1c0b012e44e8bb17b60f1b93ab3c6dfe255bfebfee8373b2efe04ae74b01e562a982152b724703
SSDEEP 12288:ME0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:MFgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1ED452391AE5509C6E34BC3F0D0E787D1F9E01FC272404DAB57E0B95319BCD9A6ADC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 87145db0ee53ecbc742824497baec9c54fb56640e0ddf85c143f1219ea54fa64
MD5 6ca48fccad05ca8bc880bed835ca7b34
SHA1 a0c5da2f470bbe44fd4d32a2cdcc12c359166727
SHA512 3ba9a62a6836878425d3d7310fec06a619e3eff2d5b1834d4f427520f58faf49b283636d356cd6a1ad78f64b58678ad4bee05b568cdf34188e493ee705138a63
SSDEEP 12288:x50DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:xmgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17E452391AD5509C6E34BC3F0D0F787D1F9E01FC272404AAB57E0B95359BCD9A6ACC868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 75f26c7eb7f4aca8ae04742a81f9e87a9cacfb6a0e2ba32814ad908c0ead99bf
MD5 ce69effa538616a2d1ee8d7e381d6a7a
SHA1 bc95325f610147f2babad66391b79b00df61df2b
SHA512 89ec2fd23f8d08166631a05fcfc83144c6e7f45d370377e8c075018df664bf876de7364921839d542f98581ba4d9c8fc83367fff31e8a704d1142e705d3e5a4b
SSDEEP 12288:4N0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:4agXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1714523A1AD5509C6E34BC3F0D0E7C7D1E9E01FC672444E6B57E0F95319BCC996A8C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 9f455462a90c03b811f53c7d88cb8ebbee1c2432fac1e714aadc75cc6e077e68
MD5 9080d60e36aa82713ffe818bb99a70b8
SHA1 e7b2805dda4d733d0bfeee4f49e574f37140c471
SHA512 6719762b00b0b4ed973221597aa59fce3d9fc64d9192da8ea438dbe9da04b8729714eea4086caf00fe0c2567af95abefaa99d7def87cea0cd20a40d7830c0e11
SSDEEP 24576:1ZMSzFVSOigXe4i7ojhsP5Lgrk1TWb4AN5:1ZMSzf5e30jaNf1TWbdz
TLSH
T179650195B3900CF8ED67827DC8A68A02D6B27C561760CA1F03F436675F733A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 56e854a9c251f1655a8ce6b642b0f28e069289095e233a5d31b50e8cf90077cc
MD5 1cff5727548962704af6b380743854d2
SHA1 8832ecd69940459fe293c2707fcc376160da1c1b
SHA512 10aff89356bb19a27741d66fb193c8a1f9fc6eb22f0e28d30d40dc372993acd497ba3ec9229bef6d3b2fb7cbbc933477e25b99e9d200f6dfa24f766b264f0ba2
SSDEEP 12288:pq0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:pjgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14F452395AD5509C6E34BC3F4D0E787D1F9E01FC272404DAB57E0B95319BCC9A6ACC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 48dfbbbf7d2fb67189b5433d274ab5996b255c16872d1aca48a40c82414e850d
MD5 8b73c17a086e8bf74aa13bc6bc41aefb
SHA1 f5ed6b1f83bdf6d598b9a6429ddb8d152d2c69c4
SHA512 0dab1d38e545f5947cd45f4caf1e5265e60573cb49e0c43e814942b9db1faed06e04cb2f9f1479d777744b0ff860b9c125e4206ddeb6bd9865c4cbab9511817f
SSDEEP 12288:3W0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3PgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B6452391AD5509C6E34BC3F4D0E787D1F9E02FC272404AAB57E0F95319BCC9A6ACC868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 bac8cac41e874d3a87b6454759517ae30ddb6adf0c0747c33a3b124803225897
MD5 473063690b6cc4da4dabf36bbbd9df9b
SHA1 c9655fb0c6dd8ea619bf7872fd9efff7d004bac7
SHA512 03996e6175c202f2ef5c493be99fa2db31f39514468e13cd6aa5366833e50942764f9ae673e8b50c5c8de345d862d2d1eacb7ee4873f5697c1d88297461a9c42
SSDEEP 12288:5yPz5L8B0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:4zyugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DC55015777A120E9D1678278C4E24B42F7B2787217208EAF13A057732E376D19E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 6116d4baa8c41ffc7937a52cbf26cfc065d421bc3ee475754f2d74a50f5fa3a5
MD5 8955727bad79cda1e849c198f0542bca
SHA1 3010600fbe6cd95801a262c0ac23066076e1ff6c
SHA512 afc2a2742773421d057a827f7127c498fcb7d400f1582bb44e82ed00921248e0419c4719733d542d45a0a1cf6464cc3fef9de430e492558fae5ab9286815e562
SSDEEP 12288:Xq0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:XjgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A1452395AD5509C6E34BC3F4D0E787D1F8E01FC272404EAB57E0B95319BCC9A6ACC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ff0897376b9d447eeae3be109a31680654d15afda59c9a5069a8124f28ae2ed1
MD5 a194ab1ca22cf2c04cfc2447fc969194
SHA1 14dd16e2b7c583157d5445766c11cac101feca8a
SHA512 6eb27637fee32ac29a5bf4622db4527bd913734bcecc57124e71f65ea866b81e33bbbcf34b5e6d885162851cc118fca5bdb0f73fc80b64c30eb94aed55654c8a
SSDEEP 12288:+q0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:+jgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10A452395AD5509C6E34BC3F4D0E787D1F9E01FC272404EAB57E0B9531DBCC9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 9aea119e4111c0dc7706d51b85537b9fcb2de843d7101be5027a9a7feed38f72
MD5 dc2b38d27836717ae1cfc36558b4d204
SHA1 9941087f5c7c870b12ef5a948329172fe21c8acb
SHA512 e2d6cce1ac194e1103b369e95cd6fc7d3dee103845df699fa3a57d578761e5c34fd52efec79217c19a4e7b0ca08e25c66989310811d4ac258ac1e50baa60fb33
SSDEEP 12288:iyPz5L8B0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:/zyugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T18B55025777A120E9D1678278C4E24B42F7B2787217208EAF13A057732E376D19E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 ce26fc73c400f297bf569c15f431ec5fc888567862192986e6ac2a036f27c82e
MD5 1e7eaa1185b1e52cd87cda16dbfec191
SHA1 8cd437ebbf5433b5de3798a51c593c721c35f8cf
SHA512 3bebff81e074804803b0aafa38ec3ef75b980e07474cf85dd702de5de3fa8a22617c6d8cd7f0c0b7652a4681e94ccec17ddaab7247a7650bb655d573c468df76
SSDEEP 24576:DTHaLl3z0zDggXe4i7ojhsP5Lgrk1TWb4AN5:DT6LljMe30jaNf1TWbdz
TLSH
T15E6502A5B3500CF8ED67827EC8A68A46D6F27C560760CA1F03E436675F333A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 ca1271aaff0273ea117e3e75a38c183c9d905aae08056f65d53e4d3e3039e2c7
MD5 3b7d447e876db57401f32232822fa266
SHA1 d4e5d0581d2bd4d362dd2129cd5ff99a4dfc5137
SHA512 7b0dd181cf72cd2e2ca64a1b3fc59ff39c98ea7bfaa786de6737ae316794194c54c3c0ad01059c15def0ab6d605b50e6a9b7e11f1d610b349b8281ce475df16d
SSDEEP 24576:I37d9CHKy7GZUgXe4i7ojhsP5Lgrk1TWb4AN5:S7d9CHKya5e30jaNf1TWbdz
TLSH
T1F775CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 ab86d2d412a2055adfe41ab351bc649f87d4ab7839395c82ed4f9f8e5b58c6c9
MD5 0c477cd97c71aa51f6048920562bf9d7
SHA1 647df71c10cc2d609054a4e297ed10eecb06d9e8
SHA512 917f3896fb844064f259bfdaa7453fa17a846a25fd75191e1b611d708d0d3ccfa799bba13dff97387ec106d6a11ef6b0051efbf6634ab8430f406b43e1340189
SSDEEP 12288:Yz0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:YwgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T166452391AD5509C6E34BC3F0D0E787D1F9E01FC272404DAB57E0B95319BCC9A6ADC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveUpdaterService-2026-09-30.0241.2576.1.aodl

Path C:\Program Files\Microsoft OneDrive\UpdaterService\logs\OneDriveUpdaterService-2026-09-30.0241.2576.1.aodl
Size 10KB
SHA256 aace3fe540f5eb0a9c1c95ea573aa5fdc0636f4da55713b163e42bb9d1558199
MD5 37da6858d84f37c7219c72d8cf86a900
SHA1 0c602bf823df69ae05e72da617180337bc2b9b9b
SHA512 c4cdb5f128d6f54ec600893c337b58629c58753830cdd68b5614d19fcaf0509a525ef4c70031fae0cfeb601337736594809a5dc6b5ad0043be826aaaf1b01c28
SSDEEP 192:qnzXHP6Yhykyy02Z9QMYM5nKClebz40p2HoY/SPv3eNn:qLXykymLjNs2Ld
TLSH
T1ED3212F2EC929922DD4710365460CF8E2AF4E8AEF2D2B52BB1C17C92944773D27BE501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-09-30_024109_2576-768.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-09-30_024109_2576-768.log
Size 1KB
SHA256 f278178490e8efb40935768bf6bb147d012dabaa150e2448e6c2e04e8ea6e97e
MD5 104c4f724ef282a4533d4101f27ea2a1
SHA1 1da4d90ccad877c1bcdcc6ef1fc4e243244ad17c
SHA512 c617e4ac2347add9c22fcefa79a3ec1fd409424a78000e96c78c56af62eeb037700ec7e52d1bd0ca41fc5353ecbcb84903b1b2ff2c827653e6e7115eb710cc1d
TLSH
T11921931A7FE80A06FBFB9EC299F754539E3939966831CA4D10A4534D0875F44EEB0327
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 384fb1e53e232c953e66c75f916a859d30504797c565542cb41326489ef162d7
MD5 bc67f6e2c9d9ce5c00138e80c860932e
SHA1 a6271f51272762c59790bb27e7cbd06e6aacc739
SHA512 49e0b2e6b2a73242ce878bb4e6fc867f47b1690ef7346a537a3b70ff4af6a38b6ea41a0b7fb630cfcb0a3194df56d23ee6018750c0f9f44a55618b1e927db87d
SSDEEP 12288:ZNsfa0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ezgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C655F15AD29802D8C16E92B4C3968A81F3733C5193E1C7CB53D0F53E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8ec57fad04817d0fff58ecb0239d2a8a03d54971a20ff65ff5291c9e3b88c04e
MD5 80f7ad2176394c4768c9a43241f52ed1
SHA1 0a5ada9aebd95af48328d29636a0e7223ca22edc
SHA512 d611cb8420cf556a759eafa092689b45783e6e96d589553f655615566611dc9bd45c99f1f40e6a41ade17e73c3838c42f3b15ce123916f554b3e3c15571ec466
SSDEEP 12288:Lh0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:LOgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1254523629F5809C6F29BC3F090F7C760F5653FC12B00899F56D0B66319B8CD5AEA8929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 6e597e226db663bab70c7bfa4ad2bee74d48faa4a857f3c8049f0f08627797e0
MD5 f42519a7195e26d6785f2ac171abbfe5
SHA1 d2a4290dd532b2e7379247b7640d16551e384371
SHA512 c849c83dbb4d123d51a639db7184a8f283d6bc6c17dd2ecb6dc86a1ef5614f087b24d4f5c967c47642fb557bcdf1f345d942c25e80cc64da61ff79fa88ff771b
SSDEEP 49152:Ra0h2GEkuAe73q3pp46zwwQze30jaNf1TWbdz:Ra0hNYG4JwqU023W
TLSH
T1F1859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1190853D3F37DE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 69b76949b92888c3ef75eb28039b4d58b0002e03de8cae622dd5b17a3ca51c3f
MD5 afb2328b42a8b269722f7f3ac4974bf2
SHA1 f0f7d15050efaa7ae891db577809e421a4d37f9c
SHA512 6f95179a4196f3e4ae4f05cbc86d01b0e127c4fadd670b779dee47d7d3efe91f1347c1a3135ca76b82fded2379346c703d010985b2c6b71b476e2801a4b35351
SSDEEP 12288:khbHjfXe0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:khbHjPXgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14455127E2AAC10C9F276D2BC91E28642D371BC51271187EF13D1927A0F3AEE85D38E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 80c4aeeb580982d347041d834e098fcd6f8cc35e6db869bbe983d8592519fd7e
MD5 29ea19d315bdcb5aabbb4a06d15ac13f
SHA1 41f06e73e15df57055e5c07202764c88a3cd5612
SHA512 60cd1c0cc75a46606e7ba9348f6223d93368eb19c06102966494e97f69715dd7b3b487b7efaa1f8885d25d10784b095f4f9571b0318516dc86838b96b3323005
SSDEEP 24576:F3YgnJcRTk4yti+R5dBR/fgXe4i7ojhsP5Lgrk1TWb4AN5:FIgnaTk46pBR/2e30jaNf1TWbdz
TLSH
T1C545BF2DF2B910B9D4AAD236414147B5FB71782D1F209ACB01B0C538AF1AEE85E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 9999531e2b3cf338dfbe20cb60e5e3df2eab99088801a9aa7338f0c3d6e8497c
MD5 db173fce2cf7a97aa2dcc1c52b3b29cc
SHA1 fc05eb4113fb474a10e4a793ece5077b21be7f66
SHA512 986732b9c2e6175e0f2dc1cc43de4b805257c15a35a41cd2b2dd1988d3bce50e6f714f1133d75cb76ae6fdf6a25f2453ee2e2f4b6f549e48d293ec4788713d83
SSDEEP 12288:7F0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:7ygXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1254523959E5509C6E28BC3F490E7C791F5A02FC133014EEB16E0F5531ABCDDAAEB8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 91c6dba65983e64ebd369b1c9ee06d6910121cd5c89be7fe4ab20aa3720ce346
MD5 60a9f6a0d755fb22b9cbbd8c2d07593d
SHA1 df9fe7c8f28fd5ea0b43ac8e77c2b426af846fd1
SHA512 33cd926240de4814c9999c36c277ff133d24be42f9df6e1ae5515904182c75bf8769d4ab5c27e6b9b3385e4bf017df2a9308ae68c589f46ae70f5bfba14ae104
SSDEEP 12288:IOb9A4LWOsvAYFTE0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAf:lpL3UTFgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T18575F155F79400F9E96BC17CC4A28A12E2B2789D1364E7DF03A84B661F637E54E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 0869435943f03f199e4067431c9ff273f7c849083e4c0ee8aaf317c6817680fa
MD5 b9bb65c6e74ba1f3a8b1bc972aacbe80
SHA1 069423cdcce0bd4ac5f35291b89674c887d82551
SHA512 9ec22b2e1cb0ef20f2c42dac970ee082cb57e9db7d66b84e9a89ad88635bb367f3f63f4459458ae066fa39ca849e5b009db65e9121a9b149dea129e3b148ca62
SSDEEP 12288:NpFtpOo0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:lOJgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11855022A37EC10D5E16AD27C85D38349E7B17892171147EF02E081BA1FB7EF86C79A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a5afdda5d3f6a7ce556930d53a7f05417ca924ee7406c405dd41dd5bc7ef7017
MD5 5d4faa905a1d27ce1ed48d4c8a67596e
SHA1 a138aa5253b22e05d6dd3225f7e3a9afedb2c26f
SHA512 3ea1f5dd218d7ee8793b08de6e7789091d40335693aa0439d3b1b512ea98b25237ccf7e11cb032279387b33069b0f82b8fe65be56514c4131cf43eefea7c860a
SSDEEP 24576:N7NM9YqZqmWMUkPjZM48Mv6bEhs+gXe4i7ojhsP5Lgrk1TWb4AN5:N7cBWMpPjN8DbEhOe30jaNf1TWbdz
TLSH
T1E8659E2E6BAC81D5D577D13DC9E28205F6B2B4611B318ACF1162833E6F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 ee318ad5409726e66500926bbb7f847518e69256ef78d08de67a0dc4e0d8dd5a
MD5 f335b2cac1f62ee6969cb4bd69508e0b
SHA1 2a700cfd63c981afaa00f3dc322677a6158862e7
SHA512 082b44625faeb805f5cecb6c4c71487ece4a63221f25bcb96f77449c3eead6f7d4f22d334d1fa5c2bf50c3320770a9acb5846764e38ea31ceb43d2b389677f9b
SSDEEP 49152:fF2YuHNETovAvNYf8kmxe30jaNf1TWbdz:m6BCf8k0U023W
TLSH
T162857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 9aa542399526a51ebe47d95ba15ea5b94908eeabaf9bbb8aff7a1b444c3eb2b5
MD5 3ef3fd30dd90689d683bf84589f22b23
SHA1 67f34b6fe64951429f76fa5c239860cd6ada3f6e
SHA512 838b48d4d68fae4fe47c7cba638db398ed644f9694dc07029e37913349b85b04c5942937f57c433fe61a6c3d4e06044ef831878b456c993ac98ab0e924482e6a
SSDEEP 24576:HAFs06+Omlf3NXEbTodgXe4i7ojhsP5Lgrk1TWb4AN5:gFs060lVXuTe30jaNf1TWbdz
TLSH
T14865BF2F66AC00D5D07ED17D8A97C91AF6B1746307255ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 582e92dcd2a6bba3c678f2ea89aa309674d9784aaad76c2bf29ca82cdb95877d
MD5 d571f18e4b11f8b26e877a91a1b878c3
SHA1 16dbfeefab8072ecbe2b0b26c86f936cc8d9e3f2
SHA512 722dccf0ba249710d9ea8f526cdb3cc9f49c93be9943acdc780827efcfc888f63bbd05f4d4b18acd489439cbb8220a9323df3dcd3ad188788a6f141af4d1a2eb
SSDEEP 24576:qJnJ5D3WX8gXe4i7ojhsP5Lgrk1TWb4AN5:qJnJ5DGXTe30jaNf1TWbdz
TLSH
T1A075D02DD2A810E8D0B7C3B4819A5795FE72386D2F226ECB14B4D5353F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 665bcd3d4d3f4963a30a8c0e89db6041aa572f4ff170241025936ea5dc2e5212
MD5 06e7a84012d827f64c1dcaa3d9e48ddc
SHA1 b016005b99a95c555a9f83c4adf0726f357c370c
SHA512 45363514fb0548803d021e509762f37b9c55055e24b8bd09f4bbf6f92a46546fdfcf47ac7fd6f7c84c329ee582d34f26d6a580ac696b6020c128b6b80c003723
SSDEEP 49152:gg06DIKdwc+eQnSt65aVNe30jaNf1TWbdz:BPU023W
TLSH
T10E955C16BBEA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 254ec531c8579b3035b1491336ceb750d5a968ebf761439ebcefe14d4ea5d0ed
MD5 214a056ebc13ca1165304dca22c60f51
SHA1 9ae86668f347d93dfba98b94f9f666eea9a8d1ff
SHA512 166ecdb0e78f9d3480cc760fccd3b5d22cc7ffd35a4e3c0fc60c5faf96ad9751fa2be572e507625899e3b6c71a6b7ced7a523c851afbd821df07cddd650dac66
SSDEEP 12288:PEP3Rnz0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:UnwgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D855126D6B9C60D5D16BD1BC81E28741E3B2F4A127011BEF02E0D27E4E779E96E3CA10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 da746ec5ec64f2f845365c0f4ff9d2188a7b654f51ccb368307b3c634ab52585
MD5 82631bf97047a64cbff2a8add898ccf7
SHA1 29368303137d6732f032bba39fd909f665d7448d
SHA512 f1f9fc9d004145d83b2883db56d20762a845369177428c42981aaf0b3cadcabeb0633447af54d9b25cb444f4c0e011ab54615843ea4293a22e3d3525da7a0d8c
SSDEEP 12288:Djkye0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:DIyXgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T118551204679854C5E2AA82B8D5F38390EA70BC606B1087EF51D0F63F6F7ABD4AD34B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 e4cc154b8134f6c256285342a86c06ed388e8a8c45ffc195c7b5463657853ebc
MD5 47af060ba7f829300d089f8013917b58
SHA1 8cea03bfa561f38811fb9cb3bde1ea50e068c3d8
SHA512 4265915a5657fee25ed569740760f51fa01ac228001aae7b8b70664840edd52d6122716fa1aaeb7f7b3e29ccd096f811c577b306c2a85219c73b6d9dd7430326
SSDEEP 12288:7yY0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:mZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11D4523596A5519CAE24BC3F490F78B91E5B03ED1370049FF02E0F6734EB89DA6AB8C54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 98402fc0a4d6cbc85ef5ee435c7767a53acf52fcd8a3f7b2e3b4fbb9ca678dc1
MD5 42944f52ce6a262145ac66cc0effcb01
SHA1 3e18178e05175fde7c289eb03dec439a1a6bc5ec
SHA512 4f733f47659352ce3891ac5eb912e38acebb1d9cdd2c8eebdfe1625f203cd48a71b8299dc87bcee51ffcab89fc9a04f452b296c638bcd0c985921efd49bd24cf
SSDEEP 24576:1Q9MxZKdcz9dw32gXe4i7ojhsP5Lgrk1TWb4AN5:1VKZZe30jaNf1TWbdz
TLSH
T1E7557C2DABE909CAE177D27595A240C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 d111cdaff4f7cc7d20daf9be5c4061300b5693310e0ba4d079d683aef24b4651
MD5 9b8c6a2bd3c03475c1e41d8403b70507
SHA1 d139707318c67f342006191d4375abc43e6be4a8
SHA512 35b2b72eccb1400e7a1817ab7612453f87bbedd13f4f3966aea0fc7d3a2359c94c3ebaa30588d646ccb2510fd207b39b2943baf44fe8d6e1a3431b35c767c709
SSDEEP 24576:EyocDApLgXe4i7ojhsP5Lgrk1TWb4AN5:5ocDApSe30jaNf1TWbdz
TLSH
T17265E01FBB6900D2E166823C88868741E7B3B4702B5257DB52D1C33E4E77AE9BD38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 471fdcf6eff50d4de5f6178415145caf9fa10e119fdbaedaf645e80512b636b4
MD5 88077ae474120022d7667507502ba983
SHA1 c9f3df6ace982512ca23d32c4ebf1afec2367577
SHA512 48df58d2bb2adf7b25869bdfb6c0697e5466c61e9e3aa823405f14f5e0e775a45e97b259014238a95f6e809b850b1e274f6178b594d1dd3ae3215537feb98036
SSDEEP 49152:eWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKSe30jaNf1TWbdz:40zuNIQU023W
TLSH
T1B8A57C3DA2BC00A9D9AAC375C14513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0ddf1286bbd9fc83aeb96e789d6c393be8fd272157902b81195b10c78e56abcf
MD5 04177add94420ccbac4d304bb9081a5b
SHA1 c690bd115e7f683092ffe9b3f802627a28e4bd70
SHA512 e437972e532ca18aba69251ab4444e4be2769669349a329e0311a54cbb0a1a3a6bbf28b198d36801161eb6c09b9d4b8373a3415cecff4000b195e65d41ba4a4a
SSDEEP 24576:e1QT7EcpfxR+N5AWAz3ooiYtjMqbwgXe4i7ojhsP5Lgrk1TWb4AN5:zTDxR+N5YzTfjMYe30jaNf1TWbdz
TLSH
T18855B02EA7F815E9D1BEC5789A23C512FA727851033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/224-80-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/224-91-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/224-77-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/224-74-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/224-68-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/548-400-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/756-359-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/756-375-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/756-402-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/756-391-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/756-406-0x000000000CD20000-0x000000000CD28000-memory.dmp

Download

memory/756-477-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/888-25-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/888-26-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/888-17-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/912-405-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1236-412-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-439-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-424-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-425-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-426-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-428-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-427-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-429-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-430-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-431-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-432-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-433-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-434-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-435-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-436-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-437-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-438-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-440-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-441-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-442-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-443-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-444-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-445-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-446-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-447-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-448-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-414-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-415-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-418-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-416-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-417-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-419-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-420-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-421-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-422-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-423-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-411-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-413-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-410-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-408-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1236-409-0x000001E156590000-0x000001E1565A0000-memory.dmp

Download

memory/1280-243-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1280-40-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1280-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1592-305-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/1592-299-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/1592-396-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1960-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1960-32-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2180-272-0x0000000000660000-0x00000000006C7000-memory.dmp

Download

memory/2180-474-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2180-271-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2180-277-0x0000000000660000-0x00000000006C7000-memory.dmp

Download

memory/2256-92-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2256-245-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2256-83-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/2256-89-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/2368-398-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2488-475-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/2488-393-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/2500-294-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2500-288-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2500-395-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2576-9-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2576-0-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2576-8-0x0000000140000000-0x000000014047F000-memory.dmp

Download

memory/2576-76-0x0000000140000000-0x000000014047F000-memory.dmp

Download

memory/2576-58-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2612-397-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3620-257-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3620-264-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3620-473-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3620-258-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3668-394-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3840-175-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3840-13-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3916-399-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4140-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4140-46-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4140-45-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4140-244-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4196-312-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4352-401-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4608-472-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4608-253-0x0000000140000000-0x00000001401F8000-memory.dmp

Download