stealc | 57353f04a0db7036246d16a8eb7bc3f56bdbb81e1dd32921b2717f8e753e28b5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 2.7MB
Sample260930-pdfnsstygz
SHA256 57353f04a0db7036246d16a8eb7bc3f56bdbb81e1dd32921b2717f8e753e28b5
MD5 3ca3dd9e2edd9aaa7da20abbd9dcaf9b
SHA1 5bdc57ff1667f74748ac4e2f6e3e4a0b433a5a95
SHA512 ae0cf1696b8b79f8cc26aa06e4dbdecfd68c3b587984d77770ad6652664c9957385cdd33e637d30ae479cbf2384030393d188f2dbb12da12ba521afa2af8c2cd
SSDEEP 49152:Id38ElBPsREFbY8nhxSMmT8oWgBCaX4h55RZnpUOHFbHshxSMmT8oWgBCaX:cLn+M4FHX4h55XpR9M+M4FHX
TLSH
T113D50159A6AC41F9D0B6D178CD525517EBB2BC1A5331D2CF03A0269E3F376E08E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc ransomware spyware stealer upx

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral1/memory/1280-440-0x0000000140000000-0x00000001402C5000-memory.dmp	family_stealc_v3

Executes dropped EXE 22 IoCs

pid	Process
624	alg.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
2072	fxssvc.exe
4680	elevation_service.exe
4464	elevation_service.exe
2820	maintenanceservice.exe
1648	msdtc.exe
3104	OSE.EXE
2500	PerceptionSimulationService.exe
4432	perfhost.exe
3472	locator.exe
2328	SensorDataService.exe
448	snmptrap.exe
3744	spectrum.exe
2344	ssh-agent.exe
996	TieringEngineService.exe
1896	AgentService.exe
2908	vds.exe
1612	vssvc.exe
984	wbengine.exe
764	WmiApSrv.exe
3940	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	alg.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d633176cc665fbf6.bin	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1280-440-0x0000000140000000-0x00000001402C5000-memory.dmp	upx
behavioral1/memory/1280-68-0x0000000140000000-0x00000001402C5000-memory.dmp	upx
behavioral1/memory/1280-8-0x0000000140000000-0x00000001402C5000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_141359\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c23ffe13d550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f1d08b13d550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008cad4613d550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9fc1613d550dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006cbe5913d550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db328e13d550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2516	DiagnosticsHub.StandardCollector.Service.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
2516	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1280	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeAuditPrivilege	2072	fxssvc.exe
Token: SeRestorePrivilege	996	TieringEngineService.exe
Token: SeManageVolumePrivilege	996	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1896	AgentService.exe
Token: SeBackupPrivilege	1612	vssvc.exe
Token: SeRestorePrivilege	1612	vssvc.exe
Token: SeAuditPrivilege	1612	vssvc.exe
Token: SeBackupPrivilege	984	wbengine.exe
Token: SeRestorePrivilege	984	wbengine.exe
Token: SeSecurityPrivilege	984	wbengine.exe
Token: 33	3940	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeDebugPrivilege	624	alg.exe
Token: SeDebugPrivilege	624	alg.exe
Token: SeDebugPrivilege	624	alg.exe
Token: SeDebugPrivilege	2516	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 4396	3940	SearchIndexer.exe	131
PID 3940 wrote to memory of 4856	3940	SearchIndexer.exe	132

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1280

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:624

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2516

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:560

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4464

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2820

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1648

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3104

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2500

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4432

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3472

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2328

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:448

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3744

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2932

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:996

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2908

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:984

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:764

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4396
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e1801381f0fa7c304c8df660841a75e52a95eb4e3ede10efcbf94a2d54b81dbb
MD5 de971643f3d262a66fce2847003ded11
SHA1 613c0a71eccf0d61f0cd2ac3faf9181dcbd9ca8c
SHA512 e5b2876e4b333d5d4e98e01a7d00dbbf97c829bf5ad2cd8a725d259d16e248b6322e191804c2d23893dc3e382586ea3827752a43e64190df295fe6c3176d4cfe
SSDEEP 49152:ab+632BuPkFKRrdE6ohmstBhuXjfS4LWxnPhxSMmT8oWgBCaX:M3q6HjBq+M4FHX
TLSH
T140D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 f13b173106b35406ddecb3cdd4ca070f090c347dc0be64bf2a245e085cc00dd5
MD5 4c5a2003720e37058c6a401f8e9e5d9e
SHA1 d73739bfd74e2450542b5e2b830577032c4763c1
SHA512 34f1ecff53c7c005de0ce1ab721a9e175ce4775726b9feaa3f9e8da48fff4f8ed46f8896c8866c2d022257fd83a92e117880798679a4ffedf3cfa53c5b4b5c5c
SSDEEP 24576:9XYfDtczA/rKhxr+EHNmT8oW4ll1JCrLKXI:otchhxSMmT8oWgBCaX
TLSH
T144850128779508F9EC67823CCCA28512EA737C954360E79B03B49A691F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 aa45d7ebebec816aea777bb7b93161f3cddca1908a2b026ddc3aadeffc6bb9a5
MD5 e475eef9371409e7ce288082b41f9cca
SHA1 ecbbb1df0b261722f3f54d1826220c59bbdb00df
SHA512 b320b657891628bacdaf744fd23e84e82b4ab2615a3c519afe9375a7292011b65e4d560654205c4b8d682e373bfe48691b73dd3222c2e604004506cd90595462
SSDEEP 24576:Y0Le5ji0hmxYrMkrKhxr+EHNmT8oW4ll1JCrLKXI:YPji0A2EhxSMmT8oWgBCaX
TLSH
T1BE95AE26F6748335D073C0B9C5D2A68AED71308657308ACB4296D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b5bb44bb9640d75760998cd27cb29a5ccc096a7894a25e32daf00ae923904747
MD5 05c53f7bf85387aedf0fa70a38459db1
SHA1 e00552c0059d13280c270549b625a3a0feaad9fa
SHA512 fed09851bfeb1d6d8998c6cf9502a6d584b84108c8980710dee64345a114b6f63d5c8bf57dc52b9e91a9576e4e6235231a7061e4f1725cc9432c086da3f73f19
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWE6q8wyuOrKhxr+EHNmT8oW4ll1JCrLKXI:s/ezSC6vUzPvxHjy4hxSMmT8oWgBCaX
TLSH
T17E756C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4004c5510f03cd87780758b393817e6e76667d529eeeb4ed7c8e377950d7605e
MD5 ad9ced1f2e4931dec889d62dd6012077
SHA1 0b11cfd368d23e25bd8e0d96b74da32f1cd784f3
SHA512 f8748fc6cfe05e7b76a7f26fb02c29fda1101538bafb3a2ce24b2ab6236fab760979c36b8f4f98320c1812115dd9af51d1d983ddbf78641169e8d55f9b1f700c
SSDEEP 24576:cVbqPb88hv/l+6rrKhxr+EHNmT8oW4ll1JCrLKXI:cVO88hXl+7hxSMmT8oWgBCaX
TLSH
T119559E66F6748331D073C07AC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 d3e936d7483ebd2ca617ba0b546528de17ce5794d59f6fcb706b9e45c007336e
MD5 c07aeb1dc2f0245969fab6b3f1a8d3c0
SHA1 10ed756f73fa4810a155348bbfdd4803b980105c
SHA512 780cec734d0d95560bfdb17fad19d1209db8fee60f6404de126f5be73e625cca04f4d4234287cfb1e6c65e34a7465800bb13c1670131cf20f3d9d3d038e337b1
SSDEEP 12288:nHUJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:nHgrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T11B6523759F0D64ABEE3B8335F87257129A990DDCD1412E3B8F3A3FAC3934C5A9052212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 b4cdb1f917d4b0205cf24238d84f025a6af4f38f70a7b106e9b0060811129917
MD5 0e7256072f3bf995beb1dcf8ab24d7f2
SHA1 864af4ca15974811566086d18b9f9c473e85f844
SHA512 207ee1715edb35ab54ce4eb182931c61ce2761dea36a318e6982b6a43d5caf6f22404a2fef39cea5fc3e26744875aa84269f7ab9a25bae2025ced50ee40ff9bf
SSDEEP 12288:leBNUbTVO86U9JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:lJIUTrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1FB85CF3BEE28FCD2C67A8D785A918700D7B278704B52A3CBD175830D9E235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0d4998049fdbae9dbaf9a5d78c7db4465a9416a0de3a2dbfec0d66accd52ceb0
MD5 95162452a60b4f7e7439bc95b721d2bc
SHA1 8ae818fa560cdc5c38f6e323732faef6e48b4a79
SHA512 cbcc0e938bb259f9b9594609d235f9bd618972e1991f5e98a02a69ba502e84e548d01f3d2c7d06d044ef856326969c97a8fd3aabd7cd6e80f5227c96b6daa6b5
SSDEEP 49152:yQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH/:yQvGAdlCEL8c/yRNw5CB+M4FHX
TLSH
T193266C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 f183d4dee77f57827ae746eed55990e0c90dfaffee75bfe481f2b57d10b3a33e
MD5 c4e519d574d8b74b47b39d79937e991a
SHA1 82a429fb4b059949b1b6947f91496ed7a42b2997
SHA512 1fe4e4154cce53a23650cad197cc3b86a40a986bc6376471986a0bd122f362249f4224df999511a34e99ea30fe037a04572632a4998fc9adff2c41491d467e3a
SSDEEP 24576:77ewsAjtrKhxr+EHNmT8oW4ll1JCrLKXI:vljUhxSMmT8oWgBCaX
TLSH
T1D785E031FF74E036C67F0D766B36C716586C6A604B522AC3E3B88E9D59302D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c7c717066ea5dd993e02ff506791db3f3c644b44e3bc7f7a76cda7e4d9e9aedb
MD5 2e770731d877d1d4c4d49fa8ebb83ee1
SHA1 8fddeb5a25b14b64c2db6ad2d5a04e08757e5794
SHA512 04cd865d999dd190d771809a008f2dae8ce58342f724da424b2c89aa984c1cf651dae21b4c15077088684bf5f529c1649945ff037b563491198bf1d7d6a7fad2
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH44:3UEtQevvqc2W1cpV2EI3244
TLSH
T1C0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 675581882e25db13e81539d3f15799ac45a00af7fc3ce21c3564c2c6eb7286a9
MD5 6ad114bc51235397ed73e5ff52e4d4db
SHA1 5cf8e492b4268a08debd3c0483162417322d1220
SHA512 b746af36b8f46dae03c9c432f49856a54ea7ed0a82688888afe5f4d457c2aaea05fba052cc72735f162f7daded45c04e8cebb2d7473f9746f7d06a9f54b42762
SSDEEP 49152:5CbRquA/m2yL5zTfFiV+XenmE3/z0hxSMmT8oWgBCaX:WoquVjnmF+M4FHX
TLSH
T10FD58D1976B8C1E4D1F6C37886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d4a878864b4c07eae3d40083afc99b6381cd7085db934ca1b57e534958d46abb
MD5 b64595183379c40717b16d47622af4dc
SHA1 2501e4bc559ca5dcd9302eab8fad65962c2f98a6
SHA512 04e42874eeea53cbcd5c7d91540714db0b7f28e37a87c002d6a418a6c1c379bc27054abdac2afd5b90d077ab7dd9e6e5eb097f4252cb33878a4ad03caeb8e78e
SSDEEP 24576:6AhGLJIFoiwtA5l7S53SrKhxr+EHNmT8oW4ll1JCrLKXI:6AMyFoiq5VhxSMmT8oWgBCaX
TLSH
T18835AE80EBF955D4F5B3AA7899B68171EA76BCA95E31C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 12d8bca8a30498daee05f127acd6119608d5a4e3fccdd8b53f212f3b8e5063ba
MD5 d8531f622f7abf527ba224ab9932120f
SHA1 4af2756e5fa9ffc17fe72424e08aee3a8640bb76
SHA512 f8535da1ec3fedb6f07b39b280ee795ddf8c33a1039a16f5a623491cbde101027e4cd5a2c7ea8d11dafdbf7e699dc59b2b4a9ec38711ebdb47bd51d933a357ba
SSDEEP 24576:lwuSOWxrKhxr+EHNmT8oW4ll1JCrLKXI:lw9O5hxSMmT8oWgBCaX
TLSH
T11485F14677A91CF9E9678238C557C136F7F2BC052621DB2F1770C65A6F33221AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 b15ab8e7e9e9db25eb61aff6dfb9691d0f86411364c7c8a9046709a6f8639f41
MD5 2b4a086a074d52983add4588d8d863ab
SHA1 3d095d38a159c40bc9a4e7bf277c1097162d4a1d
SHA512 053012499344f40d0ed9d55ec51c635101734d65824d4500a3a2815f4772d99d7029f0e938389a31634857801f6d11b4a73b6fd7cb02f65e16c426182d15a736
SSDEEP 12288:WjZ1IybJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:CZusrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T15875126A279860FAE967823CDCF14605D7B23899633143DF1A3947A92F33DC65D36322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c127ec51c6519a5d345be17a8b407a1db5951d64b75b851ada900f73e4162911
MD5 d719ca64a552e07c56584d3e7be3e5ee
SHA1 70b46f02abd24a0ecbf0b3486259ef9bd9278c32
SHA512 5491d9bc452c1c3d02a7ad1ba9661709b129239fb3b9d453656cdfaa2cc7934b3fc8d83ca147cdd307501ce4ca3016df724ba9d5b01acd50cf0ad28e14827b0b
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U7:rQRQyi36YOcPQLvw2gAf+PN3m+M4FHX
TLSH
T12B667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0a4aea9b29de43dc25bfc7ee4ed73763fe529e7ca235f9b1cc2c140a8ef74fc0
MD5 79bec00c9108132bcbddfe8d16aef3fb
SHA1 245c3eedd1c70e53d5b9ee59c79e7d5fd5359c48
SHA512 5f86d548d1204365986d2d74289c611e5e920912d87e8b90893fdc21fb8c98fd06e4d324de2b3f86fa0663a519bc739ca553231b484718f534b8f40728debae0
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U7:tQRQyi36YOcPQLvw2gAf+PN3m+M4FHX
TLSH
T140667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8146e5641e87c6ea02da15939a0923bdeb231b0f18bdb43e34e42c7538fa5fc1
MD5 6e61b37891f7b53ecb03dae2f1f026c8
SHA1 4c3261e01eb5ac938ec2efed0c226757b2989970
SHA512 4e4b5b68ecff62f64f306ed288de4d622c878073d2f92f1f13fe6cf8318427f951a39d7a5282b964928c8c8720f335149ece6bd041c096cf2e2834e76b7f439d
SSDEEP 49152:v68Qg55nhheWu7PNU3/EhxSMmT8oWgBCaX:pthWRc/E+M4FHX
TLSH
T19EB55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0b82879d7802161891314892056a1387782ba7a03311dc145734d951d699f794
MD5 9395bf0bc4eb63c4f2ee9af66a1d8222
SHA1 cd576bc5dd03c71c619694a5c416b810f709be81
SHA512 c81840f3338bf72a7e372d8b4c14de98b104a9182a9fa813c8c9fefe0c2ccb7dedc1c03784031cd4eb8a138b062ffbf0b7fd0a9c4e964481df2015d8b94b382c
SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99h:4y5112gYy5azzVvL69nLKnhZT+M4FHX
TLSH
T15E167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3a86afa2a9f6586280c089511cc06afdc53f2496e0af95e5885cf37a1013fb09
MD5 e3cb78f42b6d720aea9fe9a626960a65
SHA1 26e4c26c9de99c551051d1c6c68449adbfb6c165
SHA512 f70beb3df82da822992583635f05912aea5d3acf484eb6e77f3cc7630ddbfc229067a106514c08dc46e8421fe0f5a7501fdd902e11cda459c638994c0e367fe0
SSDEEP 49152:KB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gluhxSMmT8oWgBCaX:Yu6JmVxd2du+M4FHX
TLSH
T1CBD59D13F1DA01E8D06ED178974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b014919c5df7d5d469ad74fd6783e06a96f2774e4800e751870b3521f8cdfbf6
MD5 eb82f4284788a9276bb09c0b579a3a25
SHA1 80f2279c27579cffc2d834a3619a51393ce47dbe
SHA512 6f6fd85394ed7f7ad5ecd2f0a6b8437f77c266f5829e69b22b65eeeaaad1e84b2b366b711df4c84f4ba92d5ed05d8cbd443b0b10b34e902ccc3df32e0b1097f3
SSDEEP 49152:Q1hpsNoJpF1A6UU44CwH7R4xChxSMmT8oWgBCaX:QmifPbRF+M4FHX
TLSH
T1BAB5BE13F2D900E8D06ED17887569232EA62BC450B34B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 dc12e74929595dda4b691486af75f88f26231fb4b782f690ea847fcb94418cad
MD5 9e20577df11561ed350f12b6a2f526c6
SHA1 2a977a1d979f5e829738f144d5d8f5293c820155
SHA512 6f9ee8f523b22b7dfbcbdf4ea0beb5a5faaf6cf81400b36eec57a1194449f36044360b6474c5e07d3663b39e627e6ae4badf1e668ed843ba440c1fd51eaeee04
SSDEEP 49152:oSuZQIY0Be2KRRVtOnks6NMHqfhxSMmT8oWgBCaX:y5dKTi61f+M4FHX
TLSH
T162C5AE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c3f460257bd40be4cfe5afb032dc278d811171fc5922072e13f34ddf378e6dd6
MD5 05fd19b2ce7c45ec47e5ba20a551b056
SHA1 fd57b9e3d5912a2d07254afe38bc28787ab5b7ab
SHA512 6b5c8582eecb720ce7313df3afa165fe3241fa24b1487bb07f1f2583942c8769128f714c9c736bae4744d2ae67dfc2cc4e5e7dc456f9fc78667d2bacf6a645eb
SSDEEP 49152:0htSn8EApI0figngiDn0AP5w+hxSMmT8oWgBCaX:VX2iyphZ+M4FHX
TLSH
T1C995BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 45846c2c6f590e93d27b905ebb94b046693ad84694f4d5f6a574557f5af32a73
MD5 2b3ec7f86939818aea2ffa854830a71f
SHA1 71e4ad3d97857bab916d210a75aac8dfa376ec8d
SHA512 252fc2a06ff09c5463ed398eee665913299b71cf87b3d78502edf1dfc058b1209d5c02ce24327ddd5c20e6cef1e482c35683045e158bd1180f95e02d9f7ed4ea
SSDEEP 12288:BcJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:BIrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T134652375AF0F94EBED2AC335E862471699DC0DDDF202163BAF3E2E683A35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 69b793843aab6454fc6e0cca514a80480765210e46171660543c61d03f980dce
MD5 b11524f34f5c18ab142359048d3bf8da
SHA1 7ba8ad751c799cc4b6917f3026b7697f64b1a5b0
SHA512 8074e3bc737f940b385837318ea0cc1ee97636c79a33e1014884190f63f5f331b5526fe33ce70305da7d1b8e3126ad9bbf285b1c7ce9e2aac9d56e6741771655
SSDEEP 12288:LnJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:LJrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T16F652375AF0F54EBED2AC335E8624716D99C0DDDF202163BAF3E2E683B31C5A1152621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 d83ef9bb8b40bb1782ccafe867a242375617bf4872b70b409330dfbe5122d21e
MD5 2abf2b6c98af6ec4bc5139a77cc33201
SHA1 edda4adc60a03f2c295cf607b62981e4946b5d9a
SHA512 51112dcca557488e62fb26dede1ebbfdb16455301cebc5aab1f471a9569704bf6b25bc52b44d3017ab628340faa6068a00b36e7c0b3b0995f4e464ef8fa16f54
SSDEEP 12288:IlJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:I7rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1B3652375AF0F549BED2AC335E8624716D9DC0DDDF202263BAF3F2E683A31C5A1152251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 52e30cf7d87280950c3fbf442f12d7ecf8be4fbd0691d4cc62dd020ebe2ffdf8
MD5 01d6e1c2cb7de4819f2e70b784f6120d
SHA1 9fb09b4ce71414d4790c6427bfb93b014921a9b5
SHA512 d4e3a7d8e8303e02cd78ee75673b6bce3fb2033fe3a6d8df72d2a937a2a06300fd8af39343e9209ca2c9b8126443644b1bf37f612a70a6417f42e217795f242f
SSDEEP 12288:aViJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:prKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1206523656B0E50DBEC36C338D8724212E6F93CDCE322577F9F251E682E31A996931B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 14ee0a0f08017faf78978915b8d8faa124dd5b392298b0f9806f0c250a626381
MD5 0e23f7da5338af159acf8ddba62d6371
SHA1 a6b339adeeb107fa89433b003b25e68b7d22c3a8
SHA512 83cef0d83c19e96e7ff766ebfa5f9075c2835b9c95e8f5d47247bf46728ec52ea2a8d7fc8aa82309788c880222f6119b9c6e57ffa7fd4d6be6933a9d6c28c6a6
SSDEEP 12288:X6JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:XKrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T10A652375AF0F549BED2AC335E8624316D9DC0DDDF202263FAF3E2E683A35C5A1152261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 b52ff034fbd6d8219e90194e5ad079a54802fefbc363021a6a25fa3ae80f4778
MD5 8f6628f3e02834cad269ba415732901f
SHA1 c740f18a0c3dab93d5e49c573c092655cc8808d0
SHA512 f7aba6812119b7aef779727dc7279ed670a3b5ad0b0427bc6aeafe8d19909a6dba749340cedeffcbd6505dd4e5a9a34ecfc4353d4c1f6e464199f75f8e00d4ff
SSDEEP 12288:ZTJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:Z1rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T110652375AF0F54ABED2AC335EC624716D99C0DDDF202163FAF3E2E683A31C5A1152621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 68ea55474ba5fb59ee9de695090d68e2a123ab40de4b7fbd5d01f5962b4c1144
MD5 b3160c7aee3d1b6bece53caa4329d0c5
SHA1 16e843d137a637c212ec7512d917fb08b70db61d
SHA512 e14a1ce2c6d0e4a5334cc2805e9385abb65a1729bcf21aebdee6a81f4d639e8a129f3fe5c1da782ac885d34586f68a8ad7a26830715ca31fec1b137d9b78eb58
SSDEEP 12288:k/JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:kBrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T188652375AF0F549BED2AC339E9624715999C0DDDF202263FAF3E2E683B31C1A1052621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 9de0e3f7a3c7b5ff3024d22fa52ffb4c8bfca63d982f4c92775b34ef8e6d77e5
MD5 15beb8e65a2d896d915203dc731a397a
SHA1 323ef8a8ebfe91367fe4c1648ae69c325c0fdb2c
SHA512 7e4cec84f41b90ea283b62b5e10cf6772d056e7a619dae59e40f7159ea27ba7b7258e23e0ce2e0a1f5cd90dbcf0ab008097528f6f544e5f6c99c20fb762f7787
SSDEEP 24576:DZMEzFVSOprKhxr+EHNmT8oW4ll1JCrLKXI:DZMEzfshxSMmT8oWgBCaX
TLSH
T1358502A5B35018F9EC67823ECD218906D6F27C594760C61F07B8366A6F337A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 56f3dbcfa7dc0c277e1769b28a4e51202bdc9a8265753aa247a47d79bb119c8a
MD5 97273781c70074f52e1e0f63abd3fe96
SHA1 e6b1f3c004b36630c694782239a374a5289c8c8e
SHA512 c67e07d29a4a615a9ff182afecc8a09a2a0386c327cc7b7f3e084cc73bb385e59ed4915f9824947d50020145d506283c6632a4b160d0f0803464ffd73e4a061b
SSDEEP 12288:EAJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:EcrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T11D652375AF0F549BED2A8339E9624716D9DC0DDDF202263BEF3F2E683A31C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 218f19f22441badab66ed31aaa6df8c471a1dc37007b3ae4a1d4b16924eabd47
MD5 99c1cf8ca7b09eda6744c19098cd2ddf
SHA1 137975bf6e342b86152af742a49a3583b7caf3c8
SHA512 ad8e4e9f231c8160141158fdc367de3286ffb3509d0d6efa217308e162cea43c97164995e97cdf4c72b04556f3283126d2d2a59e696347ca5cc6f4dada5d247b
SSDEEP 12288:bkJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:bQrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1D3652375AF0F54DBED2AC335E9624716D99C0DDDF202263BAF3E2E683B31C1A1152221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 db1906e21fdcefa82ee8053eb93a3a355180b4c85b75c7ac15fa6d0fcc57b7b5
MD5 af1548bad361f88ecf299cd4b1c5cff4
SHA1 aad28ec2ba07a1d4b8b619eb92bbad9b44499d49
SHA512 2451bf9c1e27a7f732cd07f5c2509937190a21568fbca9478e3ac387fc459acf3e00cb2dede437da23e65ea76c2b7d798cd7dc2c3389907c25d356f4300e30d4
SSDEEP 12288:CyPz5L8bJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:fzydrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T126751217779630F9D5378238C8621A02F7B57C7953209BAF5B64077A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 02fc93c46be3fe619d23b3d592109f1fd0d7c10a0915760b7d33d53f8006967c
MD5 00d8a5f8c10db316a9138feb7abe8f41
SHA1 fcd445df61d4417c8cb5c7f6fe8d15df96ca9d96
SHA512 9ee19fc73fd2a430f8a8c3c9cf6ce6742f0125f9671b3303f75c59ddf4cc74f74acd598e71f0abe9ecb7bac00dcb3ea85f410c5db0cbbab2d3d546eb533a9898
SSDEEP 12288:fAJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:fcrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1DD652375AF0F54DBED2A8339E8624716D99C0DDDF202263BEF3F2E683A35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 35fbce1012716d206a544624a7317ed25a2a49f97be133d5b195c5e1b56b6410
MD5 aa054f3440fb7919b26c510e14c9249b
SHA1 04cef929a5a5d5077fb9aea34643babbbc79014c
SHA512 9c77062e1ecc79fdfc2ffaaa737521924e8ba8e366d28e99468e7964d3a466e45793d71c7347d60fcebc7d7f2031815001332f413d714b647959073de88a0bed
SSDEEP 12288:sAJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:scrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1C8652375AF0F54DBED2A8339E8624716999C0DDDF202263BEF3F2E683A31C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 cefe473c8532dc182254bcc6e15443149779c83f982d595dd744a16c47323163
MD5 ee6f3096e02617f9c0c1472fef883d56
SHA1 3b46262ef9b50b0df4df676f2ca5384848264b18
SHA512 97fe5aac8c721eba10a097daa806eb5f599da325389e64facee30498142f79880e6f3f54952ca1ad8f73acc9408f79d2e4bc547832a30535e023a82fc507513c
SSDEEP 12288:dyPz5L8bJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:UzydrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1F7751217779630F9D5378238C8621A02F7B57C7953209BAF5B64077A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 31f72fdbf2c3559b5a7cb39a41ea9b41e8aaba16d03585b7d05df2d6d1d3edbe
MD5 25361d36e948fac43e12e8647e7f8633
SHA1 2687fc72254acbbdfc4a93d42fbae93373d10a6b
SHA512 f4b56f6a7635f8855876a6d373edb26906fa044395065395ca27037e148e0f79fe7b6e139a3575eea0e71094a82193e039c7b867be55227e7de4bba8672cf430
SSDEEP 24576:XcP4mcvIjkGOxhKP2l71SNKbrh/8KB0rKhxr+EHNmT8oW4ll1JCrLKXI:sP4m4IpOO67N8KBhxSMmT8oWgBCaX
TLSH
T17365AE2DABDC0096D0BA913885658A4AFAB1742E1F3286CB1160937C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 22485f52a0390340241f06667473c2ebad00206e32e29218187d2e6a6c16e911
MD5 348e685795a9110832848f5aa12923bd
SHA1 0b010de1f4ac5d0eba9329d78db5486c43d5c0a3
SHA512 0ae74363690aa3868437dbb760d228f63df9a30900ff94a631eab06295a0b979740e3e085acb0a67e2e3521f019886b82eef214f29500e7036268a0598e24658
SSDEEP 12288:PzsfwJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:KsrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1FB75F11AD24801E9C46E9239CB524A01F7773C6993E193CB5BE0F93D2F36A945DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 65366bf5565712299054b643c6e9361be8f1f049d1e0448ebea76838b30da77d
MD5 ac43b87e9f58edc496c253dc75fcb435
SHA1 739dc67f9563570fd29860ab4367f217bbe04891
SHA512 04d293259d9706ca9fdbbbb1f7e1ac07fe833deee3cce71133579b162131c00623572f99494371f85b8a057cbc574eb8a8e775048548af42cea8889cbb5dea82
SSDEEP 12288:4QJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:4MrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1C86523759B0E945BED3A8334E8328335695D2DACE301566FFF2E2B6C3A30C565C62712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 c6fcc3a151f9f0929c50046fd5980e06eb08eea1168a514f11fc8b58fa14861e
MD5 d2a1eed7d3e2dca7cbb74496e05aacce
SHA1 0a6c478c94aa3a046806467bf920db8162f8ffd9
SHA512 ad768d265a340aba80b0568db336114f15c91af3bfc6ee4c839b1674663aab0123f6c9b07e2c43ef43b16c8077be421393f5c86d7ef7ebb83e35813656cc5ae1
SSDEEP 49152:Pa0h2GEkuAe73q3pp46zwwQdhxSMmT8oWgBCaX:Pa0hNYG4JwM+M4FHX
TLSH
T15E85AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 0d590b95cc20f3e1c7d17c9e261d43cece6e28d1a33f7fd4a22324d78eb0c2f9
MD5 b82d1daf669c9bc6a60b9d03ad3f10fa
SHA1 47062e7fbb60aee268e02c7181a3fa59bd8d4ffb
SHA512 60214822fa69495c090ba54f601008ac2cb9f881c4e13bc7eee190296a05852006ca59ef7661f79f950ebdcc6a98e44af72d42048169dd299b54816556e4f1d0
SSDEEP 24576:whbHjPZrKhxr+EHNmT8oW4ll1JCrLKXI:whbHjIhxSMmT8oWgBCaX
TLSH
T12D75017E279D20DAE932D23CD9528606C771BC691311A3EF27A682781F37DE91C35B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 c7914b8fa42c90d631c0e31671f3f37b2dde00d174122ec1cfd7b0cbe74fa528
MD5 bf45932f7ec879140527e7d4dd134a2d
SHA1 4995f616adeb679f628e9be9800b03b28159d0c9
SHA512 0af41453a1e4bb513fe3cea130244ca4fc964a1f8e4c021c72a2a8647c02f4c2a798acea2698ff0284578355f3daa69507a58e12e70685c2c4dafb1fa014256c
SSDEEP 12288:v0JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:vArKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T12F6523759B0E649BDD3AC339E863471599880D9CE30217FBAE3E2E683B35CDB1572211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 898b2c2b66d49901426edd14782349ef2356626d866cb23ad58c8c0a0b9c57d7
MD5 9ae700bea6b65e5dad62557cf0104971
SHA1 6f0f8d9a892ce83a2f888016fde83e721e78abb1
SHA512 09a1b60a6e067667e296b943ac38194cae77c7c581a01eb014b64437efd7857d9492d0582efd22a42c41004109285b720fb27466887058de02679b9049cbdc8b
SSDEEP 24576:5fL3UT/rKhxr+EHNmT8oW4ll1JCrLKXI:5fL3UihxSMmT8oWgBCaX
TLSH
T16A95F155E79500F9ED7BC23CC9628A16E6B2789D0360E7EF07684B651F236E24E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 f05398c77cf4bba9fb0c46b04018e0979bb4a2a11a6036de2ffac8753afbbd7d
MD5 c5592e0520378c0a345eb7c3ff4f1281
SHA1 6872df743f3e2716d4d959b0e68ecb6d6d36bc93
SHA512 bd4d19e1b15461104725121dc8fe0986807bd8af2470e25d4ef4bd780a0b2c80a222e9de34a53420c84be1e280b21df0fefc81d8d97366d115df126e45869789
SSDEEP 12288:XpFtfOdJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:9OzrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T145750229379D10E9E93A923CC9934309D7B17CA9531217EF46A085BD1F73EE86C3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 53b27da85432339dafcb14452f91fe009e44c4141e7fb6289aca7841af37bd85
MD5 50e693d49181b36b148665afce13a04f
SHA1 566cada21f104c23098a28f3771e716a02d51289
SHA512 bb0a627f435570cddb7f03e384fc92d388b4b37cd3086923cda405a1537b0b7a495e6394e51c039a529d2cf57a7c29f0087d97cb68797c4ca73969e6657a72db
SSDEEP 24576:k7NM9YmZqmWMUkPjZM48Mv6bEhscrKhxr+EHNmT8oW4ll1JCrLKXI:k7cBWMpPjN8DbEhAhxSMmT8oWgBCaX
TLSH
T19F659E2E6BAC81E5D477D13DC9A28206F6B1B4651B318ACF1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 b1ff23570ab6dc762ac27df7a863c89f8e69c417b29f8baa0c1a4375519ac019
MD5 c583dd0f9c658bff55f6452afebf57b7
SHA1 ce15b64b95e2261e5bbbfeb23599d8166060c83c
SHA512 241eb5615a31bfa33671af0feeb10a4117f3f408717036e45a8c8477877ac008c83247720eaad71d3c30112498842848c85112707400bf7e0681145344584628
SSDEEP 49152:NF2YuHNETovcvNYf8kmPhxSMmT8oWgBCaX:Y6tCf8kC+M4FHX
TLSH
T165858E2927ED80A4E0BBD27D85B7D246FAB2B8551B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 c0cec413b665e8020334d3fd84ea8d27d58efd5d59435d2de84edce241807a56
MD5 a705d8e52c22ec8769ceb7eb3d626486
SHA1 c86135e8879d2a843801a7d8bf0e70839e3c403e
SHA512 c1a040551698f9199982e133f42ceb3fdbf87b3fb274e4a03cb7f3fa6024b705c2e1863c204a22a051ca240b32ff880a79f474a023f62a5b53a7dda791506a63
SSDEEP 24576:jAFs06+Omlf3NXEbTonrKhxr+EHNmT8oW4ll1JCrLKXI:sFs060lVXu9hxSMmT8oWgBCaX
TLSH
T13465AF3F66AC00D5D47ED17D8997C91AF6B1746703216ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 ef8c662969968dd85356a4eafb336b95e346590a938f4b55070172eabe3c2401
MD5 57922785eae917015affa0c1bbb2b103
SHA1 9869899f896aeea1b45c31fe88d08943279a25c5
SHA512 46193d20d845eaad6f43e4ce3458c26a9de379d856d16b11c5f32cc5e27d784608e5f004caa816bca2ce223eba1a6bef18df9a4350d22e65a0f55d3f883d7bd4
SSDEEP 24576:1JnJ5D3WLqrKhxr+EHNmT8oW4ll1JCrLKXI:1JnJ5DGL9hxSMmT8oWgBCaX
TLSH
T1D585D03DD2A810E8D4B7C374815A1756FE72387D2B226ACB2878D5353F22EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4343f68614c857b661e636f8666f04bf17ffd15b2392f89697b2be1310145518
MD5 ba9bc41687459dc76ddeeb7229dada11
SHA1 ea17e99e0e0beb382595cbc0d167c77920c24808
SHA512 e785ac339e2ee2800b8308be3f4093924b7c18cc999124a630c8693cbcdc0d6ba1e4ad2ee12a34bef53324cda1a0fd58edb5a9fe5403306850b80cb34aef1527
SSDEEP 49152:oo06DIKdwc+eQnSt65aV7hxSMmT8oWgBCaX:1p+M4FHX
TLSH
T11A956C15BBEA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 441671d22acdffd23ed1793b0d7d39ab933616989246041db66e3685fea010c1
MD5 a7b48d39495c2dd541925489f5f9fb41
SHA1 b8ff9e1384e2474c927734fb2444f77ecb46607e
SHA512 c724d8bd405646ee1654b9016995ef4e013ebe4b91f1819b7175c4a03027665aa67508cc6f5121e92855ecea8b0709702e177b85e00bb085113952b1d4af2bfa
SSDEEP 12288:gEP3RBuJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:7BurKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T13475126D2B5D70EAD92A813DD4A18205D3B2F478631227FF5AA5823D4F33DE91D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 28a111d176dbcbbb1bf9e03702111efe932a3588effc713d0143ab8937294929
MD5 fea9115a8a45ab505e4ae2c963eba74b
SHA1 736b3192857039c5c28abab7cc27546a355d3360
SHA512 cfd29f3fb16b06c940e3f08ba6ca957294910a2dae359f1e6a05c6a08e9e073ce371ec39637184295efccbb5907f3fd516c5bef51a1d4f59abe7372ec141f448
SSDEEP 12288:BjkynJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:BIyJrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T148751214638860D9ED7A4238D97382619E747C24AB1157EFA9A0FB3D6F32ED46C31B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 009e356a9241e36114ad3c17855604273991b0a3525709331aa1392abdb3b272
MD5 5f6b3164d67f0c26cf0ffa79a0c7b445
SHA1 aa7336494eb0c7b49319c3abdf69c6e70042c407
SHA512 f794e28de2b59bd522b7df191b868e220f0ce994a0a578a7d57e04e997281e2b209b9e7901994d61db4418bc0a185fa2601c571739bfa9cbc76739dc3672f93d
SSDEEP 12288:ZrtJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:BjrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1A965237C5B0E749FED368338D932471195A82DBCA30129FF5EB9AE786B31CD61172A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 6cef5f51815151915ee28a5cd3cfa4e3010dcb777ad259a7f1fe420b143d3fab
MD5 84ec1962a2a03d2c746b2873a3123b1e
SHA1 2e771dee74f7c24680e09621328ffcd3ce9125a8
SHA512 529b3c50d4821beb9bd0351c1ff4b4ab44827c71db65bafa2164a38021014bb76e4a37abc7b3837abd31a5c635c9b2747d5dda6a7b133ddbb8aee23062f0666f
SSDEEP 24576:kQ9MxZKdcz97w3ErKhxr+EHNmT8oW4ll1JCrLKXI:kVKX3hxSMmT8oWgBCaX
TLSH
T187558C2DABE9059AE177D239D5A250C3A673B4301B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 456c411d3c40760b0b5f8fa04aad37ca27b7a61f8c3a96708833fa5e78e34b50
MD5 d03bbd1a387aa54824d16fb3089351ec
SHA1 ba7cac0a039ee2c49d41d1258d5c3224278e0a9c
SHA512 7d6d2811978175c807cc97339e2eef6b5099019d44c61330bc8680c8f4a182224cb5175cd1ddeb0d15c7f8070544a77d30e5ff1ac86b42015f139c4ddab46282
SSDEEP 24576:jyocbAptrKhxr+EHNmT8oW4ll1JCrLKXI:GocbApUhxSMmT8oWgBCaX
TLSH
T1E985EF1FBB6E40A2E136823CC9818305E7B3B4745B6267DB6691C73D4E239E9BD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 2667695a6bcfedf91692fa164390aeb9339ce84abf9464adc390b7f5f2b4bf7e
MD5 94ed94b125f4b01e685ed9b3fdd4c412
SHA1 2a901912599582a6be35611debc461778458615a
SHA512 a1200c65a99a64d78ad68ca28056ae5106903f8aee01dfac290febfb22c651fbcb94a0612ca1289fc37d0791211689313206641e8a6b0ea91456b20fd7645d9d
SSDEEP 49152:TWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKUhxSMmT8oWgBCaX:T0zuNIo+M4FHX
TLSH
T1A4A57B3DA2BC00A9D8AAC375C5451366EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f07e63138bfea3bf979adac227e5559d53c8c7d4dcc6d74372c554d8ccfe3125
MD5 eef180e3c7216be31b4183056a848daf
SHA1 febe75a0b1c6e2394ecefd53de6ed0170db66e04
SHA512 e8eb63377681695b58da1473fc3a82d0fd722c23af56b1d1778a5309c49c97d4b35e22670b98acc40b1e733b2866bf4fb3d983808034fcde6f9be22bd5234cd4
SSDEEP 24576:P1QT7EcpfxR+N5AWAz3ooiYtjMqburKhxr+EHNmT8oW4ll1JCrLKXI:yTDxR+N5YzTfjMihxSMmT8oWgBCaX
TLSH
T1DB55B02EA7F915E9D17EC5789A23C512FA727821033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 cdbf8e96ce10e50936205201b90df8c377f6d64a05f29f7d2b209a90efda0d5d
MD5 e9ef00238e9c19179c1ceee1e7578153
SHA1 9ce31f39f273ec265a60a2108e580a346a7b2159
SHA512 6e42bd87a0508e1b2de90ffa4bcc999766d9469fc29623e633964bd6a87a42a1ad916a0c382b22b200573206abf32952430b4defa67ab1e69ac7d743102fc828
SSDEEP 24576:3TMdOz0FFS+kmSLyrKhxr+EHNmT8oW4ll1JCrLKXI:F0K+kmSLFhxSMmT8oWgBCaX
TLSH
T15E85F17EA75D14E5E47BC23CDA538A06E6723865032276DB06A0C17D3F67EE4393AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 33b0eb167645d887195c620db1d97afb35b1bfa340d531759786774bb1ee7198
MD5 c26e3c71b8d42638c7ff0e283eb24f11
SHA1 3cbaf67c27cbc3939b387d75ce30f3a34d10a1cf
SHA512 565a27b48abe71bca55050be821062e8a5d4b8efe4bae7ad84e34e49a89b490b5f776f30cefa3e561e4e5825d6d603ef980b38c5e63d084d49c8fdd9a80404b3
SSDEEP 24576:93YgnJcRTk4yti+R5dpR/xrKhxr+EHNmT8oW4ll1JCrLKXI:9IgnaTk46ppR/YhxSMmT8oWgBCaX
TLSH
T15245BF2DF3B910B9D8AAD236850147B5FB71782D1F209ACB0170C538AF1AEE85E35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 2b0e1dde302d45ea78da7a89f58e56d5702cc384a44f9379449556d1ec85842a
MD5 98440d6d595012568014734887fbbc67
SHA1 179527ecc7de4f49f99ca1bfc1baa5716e751e04
SHA512 697f0d03295f1615488d092ed3ee40b9a3b4a8a485f8941d89994318a8e8c41ec65b333c0cce7459654db7f9f4d6f84c4e9ad554fec8abbe89c24b09e2600db5
SSDEEP 12288:c4ppJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:Z/rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T17575122D27DC30D9F8368238DA32421686707C7963112AFF3AE5CA7D5F329D99935B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/448-418-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/448-172-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/448-174-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/624-123-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/624-31-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/624-22-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/624-30-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/764-273-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/764-547-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/764-264-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/764-270-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/984-252-0x0000000000AD0000-0x0000000000B30000-memory.dmp

Download

memory/984-258-0x0000000000AD0000-0x0000000000B30000-memory.dmp

Download

memory/984-546-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/984-261-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/996-210-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/996-543-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/996-202-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/996-208-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/1280-8-0x0000000140000000-0x00000001402C5000-memory.dmp

Download

memory/1280-436-0x0000000002C20000-0x0000000002C80000-memory.dmp

Download

memory/1280-9-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/1280-441-0x0000000002AA0000-0x0000000002B23000-memory.dmp

Download

memory/1280-12-0x0000000002AA0000-0x0000000002B23000-memory.dmp

Download

memory/1280-19-0x0000000002AA0000-0x0000000002B23000-memory.dmp

Download

memory/1280-442-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/1280-440-0x0000000140000000-0x00000001402C5000-memory.dmp

Download

memory/1280-411-0x0000000002C20000-0x0000000002C80000-memory.dmp

Download

memory/1280-68-0x0000000140000000-0x00000001402C5000-memory.dmp

Download

memory/1280-0-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/1280-405-0x0000000002C20000-0x0000000002C80000-memory.dmp

Download

memory/1612-249-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1612-246-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1612-545-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1648-102-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/1648-103-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1648-109-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1648-221-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/1896-224-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/1896-226-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1896-213-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/1896-219-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/1896-222-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2072-100-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2072-48-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2072-99-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2072-49-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2072-57-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2328-285-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2328-432-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2328-427-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2328-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2328-160-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2328-162-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2344-198-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2344-190-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/2344-542-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/2344-192-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2500-135-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/2500-137-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/2500-129-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/2500-248-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/2516-45-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2516-44-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/2516-36-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2820-94-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2820-89-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2820-83-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2820-96-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2820-91-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2908-544-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2908-237-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2908-234-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/2908-228-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/3104-236-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3104-125-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3104-124-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3104-116-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3472-151-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3472-272-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3472-149-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3744-541-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3744-186-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3744-183-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3940-548-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3940-551-0x000000000D290000-0x000000000D298000-memory.dmp

Download

memory/3940-328-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/3940-311-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/3940-277-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3940-295-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/3940-283-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3940-286-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4432-260-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4432-140-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4464-78-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4464-72-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4464-189-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4464-80-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4680-69-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4680-66-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4680-185-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4680-60-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4856-555-0x0000018BDC280000-0x0000018BDC290000-memory.dmp

Download

memory/4856-568-0x0000018BDC280000-0x0000018BDC290000-memory.dmp

Download

memory/4856-553-0x0000018BDC280000-0x0000018BDC290000-memory.dmp

Download

memory/4856-556-0x0000018BDC280000-0x0000018BDC290000-memory.dmp

Download

memory/4856-558-0x0000018BDC280000-0x0000018BDC290000-memory.dmp

Download

memory/4856-557-0x0000018BDC280000-0x0000018BDC290000-memory.dmp

Download

memory/4856-559-0x0000018BDC280000-0x0000018BDC290000-memory.dmp

Download

memory/4856-560-0x0000018BDC280000-0x0000018BDC290000-memory.dmp

Download

memory/4856-569-0x0000018BDC280000-0x0000018BDC290000-memory.dmp

Download

memory/4856-554-0x0000018BDC280000-0x0000018BDC290000-memory.dmp

Download

memory/4856-567-0x0000018BDC280000-0x0000018BDC290000-memory.dmp

Download

memory/4856-566-0x0000018BDC280000-0x0000018BDC290000-memory.dmp

Download

memory/4856-565-0x0000018BDC280000-0x0000018BDC290000-memory.dmp

Download

memory/4856-564-0x0000018BDC280000-0x0000018BDC290000-memory.dmp

Download

memory/4856-563-0x0000018BDC280000-0x0000018BDC290000-memory.dmp

Download

memory/4856-562-0x0000018BDC280000-0x0000018BDC290000-memory.dmp

Download

memory/4856-561-0x0000018BDC280000-0x0000018BDC290000-memory.dmp

Download